Et Rules

web-application-attack

• "ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- index.php blogid UPDATE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP id DELETE"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- order-track.php orderNo UNION SELECT"

• "ET WEB_SERVER possible IBM Rational Directory Server (RDS) Help system href Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- details.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Blogplus block_left.php Local File Inclusion"

• "ET WEB_SPECIFIC_APPS DEDECMS feedback_js.php arcurl Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex DELETE"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp password UNION SELECT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- printarticle.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text INSERT"

• "ET ACTIVEX winhlp32 ActiveX control attack - phase 1"

• "ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (42)"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 UPDATE"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php id UPDATE"

• "ET TROJAN BroBot POST"

• "ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id SELECT"

• "ET WEB_SPECIFIC_APPS Rematic CMS produkte.php id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp user ASCII"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php catid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Oracle E-Business Suite Financials jtfwcpnt.jsp DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS LushiNews SQL Injection Attempt -- comments.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS OrangeHRM path Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin ASCII"

• "ET WEB_SPECIFIC_APPS WordPress Lanoba Social plugin action parameter Cross-Site Script Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_jeauto view parameter Local File Inclusion Attempt"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 8"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick_mod ASCII"

• "ET WEB_SPECIFIC_APPS WordPress Custom Contact Forms options-general.php Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_forum ASCII"

• "ET WEB_SPECIFIC_APPS Joomla PollXT component Itemid parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid INSERT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp sort UPDATE"

• "ET WEB_SERVER Possible IIS Integer Overflow DoS (CVE-2015-1635)"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- rating.asp id SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x UPDATE"

• "ET WEB_SPECIFIC_APPS Fullaspsite ASP Hosting Site SQL Injection Attempt -- listmain.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS Joomla techfolio component UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Digitizing Quote And Ordering System SQL Injection Attempt -- search.asp ordernum DELETE"

• "ET WEB_SPECIFIC_APPS WordPress Plugin iThemes Security SQL Injection"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp pass SELECT"

• "ET WEB_SERVER Attempt To Access MSSQL xp_fileexist Stored Procedure Via URI to Locate Files On Disk"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- res_details.asp resid ASCII"

• "ET WEB_SPECIFIC_APPS Group Office json.php fingerprint Parameter Remote Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Contact Form Maker Plugin - SQL Injection 1"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- phonemessage.asp num UNION SELECT"

• "ET WEB_SPECIFIC_APPS Simple Web Content Management System SQL Injection Attempt -- page.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php user INSERT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- order-track.php orderNo SELECT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- changeannonce.php idannonce SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Digiappz DigiAffiliate SQL Injection Attempt -- visu_user.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Unique Ads (UDS) SQL Injection Attempt -- banner.php bid SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php so UPDATE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp harf INSERT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_id DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Site Engine Manager SQL Injection Attempt -- index.asp mid SELECT"

• "ET WEB_SERVER Generic Uploader Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS iGeneric iG Calendar SQL Injection Attempt -- user.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId INSERT"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick_mod DELETE"

• "ET WEB_SPECIFIC_APPS Xtreme ASP Photo Gallery SQL Injection Attempt -- displaypic.asp sortorder ASCII"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- userdetail.php id ASCII"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines INSERT"

• "ET WEB_SPECIFIC_APPS Script Toko Online shop_display_products.php cat_id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_search.asp query INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_jphoto Component Id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SERVER Possible MySQL SQLi Attempt Information Schema Access"

• "ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP id DELETE"

• "ET WEB_SPECIFIC_APPS bbPress SQL Injection Attempt -- formatting-functions.php DELETE"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- navigacija.php IDMeniGlavni DELETE"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php ipadd SELECT"

• "ET WEB_SPECIFIC_APPS Vizayn Haber SQL Injection Attempt -- haberdetay.asp id ASCII"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i UPDATE"

• "ET WEB_SPECIFIC_APPS X-BLC get_read.php section Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Possible Rentventory SQL Injection Attempt"

• "ET WEB_SERVER 16Shop Phishing Kit Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php post_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewBugs.php s INSERT"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid ASCII"

• "ET WEB_SPECIFIC_APPS ProNews SQL Injection Attempt -- lire-avis.php aa UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla techfolio component INSERT INTO SQL Injection Attempt"

• "ET WEB_SERVER ColdFusion adminapi access"

• "ET WEB_SPECIFIC_APPS eNdonesia artid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Oxygen (O2PHP Bulletin Board) SQL Injection Attempt -- viewthread.php pid INSERT"

• "ET WEB_SERVER ATTACKER WebShell - Zehir4.asp - content"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie UNION SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- cat.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_ccnewsletter controller Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS dB Masters Curium CMS SQL Injection Attempt -- news.php c_id DELETE"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- logon_user.php username SELECT"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm langId UNION SELECT"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp l UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! Foobla RSS Feed Creator Component 'id' Parameter UPDATE SET SQL Injection"

• "ET WEB_SPECIFIC_APPS X-Ice News System SQL Injection Attempt -- devami.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS eyeOS callback parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- weblinks.php where UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php search DELETE"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php clickurl INSERT"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery (CPG) SQL Injection Attempt -- thumbnails.php cpg131_fav UPDATE"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- moscomment.php mcname INSERT"

• "ET WEB_SPECIFIC_APPS QUICKTEAM qte_result.php title Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Free Blog Arbitrary File Deletion Attempt"

• "ET WEB_SPECIFIC_APPS Million Pixel Ad Script tops_top.php id_cat parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php board SELECT"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen UNION SELECT"

• "ET SCAN Acunetix scan in progress acunetix variable in http_uri"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- mainfile.php lang DELETE"

• "ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id DELETE"

• "ET WEB_SPECIFIC_APPS OBOphiX fonctions_racine.php chemin_lib parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS MAXcms RFI attempt (1)"

• "ET WEB_SPECIFIC_APPS Hunkaray Duyuru Scripti SQL Injection Attempt -- oku.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 ASCII"

• "ET WEB_SPECIFIC_APPS Plogger phpThumb.php w Parameter Remote File Disclosure Attempt"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick SELECT"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp agentid INSERT"

• "ET WEB_SPECIFIC_APPS RevokeSoft RevokeBB SQL Injection Attempt -- class_users.php DELETE"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp category SELECT"

• "ET WEB_SPECIFIC_APPS GlobalMegaCorp dvddb SQL Injection Attempt -- common.php user INSERT"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick_mod UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress CommentLuv Plugin _ajax_nonce Parameter XSS Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_recent.asp currentpage ASCII"

• "ET WEB_SPECIFIC_APPS Website Baker SQL Injection Attempt -- eWebQuiz.asp QuizID SELECT"

• "ET WEB_SPECIFIC_APPS ChillyCMS mod Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp menuSelect ASCII"

• "ET WEB_SPECIFIC_APPS Fullaspsite ASP Hosting Site SQL Injection Attempt -- listmain.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS TEDE Simplificado processaPesquisa.php script UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager eventmon Reflective XSS Attempt"

• "ET WEB_SPECIFIC_APPS mcRefer SQL Injection Attempt -- install.php bgcolor UNION SELECT"

• "ET WEB_SERVER Suspected Webshell systeminfo Command (Inbound)"

• "ET WEB_SPECIFIC_APPS joomla com_connect controller parameter Local File Inclusion vulnerability"

• "ET WEB_SPECIFIC_APPS Nucleus PLUGINADMIN.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_rsgallery2 Component catid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS rgboard _footer.php skin_path parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS WordPress LeagueManager plugin season parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp parola DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newemail UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid ASCII"

• "ET WEB_SPECIFIC_APPS BasicForum SQL Injection Attempt -- edit.asp id INSERT"

• "ET WEB_SPECIFIC_APPS coRED CMS rubID Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm categoryid INSERT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php topic_id UPDATE"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- thumbnails.asp ci UPDATE"

• "ET WEB_SPECIFIC_APPS SOPHIA CMS SQL Injection Attempt -- dsp_page.cfm pageid INSERT"

• "ET WEB_SPECIFIC_APPS Sisplet CMS komentar.php site_path Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Possible Mambo MOStlyCE Module Image Manager Utility Arbitrary File Upload Attempt"

• "ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row SELECT"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Seo Panel file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla mod_currencyconverter from Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- contacts.php text SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Newsletter MX SQL Injection Attempt -- admin_mail_adressee.asp ID UNION SELECT"

• "ET WEB_CLIENT Possible HTTP 405 XSS Attempt (External Source)"

• "ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php gruppe_id INSERT"

• "ET WEB_SPECIFIC_APPS Boonex Dolphin explain Parameter Cross Site Scripting Attempt"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 19"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp typ DELETE"

• "ET WEB_SERVER SQL Injection Local File Access Attempt Using LOAD_FILE"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 16"

• "ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat INSERT"

• "ET WEB_SPECIFIC_APPS Unique Ads (UDS) SQL Injection Attempt -- banner.php bid DELETE"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_forum UPDATE"

• "ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id DELETE"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "GPL WEB_SERVER python access attempt"

• "ET WEB_SPECIFIC_APPS Online Web Building SQL Injection Attempt -- page.asp art_id DELETE"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nsbypass.php SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordOld SELECT"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- index.php blogid UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- DisplayResults.php iSearchID UNION SELECT"

• "ET WEB_SPECIFIC_APPS ODARS resource_categories_view.php CLASSES_ROOT parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id INSERT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp order DELETE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp model UPDATE"

• "ET WEB_SPECIFIC_APPS Admidio headline parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WHCMS smarty Parameter Remote File inclusion Attempt 2"

• "ET WEB_SPECIFIC_APPS Sphider SQL Injection Attempt -- search.php category ASCII"

• "ET WEB_SPECIFIC_APPS PHP-fusion Team Structure Infusion team_id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php so SELECT"

• "ET EXPLOIT Joomla 3.2.1 SQL injection attempt 2"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp pass UNION SELECT"

• "ET CURRENT_EVENTS Apple Phishing Panel Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php pid UNION SELECT"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 18"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php message UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla SQL Reports user_id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Invision Power Board (IPB) SQL Injection Attempt -- class_session.php CLIENT_IP UNION SELECT"

• "ET WEB_SPECIFIC_APPS eGroupware loaddetails.php script DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER Generic File Upload Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice ASCII"

• "ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id SELECT"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick ASCII"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- search.asp DELETE"

• "ET WEB_SPECIFIC_APPS Ublog Reload SQL Injection Attempt -- badword.asp SELECT"

• "ET WEB_SPECIFIC_APPS ScriptMate User Manager SQL Injection Attempt -- usermessages.asp mesid DELETE"

• "ET WEB_SPECIFIC_APPS RecordPress header.php rp-menu.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID SELECT"

• "ET WEB_SPECIFIC_APPS LushiNews SQL Injection Attempt -- comments.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Philboard SQL Injection Attempt -- philboard_forum.asp forumid DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke FriendSend module sid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- logon_user.php username UPDATE"

• "ET WEB_SERVER Microsoft SharePoint Server 2007 _layouts/help.aspx Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Invision Community Blog Mod SQL Injection Attempt -- entry_reply_entry.php eid ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Skysa Official submit parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id INSERT"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- index.php blogid DELETE"

• "ET WEB_SPECIFIC_APPS icash Click&BaneX user_menu.asp ID parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_aut ASCII"

• "ET WEB_SPECIFIC_APPS Ban SQL Injection Attempt -- connexion.php id UNION SELECT"

• "ET DOS LOIC POST"

• "ET WEB_SPECIFIC_APPS OSSIM repository_attachment.php INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS CMSQLITE mediaAdmin.php file Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Inventory consulta_fact.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- res_details.asp resid INSERT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp currentpage UNION SELECT"

• "ET WEB_SPECIFIC_APPS F5 Data Manager DiagLogListActionBody.do Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS programsrating postcomments.php id XSS attempt"

• "ET WEB_SPECIFIC_APPS TECHNOTE shop_this_skin_path Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- com_comment.php mcname UPDATE"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- artreplydelete.asp username ASCII"

• "ET WEB_CLIENT Generic Uploader Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS aFAQ SQL Injection Attempt -- faqDsp.asp catcode UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp area SELECT"

• "ET WEB_SPECIFIC_APPS Informacion General informacion_general.php UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- journal.php w INSERT"

• "ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id DELETE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- giris.asp kullaniciadi ASCII"

• "ET WEB_SPECIFIC_APPS TEDE Simplificado processaPesquisa.php script SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS asaher pro add_comments.php row_y5_site_configuration Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Possible IBM BladeCenter Management Module cindefn.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- detail.asp property_id DELETE"

• "ET WEB_SPECIFIC_APPS e107 BLOG Engine macgurublog.php uid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS LightNEasy File Manager language Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids INSERT"

• "ET ACTIVEX DjVu DjVu_ActiveX_MSOffice.dll ActiveX Component Heap Buffer Overflow"

• "ET WEB_SPECIFIC_APPS webEdition CMS shop_artikelid Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newemail DELETE"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- mailer.w2b draft UPDATE"

• "ET WEB_SERVER PHP Possible ogg Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Omegasoft SQL Injection Attempt -- OmegaMw7.asp UNION SELECT"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS ARISg errmsg Parameter Cross Site Scripting Attempt"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_code DELETE"

• "ET WEB_SPECIFIC_APPS Joomla Component Billy Portfolio catid Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php pid UPDATE"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php ipadd DELETE"

• "ET WEB_SPECIFIC_APPS Dolphin BxDolGzip.php file Disclosure Attempt"

• "ET WEB_SPECIFIC_APPS AJ Forum SQL Injection Attempt -- topic_title.php td_id INSERT"

• "ET WEB_SPECIFIC_APPS Bugzilla token.cgi HPP e-mail validation bypass Attempt Client Body"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php id INSERT"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php blogid ASCII"

• "ET WEB_SPECIFIC_APPS WordPress WP-Property Plugin uploadify.php Arbitrary File Upload Vulnerability"

• "ET WEB_SPECIFIC_APPS Planex Mini-300PU & Mini100s Cross-site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Grady Levkov id Parameter Cross Site Scripting Attempt"

• "ET ACTIVEX Dart Communications PowerTCP FTP for ActiveX DartFtp.dll Control Buffer Overflow"

• "ET WEB_SPECIFIC_APPS ViArt Shop Evaluation admin_header.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- send_password_preferences.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- ipsearch.admin.php SELECT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 23"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp keyword DELETE"

• "ET WEB_SPECIFIC_APPS Possible IBM Rational RequisitePro ReqWebHelp Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DirectNews rootpath parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php sid UNION SELECT"

• "ET WEB_SERVER Attempt To Access MSSQL xp_cmdshell Stored Procedure Via URI"

• "ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- userdetail.php id DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- detail.asp p ASCII"

• "ET WEB_SPECIFIC_APPS Wikiwig spell-check-savedicts.php to_p_dict Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp cat ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp In INSERT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid UPDATE"

• "ET WEB_SPECIFIC_APPS Glossword gw_admin.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! JBudgetsMagic 'bid' Parameter INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS MoinMoin twikidraw Action Traversal File Upload"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp id ASCII"

• "ET WEB_SERVER Attempt To Access MSSQL xp_regread/xp_regwrite/xp_regdeletevalue/xp_regdeletekey Stored Procedure Via URI to Modify Registry"

• "ET WEB_SPECIFIC_APPS NetClassifieds Premium Edition SQL Injection Attempt -- ViewCat.php s_user_id SELECT"

• "ET WEB_SPECIFIC_APPS OneFileCMS f parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS Mambo N-Myndir UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newwebsite DELETE"

• "ET WEB_SPECIFIC_APPS Joomla JGrid Component File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID UPDATE"

• "ET WEB_SPECIFIC_APPS Minerva mod SQL Injection Attempt -- forum.php c UNION SELECT"

• "ET WEB_SPECIFIC_APPS GlobalMegaCorp dvddb SQL Injection Attempt -- common.php user UPDATE"

• "ET WEB_SPECIFIC_APPS Consona Products n6plugindestructor.asp Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id SELECT"

• "ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa ASCII"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_doc SELECT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- changeannonce.php idannonce UPDATE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery (CPG) SQL Injection Attempt -- thumbnails.php cpg131_fav DELETE"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids ASCII"

• "ET WEB_SPECIFIC_APPS MGB OpenSource Guestbook SQL Injection Attempt -- email.php id ASCII"

• "ET WEB_SPECIFIC_APPS Orlando CMS stage4.php GLOBALS Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_categories.asp catID ASCII"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- linkslist.asp psearch INSERT"

• "ET WEB_SPECIFIC_APPS SoftMP3 search Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cat ASCII"

• "ET WEB_CLIENT Generic WSO Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS gCards SQL Injection Attempt -- getnewsitem.php newsid UNION SELECT"

• "ET WEB_SPECIFIC_APPS iGaming CMS loadplugin.php load Parameter Local File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Apache Archive roleedit script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS MGB OpenSource Guestbook SQL Injection Attempt -- email.php id INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid INSERT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 12"

• "ET WEB_SPECIFIC_APPS Boonex Dolphin relocate Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- rating.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Invision Power Board (IPB) SQL Injection Attempt -- class_session.php CLIENT_IP INSERT"

• "ET WEB_SPECIFIC_APPS DVD Rental Software cat_id parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Keynect Ecommerce SQL Injection Attempt -- products.php ctf SELECT"

• "ET WEB_SPECIFIC_APPS XAMPP showcode.php TEXT Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp id INSERT"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile UPDATE"

• "ET WEB_SPECIFIC_APPS WB News news.php config Parameter Remote File Inclusion -1"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick SELECT"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtPas ASCII"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page UPDATE"

• "ET WEB_SPECIFIC_APPS SiteGo file parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Zabbix popup.php UPDATE SET SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS Mambo AHS Shop component UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Commentics id parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Informacion General informacion_general.php UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q ASCII"

• "ET WEB_SPECIFIC_APPS WB News Comments.php config Parameter Remote File Inclusion -2"

• "ET WEB_SERVER Possible HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_id INSERT"

• "ET WEB_SPECIFIC_APPS Pixel8 Web Photo Album AlbumID SQL Injection"

• "ET WEB_SPECIFIC_APPS Possible Zenoss Network Monitoring Application INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Calendar SQL Injection Attempt -- user.php id UPDATE"

• "ET WEB_SPECIFIC_APPS WP Generic revslider Arbitrary File Download"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Okul Web Otomasyon Sistemi SQL Injection Attempt -- etkinlikbak.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php name DELETE"

• "ET WEB_SERVER PHP tags in HTTP POST"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgAnalyse.asp MessagePart XSS Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_boss controller Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS gCards SQL Injection Attempt -- getnewsitem.php newsid UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text ASCII"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php website DELETE"

• "ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserEmail UNION SELECT"

• "ET WEB_SPECIFIC_APPS Horde type Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS vSupport Integrated Ticket System SQL Injection Attempt -- vBSupport.php ticketid SELECT"

• "ET WEB_SPECIFIC_APPS fipsForum SQL Injection Attempt -- default2.asp kat INSERT"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php ipadd UNION SELECT"

• "ET WEB_SPECIFIC_APPS MODx CMS snippet.reflect.php reflect_base Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Shape Web Solutions imprimir.php UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page UNION SELECT"

• "ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS BaglerCMS articleID parameter Cross-Site Script Attempt"

• "ET WEB_SPECIFIC_APPS eGroupware loaddetails.php script INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup UPDATE"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS Campsite article_id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Apache Archive configureAppearance script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID SELECT"

• "ET WEB_SPECIFIC_APPS Cacti SQL Injection Vulnerability tree.php leaf_id DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- letterman.class.php id SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component Media Mall Factory Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! JoomlaFacebook Component UPDATE SET SQL Injection"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHPNuke general SQL injection attempt"

• "ET WEB_SPECIFIC_APPS Fuzzylime Forum SQL Injection Attempt -- low.php topic INSERT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup SELECT"

• "ET WEB_SPECIFIC_APPS Mu Perspectives Cms id parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- print.php news_id SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_jcollection controller Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Web File Browser file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- update_profile.php username UNION SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php email UNION SELECT"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm newsId ASCII"

• "ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id UPDATE"

• "ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId SELECT"

• "ET WEB_SPECIFIC_APPS Absolute Image Gallery SQL Injection Attempt -- gallery.asp categoryid DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp orderby UNION SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp uid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid DELETE"

• "ET WEB_SPECIFIC_APPS VP-ASP Shopping Cart SQL Injection Attempt -- shopgiftregsearch.asp LoginLastname SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress - posts-layout (post-layout Doppelganger) Plugin Activation"

• "ET WEB_SPECIFIC_APPS Joomla com_blog Component id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Ublog Reload SQL Injection Attempt -- badword.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Kolayindir Download (Yenionline) SQL Injection Attempt -- down.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- detail.asp p INSERT"

• "ET WEB_SPECIFIC_APPS AlstraSoft Video Share Enterprise album.php UID Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php name SELECT"

• "ET WEB_CLIENT Generic WSO Webshell Password Prompt Accessed on External Compromised Server"

• "ET TROJAN Dark Nexus IoT Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php pid SELECT"

• "ET WEB_SPECIFIC_APPS f-fileman direkt Parameter Directory Traversal Vulnerability"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewReport.php bug ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp gallery_id DELETE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp year UNION SELECT"

• "ET WEB_SPECIFIC_APPS Mambo Component com_viewfulllisting SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php UPDATE"

• "ET WEB_SPECIFIC_APPS Inventory newtransact.php Cross Site Scripting Attempt"

• "ET ACTIVEX SaschArt SasCam Webcam Server ActiveX Control Head Method Buffer Overflow Attempt"

• "ET ACTIVEX Microsoft DirectX 9 msvidctl.dll ActiveX Control Code Execution Attempt"

• "ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php SELECT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp currentpage ASCII"

• "ET ACTIVEX Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (2)"

• "ET WEB_CLIENT Anonymous Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS LocazoList SQL Injection Attempt -- main.asp subcatID DELETE"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand INSERT"

• "ET WEB_SPECIFIC_APPS Portel patron Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php name ASCII"

• "ET WEB_SPECIFIC_APPS Joomla jfeedback Component controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS mySeatXT SQL Injection Attempt autocomplete.php field UPDATE"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_search.asp query UPDATE"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- printview.php topic DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- category.php catid SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS bug_actiongroup_ext_page.php script Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_zoomportfolio component INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- login.php login_username UNION SELECT"

• "ET WEB_SPECIFIC_APPS MyOWNspace getfeed.php file Parameter Local File Inclusion Attempt(1)"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 UNION SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID INSERT"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php order ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid UPDATE"

• "ET WEB_SPECIFIC_APPS iGaming CMS reviews.php browse parameter SQL injection"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php board UNION SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php message ASCII"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php lastname DELETE"

• "ET ACTIVEX winhlp32 ActiveX control attack - phase 3"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 UPDATE"

• "ET WEB_SERVER ColdFusion componentutils access"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm langId INSERT"

• "ET WEB_SPECIFIC_APPS Bexfront sid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS fipsGallery SQL Injection Attempt -- index1.asp which UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newwebsite SELECT"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtPas UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- polls.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Profi Einzelgebots Auktions System auktion_text.php Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp manufacturer UNION SELECT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- set_preferences.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- category.php catid UNION SELECT"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- detail.asp property_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla SQL Reports user_id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Bugzilla token.cgi HPP e-mail validation bypass Attempt URI"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserEmail SELECT"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- faqDsp.asp catcode DELETE"

• "ET WEB_SPECIFIC_APPS Modx Revolution < 2.6.4 phpthumb.php RCE Attempt"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_downloads.php did UPDATE"

• "ET WEB_SPECIFIC_APPS Fullaspsite ASP Hosting Site SQL Injection Attempt -- listmain.asp cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS Webcat web_id Parameter Blind SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php us DELETE"

• "ET WEB_SPECIFIC_APPS Omegasoft SQL Injection Attempt -- OmegaMw7.asp SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp listing_price INSERT"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Sort Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp ak ASCII"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Audins Audiens SQL Injection Attempt -- index.php PHPSESSID SELECT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- fiche_membre.php idmembre SELECT"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp agent INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserEmail INSERT"

• "ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori ASCII"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp password UPDATE"

• "ET WEB_SPECIFIC_APPS TinyBrowser upload.php file Script Execution Attempt"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp loc INSERT"

• "ET WEB_SPECIFIC_APPS Possible WP CuckooTap Arbitrary File Download"

• "ET WEB_SPECIFIC_APPS phpBB SQL Injection Attempt -- admin_hacks_list.php hack_id DELETE"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick_mod UPDATE"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgAnalyse.asp ServerName XSS Attempt"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp gallery_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php UPDATE"

• "ET WEB_SPECIFIC_APPS DiY-CMS lang Parameter Remote File inclusion Attempt"

• "ET WEB_SERVER Possible SQL Injection SELECT CONCAT in HTTP URI"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp id ASCII"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php url UPDATE"

• "ET WEB_SPECIFIC_APPS Bookmark4U SQL Injection Attempt -- config.php sqlcmd ASCII"

• "ET WEB_SERVER SELECT SUBSTR/ING in URI Possible Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Mambo LaiThai SQL Injection Attempt -- mambo.php ASCII"

• "ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS GetSimple CMS path parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id ASCII"

• "ET WEB_SPECIFIC_APPS e107 trackback_url Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand SELECT"

• "ET WEB_SPECIFIC_APPS EasySiteEdit langval Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS digiSHOP cart.php SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS T-Content Management System id_novedad Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS phpBazar picturelib.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board Lite SQL Injection Attempt -- thread.php threadvisit UNION SELECT"

• "ET EXPLOIT Stored XSS Vulnerability CVE-2021-31250 M3"

• "ET WEB_SERVER Generic PHP Uploader Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS LiveCMS SQL Injection Attempt -- categoria.php cid SELECT"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- group.php id INSERT"

• "ET WEB_SERVER PHP Possible ftp Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- index.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php website UNION SELECT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Enthusiast path parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Tunngavik CMS id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER Nagios statuswml.cgi Remote Arbitrary Shell Command Injection attempt"

• "ET WEB_SPECIFIC_APPS Possible Drupal Object Unserialize Exploit Attempt"

• "ET WEB_SPECIFIC_APPS CMScontrol 7.x (index.php id_menu) SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publications_list.asp vjob DELETE"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board katid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Lotfian Request For Travel SQL Injection Attempt -- ProductDetails.asp PID DELETE"

• "ET WEB_SPECIFIC_APPS Immophp annonce parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp category DELETE"

• "ET WEB_SPECIFIC_APPS Flash Gallery wordpress plugin SQL Injection Attempt -- massedit_album.php gall_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass INSERT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_Type_ID ASCII"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp ak UPDATE"

• "ET WEB_SPECIFIC_APPS Plone and Zope cmd Parameter Remote Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS WordPress FSML Plugin fsml-admin.js.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_id UPDATE"

• "ET WEB_SERVER PHP System Command in HTTP POST"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 SELECT"

• "ET WEB_SPECIFIC_APPS MindTouch Deki Wiki wgDekiPluginPath parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke viewslink module sid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_aut SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- user.php email INSERT"

• "ET WEB_SPECIFIC_APPS RS-CMS rscms_mod_newsview.php key Parameter Processing Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publications_list.asp vjob ASCII"

• "ET WEB_SPECIFIC_APPS Joomla portalid Component UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID SELECT"

• "ET WEB_SPECIFIC_APPS Possible bloofoxCMS 'search' Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- voirannonce.php no UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Fusion mguser fotoalbum album_id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Tiki Wiki CMS Groupware language Parameter Local File Inclusion Attempt"

• "ET WEB_SERVER Bot Search RFI Scan (Casper-Like MaMa Cyber/ebes)"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php id DELETE"

• "ET WEB_SPECIFIC_APPS ContentNow SQL Injection Attempt -- index.php pageid INSERT"

• "ET WEB_SERVER Generic Stolen Credentials Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS e107 Plugin lyrics_menu lyrics_song.php l_id Parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS RevokeSoft RevokeBB SQL Injection Attempt -- class_users.php UPDATE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp listing_price ASCII"

• "ET WEB_SPECIFIC_APPS Xt-News SQL Injection Attempt -- show_news.php id_news SELECT"

• "ET WEB_SPECIFIC_APPS Dompdf dompdf.php input_file Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Contra Haber Sistemi SQL Injection Attempt -- haber.asp id UPDATE"

• "ET WEB_CLIENT WSO 2.5 Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp gallery_id INSERT"

• "ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager advancedfind.do Reflective XSS Attempt"

• "ET WEB_SPECIFIC_APPS fipsCMS SQL Injection Attempt -- index.asp fid INSERT"

• "ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter DELETE FROM SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Openscrutin profil.class.php path_om Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp id INSERT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp categoryID_list UPDATE"

• "ET WEB_SPECIFIC_APPS OSSIM repository_attachment.php UNION SELECT SQL Injection Attempt"

• "ET WEB_CLIENT Java Web Start Command Injection (.jar)"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php id ASCII"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp pass DELETE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php id ASCII"

• "ET WEB_SPECIFIC_APPS dB Masters Curium CMS SQL Injection Attempt -- news.php c_id SELECT"

• "ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp menuSelect DELETE"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server"

• "ET WEB_SPECIFIC_APPS NewSolved newsscript.php jahr Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp area ASCII"

• "ET WEB_SPECIFIC_APPS Hazir Site SQL Injection Attempt -- giris_yap.asp sifre INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! CB Resume Builder 'group_id' Parameter UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordOld INSERT"

• "ET WEB_CLIENT Suspicious PHP UNZIP Tool Accessed on External Possibly Compromised Server"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- admin.php uploadimage SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_joomportfolio (secid) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Redaxo CMS index.inc.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Helpdesk Pilot Knowledge Base SQL Injection Attempt"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 29"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp secondgroup UPDATE"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- modules.php active INSERT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp page UPDATE"

• "ET WEB_SPECIFIC_APPS Open Source Support Ticket System module.php Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- print.php news_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nukesentinel.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-7"

• "ET WEB_SPECIFIC_APPS Tours Manager cityview.php cityid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS OSSIM repository_attachment.php SELECT FROM SQL Injection Attempt"

• "ET WEB_CLIENT APT/Hafnium SPORTSBALL Webshell Observed Outbound"

• "ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Solar Empire SQL Injection Attempt -- game_listing.php ASCII"

• "ET WEB_SPECIFIC_APPS Newsletter MX SQL Injection Attempt -- admin_mail_adressee.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- block-Old_Articles.php cat INSERT"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- moscomment.php mcname SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php clickurl SELECT"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp loc UPDATE"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite SELECT"

• "ET WEB_SPECIFIC_APPS Newsletter MX SQL Injection Attempt -- admin_mail_adressee.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id ASCII"

• "ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php password DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- content.asp sent ASCII"

• "ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid UPDATE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- db_ecard.php start ASCII"

• "ET WEB_SPECIFIC_APPS All In One Control Panel SQL Injection Attempt -- cp_menu_data_file.php menu UNION SELECT"

• "ET WEB_SPECIFIC_APPS MyStats SQL Injection Attempt -- mystats.php details UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_jshop component pid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS fipsCMS SQL Injection Attempt -- index.asp fid SELECT"

• "ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid UPDATE"

• "ET WEB_CLIENT Generic WSO Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS CubeCart loc parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_rule controller Local File Inclusion Attempt"

• "ET WEB_SERVER Possible Cisco PIX/ASA HTTP Web Interface HTTP Response Splitting Attempt"

• "ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType UPDATE"

• "ET WEB_SPECIFIC_APPS MAXcms RFI attempt (2)"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating ASCII"

• "ET WEB_SPECIFIC_APPS Campsite article_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ScriptMate User Manager SQL Injection Attempt -- usermessages.asp mesid UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.register.inc.php INSERT"

• "ET WEB_SPECIFIC_APPS WordPress Pretty Link plugin url Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php f ASCII"

• "ET WEB_SPECIFIC_APPS Possible Zenoss Cross Site Request Forgery Ping UserCommand Attempt"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_view.asp articleID DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid UPDATE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- set_preferences.asp DELETE"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- phonemessage.asp num SELECT"

• "ET WEB_SPECIFIC_APPS SiteloomCMS mailform_1 variable Cross Site Scripting Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- ldap.php INSERT"

• "ET WEB_SPECIFIC_APPS evision cms addtour.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS MindTouch Deki Wiki deki_plugin.php Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS WordPress WP ecommerce Shop Styling Plugin dompdf RFI Attempt"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-functions.php SELECT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 15"

• "ET WEB_SPECIFIC_APPS MGB OpenSource Guestbook SQL Injection Attempt -- email.php id SELECT"

• "ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Cartweaver 3 Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Nicola Asuni All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_functions_downloads.php download_category INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php goTo INSERT"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp cat INSERT"

• "ET WEB_SPECIFIC_APPS JobHut browse.php pk Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS evision cms addplain.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- gmail.php ASCII"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user DELETE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- email.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS N-13 News default_login_language Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_jmsfileseller view parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS joomla com_djcatalog component DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla com_avosbillets Component id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_musicgallery Component Id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS gpEasy CMS section parameter XSS Attempt"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_categories.asp catID UPDATE"

• "ET WEB_SERVER Suspected Webshell tasklist Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"

• "ET WEB_SPECIFIC_APPS Hunkaray Duyuru Scripti SQL Injection Attempt -- oku.asp id ASCII"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- filecheck.php id ASCII"

• "ET WEB_SPECIFIC_APPS ManageEngine Applications Manager attributeToSelect parameter Cross-Site Script Attempt"

• "ET WEB_SPECIFIC_APPS User Agent (SQLi Injection / Scanning)"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php goTo ASCII"

• "ET WEB_SPECIFIC_APPS PHP Labs JobSitePro SQL Injection Attempt -- search.php salary INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare SELECT"

• "ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager clusterName Reflective XSS Attempt"

• "GPL WEB_SERVER iisadmin access"

• "ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id ASCII"

• "ET WEB_SPECIFIC_APPS eNdonesia artid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- albmgr.php cat DELETE"

• "ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID INSERT"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick_mod INSERT"

• "ET WEB_SPECIFIC_APPS Hazir Site SQL Injection Attempt -- giris_yap.asp sifre UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-fusion Team Structure Infusion team_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php catid UPDATE"

• "ET WEB_SPECIFIC_APPS F3Site2009 LFI Exploit Attempt (new.php)"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla com_dshop Component INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_bch controller Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp In ASCII"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php from UPDATE"

• "ET WEB_SPECIFIC_APPS Amateur Photographer Image Gallery file parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style SELECT"

• "ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row INSERT"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- ipsearch.admin.php INSERT"

• "ET WEB_SPECIFIC_APPS Nagios Expand Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp AlphaSort UPDATE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- email.php id INSERT"

• "ET WEB_SPECIFIC_APPS Oracle Business Process Management context Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Free PHP photo gallery script path parameter Remote File inclusion Attempt"

• "ET WEB_SERVER Generic Webshell Activity"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php language SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_code UNION SELECT"

• "ET WEB_SPECIFIC_APPS gpEasy CMS key parameter XSS Attempt"

• "ET WEB_SERVER Possible Perl Shell in HTTP POST"

• "ET WEB_SPECIFIC_APPS phpBB2 Plus SQL Injection Attempt -- admin_acronyms.php id DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! JoomlaFacebook Component SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Automne upload-controler.php Arbitrary File Upload Vulnerability"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id UNION SELECT"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Joomla! Foobla RSS Feed Creator Component 'id' Parameter UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 INSERT"

• "ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS LushiWarPlaner SQL Injection Attempt -- register.php id ASCII"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_code INSERT"

• "ET WEB_SERVER Possible Cisco Subscriber Edge Services Manager Cross Site Scripting/HTML Injection Attempt"

• "ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank UPDATE"

• "ET WEB_SPECIFIC_APPS Flash Gallery wordpress plugin SQL Injection Attempt -- massedit_album.php gall_id SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- wallpaper.php wallpaperid SELECT"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_user INSERT"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php ipadd UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id ASCII"

• "ET WEB_SPECIFIC_APPS Comersus Shop Cart SQL Injection Attempt -- comersus_optReviewReadExec.asp idProduct UNION SELECT"

• "ET WEB_SPECIFIC_APPS People Joomla Component controller Parameter Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat DELETE"

• "ET WEB_SPECIFIC_APPS fipsGallery SQL Injection Attempt -- index1.asp which ASCII"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- meal_rest.asp mealid DELETE"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm newsId UPDATE"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Apache RocketMQ 5.1.0 Arbitrary Code Injection in Broker Config (CVE-2023-33246)"

• "ET WEB_SPECIFIC_APPS ArdeaCore pathForArdeaCore Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id DELETE"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Possible Skype for Business SSRF Attempt (CVE-2023-41763)"

• "ET WEB_SPECIFIC_APPS Flash Quiz high_score_web.php quiz Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- letterman.class.php id INSERT"

• "ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- modules.php active SELECT"

• "ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager deviceInstanceName Reflective XSS Attempt"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_downloads.php did INSERT"

• "ET SCAN SQL Injection Attempt (Agent uil2pn)"

• "ET WEB_SPECIFIC_APPS Zimplit CMS file Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Multiple Membership Script id parameter SQL injection"

• "ET WEB_SPECIFIC_APPS iScripts MultiCart orderid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId DELETE"

• "ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex UPDATE"

• "ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex SELECT"

• "ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id ASCII"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php defaultLetter DELETE"

• "ET WEB_SPECIFIC_APPS WordPress Cloudsafe365 file parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- ipsearch.admin.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php INSERT"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid INSERT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- set_preferences.asp INSERT"

• "ET EXPLOIT Local File Inclusion with Shell Execution via proc/self/environ"

• "ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid ASCII"

• "ET WEB_SPECIFIC_APPS fipsGallery SQL Injection Attempt -- index1.asp which DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! CB Resume Builder 'group_id' Parameter INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS MindTouch Deki Wiki link.php Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- thumbnails.asp ci DELETE"

• "ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id DELETE"

• "ET WEB_SPECIFIC_APPS LushiNews SQL Injection Attempt -- comments.php id SELECT"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- search.asp search UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text UNION SELECT"

• "ET WEB_SPECIFIC_APPS CF_Calendar calid parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- albmgr.php cat INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice UPDATE"

• "ET EXPLOIT ADB Broadband Authorization Bypass"

• "ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla Incapsula component Security.php XSS Attempt"

• "ET WEB_SPECIFIC_APPS joomla com_djcatalog component UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- download_image.asp image_id SELECT"

• "ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgForwardToRiskFilter.asp IsolatedMessageID XSS Attempt"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm categoryid DELETE"

• "ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id UNION SELECT"

• "ET SCAN DirBuster Web App Scan in Progress"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_view.asp articleID UPDATE"

• "ET WEB_SERVER Possible SQL Injection Attempt INSERT INTO in HTTP URI"

• "ET WEB_SPECIFIC_APPS Orlando CMS init.php GLOBALS Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php category_id INSERT"

• "ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Leaflet plugin(leaflet_marker) id parameter Cross-Site Scripting Attempt"

• "ET WEB_SERVER Suspected Generic Webshell Activity (Outbound)"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php search UPDATE"

• "ET WEB_SPECIFIC_APPS x10 Automatic MP3 Script function_core.php web_root Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS WordPress Download Monitor thumbnail parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php product_id ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat ASCII"

• "ET WEB_SPECIFIC_APPS Harlandscripts Pro Traffic One mypage.php trg Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS phpBB SQL Injection Attempt -- admin_hacks_list.php hack_id UPDATE"

• "ET WEB_SPECIFIC_APPS Online Web Building SQL Injection Attempt -- page.asp art_id INSERT"

• "ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid ASCII"

• "ET WEB_SERVER Attempt To Access MSSQL xp_enumerrorlogs Stored Procedure Via URI to View Error Logs"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- detail.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS LightOpenCMS smarty.php cwd Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php productId INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_jphoto Component Id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS asaher pro downloads.php row_y5_site_configuration Remote File Inclusion Attempt"

• "ET WEB_SERVER Oracle Secure Enterprise Search 10.1.8 search Script XSS attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Compromised Internal Server"

• "ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Sharebar plugin status parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- login.asp sent INSERT"

• "ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ShopNx - Arbitrary File Upload"

• "ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp did INSERT"

• "ET WEB_SPECIFIC_APPS Mambo LaiThai SQL Injection Attempt -- mambo.php UPDATE"

• "ET WEB_SPECIFIC_APPS Apache Archive addLegacyArtifactPath script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DokuWiki target parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHPKit SQL Injection Attempt -- include.php catid INSERT"

• "ET WEB_SPECIFIC_APPS ContentNow SQL Injection Attempt -- index.php pageid DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- login.asp sent SELECT"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php user UNION SELECT"

• "ET WEB_SPECIFIC_APPS iBrowser Plugin dir Parameter Cross Site Scripting Attempt-2"

• "ET CURRENT_EVENTS Apple Phishing Panel Accessed on Internal Server"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS Michelles L2J Dropcalc SQL Injection Attempt -- i-search.php itemid UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Advanced Text Widget plugin page parameter Cross-Site Script Attempt"

• "ET WEB_SERVER ATTACKER WebShell - PHP Offender - Title"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i ASCII"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp uid DELETE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- db_ecard.php start SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php name INSERT"

• "GPL EXPLOIT xp_filelist attempt"

• "ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews ASCII"

• "ET WEB_SPECIFIC_APPS Kolayindir Download (Yenionline) SQL Injection Attempt -- down.asp id ASCII"

• "ET WEB_SPECIFIC_APPS WebPhotoPro art.php idm Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Contra Haber Sistemi SQL Injection Attempt -- haber.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ParsBlogger blog.asp wr parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp uid INSERT"

• "ET WEB_SPECIFIC_APPS Joomla component smartformer Remote File Inclusion Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2"

• "ET WEB_SPECIFIC_APPS EJBCA issuer Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_comments.asp articleID UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie DELETE"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php order UPDATE"

• "ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album SELECT"

• "ET WEB_SPECIFIC_APPS fipsGallery SQL Injection Attempt -- index1.asp which UPDATE"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid ASCII"

• "ET WEB_SPECIFIC_APPS ANGEL Learning Management Suite (LMS) SQL Injection Attempt -- default.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp DELETE"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-3"

• "ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id INSERT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Project_ID INSERT"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- G_Display.php iCategoryUnq DELETE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- down.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_rsgallery2 Component catid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_jcalpro cal_popup.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php topic_id INSERT"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp pass SELECT"

• "ET WEB_SPECIFIC_APPS Solar Empire SQL Injection Attempt -- game_listing.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Ixprim SQL Injection Attempt -- ixm_ixpnews.php story_id SELECT"

• "ET WEB_SPECIFIC_APPS WebSense Email security viewHeaders.asp Queue XSS Attempt"

• "ET WEB_SPECIFIC_APPS phpBB SQL Injection Attempt -- admin_hacks_list.php hack_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp id INSERT"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgForwardToRiskFilter.asp FileName XSS Attempt"

• "ET WEB_SPECIFIC_APPS Shape Web Solutions imprimir.php SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress PDF and Print Button Joliprint plugin opt parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Immophp annonce parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php search INSERT"

• "ET WEB_SPECIFIC_APPS Keynect Ecommerce SQL Injection Attempt -- products.php ctf DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS IBM ENOVIA SmarTeam v5 LoginPage.aspx Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php position ASCII"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp uid DELETE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- fiche_membre.php idmembre DELETE"

• "ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa INSERT"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp did UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- DisplayResults.php iSearchID UPDATE"

• "ET WEB_SPECIFIC_APPS WarHound General Shopping Cart SQL Injection Attempt -- item.asp ItemID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php ASCII"

• "ET WEB_SPECIFIC_APPS Fuzzylime Forum SQL Injection Attempt -- low.php topic UPDATE"

• "ET WEB_CLIENT WSO 2.6 Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS WeBid ST_platforms.php include_path Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID INSERT"

• "ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DevelopItEasy Photo Gallery cat_id parameter SQL Injection"

• "ET EXPLOIT Joomla 3.2.1 SQL injection attempt"

• "ET WEB_SPECIFIC_APPS LushiWarPlaner SQL Injection Attempt -- register.php id DELETE"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewReport.php bug INSERT"

• "ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id ASCII"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating UPDATE"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite UNION SELECT"

• "ET WEB_SPECIFIC_APPS Manhali download.php Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- showfile.asp fid SELECT"

• "ET WEB_SPECIFIC_APPS WSN Guest search.php search parameter SQL Injection"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET EXPLOIT Xiongmai/HiSilicon DVR - Request for Product Details Possible CVE-2017-7577 Exploit Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp uid UPDATE"

• "ET WEB_SPECIFIC_APPS IBSng str Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publication_view.asp InfoID SELECT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php product_id UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla RokQuickCart view Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php from SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Wordpress eShop plugin eshoptemplate parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin UPDATE"

• "ET WEB_SPECIFIC_APPS DaFun Spirit lgsl_players.php lgsl_path Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS ScriptMate User Manager SQL Injection Attempt -- usermessages.asp mesid ASCII"

• "ET WEB_SPECIFIC_APPS Golem Gaming Portal root_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joostina CMS users component Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php image_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php login UNION SELECT"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SERVER Joomla Component SQLi Attempt"

• "ET WEB_SERVER Possible CREATE SQL Injection Attempt in URI"

• "ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Openscrutin courrier.class.php path_om Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x DELETE"

• "ET WEB_SPECIFIC_APPS Mambo N-Myndir DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS pfile file.php id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- pfs.edit.inc.php INSERT"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy INSERT"

• "ET WEB_SPECIFIC_APPS Mp3 Online Id Tag Editor module.archive.gzip.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- mailer.w2b draft DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! Soundset Component 'cat_id' Parameter SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listfull.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress PingBack Possible GHOST attempt"

• "ET WEB_SPECIFIC_APPS Invision Power Board (IPB) SQL Injection Attempt -- class_session.php CLIENT_IP UPDATE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp uid ASCII"

• "ET WEB_SPECIFIC_APPS PSY Auction SQL Injection Attempt -- item.php id UPDATE"

• "ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines SELECT"

• "ET WEB_SERVER Possible Oracle Reports Forms RCE CVE-2012-3152"

• "ET WEB_SPECIFIC_APPS Joomla com_photoblog component category Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Concrete CMS btask parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id ASCII"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice ASCII"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS PHPStore Wholesales id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS CitusCMS filePath Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Ban SQL Injection Attempt -- connexion.php id DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp AlphaSort SELECT"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP kid INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 UPDATE"

• "ET WEB_SPECIFIC_APPS Dokeos and Chamilo open_document.php file Parameter File Disclosure Attempt"

• "ET EXPLOIT Possible CVE-2017-12629 RCE Exploit Attempt (HTTP GET 2)"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php id INSERT"

• "ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS vSupport Integrated Ticket System SQL Injection Attempt -- vBSupport.php ticketid UPDATE"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid SELECT"

• "ET ACTIVEX Visagesoft eXPert PDF Viewer ActiveX Control Arbitrary File Overwrite"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Business Objects Crystal Reports Web Form Viewer Directory Traversal Attempt"

• "ET WEB_SPECIFIC_APPS mcRefer SQL Injection Attempt -- install.php bgcolor INSERT"

• "ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user ASCII"

• "ET WEB_SERVER Generic WSO Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS evision cms addarticles.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS WarHound General Shopping Cart SQL Injection Attempt -- item.asp ItemID ASCII"

• "ET WEB_SPECIFIC_APPS phpBMS invoices_discount_ajax.php id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ANGEL Learning Management Suite (LMS) SQL Injection Attempt -- default.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid UPDATE"

• "ET WEB_SPECIFIC_APPS SERWeb main_prepend.php functionsdir Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp cat ASCII"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- set_preferences.asp ASCII"

• "ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id INSERT"

• "ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php image_id DELETE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp area INSERT"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- index.php blogid INSERT"

• "ET WEB_SPECIFIC_APPS Nagios XI div parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Vizayn Haber SQL Injection Attempt -- haberdetay.asp id SELECT"

• "GPL EXPLOIT unicode directory traversal attempt"

• "ET WEB_SERVER Gootkit Website Infection Request for FTP Credentials from Control Server"

• "ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType UNION SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php position SELECT"

• "ET WEB_SPECIFIC_APPS fipsGallery SQL Injection Attempt -- index1.asp which INSERT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_hello UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publication_view.asp InfoID ASCII"

• "ET WEB_SPECIFIC_APPS evision cms addbrandnews.php module parameter Local File Inclusion"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php website INSERT"

• "ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete UNION SELECT"

• "ET WEB_SERVER Generic Email Spoofing Tool Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 UNION SELECT"

• "ET WEB_SPECIFIC_APPS Minerva mod SQL Injection Attempt -- forum.php c SELECT"

• "ET WEB_SERVER ImageMagick CVE-2016-3717 Local File Read Inbound (label: + mvg)"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M3"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewReport.php bug DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_musicgallery Component Id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS fipsForum SQL Injection Attempt -- default2.asp kat UNION SELECT"

• "ET WEB_SPECIFIC_APPS Gbook MX newlangsel Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS WikyBlog which Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick_mod SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_joaktree Component treeId Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_quicknews Component newsid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Bookmark4U SQL Injection Attempt -- config.php sqlcmd DELETE"

• "ET WEB_SPECIFIC_APPS Digitizing Quote And Ordering System SQL Injection Attempt -- search.asp ordernum UNION SELECT"

• "ET WEB_SPECIFIC_APPS Xt-News SQL Injection Attempt -- show_news.php id_news INSERT"

• "ET WEB_SPECIFIC_APPS axdcms aXconf Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Horde 3.3.12 Backdoor Attempt"

• "ET WEB_SPECIFIC_APPS BasicForum SQL Injection Attempt -- edit.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress Plugin Is-human type Parameter Remote Code Execution Attempt"

• "ET WEB_SPECIFIC_APPS Sahana Agasti AccessController.php approot Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php clickurl UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordNew ASCII"

• "ET WEB_SPECIFIC_APPS ASP ListPics SQL Injection Attempt -- listpics.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php galleryID UPDATE"

• "ET WEB_SPECIFIC_APPS GeekLog filemgt UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board Lite SQL Injection Attempt -- thread.php threadvisit SELECT"

• "ET WEB_SPECIFIC_APPS ScriptMate User Manager SQL Injection Attempt -- usermessages.asp mesid INSERT"

• "ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa UPDATE"

• "ET WEB_SPECIFIC_APPS OvBB admincp.php smilieid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_ID SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- ldap.php UPDATE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp ak UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS YapBB class_yapbbcooker.php cfgIncludeDirectory Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla! SportFusion Component UPDATE SET SQL Injection"

• "ET ACTIVEX Gesytec ElonFmt ActiveX Component GetItem1 member Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS YaPig last_gallery.php YAPIG_PATH Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_user ASCII"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q DELETE"

• "ET WEB_SPECIFIC_APPS IWantOneButton Wordpress updateAJAX.php post_id Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Redaxo CMS specials.inc.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- news.php item SELECT"

• "ET WEB_SPECIFIC_APPS TinyWebGallery workaround_dir parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- artreplydelete.asp username INSERT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- block-Old_Articles.php cat SELECT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 17"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- sections.php text UPDATE"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp sifre ASCII"

• "ET WEB_SPECIFIC_APPS Snipsnap search Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp parentid ASCII"

• "ET WEB_SPECIFIC_APPS SOPHIA CMS SQL Injection Attempt -- dsp_page.cfm pageid ASCII"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_cat_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid DELETE"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 28"

• "ET WEB_SPECIFIC_APPS Noname Media Photo Galerie Standard SQL Injection Attempt -- view.php id ASCII"

• "ET CURRENT_EVENTS Apple Phishing Panel Accessed on External Server"

• "ET WEB_SPECIFIC_APPS OTManager ADM_Pagina.php Tipo Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla Frontend-User-Access controller Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS WP Forum Server wordpress plugin SQL Injection Attempt -- feed.php topic UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress Chocolate WP Theme src Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS VP-ASP Shopping Cart SQL Injection Attempt -- shopgiftregsearch.asp LoginLastname UPDATE"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm newsId INSERT"

• "ET WEB_SPECIFIC_APPS PHPKit SQL Injection Attempt -- include.php catid ASCII"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- preferences.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla XCloner Component index2.php mosmsg Parameter Cross Site Scripting Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php user ASCII"

• "ET WEB_SPECIFIC_APPS SonicWALL SonicOS searchStr XML Tag Script Insertion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice UPDATE"

• "ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M2"

• "ET WEB_SPECIFIC_APPS Rapid Classified SQL Injection Attempt -- viewad.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla Community component userid parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm langId SELECT"

• "ET WEB_SPECIFIC_APPS ExBB threadstop.php exbb Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- phonemessage.asp num DELETE"

• "ET ACTIVEX 4XEM VatDecoder VatCtrl Class ActiveX Control Url Property Buffer Overflow Vulnerability"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- userdetail.php id INSERT"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php picID UPDATE"

• "ET WEB_SERVER Script tag in URI Possible Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_perchagallery Component id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- inc_secureloginmanager.asp sent UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke FriendSend module sid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp title ASCII"

• "ET WEB_SERVER ColdFusion Path Traversal (locale 1/5)"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- search.asp INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID UPDATE"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp order UPDATE"

• "GPL EXPLOIT cmd32.exe access"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- list.php categoryid ASCII"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp id SELECT"

• "ET WEB_SPECIFIC_APPS eNdonesia artid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- wallpaper.php wallpaperid UPDATE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- content.asp sent DELETE"

• "ET WEB_SPECIFIC_APPS Cacti cacti/utilities.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Video Lead Form plugin errMsg parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id DELETE"

• "ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Bluetrait SQL Injection Attempt -- bt-trackback.php SELECT"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- rating.asp id DELETE"

• "ET WEB_SPECIFIC_APPS NotFTP config.php languages Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.register.inc.php UPDATE"

• "ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UNION SELECT"

• "ET WEB_SPECIFIC_APPS Noname Media Photo Galerie Standard SQL Injection Attempt -- view.php id INSERT"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- db_ecard.php start UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke FriendSend module sid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Foobla Suggestions Component idea_id UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- phonemessage.asp num INSERT"

• "ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_recent.asp currentpage INSERT"

• "ET WEB_SPECIFIC_APPS Publishing Technology id Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- menu.php ASCII"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SportFusion Component SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php topic_id SELECT"

• "ET WEB_SPECIFIC_APPS ASP ListPics SQL Injection Attempt -- listpics.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID ASCII"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- rating.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS HP System Management Homepage Input Validation Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nukesentinel.php UPDATE"

• "ET WEB_SERVER WSO 4.2.5 Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp title UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listfull.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS SalesCart Shopping Cart SQL Injection Attempt -- reorder2.asp INSERT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php cid DELETE"

• "ET WEB_SPECIFIC_APPS bbPress SQL Injection Attempt -- formatting-functions.php UNION SELECT"

• "ET WEB_SERVER Generic Website Ransomnote Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- db_ecard.php start INSERT"

• "ET WEB_SERVER PHP Possible file Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS tinyCMS templater.php Local File Inclusion"

• "ET WEB_SPECIFIC_APPS All In One Control Panel SQL Injection Attempt -- cp_menu_data_file.php menu UPDATE"

• "ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName DELETE"

• "ET EXPLOIT Stored XSS Vulnerability CVE-2021-31250 M1"

• "ET WEB_SPECIFIC_APPS All In One Control Panel SQL Injection Attempt -- cp_menu_data_file.php menu DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Multiple Products upload_image_category.asp cid Parameter SQL Injection"

• "ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- recipe.php recipeid INSERT"

• "ET WEB_SPECIFIC_APPS PSY Auction SQL Injection Attempt -- item.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS LiveCMS SQL Injection Attempt -- categoria.php cid DELETE"

• "ET WEB_SPECIFIC_APPS LushiNews SQL Injection Attempt -- comments.php id ASCII"

• "ET WEB_SPECIFIC_APPS Calendar MX BASIC SQL Injection Attempt -- calendar_detail.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS Possible JBoss/JMX InvokerServlet RCE Using Marshalled Object"

• "ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album INSERT"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat INSERT"

• "ET WEB_SPECIFIC_APPS Lotfian Request For Travel SQL Injection Attempt -- ProductDetails.asp PID UPDATE"

• "ET WEB_SPECIFIC_APPS X-Ice News System SQL Injection Attempt -- devami.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Wordpress Audio Player Plugin playerID parameter XSS attempt in swf"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- inc_secureloginmanager.asp sent UNION SELECT"

• "ET WEB_SPECIFIC_APPS Weekly Drawing Contest SQL Injection Attempt -- check_vote.php order UPDATE"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php sid ASCII"

• "ET WEB_SPECIFIC_APPS WordPress Copperleaf Photolog postid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ACGVannu SQL Injection Attempt -- modif.html id_mod DELETE"

• "ET WEB_SPECIFIC_APPS Cacti SQL Injection Vulnerability tree.php leaf_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- albmgr.php cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- compare_product.php id INSERT"

• "ET WEB_SPECIFIC_APPS WebMoney html2.php page Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla Jotloader component section parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php DELETE"

• "ET WEB_SPECIFIC_APPS jSchool Advanced id_gallery Parameter SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID DELETE"

• "ET WEB_SPECIFIC_APPS digiSHOP cart.php DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 29o3 CMS layoutHeaderFuncs.php LibDir Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Cisco Common Services Framework Reflective XSS Attempt"

• "ET WEB_SPECIFIC_APPS 8pixel.net simpleblog SQL Injection Attempt -- edit.asp id DELETE"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php country SELECT"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i UNION SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- order-track.php orderNo DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_avosbilletsy Component id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Jimtawl Component task Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp l DELETE"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- users.php id INSERT"

• "ET WEB_SPECIFIC_APPS Web Edition mod parameter Local File Inclusion vulnerability"

• "ET WEB_SPECIFIC_APPS Joomla com_job Component id_job Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Messageriescripthp SQL Injection Attempt -- lire-avis.php aa SELECT"

• "ET WEB_SPECIFIC_APPS ASP SiteWare autoDealer SQL Injection Attempt -- detail.asp iPro DELETE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp area UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php cat_id INSERT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp gallery_id SELECT"

• "ET WEB_SPECIFIC_APPS RecordPress rp-menu.php sess_user Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Mambo N-Myndir SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid ASCII"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- index.php p_skin DELETE"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php topic_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php lastname INSERT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp pass UPDATE"

• "ET WEB_SPECIFIC_APPS Dell OpenManage Server Administrator topic parameter XSS Attempt"

• "ET WEB_SPECIFIC_APPS Mambo AHS Shop component INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id SELECT"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp id ASCII"

• "ET WEB_SERVER WSO 2.5 Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS Ektron CMS400.NET medialist.aspx selectids Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS BP Blog SQL Injection Attempt -- default.asp layout UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID UPDATE"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php url INSERT"

• "ET WEB_SPECIFIC_APPS Joomla je-media-player view parameter Local File Inclusion Attempt"

• "ET WEB_SERVER Suspected Webshell Activity (Inbound)"

• "ET WEB_SPECIFIC_APPS CMSQLITE id parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- archives.php month UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_quicknews Component newsid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id UNION SELECT"

• "ET WEB_SERVER PHP Possible data Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Frontis aps_browse_sources.php source_class Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php ASCII"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- logon_user.php username ASCII"

• "ET WEB_SERVER Suspected Webshell registry Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php productId SELECT"

• "ET WEB_SPECIFIC_APPS ProNews SQL Injection Attempt -- lire-avis.php aa ASCII"

• "ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id INSERT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp stock_number INSERT"

• "ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla FaceBook Component face_id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp parola ASCII"

• "ET WEB_SPECIFIC_APPS Nabopoll SQL Injection Attempt -- result.php surv INSERT"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php newsid SELECT"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie INSERT"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass ASCII"

• "ET WEB_SERVER Local Website Infected By Gootkit"

• "ET WEB_SPECIFIC_APPS Apache Archive addRepository script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp pass ASCII"

• "ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (1)"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php productId DELETE"

• "ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- menu.php DELETE"

• "ET WEB_SPECIFIC_APPS Shape Web Solutions imprimir.php INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- details.asp id SELECT"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php id SELECT"

• "ET WEB_SPECIFIC_APPS ProNews SQL Injection Attempt -- lire-avis.php aa DELETE"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS VP-ASP Shopping Cart SQL Injection Attempt -- shopgiftregsearch.asp LoginLastname UNION SELECT"

• "ET WEB_SERVER SQL Injection Attempt (Agent CZxt2s)"

• "ET WEB_SPECIFIC_APPS Openconstructor CMS result Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Michelles L2J Dropcalc SQL Injection Attempt -- i-search.php itemid DELETE"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp category INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- ldap.php DELETE"

• "ET WEB_SPECIFIC_APPS JiRos FAQ Manager SQL Injection Attempt -- index.asp tID UNION SELECT"

• "GPL WEB_SERVER viewcode access"

• "ET WEB_SPECIFIC_APPS phpBB SQL Injection Attempt -- admin_hacks_list.php hack_id INSERT"

• "ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course UNION SELECT"

• "ET WEB_SPECIFIC_APPS Nitrotech members.php id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Quantum Game Library smarty.inc.php CONFIG Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp area UNION SELECT"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- sendarticle.asp DELETE"

• "ET WEB_SPECIFIC_APPS Joomla 3.7.0 - Sql Injection (CVE-2017-8917)"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- openlink.asp LinkID SELECT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php ps UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpBB2 Plus SQL Injection Attempt -- admin_acronyms.php id SELECT"

• "ET WEB_SPECIFIC_APPS EasySiteNetwork Riddles Complete Website riddle.php riddleid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- polls.php id ASCII"

• "ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id DELETE"

• "ET WEB_SPECIFIC_APPS AJ Forum SQL Injection Attempt -- topic_title.php td_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick_mod UNION SELECT"

• "ET WEB_SPECIFIC_APPS Guo Xu Guos Posting System (GPS) SQL Injection Attempt -- print.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) Lite SQL Injection Attempt -- pms.php pmid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php board INSERT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- cat.asp cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS Simple Web Content Management System SQL Injection Attempt -- page.php id DELETE"

• "ET WEB_SPECIFIC_APPS Fullaspsite ASP Hosting Site SQL Injection Attempt -- listmain.asp cat ASCII"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp agent DELETE"

• "ET WEB_SERVER PUT Website Defacement Attempt"

• "ET WEB_SPECIFIC_APPS pfile file.php id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Andromeda Streaming MP3 Server andromeda.php Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php by SELECT"

• "ET WEB_SPECIFIC_APPS Joomla mediaslide component viewer.php path Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Greenpeace.fr filter_dpt Parameter Cross Site Scripting Attempt"

• "ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UPDATE"

• "ET WEB_SPECIFIC_APPS Constructr CMS SQL Injection Attempt -- constructrXmlOutput.content.xml.php page_id ASCII"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_br controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php website ASCII"

• "ET WEB_SPECIFIC_APPS iGaming CMS previews.php browse parameter SQL injection"

• "ET WEB_SPECIFIC_APPS uniForum SQL Injection Attempt -- wbsearch.aspx UNION SELECT"

• "ET WEB_SPECIFIC_APPS Messageriescripthp SQL Injection Attempt -- lire-avis.php aa UPDATE"

• "ET WEB_SPECIFIC_APPS uniForum SQL Injection Attempt -- wbsearch.aspx ASCII"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- recipe.php recipeid SELECT"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp secondgroup INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DevelopItEasy Photo Gallery photo_id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla GoogleMaps Plugin Open Proxy Access"

• "ET WEB_SPECIFIC_APPS Possible JBoss JMX Console Beanshell Deployer WAR Upload and Deployment Exploit Attempt"

• "ET WEB_SPECIFIC_APPS McAfee Email Gateway queueMsgType Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- content.php where DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! Survey Manager Component UPDATE SET SQL Injection"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php image_id SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp year ASCII"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp state SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp year SELECT"

• "ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php post_id DELETE"

• "ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- set_preferences.asp UPDATE"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- navigacija.php IDMeniGlavni SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- gmail.php SELECT"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- wallpaper.php wallpaperid ASCII"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- index.php p_skin UPDATE"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp did ASCII"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp agentid DELETE"

• "ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php UPDATE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vehicleID SELECT"

• "ET WEB_SPECIFIC_APPS Ublog Reload SQL Injection Attempt -- badword.asp ASCII"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 UNION SELECT"

• "ET WEB_SPECIFIC_APPS joomla com_djcatalog component INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS Digitizing Quote And Ordering System SQL Injection Attempt -- search.asp ordernum ASCII"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- phonemessage.asp num UPDATE"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp title UNION SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP Aardvark Topsites PHP CONFIG PATH Remote File Include Attempt"

• "ET WEB_SPECIFIC_APPS Symantec Endpoint Manager XXE RCE Attempt"

• "ET WEB_SERVER Tilde in URI - potential .conf source disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS Joomla Component com_zcalendar (eid) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE"

• "ET WEB_SPECIFIC_APPS JiRos FAQ Manager SQL Injection Attempt -- index.asp tID ASCII"

• "ET WEB_SPECIFIC_APPS SurgeFTP surgeftpmgr.cgi classid Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- archives.php month ASCII"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- list.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand ASCII"

• "ET WEB_SPECIFIC_APPS Solar Empire SQL Injection Attempt -- game_listing.php INSERT"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php catid INSERT"

• "ET WEB_SPECIFIC_APPS LocazoList SQL Injection Attempt -- main.asp subcatID ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_quicknews Component newsid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Piwik Backdoor Access"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php message UPDATE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id ASCII"

• "ET WEB_SPECIFIC_APPS Ublog Reload SQL Injection Attempt -- badword.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- search.asp search SELECT"

• "GPL WEB_SERVER /scripts/iisadmin/default.htm access"

• "ET WEB_SPECIFIC_APPS Joomla com_jshop pid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS X-Ice News System SQL Injection Attempt -- devami.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board katid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp orderby UNION SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php clickurl DELETE"

• "ET WEB_SPECIFIC_APPS NetClassifieds Premium Edition SQL Injection Attempt -- ViewCat.php s_user_id DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id DELETE"

• "ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id UPDATE"

• "ET WEB_SPECIFIC_APPS PWP Technologies The Classified Ad System SQL Injection Attempt -- default.asp main DELETE"

• "ET WEB_SPECIFIC_APPS Pilot Online Training Solution news_read.php id SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- letterman.class.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- modules.php active UNION SELECT"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- showfile.asp fid UNION SELECT"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp category UNION SELECT"

• "ET WEB_SPECIFIC_APPS VTiger CRM module_name parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id DELETE"

• "ET WEB_SPECIFIC_APPS DeluxeBB misc.php qorder Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Flash Quiz question.php order_number Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- search.asp ASCII"

• "ET WEB_SPECIFIC_APPS Orlando CMS stage1.php GLOBALS Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS phpProfiles topic_title parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS QUICKTEAM qte_result.php title Parameter UNION SELECT SQL Injection Attempt"

• "ET SCAN Acunetix scan in progress acunetix_wvs_security_test in http_uri"

• "ET WEB_SPECIFIC_APPS fipsGallery SQL Injection Attempt -- index1.asp which SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp year DELETE"

• "ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName UPDATE"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id DELETE"

• "ET WEB_SPECIFIC_APPS WordPress Mingle Forum groupid parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php position INSERT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp currentpage INSERT"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- wp-trackback.php DELETE"

• "ET WEB_SPECIFIC_APPS SFS EZ Hotscripts-like Site showcategory.php cid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS 29o3 CMS layoutParser.php LibDir Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Audins Audiens SQL Injection Attempt -- index.php PHPSESSID ASCII"

• "ET WEB_SPECIFIC_APPS ASP ListPics SQL Injection Attempt -- listpics.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp gallery_id ASCII"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP id ASCII"

• "ET WEB_SPECIFIC_APPS Weekly Drawing Contest SQL Injection Attempt -- check_vote.php order SELECT"

• "ET WEB_SPECIFIC_APPS e107 resetcore.php SQL Injection attempt"

• "ET WEB_SERVER Tilde in URI - potential .inc source disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS WordPress LeagueManager plugin group parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- res_details.asp resid DELETE"

• "ET WEB_SPECIFIC_APPS AjaxPortal di.php pathtoserverdata Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- openlink.asp LinkID INSERT"

• "ET WEB_SPECIFIC_APPS LocazoList SQL Injection Attempt -- main.asp subcatID UPDATE"

• "ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Simple Web Content Management System SQL Injection Attempt -- page.php id INSERT"

• "ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS vBSupport SQL Injection Attempt -- vBSupport.php SELECT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_comments.asp articleID INSERT"

• "ET WEB_SPECIFIC_APPS LushiNews SQL Injection Attempt -- comments.php id INSERT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- changeannonce.php idannonce UNION SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- details.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS SAPID get_infochannel.inc.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp id ASCII"

• "ET CURRENT_EVENTS php with eval/gzinflate/base64_decode possible webshell"

• "ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap NSE)"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- login.asp sent UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp Keyword UPDATE"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp pass INSERT"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php newsid ASCII"

• "ET WEB_SPECIFIC_APPS NewSolved newsscript.php idneu Parameter SQL Injection"

• "ET WEB_SERVER ColdFusion scheduletasks access"

• "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (web.config) (CVE-2020-10148)"

• "ET WEB_SPECIFIC_APPS phpBMS invoices_discount_ajax.php id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS RIPS code.php Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- thumbnails.asp ci UNION SELECT"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP kid INSERT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid DELETE"

• "ET WEB_SPECIFIC_APPS Synactis All_IN_THE_BOX ActiveX SaveDoc Method Arbitrary File Overwrite"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid INSERT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_comments.asp articleID ASCII"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q UNION SELECT"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- showfile.asp fid DELETE"

• "ET WEB_SPECIFIC_APPS Omegasoft SQL Injection Attempt -- OmegaMw7.asp DELETE"

• "ET WEB_SPECIFIC_APPS TinyBrowser edit.php file Script Execution Attempt"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- linkslist.asp psearch UPDATE"

• "ET WEB_SPECIFIC_APPS VS Panel showcat.php Cat_ID Parameter SQL Injection"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS WordPress 1-jquery-photo-gallery-slideshow-flash plugin page Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS SHOP-INET show_cat2.php grid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Immophp annonce parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp password DELETE"

• "ET WEB_SPECIFIC_APPS phpCow skin_file Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_avosbillets Component id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Absolute Image Gallery SQL Injection Attempt -- gallery.asp categoryid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php sk UNION SELECT"

• "ET WEB_SPECIFIC_APPS Fuzzylime Forum SQL Injection Attempt -- low.php topic UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress PDF and Print Button Joliprint plugin type parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName SELECT"

• "ET WEB_SPECIFIC_APPS Wiki Web Help configpath parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php language UNION SELECT"

• "ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS coRED CMS rubID Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass DELETE"

• "ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Possible JBoss/JMX EJBInvokerServlet RCE Using Marshalled Object"

• "ET WEB_SPECIFIC_APPS ColdUserGroup LibraryID Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS SourceBans ajaxargs Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Guo Xu Guos Posting System (GPS) SQL Injection Attempt -- print.asp id DELETE"

• "ET ACTIVEX ChilkatHttp ActiveX 2.3 Arbitrary Files Overwrite"

• "ET WEB_SPECIFIC_APPS WP Forum Server wordpress plugin SQL Injection Attempt -- feed.php topic SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS gCards SQL Injection Attempt -- getnewsitem.php newsid ASCII"

• "ET WEB_SPECIFIC_APPS KR-Web krgourl.php DOCUMENT_ROOT Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_class UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- gmail.php DELETE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php language ASCII"

• "ET WEB_SPECIFIC_APPS Shape Web Solutions imprimir.php DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UPDATE"

• "ET WEB_SPECIFIC_APPS Oracle E-Business Suite Financials jtfwcpnt.jsp INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp manufacturer DELETE"

• "ET WEB_SPECIFIC_APPS Group-Office comment_id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS phpBB2 Plus SQL Injection Attempt -- admin_acronyms.php id UPDATE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- okvalannonce.php idannonce SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- weblinks.php where UPDATE"

• "ET WEB_SPECIFIC_APPS BbZL.PhP lien_2 Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick INSERT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- index.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp ak SELECT"

• "ET WEB_SERVER Possible ALTER SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp AlphaSort DELETE"

• "ET WEB_SPECIFIC_APPS Dokuwiki doku.php config_cascade Local File Inclusion"

• "ET WEB_CLIENT WSO 4.2.5 Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS LushiWarPlaner SQL Injection Attempt -- register.php id UNION SELECT"

• "ET EXPLOIT TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (WiFi Password Change)"

• "ET WEB_SPECIFIC_APPS evision cms addpolling.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum.asp baslik ASCII"

• "ET WEB_SPECIFIC_APPS X-Ice News System SQL Injection Attempt -- devami.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- category.php catid DELETE"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- admin.php uploadimage UPDATE"

• "GPL SQL Oracle iSQLPlus login.uix username overflow attempt"

• "ET WEB_SPECIFIC_APPS DvBBS boardrule.php groupboardid Parameter SQL Injection"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Apache Archive deleteNetworkProxy script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS phpscripte24 Vor und Ruckwarts Auktions System Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php language UPDATE"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- cat.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php galleryID SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_hello controller parameter Local File Inclusion vulnerability"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php cid SELECT"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid SELECT"

• "ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (2)"

• "ET WEB_SPECIFIC_APPS Wordpress eShop plugin action parameter Cross Site Scripting Attempt"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php catid DELETE"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php country UPDATE"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board katid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Openscrutin collectivite.class.php path_om Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp l ASCII"

• "ET WEB_SPECIFIC_APPS OneFileCMS p parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Softwebs Nepal Ananda Real Estate SQL Injection Attempt -- list.asp agent DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_jeformcr view parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Onguma Time Sheet Component onguma.class.php mosConfig_absolute_path Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS PHP Realty dpage.php docID parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS SoftMP3 search Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Mini Mail Dashboard Widget abspath Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Mambo Cache_Lite Class mosConfig_absolute_path Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ClipShare Pro channel_detail.php chid Parameter SQL Injection"

• "ET WEB_SERVER DNS changer cPanel attempt"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- index.cfm INSERT"

• "ET WEB_SPECIFIC_APPS Bandwebsite lyrics.php id parameter Sql Injection"

• "ET WEB_SPECIFIC_APPS Joomla Component com_doqment Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- res_details.asp resid SELECT"

• "ET SCAN Possible Scanning for Vulnerable JBoss"

• "ET WEB_SPECIFIC_APPS com_if_nexus controller Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Messageriescripthp SQL Injection Attempt -- lire-avis.php aa INSERT"

• "ET WEB_SPECIFIC_APPS bbPress SQL Injection Attempt -- formatting-functions.php UPDATE"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- com_comment.php mcname ASCII"

• "ET WEB_SPECIFIC_APPS OTManager ADM_Pagina.php Tipo Local File Inclusion"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS fipsCMS SQL Injection Attempt -- index.asp fid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid DELETE"

• "ET WEB_SPECIFIC_APPS IBM Rational RequisitePro ReqWebHelp searchWord Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Cacti SQL Injection Vulnerability tree.php leaf_id SELECT"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php by UPDATE"

• "ET WEB_SPECIFIC_APPS Possible Zenoss Network Monitoring Application UNTION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS BASE base_stat_common.php remote file include"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php order INSERT"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- archives.php month DELETE"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Super Link Exchange Script SQL Injection Attempt -- directory.php cat UPDATE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- okvalannonce.php idannonce UNION SELECT"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- sendarticle.asp ASCII"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtPas DELETE"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp agent UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebPhotoPro rubrika.php idr Parameter SQL Injection"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- archives.php month UPDATE"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- preferences.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS PunBB viewtopic_PM-link.php pun_user language Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin DELETE"

• "ET WEB_SPECIFIC_APPS Gallery2 adodb-error.inc.php ADODB_LANG Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS HP Insight Diagnostics Online Edition search.php XSS Attempt"

• "ET WEB_SPECIFIC_APPS CMS Faethon info.php item Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- journal.php w UPDATE"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- navigacija.php IDMeniGlavni ASCII"

• "ET WEB_SPECIFIC_APPS bcoos adresses module viewcat.php cid Parameter SQL injection"

• "ET WEB_SPECIFIC_APPS MAXcms RFI attempt (3)"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php goTo DELETE"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgAnalyse.asp FileName XSS Attempt"

• "ET WEB_SPECIFIC_APPS Oxygen (O2PHP Bulletin Board) SQL Injection Attempt -- viewthread.php pid UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nsbypass.php DELETE"

• "ET WEB_SPECIFIC_APPS Invision Power Board (IPB) SQL Injection Attempt -- class_session.php CLIENT_IP DELETE"

• "ET WEB_SPECIFIC_APPS MiNT Haber Sistemi SQL Injection Attempt -- duyuru.asp id DELETE"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla Component com_digistore (pid) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- polls.php id SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vehicleID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_joaktree Component treeId Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- slideshow.asp ci UNION SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp order INSERT"

• "ET WEB_SPECIFIC_APPS e107 imgp Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Inventory newinventario.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- search.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp uid INSERT"

• "ET WEB_CLIENT Predator the Thief Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Hazir Site SQL Injection Attempt -- giris_yap.asp sifre UNION SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php imageurl DELETE"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer INSERT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- print.php news_id INSERT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_hello UNION SELECT SQL Injection Attempt"

• "ET WEB_SERVER Possible HTTP 503 XSS Attempt (Internal Source)"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php ASCII"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_search.asp query UNION SELECT"

• "ET WEB_SPECIFIC_APPS AdaptWeb a_index.php CodigoDisciplina Parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php order UNION SELECT"

• "ET WEB_SPECIFIC_APPS Xt-News SQL Injection Attempt -- show_news.php id_news ASCII"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup DELETE"

• "ET WEB_SERVER HP Intelligent Management Java Deserialization RCE Attempt"

• "ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid SELECT"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php order DELETE"

• "ET WEB_CLIENT Generic Webshell Accessed on Compromised External Server"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- changeannonce.php idannonce DELETE"

• "ET WEB_SPECIFIC_APPS WordPress 2 Click Social Media Buttons plugin xing-url parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- members.asp sent SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice SELECT"

• "ET WEB_SPECIFIC_APPS webEdition CMS edit_shop_editorFrameset.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS asaher pro emailsender.php row_y5_site_configuration Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php pid ASCII"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp pass UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla MyRemote Video Gallery (user_id) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- prikazInformacije.php IDStranicaPodaci ASCII"

• "ET WEB_SPECIFIC_APPS V-EVA Classified Script clsid Parameter INSERT INTO SQL Injection Attempt"

• "GPL EXPLOIT echo command attempt"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- email.php id SELECT"

• "ET WEB_SPECIFIC_APPS RaXnet Cacti top_graph_header.php config Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x ASCII"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP id ASCII"

• "ET WEB_SPECIFIC_APPS 4images global.php db_servertype Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Apache Archive networkProxies script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp pass DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newwebsite UNION SELECT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php us UPDATE"

• "ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1"

• "ET WEB_SPECIFIC_APPS DirectNews uploadBigFiles.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- user.php email SELECT"

• "ET WEB_SPECIFIC_APPS TEDE Simplificado processaPesquisa.php script DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtUse UNION SELECT"

• "ET EXPLOIT Intex Router N-150 Cross-Site Request Forgery"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi INSERT"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp AlphaSort ASCII"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php lastname SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newname UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla DS-Syndicate Component feed_id SQL Injection"

• "ET WEB_SPECIFIC_APPS Horde XSS attempt passwd/main.php (2)"

• "ET WEB_SPECIFIC_APPS TurnkeyForms Local Classifieds listtest.php r parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newwebsite UPDATE"

• "ET WEB_SPECIFIC_APPS Group-Office comment_id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP Membership Site Manager Script key Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS millionpixel payment.php order_id XSS attempt"

• "ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id INSERT"

• "ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- dispimage.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS bbPress SQL Injection Attempt -- formatting-functions.php ASCII"

• "ET WEB_SPECIFIC_APPS Digitizing Quote And Ordering System SQL Injection Attempt -- search.asp ordernum SELECT"

• "ET WEB_SERVER PHP Generic Remote File Include Attempt (FTP)"

• "ET WEB_SPECIFIC_APPS Pranian Group e107 page Parameter Cross Site Scripting Vulnerability Attempt"

• "ET WEB_SPECIFIC_APPS Possible Zenoss Network Monitoring Application INTO OUTFILE SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ZyXEL P-660R-T1 HomeCurrent_Date Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Bookmark4U SQL Injection Attempt -- config.php sqlcmd INSERT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- index.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_pinboard option Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID SELECT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_recent.asp currentpage SELECT"

• "ET WEB_SERVER Bot Search RFI Scan (ByroeNet/Casper-Like sun4u)"

• "ET WEB_SPECIFIC_APPS Contra Haber Sistemi SQL Injection Attempt -- haber.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 DELETE"

• "ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity SELECT"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php user SELECT"

• "ET WEB_SPECIFIC_APPS 212cafe Board view.php qID Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Openads row Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- autherror.cfm errorcode DELETE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- changeannonce.php idannonce ASCII"

• "ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- down.asp id UNION SELECT"

• "ET WEB_SERVER FiercePhish Password Prompt Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Open Web Analytics owa_action Parameter Local File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserType DELETE"

• "ET WEB_SPECIFIC_APPS Keynect Ecommerce SQL Injection Attempt -- products.php ctf INSERT"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-8"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- news.php item UNION SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Copperleaf Photolog postid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php clickurl UPDATE"

• "ET WEB_SPECIFIC_APPS Flash Quiz question.php quiz Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi DELETE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP id INSERT"

• "ET WEB_SPECIFIC_APPS WordPress Copperleaf Photolog postid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) SQL Injection Attempt -- functions.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS fipsForum SQL Injection Attempt -- default2.asp kat UPDATE"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname SELECT"

• "ET WEB_SPECIFIC_APPS Calendar MX BASIC SQL Injection Attempt -- calendar_detail.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS Lotfian Request For Travel SQL Injection Attempt -- ProductDetails.asp PID UNION SELECT"

• "ET WEB_SERVER SQL Injection Select Sleep Time Delay"

• "ET WEB_SPECIFIC_APPS Super Link Exchange Script SQL Injection Attempt -- directory.php cat INSERT"

• "ET WEB_SPECIFIC_APPS Simple Web Content Management System SQL Injection Attempt -- page.php id SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp id DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp orderby ASCII"

• "ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id SELECT"

• "ET WEB_SPECIFIC_APPS Messageriescripthp SQL Injection Attempt -- lire-avis.php aa DELETE"

• "ET WEB_SPECIFIC_APPS MGB OpenSource Guestbook SQL Injection Attempt -- email.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery (CPG) SQL Injection Attempt -- thumbnails.php cpg131_fav ASCII"

• "ET WEB_SPECIFIC_APPS Celepar module for Xoops aviso.php codigo SQL injection"

• "ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id UPDATE"

• "ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- changeannonce.php idannonce INSERT"

• "ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user UNION SELECT"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- recipe.php recipeid UPDATE"

• "ET WEB_SPECIFIC_APPS Constructr CMS SQL Injection Attempt -- constructrXmlOutput.content.xml.php page_id INSERT"

• "ET WEB_SPECIFIC_APPS Noname Media Photo Galerie Standard SQL Injection Attempt -- view.php id DELETE"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtUse SELECT"

• "ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Barracuda Web Application Firewall 600 XSS attempt (backup_path)"

• "ET WEB_SPECIFIC_APPS QUICKTEAM qte_result.php title Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm newsId DELETE"

• "ET WEB_SPECIFIC_APPS WordPress Age Verification plugin redirect_to Parameter URI Redirection"

• "ET ACTIVEX Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (1)"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp sort SELECT"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids UPDATE"

• "ET WEB_SPECIFIC_APPS cpCommerce _functions.php GLOBALS Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x INSERT"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- index.cfm ASCII"

• "ET WEB_SPECIFIC_APPS LoCal Calendar System LIBDIR Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS vtiger CRM service parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php did INSERT"

• "ET ACTIVEX SoftCab Sound Converter ActiveX SaveFormat File overwrite Attempt"

• "ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page SELECT"

• "ET WEB_SPECIFIC_APPS zeeproperty adid Parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID UNION SELECT"

• "ET WEB_SPECIFIC_APPS BP Blog SQL Injection Attempt -- default.asp layout UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newemail INSERT"

• "ET EXPLOIT MMCS service (Big Endian)"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php sid DELETE"

• "ET WEB_SPECIFIC_APPS dB Masters Curium CMS SQL Injection Attempt -- news.php c_id ASCII"

• "ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id INSERT"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_aut DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- login.asp sent DELETE"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- update_profile.php username DELETE"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board katid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip UPDATE"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- artreplydelete.asp username UPDATE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp loc UNION SELECT"

• "ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity ASCII"

• "ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS DM Albums album.php SECURITY_FILE Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- gmail.php UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp orderby DELETE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP kid UPDATE"

• "ET WEB_SPECIFIC_APPS Maran PHP Shop id Parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp pass UNION SELECT"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UNION SELECT"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue ASCII"

• "ET WEB_SPECIFIC_APPS GeekLog filemgt UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php user UPDATE"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewReport.php bug SELECT"

• "ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script UNION SELECT SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php user_login_cookie UNION SELECT"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue DELETE"

• "ET WEB_SPECIFIC_APPS beLive arch.php arch Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- preferences.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_dshop Component UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- pfs.edit.inc.php ASCII"

• "ET WEB_SPECIFIC_APPS XOOPS Makale Module id SQL Injection"

• "ET WEB_SPECIFIC_APPS Hubscript PHPInfo Attempt"

• "ET WEB_SPECIFIC_APPS ASP ListPics SQL Injection Attempt -- listpics.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid ASCII"

• "ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- filecheck.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS e107 HANDLERS_DIRECTORY Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp did UPDATE"

• "ET WEB_SPECIFIC_APPS Tunngavik CMS id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- index.php blogid ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- content.php where UPDATE"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID INSERT"

• "ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex UNION SELECT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_categories.asp catID DELETE"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php by ASCII"

• "ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id UPDATE SET SQL Injection Attempt"

• "ET CURRENT_EVENTS ANTIBOT Phishing Panel Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page INSERT"

• "ET WEB_SPECIFIC_APPS Interactive Web Solutions site_info.php INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- news.php item UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_jphoto Component Id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Uploader download_launch.php Remote File Disclosure Attempt"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- meal_rest.asp mealid ASCII"

• "ET WEB_SPECIFIC_APPS Mambo N-Myndir UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick ASCII"

• "ET WEB_SERVER Possible Attempt to Get SQL Server Version in URI using SELECT VERSION"

• "ET WEB_SPECIFIC_APPS OpenX OpenFlashChart Remote Exploit Attempt"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp parentid UPDATE"

• "ET EXPLOIT TOTOLINK Router Cross-site Scripting CVE-2021-34228 (boafrm) M2"

• "ET WEB_SPECIFIC_APPS XRMS CRM workflow-activities.php include_directory Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp password INSERT"

• "ET WEB_SPECIFIC_APPS PMB Services id Parameter INSERT INTO SQL Injection Attempt"

• "ET EXPLOIT [ConnectWise CRU] Potential Sonicwall SRA SQLi (CVE-2019-7481)"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- printmain.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS WB News archive.php config Parameter Remote File Inclusion -1"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_forum INSERT"

• "ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id INSERT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_Type_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Fuzzylime Forum SQL Injection Attempt -- low.php topic ASCII"

• "ET WEB_SPECIFIC_APPS SiteGo get_templet.php of green Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Contenido idart Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS phpBB2 Plus SQL Injection Attempt -- admin_acronyms.php id INSERT"

• "ET WEB_SPECIFIC_APPS A6MamboHelpDesk Admin.a6mambohelpdesk.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- group.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_photoblog component category Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Shape Web Solutions imprimir.php UNION SELECT SQL Injection Attempt"

• "GPL EXPLOIT cmd? access"

• "ET WEB_SPECIFIC_APPS Hunkaray Duyuru Scripti SQL Injection Attempt -- oku.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery (CPG) SQL Injection Attempt -- thumbnails.php cpg131_fav INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 ASCII"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke viewslink module sid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Fuzzylime Forum SQL Injection Attempt -- low.php topic DELETE"

• "ET WEB_SPECIFIC_APPS Fullaspsite GeometriX Download Portal SQL Injection Attempt -- down_indir.asp id UPDATE"

• "ET WEB_SERVER MINI MO Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla com_jphoto Component Id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHPmyGallery lang parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Invision Community Blog Mod SQL Injection Attempt -- entry_reply_entry.php eid INSERT"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- admin.php uploadimage ASCII"

• "ET WEB_SPECIFIC_APPS ispCP Omega admin1.template.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Possible Joomla! Game Server Component 'id' Parameter SELECT FROM SQL Injection"

• "ET WEB_CLIENT Leaf PHPMailer Accessed on External Server"

• "ET WEB_SERVER /bin/tsh In URI Possible Shell Command Execution Attempt"

• "ET WEB_SERVER ColdFusion password.properties access"

• "ET WEB_SPECIFIC_APPS phpBB SQL Injection Attempt -- admin_hacks_list.php hack_id ASCII"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp show_id INSERT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- members.asp sent UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.register.inc.php DELETE"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp agentid UPDATE"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname DELETE"

• "ET WEB_SPECIFIC_APPS Openconstructor CMS keyword Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_view.asp articleID ASCII"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- list.php categoryid DELETE"

• "ET WEB_SERVER Possible DROP SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Bexfront sid Parameter UPDATE SET SQL Injection Attempt"

• "ET EXPLOIT Possible Microsoft SQL RCE Attempt (CVE-2020-0618)"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla Component Event Manager 1.5 (id) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Incapsula component Performance.php file XSS Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup INSERT"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- rating.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Apache Archive legacyArtifactPath script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- navigacija.php IDMeniGlavni UPDATE"

• "ET WEB_SPECIFIC_APPS LetoDMS lang Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id INSERT"

• "ET WEB_SPECIFIC_APPS PHP Labs JobSitePro SQL Injection Attempt -- search.php salary UPDATE"

• "ET EXPLOIT Possible ELEFANTE/ElephantBeetle WebShell Access Inbound"

• "ET WEB_SPECIFIC_APPS X-Ice News System SQL Injection Attempt -- devami.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserType ASCII"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- archives.php month INSERT"

• "ET WEB_SPECIFIC_APPS AWCM common.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- download_image.asp image_id INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice DELETE"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php ASCII"

• "ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla FaceBook Component face_id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp manufacturer INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! JBudgetsMagic 'bid' Parameter SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Hunkaray Duyuru Scripti SQL Injection Attempt -- oku.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Pre Podcast Portal tour.php id SQL Injection"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- group.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Real Estate Manager realestate-index.php cat_id SQL Injection"

• "ET WEB_SPECIFIC_APPS Job2C windetail.php adtype Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- DisplayResults.php iSearchID ASCII"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- giris.asp kullaniciadi DELETE"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- print.php id DELETE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- usermgr.php gid SELECT"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- recipe.php recipeid ASCII"

• "ET WEB_SPECIFIC_APPS Omegasoft SQL Injection Attempt -- OmegaMw7.asp INSERT"

• "ET WEB_SPECIFIC_APPS Pre Online Tests Generator Pro UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Fullaspsite Asp Hosting Sitesi SQL Injection Attempt -- windows.asp kategori_id INSERT"

• "ET WEB_SPECIFIC_APPS Cyphor show.php SQL injection attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Calendar SQL Injection Attempt -- user.php id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_jshop pid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nukesentinel.php SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp area UPDATE"

• "ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php SELECT"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentmail SELECT"

• "ET WEB_SPECIFIC_APPS OvBB admincp.php smilieid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank UNION SELECT"

• "ET WEB_SERVER Possible SQL Injection INTO OUTFILE Arbitrary File Write Attempt in HTTP URI"

• "ET EXPLOIT Possible Telerik UI CVE-2019-18935 File Upload Attempt M1"

• "ET WEB_SPECIFIC_APPS Omegasoft SQL Injection Attempt -- OmegaMw7.asp ASCII"

• "ET SCAN Havij SQL Injection Tool User-Agent Outbound"

• "ET WEB_SPECIFIC_APPS Joomla com_musicgallery Component Id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Project_ID ASCII"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i UPDATE"

• "ET SCAN PHP Attack Tool Morfeus F Scanner"

• "ET WEB_SPECIFIC_APPS Possible IBM Lotus Connections simpleSearch.do Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP kid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rapid Classified SQL Injection Attempt -- viewad.asp id ASCII"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- DocPay.w2b listDocPay ASCII"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- login.asp sent ASCII"

• "ET WEB_SPECIFIC_APPS OpenX OpenFlashChart Remote Exploit - possible Access to uploaded Files"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen DELETE"

• "ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp harf UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp area DELETE"

• "ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp area SELECT"

• "ET WEB_SPECIFIC_APPS PNphpBB2 admin_smilies.php ModName parameter Local File inclusion"

• "ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UPDATE"

• "ET WEB_SPECIFIC_APPS OTRS Installation Dialog (after auth) attempt"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp did INSERT"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- login.php login_username INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms UPDATE"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- printview.php topic ASCII"

• "ET WEB_SPECIFIC_APPS Nabopoll SQL Injection Attempt -- result.php surv DELETE"

• "ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user INSERT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp stock_number UPDATE"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp did UPDATE"

• "ET WEB_SPECIFIC_APPS phpBB2 Plus SQL Injection Attempt -- admin_acronyms.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album UNION SELECT"

• "ET WEB_SPECIFIC_APPS MindTouch Deki Wiki wgDekiPluginPath parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile ASCII"

• "ET WEB_SPECIFIC_APPS LushiWarPlaner SQL Injection Attempt -- register.php id INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice SELECT"

• "ET WEB_SPECIFIC_APPS PMB Services id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WB News SendFriend.php config Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_aut INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID DELETE"

• "ET WEB_SPECIFIC_APPS XAMPP xamppsecurity.phpp TEXT Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id UPDATE"

• "ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listfull.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- ldap.php SELECT"

• "ET WEB_SPECIFIC_APPS Joomla SQL Reports user_id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php comment UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- ipsearch.admin.php DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_zoomportfolio component UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp user INSERT"

• "ET WEB_SPECIFIC_APPS Fullaspsite GeometriX Download Portal SQL Injection Attempt -- down_indir.asp id INSERT"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php defaultLetter ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp orderby SELECT"

• "ET WEB_SPECIFIC_APPS Mahara query Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS My PHP Dating id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS PhreeBooks js_include.php form Parameter Cross Site Scripting Attempt 1"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- send_password_preferences.asp SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_mgm Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Component Ek rishta 2.10 - SQL Injection 3"

• "ET EXPLOIT [ConnectWise CRU] Potential Sonicwall SMA User-Level Authentication Bypass (sslvpnclient) (CVE-2021-20016)"

• "ET WEB_SERVER MongoDB Negated Parameter Server Side JavaScript Injection Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Compromised Internal Server"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 2"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler UPDATE"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp kullanici_ismi ASCII"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- content.asp sent SELECT"

• "ET EXPLOIT phpLDAPadmin LDAP Injection"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat ASCII"

• "ET WEB_SPECIFIC_APPS uniForum SQL Injection Attempt -- wbsearch.aspx DELETE"

• "ET WEB_SPECIFIC_APPS Xtreme ASP Photo Gallery SQL Injection Attempt -- displaypic.asp sortorder UPDATE"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- com_comment.php mcname SELECT"

• "ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- filecheck.php id DELETE"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action DELETE"

• "ET WEB_SPECIFIC_APPS X7 Chat mini.php help_file Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ScriptMate User Manager SQL Injection Attempt -- usermessages.asp mesid UNION SELECT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- okvalannonce.php idannonce INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa DELETE"

• "ET WEB_SPECIFIC_APPS Possible ZOHO ManageEngine ADSelfService Captcha Bypass Attempt"

• "ET WEB_SERVER ColdFusion scheduleedit access"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- register.asp UserUpdate ASCII"

• "ET WEB_SPECIFIC_APPS F5 Data Manager ViewInventoryErrorReport.do Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id UNION SELECT SQL Injection Attempt"

• "ET WEB_SERVER ImageMagick CVE-2016-3716 Move File Inbound (msl: + mvg)"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordOld UNION SELECT"

• "ET SCAN Tomcat Auth Brute Force attempt (manager)"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- search.asp search DELETE"

• "ET EXPLOIT Possible Telerik UI CVE-2019-18935 File Upload Attempt M2"

• "ET WEB_SPECIFIC_APPS phpMyAdmin Remote Code Execution Proof of Concept (c=)"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- index.php p_skin SELECT"

• "ET WEB_SPECIFIC_APPS Possible DoubleQlik RCE via Path Traversal (CVE-2023-41266)"

• "ET WEB_SPECIFIC_APPS Wordpress featurific-for-wordpress plugin snum parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum2.asp soruid UPDATE"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat UPDATE"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id ASCII"

• "ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Ban SQL Injection Attempt -- connexion.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID SELECT"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nukesentinel.php DELETE"

• "ET WEB_SERVER PHP Possible rar Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum.asp baslik SELECT"

• "ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id UPDATE"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- DocPay.w2b listDocPay SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserEmail ASCII"

• "ET WEB_SPECIFIC_APPS Invision Gallery SQL Injection Attempt -- post.php img UPDATE"

• "ET WEB_SPECIFIC_APPS Openfoncier avis.class.php script Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Potential Wordpress local file disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS PHP-Fusion mguser fotoalbum album_id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Tunngavik CMS id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp orderby ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- menu.php INSERT"

• "ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID ASCII"

• "ET WEB_SPECIFIC_APPS Mambo LaiThai SQL Injection Attempt -- mambo.php DELETE"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp author DELETE"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp page ASCII"

• "ET WEB_SPECIFIC_APPS F5 Data Manager DiagCaptureFileListActionBody.do capture parameter LFI Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- polls.php id SELECT"

• "ET WEB_SPECIFIC_APPS Possible Achievo userid= Variable UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP kid SELECT"

• "ET WEB_SPECIFIC_APPS Pligg check_url.php url parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS SaurusCMS captcha_image.php script Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- list.php categoryid INSERT"

• "ET WEB_SPECIFIC_APPS DMXReady Site Engine Manager SQL Injection Attempt -- index.asp mid ASCII"

• "ET WEB_SPECIFIC_APPS ACGVannu SQL Injection Attempt -- modif.html id_mod UPDATE"

• "ET WEB_SPECIFIC_APPS WebC.be Fichier_a_telecharger Parameter Local File Disclosure Attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- compare_product.php id SELECT"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php qid INSERT"

• "ET WEB_SPECIFIC_APPS Simplemachines view parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip ASCII"

• "ET WEB_SPECIFIC_APPS DS CMS DetailFile.php nFileId Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori INSERT"

• "ET WEB_SPECIFIC_APPS ViArt Shop Evaluation ajax_list_tree.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Dance Studio Manager dailyview.php date Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Fullaspsite ASP Hosting Site SQL Injection Attempt -- listmain.asp cat INSERT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_hdflvplayer Component id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_videogallery controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtUse ASCII"

• "ET WEB_SPECIFIC_APPS Aigaion ID Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php SELECT"

• "ET WEB_SPECIFIC_APPS T-Content Management System id_novedad Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Vizayn Haber SQL Injection Attempt -- haberdetay.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php id DELETE"

• "ET CURRENT_EVENTS Wordpress timthumb look-alike domain list RFI"

• "ET WEB_SPECIFIC_APPS ProNews SQL Injection Attempt -- lire-avis.php aa UNION SELECT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- download_image.asp image_id UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress WP Survey and Quiz Tool plugin rowcount Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Component com_jbook (Itemid) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php password SELECT"

• "ET WEB_SPECIFIC_APPS Ideal MooFAQ Joomla Component file_includer.php file Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue INSERT"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile INSERT"

• "ET WEB_SPECIFIC_APPS vBSupport SQL Injection Attempt -- vBSupport.php INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_job Component id_job Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress The-Welcomizer plugin page parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Vt-Forum Lite SQL Injection Attempt -- vf_memberdetail.asp user DELETE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- okvalannonce.php idannonce ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Nuke FriendSend module sid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php category_id UPDATE"

• "ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS WHMCompleteSolution templatefile Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS BP Blog SQL Injection Attempt -- default.asp layout ASCII"

• "ET WEB_SPECIFIC_APPS Ultrize TimeSheet timesheet.php include_dir Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS F5 Data Manager ViewSatReport.do Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Blog SQL Injection Attempt -- displayCalendar.asp date DELETE"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp menuSelect SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin UNION SELECT"

• "ET WEB_SPECIFIC_APPS ASP SiteWare autoDealer SQL Injection Attempt -- detail.asp iPro ASCII"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_id SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress Easy Stats plugin homep Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- usermgr.php gid INSERT"

• "ET WEB_SPECIFIC_APPS Ublog Reload SQL Injection Attempt -- badword.asp INSERT"

• "ET WEB_SPECIFIC_APPS X-Ice News System SQL Injection Attempt -- devami.asp id DELETE"

• "ET WEB_SERVER WSO 2.6 Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi SELECT"

• "ET WEB_CLIENT Generic Cpanel Cracker Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Copperleaf Photolog postid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager eventmon_wrapper.jsp Reflective XSS Attempt"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- admin.php uploadimage UNION SELECT"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- search.asp search UPDATE"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Invision Gallery SQL Injection Attempt -- post.php img DELETE"

• "ET WEB_SPECIFIC_APPS Joomla jwmmxtd Component mosConfig_absolute_path Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php country ASCII"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php sid UPDATE"

• "ET WEB_SPECIFIC_APPS Flash Quiz high_score.php quiz Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS CafeEngine id Remote SQL Injection (menu.php)"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vin SELECT"

• "ET WEB_SPECIFIC_APPS Rapid Classified SQL Injection Attempt -- viewad.asp id DELETE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp harf ASCII"

• "ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Unique Ads (UDS) SQL Injection Attempt -- banner.php bid ASCII"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) Lite SQL Injection Attempt -- pms.php pmid UPDATE"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer SELECT"

• "ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id INSERT"

• "ET WEB_SPECIFIC_APPS dB Masters Curium CMS SQL Injection Attempt -- news.php c_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newmessage INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php lastname ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp INSERT"

• "ET WEB_SPECIFIC_APPS WeBid cron.php include_path Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid ASCII"

• "ET WEB_SPECIFIC_APPS asaher pro view_blog_archives.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm categoryid UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- polls.php id INSERT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_Type_ID DELETE"

• "ET ACTIVEX winhlp32 ActiveX control attack - phase 2"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- slideshow.asp ci DELETE"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Minerva mod SQL Injection Attempt -- forum.php c INSERT"

• "ET WEB_SPECIFIC_APPS Flash Quiz answers.php quiz Parameter SQL Injection"

• "ET WEB_SERVER Magento XMLRPC-Exploit Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php boardids UPDATE"

• "ET WEB_SPECIFIC_APPS Invision Community Blog Mod SQL Injection Attempt -- entry_reply_entry.php eid UPDATE"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname UNION SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php email SELECT"

• "ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName INSERT"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- res_details.asp resid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname UPDATE"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- order-track.php orderNo INSERT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- mesajkutum.asp mesajno UPDATE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- send_password_preferences.asp ASCII"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php login UPDATE"

• "ET WEB_SPECIFIC_APPS phpSkelSite TplSuffix parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php cid UNION SELECT"

• "ET WEB_CLIENT Generic Website Ransomnote Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp sifre DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_recent.asp currentpage UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php cat_id DELETE"

• "ET WEB_SPECIFIC_APPS KingCMS menu.php CONFIG Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp currentpage SELECT"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-2"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publications_list.asp vjob INSERT"

• "ET WEB_SERVER ColdFusion Path Traversal (locale 2/5)"

• "ET WEB_SPECIFIC_APPS JCE Joomla Extension"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- email.php id DELETE"

• "ET WEB_SPECIFIC_APPS WordPress Simple Download Button Shortcode Plugin Arbitrary File Disclosure Vulnerability"

• "ET WEB_SPECIFIC_APPS Website Baker SQL Injection Attempt -- eWebQuiz.asp QuizID DELETE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP kid DELETE"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick DELETE"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "GPL WEB_SERVER perl post attempt"

• "ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_dshop Component DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- ipsearch.admin.php UPDATE"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- default.asp page UPDATE"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp sifre INSERT"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- detail.php id SELECT"

• "ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID UNION SELECT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Possible IBM BladeCenter Management Module power_management_policy_options.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php cat_id DELETE"

• "ET WEB_SPECIFIC_APPS Possible IBM BladeCenter Management Module ipmi_bladestatus.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_acooldebate controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- DocPay.w2b listDocPay UNION SELECT"

• "ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare ASCII"

• "ET WEB_SPECIFIC_APPS MODx CMS snippet.reflect.php reflect_base Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Ixprim SQL Injection Attempt -- ixm_ixpnews.php story_id INSERT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword ASCII"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla intuit component intuit.php approval Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen UPDATE"

• "ET WEB_SPECIFIC_APPS Quantum Game Library server_request.php CONFIG Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course UPDATE"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup DELETE"

• "ET WEB_SPECIFIC_APPS TEDE Simplificado processaPesquisa.php script UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS dB Masters Curium CMS SQL Injection Attempt -- news.php c_id INSERT"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- sections.php text SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp listing_price UNION SELECT"

• "ET WEB_SPECIFIC_APPS PEAR include_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp user DELETE"

• "ET WEB_SPECIFIC_APPS AJ Forum SQL Injection Attempt -- topic_title.php td_id ASCII"

• "ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id INSERT"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp did SELECT"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php url ASCII"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php topic_id DELETE"

• "ET WEB_SPECIFIC_APPS Adiscon LogAnalyzer viewid Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Xt-News SQL Injection Attempt -- show_news.php id_news UPDATE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- albmgr.php cat SELECT"

• "ET WEB_SPECIFIC_APPS Cisco Prime Infrastruture RCE - CVE-2019-1821"

• "ET WEB_SPECIFIC_APPS Group-Office comment_id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS gravity-gtd rpc.php objectname parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- preferences.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp uid SELECT"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen ASCII"

• "ET WEB_SPECIFIC_APPS Oxygen (O2PHP Bulletin Board) SQL Injection Attempt -- viewthread.php pid SELECT"

• "ET WEB_SPECIFIC_APPS Autos catid SQL Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid SELECT"

• "ET WEB_SPECIFIC_APPS Invision Gallery SQL Injection Attempt -- post.php img ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php INSERT"

• "ET WEB_SPECIFIC_APPS Bookmark4U SQL Injection Attempt -- config.php sqlcmd UNION SELECT"

• "ET WEB_SPECIFIC_APPS mySeatXT SQL Injection Attempt autocomplete.php field INSERT"

• "ET WEB_SPECIFIC_APPS Mambo LaiThai SQL Injection Attempt -- mambo.php INSERT"

• "ET WEB_SPECIFIC_APPS Barracuda Web Application Firewall 600 XSS attempt (backup_server)"

• "ET WEB_CLIENT Generic Mini Webshell Accessed on External Compromised Server"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 4"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- detail.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex INSERT"

• "ET WEB_SPECIFIC_APPS WordPress CataBlog plugin category Cross-Site Scripting Attempt"

• "ET EXPLOIT Possible Local Active Directory Federation Services (AD FS) Replication Attempt"

• "ET WEB_SPECIFIC_APPS Built2go Real Estate Listings event_id SQL Injection"

• "ET WEB_SPECIFIC_APPS V-EVA Classified Script clsid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_blog Component id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS BP Blog SQL Injection Attempt -- default.asp layout SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- journal.php w SELECT"

• "ET EXPLOIT Possible CVE-2017-12629 XXE Exploit Attempt (URI)"

• "ET EXPLOIT Possible Microsoft Exchange Server OWA GetWacUrl Information Disclosure Attempt (CVE-2020-17143)"

• "ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (3)"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Flash Gallery wordpress plugin SQL Injection Attempt -- massedit_album.php gall_id UPDATE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- albmgr.php cat ASCII"

• "ET WEB_SPECIFIC_APPS myEvent viewevent.php SQL Injection"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp category ASCII"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- dlwallpaper.php wallpaperid ASCII"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp stock_number ASCII"

• "ET EXPLOIT NB8-02 - Possible Unauthed RCE via nbbsdtar"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vehicleID UPDATE"

• "ET WEB_SPECIFIC_APPS Fatwiki monatsblatt.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip SELECT"

• "ET WEB_SPECIFIC_APPS Possible Novell eDirectory 'dconserv.dlm' Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS JoomSocial AvatarUpload RCE"

• "ET WEB_SPECIFIC_APPS mySeatXT SQL Injection Attempt autocomplete.php field ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_fundhelp controller Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) SQL Injection Attempt -- functions.php id DELETE"

• "ET WEB_SPECIFIC_APPS Minerva mod SQL Injection Attempt -- forum.php c UPDATE"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- detail.asp property_id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla Component joomlaXplorer admin.joomlaxplorer.php File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Fullaspsite GeometriX Download Portal SQL Injection Attempt -- down_indir.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp Keyword DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Site Engine Manager SQL Injection Attempt -- index.asp mid DELETE"

• "ET WEB_SPECIFIC_APPS Calendar MX BASIC SQL Injection Attempt -- calendar_detail.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID INSERT"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID ASCII"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 ASCII"

• "ET WEB_SPECIFIC_APPS Bluetrait SQL Injection Attempt -- bt-trackback.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS joomla com_jstore controller parameter Local File Inclusion vulnerability"

• "ET WEB_SPECIFIC_APPS Serendipity SQL Injection Attempt -- index.php serendipity SELECT"

• "ET WEB_SPECIFIC_APPS SiteGo OpenFolder parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php us ASCII"

• "ET WEB_SPECIFIC_APPS Joomla Component com_acmis (Itemid) SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Nicola Asuni All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_functions_downloads.php download_category ASCII"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp sale_type SELECT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php Itemid UNION SELECT"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_show.asp id2006quant INSERT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- printarticle.asp ASCII"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php sk DELETE"

• "ET WEB_SPECIFIC_APPS Super Link Exchange Script SQL Injection Attempt -- directory.php cat SELECT"

• "ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID DELETE"

• "ET WEB_SPECIFIC_APPS Manage Engine Service Desk Plus WorkOrder.do UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! Survey Manager Component DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS SoftMP3 search Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Bookmark4U SQL Injection Attempt -- config.php sqlcmd UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp Keyword SELECT"

• "ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) (Content-Disposition) M1"

• "ET WEB_SPECIFIC_APPS SuperNews valor.php noticia Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Wordpress Plugin PICA Photo Gallery imgname parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS pHNews comments.php templates_dir Local File Inclusion"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Project_ID SELECT"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_joaktree Component treeId Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat ASCII"

• "ET WEB_SPECIFIC_APPS Informacion General informacion_general.php SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- table_broken.php lid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- printarticle.asp SELECT"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp agent UPDATE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Blog SQL Injection Attempt -- displayCalendar.asp date UNION SELECT"

• "ET WEB_SPECIFIC_APPS Digitizing Quote And Ordering System SQL Injection Attempt -- search.asp ordernum UPDATE"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp parola SELECT"

• "ET WEB_SPECIFIC_APPS Bluetrait SQL Injection Attempt -- bt-trackback.php DELETE"

• "ET WEB_SPECIFIC_APPS AjaxPortal ajaxp_backend.php page Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS WordPress Vodpod Video Gallery Plugin gid Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Design4Online UserPages2 SQL Injection Attempt -- page.asp art_id DELETE"

• "ET WEB_SPECIFIC_APPS Lotfian Request For Travel SQL Injection Attempt -- ProductDetails.asp PID SELECT"

• "ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vin UPDATE"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i SELECT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- fiche_membre.php idmembre ASCII"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php country INSERT"

• "ET WEB_SPECIFIC_APPS Vt-Forum Lite SQL Injection Attempt -- vf_memberdetail.asp user ASCII"

• "ET WEB_SPECIFIC_APPS Zimplit CMS client Parameter Cross Site Scripting Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user SELECT"

• "ET WEB_SPECIFIC_APPS ZABBIX locales.php srclang Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id DELETE"

• "ET WEB_SERVER SmailMax PHPMailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentmail DELETE"

• "ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid UNION SELECT"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action INSERT"

• "ET SCAN Simple Slowloris Flooder"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- printview.php topic SELECT"

• "ET WEB_SPECIFIC_APPS 724CMS section.php Module Parameter Local File inclusion Attempt"

• "ET WEB_CLIENT Generic Mailer Check Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Horde XSS attempt test.php (2)"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID SELECT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id ASCII"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Invalid/Suspicious User-Agent (PHP)"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_show.asp id2006quant UNION SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- block-Old_Articles.php cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS OvBB admincp.php smilieid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS T-Content Management System id_novedad Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_picasa2gallery controller parameter Local File Inclusion vulnerability"

• "ET WEB_CLIENT Possible HTTP 406 XSS Attempt (External Source)"

• "ET WEB_SPECIFIC_APPS Okul Web Otomasyon Sistemi SQL Injection Attempt -- etkinlikbak.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Bluetrait SQL Injection Attempt -- bt-trackback.php ASCII"

• "ET WEB_SPECIFIC_APPS Hubscript XSS Attempt"

• "ET WEB_SERVER Possible AntSword Webshell Commands Inbound"

• "ET WEB_SERVER Generic Webshell Accessed on Compromised Internal Server"

• "ET WEB_SERVER Suspected Webshell directory listing Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php INSERT"

• "ET WEB_SPECIFIC_APPS Easypush Server Manager addressbook.cgi page Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! JBudgetsMagic 'bid' Parameter UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- autherror.cfm errorcode UPDATE"

• "ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid SELECT"

• "ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT"

• "ET WEB_SPECIFIC_APPS digiSHOP cart.php INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS eNdonesia artid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla SQL Reports user_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS V-EVA Classified Script clsid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP phpMyAgenda rootagenda Remote File Include Attempt"

• "ET WEB_SPECIFIC_APPS WordPress LiveGrounds plugin uid parameter Cross-Site Script Attempt"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 14"

• "ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines ASCII"

• "ET WEB_SERVER Possible Cisco ASA Appliance Clientless SSL VPN HTML Rewriting Security Bypass Attempt/Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS QuickTeam qte_init.php qte_root Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id ASCII"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php newsid UNION SELECT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp orderby UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- content.php where UNION SELECT"

• "ET WEB_SPECIFIC_APPS Zabbix popup.php UNION SELECT SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- list.php categoryid UPDATE"

• "ET WEB_SPECIFIC_APPS Apache Archive confirmDeleteRepository script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS bizdir.cgi f_srch Parameter Cross Site Scripting Attempt"

• "ET WEB_CLIENT FiercePhish Password Prompt Accessed on External Server"

• "ET WEB_SPECIFIC_APPS WarHound General Shopping Cart SQL Injection Attempt -- item.asp ItemID SELECT"

• "ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php ASCII"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php so UNION SELECT"

• "ET WEB_SPECIFIC_APPS Autonomous LAN Party _bot.php master Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php DELETE"

• "ET WEB_SPECIFIC_APPS SaurusCMS com_del.php class_path Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php defaultLetter INSERT"

• "ET WEB_SPECIFIC_APPS Mambo N-Myndir INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php image_id UPDATE"

• "ET EXPLOIT Stored XSS Vulnerability CVE-2021-31250 M2"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp typ ASCII"

• "ET WEB_SPECIFIC_APPS Fork-CMS js.php module parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS asaher pro view_messages.php row_y5_site_configuration Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Wordpress Plugin Page Flip Image Gallery getConfig.php book_id parameter Remote File Disclosure"

• "ET WEB_SPECIFIC_APPS AlstraSoft AskMe que_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS aFAQ SQL Injection Attempt -- faqDsp.asp catcode DELETE"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- register.asp UserUpdate DELETE"

• "ET WEB_SPECIFIC_APPS Keynect Ecommerce SQL Injection Attempt -- products.php ctf ASCII"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php name UPDATE"

• "ET WEB_SPECIFIC_APPS Basebuilder main.inc.php mj_config Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) Lite SQL Injection Attempt -- pms.php pmid SELECT"

• "ET WEB_SPECIFIC_APPS Guo Xu Guos Posting System (GPS) SQL Injection Attempt -- print.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid UPDATE"

• "ET WEB_SPECIFIC_APPS Contra Haber Sistemi SQL Injection Attempt -- haber.asp id SELECT"

• "ET WEB_SPECIFIC_APPS PSY Auction SQL Injection Attempt -- item.php id DELETE"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup UNION SELECT"

• "ET WEB_SPECIFIC_APPS LI-Guestbook SQL Injection Attempt -- guestbook.php country DELETE"

• "ET WEB_SPECIFIC_APPS Hazir Site SQL Injection Attempt -- giris_yap.asp sifre ASCII"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp secondgroup UNION SELECT"

• "ET EXPLOIT TOTOLINK Router Cross-site Scripting CVE-2021-34228 (boafrm) M3"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtPas SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS PHP-Nuke FriendSend module sid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SERVER Cisco IOS HTTP Server Exec Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines UPDATE"

• "ET WEB_SPECIFIC_APPS Bexfront sid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid ASCII"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php language INSERT"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen INSERT"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! Survey Manager Component SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Orbis editor-body.php script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- sendarticle.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Serendipity SQL Injection Attempt -- index.php serendipity DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php topic_id ASCII"

• "ET WEB_SPECIFIC_APPS WordPress XCloner Plugin index2.php option Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DEDECMS feedback_js.php arcurl Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Potential Wordpress local file disclosure vulnerability"

• "ET WEB_CLIENT Generic Email Spoofing Tool Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer DELETE"

• "ET WEB_SPECIFIC_APPS VP-ASP Shopping Cart SQL Injection Attempt -- shopgiftregsearch.asp LoginLastname INSERT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- print.php news_id UPDATE"

• "ET WEB_SPECIFIC_APPS Wordpress Zingiri webshop plugin Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Vizayn Haber SQL Injection Attempt -- haberdetay.asp id DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp l INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid SELECT"

• "GPL EXPLOIT iissamples access"

• "ET WEB_SPECIFIC_APPS Joomla techfolio component SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Okul Web Otomasyon Sistemi SQL Injection Attempt -- etkinlikbak.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP kid ASCII"

• "ET WEB_SPECIFIC_APPS Mambo AHS Shop component DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm newsId UNION SELECT"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue UNION SELECT"

• "ET WEB_SPECIFIC_APPS PSY Auction SQL Injection Attempt -- item.php id INSERT"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Podcast Generator themes.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php imageurl ASCII"

• "ET WEB_SERVER WSO 2.6 Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- print.php id UPDATE"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i INSERT"

• "ET WEB_SPECIFIC_APPS AJ Forum SQL Injection Attempt -- topic_title.php td_id SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID SELECT"

• "ET WEB_SPECIFIC_APPS Oracle Event Processing FileUploadServlet Arbitrary File Upload"

• "ET WEB_SPECIFIC_APPS Invision Gallery SQL Injection Attempt -- post.php img UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress Plugins Wp-ImageZoom file parameter Remote File Disclosure Vulnerability"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user UPDATE"

• "ET WEB_SERVER Possible HTTP 500 XSS Attempt (Internal Source)"

• "ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php cid SELECT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php ps ASCII"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- save.php groupAddName DELETE"

• "ET ACTIVEX Awingsoft Web3D Player Remote Buffer Overflow"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-5"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- detail.asp p DELETE"

• "ET WEB_SPECIFIC_APPS Joomla Seyret Video com_seyret Component Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla techfolio component DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php email ASCII"

• "ET WEB_SPECIFIC_APPS EZPX photoblog tpl_base_dir Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Mole viewsource.php fname Parameter Local File Inclusion"

• "ET WEB_SERVER Possible INSERT VALUES SQL Injection Attempt"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php cid INSERT"

• "ET WEB_SPECIFIC_APPS MassMirror Uploader example_1.php Remote File Inclusion attempt"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- index.php p_skin ASCII"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php product_id SELECT"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php did DELETE"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nsbypass.php UPDATE"

• "ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid INSERT"

• "ET WEB_SPECIFIC_APPS PHP-Fusion mguser fotoalbum album_id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp password SELECT"

• "ET WEB_SPECIFIC_APPS GlobalMegaCorp dvddb SQL Injection Attempt -- common.php user DELETE"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- logon_user.php username DELETE"

• "ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp show_id DELETE"

• "ET WEB_SPECIFIC_APPS gCards SQL Injection Attempt -- getnewsitem.php newsid DELETE"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- product.asp productid UPDATE"

• "ET WEB_SPECIFIC_APPS Wikiwig spell-check-savedicts.php to_r_list Parameter Cross Site Scripting Attempt"

• "ET WEB_SERVER Apache Tomcat Boundary Overflow DOS/File Upload Attempt"

• "ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid INSERT"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php url ASCII"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- product.asp productid DELETE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP kid DELETE"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat INSERT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php category_id DELETE"

• "ET WEB_SPECIFIC_APPS ContentNow SQL Injection Attempt -- index.php pageid ASCII"

• "ET EXPLOIT Lexmark Printer RDYMSG Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- polls.php id ASCII"

• "ET WEB_SPECIFIC_APPS wordpress thecartpress plugin loop parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp UNION SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- user.php email UPDATE"

• "ET WEB_SPECIFIC_APPS WP Forum Server wordpress plugin SQL Injection Attempt -- feed.php topic UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_zoomportfolio component UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Possible WP Plug-in MailPoet Arbitrary File Upload/Auth Bypass Vulnerability"

• "ET WEB_SPECIFIC_APPS Calendar MX BASIC SQL Injection Attempt -- calendar_detail.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Informacion General informacion_general.php DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- down.asp id UPDATE"

• "ET WEB_SERVER ATTACKER WebShell - PHP Offender - POST Command"

• "ET WEB_SPECIFIC_APPS Xt-News SQL Injection Attempt -- show_news.php id_news DELETE"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- dlwallpaper.php wallpaperid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_zoomportfolio component DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id ASCII"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite UPDATE"

• "ET WEB_SERVER Suspected Webshell wmic Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Joomla mojoBlog wp-comments-post.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHP Labs JobSitePro SQL Injection Attempt -- search.php salary UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Community Builder Enhenced Component Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ECShop user.php order_sn Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla Component com_jphone Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserType SELECT"

• "ET WEB_SPECIFIC_APPS Nicola Asuni All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_functions_downloads.php download_category UNION SELECT"

• "ET WEB_SPECIFIC_APPS aFAQ SQL Injection Attempt -- faqDsp.asp catcode ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id ASCII"

• "ET WEB_SERVER PHP Generic Remote File Include Attempt (HTTPS)"

• "ET WEB_SPECIFIC_APPS RealtyListings type.asp iType Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp stock_number SELECT"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp author SELECT"

• "ET WEB_SPECIFIC_APPS AWCM window_top.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Messageriescripthp SQL Injection Attempt -- lire-avis.php aa ASCII"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php Itemid DELETE"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer ASCII"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- giris.asp kullaniciadi UPDATE"

• "ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UNION SELECT"

• "ET WEB_SPECIFIC_APPS Campsite article_id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php comment ASCII"

• "ET WEB_SPECIFIC_APPS WarHound General Shopping Cart SQL Injection Attempt -- item.asp ItemID DELETE"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- cat.asp cat ASCII"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php category_id DELETE"

• "ET WEB_SPECIFIC_APPS PEAR_PHPDIR Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- printmain.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla EZ Realty id Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS OrangeHRM recruitcode parameter Cross Site Script Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php UPDATE"

• "ET WEB_SPECIFIC_APPS Plogger phpThumb.php src Parameter Remote File Disclosure Attempt"

• "ET WEB_SERVER Possible HTTP 401 XSS Attempt (Local Source)"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x UNION SELECT"

• "ET WEB_SPECIFIC_APPS mcRefer SQL Injection Attempt -- install.php bgcolor DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php UPDATE"

• "ET WEB_SPECIFIC_APPS Thyme export.php export_to Parameter Local File Inclusion"

• "ET WEB_SERVER Possible Barracuda IM Firewall smtp_test.cgi Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat ASCII"

• "ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- letterman.class.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Oracle E-Business Suite Financials jtfwcpnt.jsp SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- inc_secureloginmanager.asp sent SELECT"

• "ET WEB_SPECIFIC_APPS QuickTeam qte_web.php qte_web_path Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews DELETE"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS DirectNews class.panier_article.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Newsletter MX SQL Injection Attempt -- admin_mail_adressee.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Dolibarr ERP CRM PHP Code Injection"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php cid INSERT"

• "ET WEB_SPECIFIC_APPS Ixprim SQL Injection Attempt -- ixm_ixpnews.php story_id UPDATE"

• "ET WEB_SPECIFIC_APPS MAXcms fm_includes_special Parameter Remote File Inclusion Attempt"

• "GPL EXPLOIT ISAPI .ida attempt"

• "ET WEB_SPECIFIC_APPS Super Link Exchange Script SQL Injection Attempt -- directory.php cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M1"

• "ET WEB_SPECIFIC_APPS OvBB admincp.php smilieid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_view.asp articleID SELECT"

• "ET WEB_SPECIFIC_APPS PowerNews news.php newsid parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- list.php categoryid SELECT"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php pid DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_cat_id SELECT"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie UPDATE"

• "ET WEB_SPECIFIC_APPS VP-ASP Shopping Cart SQL Injection Attempt -- shopgiftregsearch.asp LoginLastname DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php INSERT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Design4Online UserPages2 SQL Injection Attempt -- page.asp art_id INSERT"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp id DELETE"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick UPDATE"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- compare_product.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- detail.asp p UNION SELECT"

• "ET WEB_SPECIFIC_APPS GDL gdl.php node Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID SELECT"

• "ET WEB_SPECIFIC_APPS Nucleus action.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp pass UNION SELECT"

• "ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete ASCII"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- table_broken.php lid DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Online Web Building SQL Injection Attempt -- page.asp art_id UPDATE"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress WP Publication file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Nabopoll SQL Injection Attempt -- result.php surv SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_bit controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordNew INSERT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- voirannonce.php no SELECT"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp kullanici ASCII"

• "ET WEB_SERVER PIWIK Backdoored Version calls home"

• "ET WEB_SPECIFIC_APPS fipsForum SQL Injection Attempt -- default2.asp kat ASCII"

• "ET WEB_SPECIFIC_APPS WP Forum Server wordpress plugin SQL Injection Attempt -- feed.php topic DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Fusion mguser fotoalbum album_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp kullanici INSERT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 31"

• "ET WEB_SPECIFIC_APPS Hedgehog CMS header.php c_temp_path Local File Inclusion"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php id INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_universal Component Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Possible Adobe Flex SDK index.template.html Cross Site Scripting Attempt"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 9"

• "ET WEB_SPECIFIC_APPS PHP-Nuke viewslink module sid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- members.asp sent UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_jvb_bridge Itemid Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewReport.php bug UNION SELECT"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp maingroup INSERT"

• "ET WEB_SPECIFIC_APPS vBulletin vBTube uname Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp uid INSERT"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php ipadd INSERT"

• "ET WEB_SPECIFIC_APPS Newsletter MX SQL Injection Attempt -- admin_mail_adressee.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_jshop pid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php country UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpRS id parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- sendarticle.asp UPDATE"

• "ET WEB_CLIENT WSO 2.6 Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Vt-Forum Lite SQL Injection Attempt -- vf_memberdetail.asp user SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp area INSERT"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS BasicForum SQL Injection Attempt -- edit.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- thumbnails.asp ci INSERT"

• "ET WEB_SPECIFIC_APPS phpMiniAdmin db Parameter Cross Site Scripting Attempt"

• "ET WEB_SERVER Suspected Webshell Activity (Inbound)"

• "ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UNION SELECT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_recent.asp currentpage UPDATE"

• "ET WEB_SPECIFIC_APPS pliggCMS src parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Component com_xmovie file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS T-Content Management System id_novedad Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS Possible Achievo userid= Variable INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS joomla com_djcatalog component SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Ektron CMS400.NET reterror.aspx info Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_recent.asp currentpage DELETE"

• "ET SCAN DominoHunter Security Scan in Progress"

• "ET WEB_SPECIFIC_APPS SFS EZ BIZ PRO track.php id Parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php imageurl SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress Plugin Newsletter data parameter Local File Inclusion vulnerability"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp SELECT"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php user_login_cookie ASCII"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php comment INSERT"

• "ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Zotpress citation Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- sections.php text DELETE"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- artreplydelete.asp username UNION SELECT"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp author UNION SELECT"

• "ET WEB_SPECIFIC_APPS Mole viewsource.php dirn Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id DELETE"

• "ET WEB_SPECIFIC_APPS Immophp secteur parameter Cross Site Scripting Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS PHPNuke SQL injection attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP id SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp uid UPDATE"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- a_register.asp DELETE"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp state ASCII"

• "ET WEB_SPECIFIC_APPS Wordpress yousaytoo-auto-publishing plugin submit Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- logon_user.php username INSERT"

• "ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Flash Gallery wordpress plugin SQL Injection Attempt -- massedit_album.php gall_id INSERT"

• "ET WEB_SPECIFIC_APPS SERWeb load_lang.php configdir Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS aFAQ SQL Injection Attempt -- faqDsp.asp catcode SELECT"

• "ET WEB_SPECIFIC_APPS NetClassifieds Premium Edition SQL Injection Attempt -- ViewCat.php s_user_id INSERT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php clickurl ASCII"

• "ET WEB_SPECIFIC_APPS Open Web Analytics owa_do Parameter Local File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS LushiNews SQL Injection Attempt -- comments.php id DELETE"

• "ET WEB_SPECIFIC_APPS ASPApps.com Template Creature media_level.asp mcatid parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla! Soundset Component 'cat_id' Parameter UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid DELETE"

• "ET WEB_SPECIFIC_APPS VBulletin 4.0.1 SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- viewlinks.asp CategoryID ASCII"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id ASCII"

• "ET WEB_SPECIFIC_APPS WebPhotoPro rub.php idr Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Softwebs Nepal Ananda Real Estate SQL Injection Attempt -- list.asp agent UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpDatingClub website.php page Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- recipe.php recipeid UNION SELECT"

• "ET WEB_SPECIFIC_APPS ContentNow SQL Injection Attempt -- index.php pageid UPDATE"

• "ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user ASCII"

• "ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity UPDATE"

• "ET WEB_SERVER WEBSHELL K-Shell/ZHC Shell 1.0/Aspx Shell Backdoor NetCat_Listener"

• "ET WEB_SPECIFIC_APPS W-Agora search.php bn Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery (CPG) SQL Injection Attempt -- thumbnails.php cpg131_fav UNION SELECT"

• "ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album UPDATE"

• "ET WEB_SPECIFIC_APPS Absolute Image Gallery SQL Injection Attempt -- gallery.asp categoryid INSERT"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id UPDATE"

• "ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk INSERT"

• "ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid INSERT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vehicleID ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board katid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php position UPDATE"

• "ET WEB_SPECIFIC_APPS Barracuda Web Application Firewall 600 XSS attempt (backup_username)"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp agentid UNION SELECT"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_downloads.php did UNION SELECT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php category_id UPDATE"

• "ET WEB_SPECIFIC_APPS pfile file.php id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- category.php catid UPDATE"

• "ET WEB_SPECIFIC_APPS PHPKit SQL Injection Attempt -- include.php catid DELETE"

• "ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp model INSERT"

• "ET WEB_SPECIFIC_APPS Acute Control Panel container.php theme_directory parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.php id SELECT"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newemail SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php imageurl INSERT"

• "ET WEB_SPECIFIC_APPS Sepcity Lawyer Portal deptdisplay.asp ID parameter SQL Injection"

• "ET WEB_SERVER Likely Malicious Request for /proc/self/environ"

• "ET WEB_SPECIFIC_APPS Cacti SQL Injection Vulnerability tree.php leaf_id INSERT"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nukesentinel.php ASCII"

• "ET WEB_SPECIFIC_APPS WEB-PHP RCE PHPBB 2004-1315"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_authorization.php xuser_name UPDATE"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp id INSERT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp sale_type UNION SELECT"

• "ET WEB_SPECIFIC_APPS SimpleInvoices having parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Blog SQL Injection Attempt -- displayCalendar.asp date UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla Component com_kkcontent Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php f SELECT"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp kullanici SELECT"

• "ET WEB_SPECIFIC_APPS Nagios XI view parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- DocPay.w2b listDocPay UPDATE"

• "ET WEB_SPECIFIC_APPS ReVou Micro Blogging user_updates.php user Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_code UPDATE"

• "ET WEB_SPECIFIC_APPS x10 Automatic MP3 Script layout_lyrics.php web_root Parameter Local file Inclusion"

• "ET CURRENT_EVENTS Apple Phishing Panel Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php imageurl UPDATE"

• "ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id INSERT"

• "ET EXPLOIT Attempted ThinkPHP < 5.2.x RCE Inbound (CVE-2018-20062)"

• "ET WEB_SPECIFIC_APPS iScripts MultiCart orderid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp cat UNION SELECT"

• "ET WEB_SERVER Possible Perl Shell in HTTP POST"

• "ET WEB_SPECIFIC_APPS SFS EZ Hotscripts-like Site software-description.php id Parameter SQL Injection"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Joomla com_hdflvplayer Component id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Calendar SQL Injection Attempt -- user.php id DELETE"

• "ET WEB_SPECIFIC_APPS WordPress PHP Speedy Plugin page Parameter Local File Inclusion Attempt"

• "ET WEB_SERVER Possible HTTP 406 XSS Attempt (Local Source)"

• "ET EXPLOIT Cisco ASA XSS Attempt (CVE-2020-3580)"

• "ET WEB_SPECIFIC_APPS fipsCMS SQL Injection Attempt -- index.asp fid ASCII"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id SELECT"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! JoomlaFacebook Component UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS BP Blog SQL Injection Attempt -- default.asp layout DELETE"

• "ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity UNION SELECT"

• "ET WEB_SERVER ScriptResource.axd access without t (time) parameter - possible ASP padding-oracle exploit"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS WordPress Leaflet plugin(leaflet_layer) id parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ZOHO ManageEngine ADSelfService Employee Search XSS Attempt"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- showfile.asp fid ASCII"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id SELECT"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- DisplayResults.php iSearchID SELECT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php code ASCII"

• "ET WEB_SERVER Suspected Webshell query Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php productId ASCII"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewReport.php bug UPDATE"

• "ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id DELETE"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- cat.asp cat INSERT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_search.asp query DELETE"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp pass DELETE"

• "ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordOld DELETE"

• "ET WEB_SPECIFIC_APPS Possible Achievo userid= Variable SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php firstname DELETE"

• "ET WEB_SPECIFIC_APPS TelebidAuctionScript aid Parameter Blind SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- default.asp page ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_quicknews Component newsid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Possible Mambo/Joomla! com_koesubmit Component 'koesubmit.php' Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- okvalannonce.php idannonce UPDATE"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Blog SQL Injection Attempt -- displayCalendar.asp date INSERT"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- product.asp productid ASCII"

• "ET WEB_SPECIFIC_APPS Fullaspsite GeometriX Download Portal SQL Injection Attempt -- down_indir.asp id SELECT"

• "ET WEB_SERVER Bot Search RFI Scan (Casper-Like Jcomers Bot scan)"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp kullanici_ismi DELETE"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_downloads.php did ASCII"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_authorization.php xuser_name DELETE"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- register.asp UserUpdate SELECT"

• "ET WEB_SPECIFIC_APPS PHPOF DB_AdoDB.Class.PHP PHPOF_INCLUDE_PATH parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Oxygen (O2PHP Bulletin Board) SQL Injection Attempt -- viewthread.php pid ASCII"

• "ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType SELECT"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP id INSERT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- details.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_kp controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin SELECT"

• "ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_wisroyq controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! Survey Manager Component UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS TurnkeyForms Business Survey Pro id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- modules.php active ASCII"

• "ET WEB_SPECIFIC_APPS maxxweb Cms kategorie parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp author INSERT"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- detail.asp property_id INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UPDATE"

• "ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3"

• "ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id SELECT"

• "ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Nagios Expand Parameter XSS Attempt"

• "ET WEB_SPECIFIC_APPS Wazzum Dating Software profile_view.php userid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Messageriescripthp SQL Injection Attempt -- lire-avis.php aa UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Paid4Mail RFI attempt"

• "ET WEB_SPECIFIC_APPS Joomla Component com_personel (id) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- user.php email ASCII"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action UNION SELECT"

• "ET WEB_SERVER HP OpenView /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS Aj Square RSS Reader url SQL Injection"

• "ET WEB_SPECIFIC_APPS JiRos FAQ Manager SQL Injection Attempt -- index.asp tID SELECT"

• "ET WEB_SPECIFIC_APPS MGB OpenSource Guestbook SQL Injection Attempt -- email.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- detail.php id ASCII"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php qid UNION SELECT"

• "GPL EXPLOIT /msadc/samples/ access"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile DELETE"

• "ET WEB_SPECIFIC_APPS BibCiter users.php idu Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass UPDATE"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla NoticeBoard Component controller Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS phpProfiles menu Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS eNdonesia artid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid INSERT"

• "ET WEB_SERVER Possible SQL Injection Attempt UNION SELECT in HTTP URI"

• "ET WEB_SPECIFIC_APPS Ve-EDIT edit_htmlarea.php highlighter Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key ASCII"

• "ET WEB_SPECIFIC_APPS PNphpBB2 admin_words.php ModName parameter Local File inclusion"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Mambo component com_zoom Blind SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php t UNION SELECT"

• "ET WEB_SPECIFIC_APPS DevelopItEasy News And Article aid parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Bexfront sid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS phpSkelSite theme parameter remote file inclusion"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp did UNION SELECT"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action ASCII"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- a_register.asp UPDATE"

• "ET WEB_CLIENT Generic Stolen Credentials Accessed on External Server"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- printview.php topic UPDATE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp uid UPDATE"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery (CPG) SQL Injection Attempt -- thumbnails.php cpg131_fav SELECT"

• "ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template UNION SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp stock_number DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php DELETE"

• "ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php firstname UPDATE"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid DELETE"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- G_Display.php iCategoryUnq ASCII"

• "ET WEB_SPECIFIC_APPS Possible Docebo SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- polls.php id UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid INSERT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS DynPG CMS PathToRoot Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Comersus Shop Cart SQL Injection Attempt -- comersus_optReviewReadExec.asp idProduct SELECT"

• "ET WEB_SPECIFIC_APPS WordPress XCloner Plugin index2.php mosmsg Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS MyStats SQL Injection Attempt -- mystats.php details UPDATE"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp author ASCII"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- product.asp productid INSERT"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- linkslist.asp psearch ASCII"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php t SELECT"

• "ET WEB_SPECIFIC_APPS PNphpBB2 admin_groups_reapir.php ModName parameter Local File inclusion"

• "ET WEB_SPECIFIC_APPS Contra Haber Sistemi SQL Injection Attempt -- haber.asp id ASCII"

• "ET SCAN ZmEu exploit scanner"

• "ET WEB_SPECIFIC_APPS ProNews SQL Injection Attempt -- lire-avis.php aa INSERT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- printarticle.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php blogid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp user UNION SELECT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id SELECT"

• "ET WEB_SERVER Generic Mailer Check Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS PHP-fusion Team Structure Infusion team_id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- usermgr.php gid ASCII"

• "ET WEB_SPECIFIC_APPS e107 permLink Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat UNION SELECT"

• "ET WEB_SERVER PHP Possible ssh2 Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Xtreme ASP Photo Gallery SQL Injection Attempt -- displaypic.asp sortorder UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! JoomlaFacebook Component INSERT INTO SQL Injection"

• "ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS TEMENOS T24 skin parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id UNION SELECT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS SOPHIA CMS SQL Injection Attempt -- dsp_page.cfm pageid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php t ASCII"

• "ET WEB_SPECIFIC_APPS Joomla swMenuPro ImageManager.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum2.asp soruid ASCII"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Guo Xu Guos Posting System (GPS) SQL Injection Attempt -- print.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS iScripts MultiCart orderid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_CLIENT Generic Stolen Credentials Accessed on External Server"

• "ET WEB_SPECIFIC_APPS cPanel fileop Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS LI-Guestbook SQL Injection Attempt -- guestbook.php country SELECT"

• "ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines UNION SELECT"

• "ET WEB_SPECIFIC_APPS dirLIST thumb_gen.php Local File Inclusion Attempt"

• "ET EXPLOIT Possible CVE-2017-12629 RCE Exploit Attempt (HTTP POST)"

• "ET WEB_SPECIFIC_APPS Dros core.process_compiled_include.php smarty Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp In UNION SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- mesajkutum.asp mesajno UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wbstreet show.php id parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- prikazInformacije.php IDStranicaPodaci SELECT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php cat_id UPDATE"

• "ET WEB_SPECIFIC_APPS Tinderbox.mozilla.org showbuilds.cgi Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler INSERT"

• "ET WEB_SPECIFIC_APPS Joomla mojoBlog wp-trackback.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php firstname INSERT"

• "ET WEB_SPECIFIC_APPS DVD Rental Software cat_id parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key UNION SELECT"

• "ET WEB_SPECIFIC_APPS SOPHIA CMS SQL Injection Attempt -- dsp_page.cfm pageid UPDATE"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) Lite SQL Injection Attempt -- pms.php pmid DELETE"

• "ET WEB_SPECIFIC_APPS QUICKTEAM qte_result.php title Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID DELETE"

• "ET WEB_SPECIFIC_APPS WordPress Browser Rejector Plugin wppath Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- userdetail.php id SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php password ASCII"

• "ET WEB_SPECIFIC_APPS fipsCMS SQL Injection Attempt -- index.asp fid DELETE"

• "ET WEB_SERVER PHP Possible ftps Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Webspell wCMS-Clanscript staticID Parameter SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php id SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_photoblog component category Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Copperleaf Photolog postid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER Possible MySQL SQLi User-Dump Attempt"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat SELECT"

• "ET WEB_SPECIFIC_APPS TinyWebGallery install_path parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS pHNews comments.php template Local File Inclusion"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- viewlinks.asp CategoryID INSERT"

• "ET WEB_SPECIFIC_APPS Possible Joomla! Game Server Component 'id' Parameter UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk UNION SELECT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- default.asp page DELETE"

• "ET WEB_SPECIFIC_APPS AvailScript Article Script articles.php aIDS Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- viewlinks.asp CategoryID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Zabbix popup.php SELECT FROM SQL Injection Vulnerability"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- dispimage.asp id INSERT"

• "ET EXPLOIT Joomla RCE M2 (Serialized PHP in UA)"

• "ET WEB_SPECIFIC_APPS ANGEL Learning Management Suite (LMS) SQL Injection Attempt -- default.asp id UNION SELECT"

• "ET WEB_SERVER PHP Possible expect Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Achievo atknodetype parameter Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- showfile.asp fid INSERT"

• "ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id ASCII"

• "ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS FCMS settings.php current_user_id Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp agent SELECT"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nukesentinel.php INSERT"

• "ET WEB_SPECIFIC_APPS Pre Online Tests Generator Pro SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WebPhotoPro galeri_info.php lang Parameter SQL Injection"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid UPDATE"

• "ET WEB_SPECIFIC_APPS Rakhi Software Price Comparison Script product.php subcategory_id SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla XCloner Component cloner.cron.php config Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php SELECT"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- update_profile.php username ASCII"

• "ET WEB_SPECIFIC_APPS Horde IMP fetchmailprefs.php Cross Site Scripting Attempt"

• "ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Contra Haber Sistemi SQL Injection Attempt -- haber.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Joomla Component Ek rishta 2.10 - SQL Injection 2"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php galleryID INSERT"

• "ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex ASCII"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php url INSERT"

• "ET WEB_SPECIFIC_APPS CultBooking lang parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Daily add_postit.php id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS AWStats Totals sort parameter Remote Code Execution Attempt"

• "ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- navigacija.php IDMeniGlavni UNION SELECT"

• "ET WEB_SPECIFIC_APPS Group-Office comment_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Okul Web Otomasyon Sistemi SQL Injection Attempt -- etkinlikbak.asp id INSERT"

• "ET WEB_SPECIFIC_APPS iGeneric iG Calendar SQL Injection Attempt -- user.php id INSERT"

• "ET WEB_SPECIFIC_APPS Lotfian Request For Travel SQL Injection Attempt -- ProductDetails.asp PID ASCII"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_class UPDATE"

• "ET WEB_SPECIFIC_APPS Flash Gallery wordpress plugin SQL Injection Attempt -- massedit_album.php gall_id DELETE"

• "ET WEB_SPECIFIC_APPS Design4Online UserPages2 SQL Injection Attempt -- page.asp art_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- autherror.cfm errorcode UNION SELECT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- download_image.asp image_id DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_blog Component id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- giris.asp kullaniciadi UNION SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Fullaspsite Asp Hosting Sitesi SQL Injection Attempt -- windows.asp kategori_id SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp order UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgAnalyse.asp IsolatedMessageID XSS Attempt"

• "ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa SELECT"

• "ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- filecheck.php id INSERT"

• "ET WEB_SPECIFIC_APPS Mambo LaiThai SQL Injection Attempt -- mambo.php SELECT"

• "ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- ldap.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Lance show.php catid SQL Injection"

• "ET WEB_SPECIFIC_APPS CreateAuction SQL Injection Attempt -- cats.asp catid UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php id INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID SELECT"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Orderby Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS mySeatXT SQL Injection Attempt autocomplete.php field DELETE"

• "ET WEB_SPECIFIC_APPS WebPhotoPro galeri_info.php ida Parameter SQL Injection"

• "GPL EXPLOIT Alternate Data streams ASP file access attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php sk ASCII"

• "ET WEB_SPECIFIC_APPS ActivDesk cid Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- faqDsp.asp catcode ASCII"

• "ET WEB_SPECIFIC_APPS b2evolution skins_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ProdLer prodler.class.php sPath Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_catalogue controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php defaultLetter UPDATE"

• "ET WEB_SPECIFIC_APPS ea-gBook index_inc.php inc_ordner parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- index.cfm UNION SELECT"

• "ET WEB_SPECIFIC_APPS LocazoList SQL Injection Attempt -- main.asp subcatID UNION SELECT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php blogid INSERT"

• "ET WEB_SPECIFIC_APPS Flash Quiz num_questions.php quiz Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS impressCMS FCKeditor root_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- mesajkutum.asp mesajno INSERT"

• "ET WEB_SPECIFIC_APPS Fullaspsite Asp Hosting Sitesi SQL Injection Attempt -- windows.asp kategori_id DELETE"

• "ET WEB_SERVER Cpanel Cracker Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Joomla component img Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- G_Display.php iCategoryUnq UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID ASCII"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- detail.php id INSERT"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Flash Gallery wordpress plugin folder.php type Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Vt-Forum Lite SQL Injection Attempt -- vf_memberdetail.asp user UPDATE"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php ipadd ASCII"

• "ET WEB_SPECIFIC_APPS Demium CMS urheber.php name Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Cacti SQL Injection Vulnerability tree.php leaf_id UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.php id UPDATE"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-4"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 24"

• "ET WEB_SPECIFIC_APPS Wordpress Myflash path parameter Local File Inclusion Attempt"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 21"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id DELETE"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- moscomment.php mcname DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear SELECT"

• "ET WEB_SPECIFIC_APPS Website Baker SQL Injection Attempt -- eWebQuiz.asp QuizID UNION SELECT"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_forum SELECT"

• "ET WEB_SERVER Possible HTTP 405 XSS Attempt (Local Source)"

• "ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp orderby SELECT"

• "ET WEB_SPECIFIC_APPS ProNews SQL Injection Attempt -- lire-avis.php aa SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- polls.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS CMS Board site_path Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS cfagcms right.php title Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Rapid Classified SQL Injection Attempt -- viewad.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms INSERT"

• "ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews UNION SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp order DELETE"

• "ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Concrete DIR_FILES_BLOCK_TYPES_CORE Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS playSMS init.php apps_path plug parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS PowerPHPBoard footer.inc.php settings Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ClarkConnect Linux proxy.php XSS Attempt"

• "ET WEB_SPECIFIC_APPS Jenkins Information Disclosure CVE-2017-1000395"

• "ET WEB_SPECIFIC_APPS All In One Control Panel poll_id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp parentid INSERT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 22"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- contacts.php text UPDATE"

• "ET WEB_SPECIFIC_APPS F3Site2009 LFI Exploit Attempt (poll.php)"

• "ET WEB_SPECIFIC_APPS Barracuda Web Application Firewall 600 XSS attempt (backup_password)"

• "ET WEB_SERVER SQL Injection Attempt (Agent NV32ts)"

• "ET WEB_SPECIFIC_APPS WordPress Relocate Upload plugin abspath parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Free Bible Search readbible.php SQL Injection"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php firstname ASCII"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid UPDATE"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i UNION SELECT"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php blogid UPDATE"

• "ET WEB_SPECIFIC_APPS eGroupware loaddetails.php script UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS fipsForum SQL Injection Attempt -- default2.asp kat DELETE"

• "ET WEB_SERVER Possible SQL injection obfuscated via REVERSE function in HTTP URI"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS SalesCart Shopping Cart SQL Injection Attempt -- reorder2.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice UNION SELECT"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp password ASCII"

• "ET WEB_SPECIFIC_APPS Invision Gallery SQL Injection Attempt -- post.php img INSERT"

• "ET WEB_SERVER SHOW CURDATE/CURTIME SQL Injection Attempt in URI"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php board UPDATE"

• "ET WEB_SPECIFIC_APPS phPortal gunaysoft.php sayfaid Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- menu.php UPDATE"

• "ET WEB_SERVER WSO Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter UPDATE SET SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS WordPress PHP Speedy Plugin title parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Safe Search Plugin v1 Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WordPress flash-album-gallery plugin i Parameter Cross Site Scripting Attempt"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newmessage SELECT"

• "ET WEB_SPECIFIC_APPS Interleave basicstats.php AjaxHandler Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp order UNION SELECT"

• "ET WEB_SERVER Possible SQL Injection Attempt SELECT FROM"

• "ET WEB_SPECIFIC_APPS simple machines forum include parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserPass SELECT"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp title DELETE"

• "ET WEB_SPECIFIC_APPS Okul Web Otomasyon Sistemi SQL Injection Attempt -- etkinlikbak.asp id DELETE"

• "ET WEB_SPECIFIC_APPS webEdition CMS we_transaction Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp page DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php cat_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS playSMS init.php apps_path themes parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS ClanSphere CurrentFolder Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Group-Office comment_id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword SELECT"

• "ET EXPLOIT Websense Content Gateway submit_net_debug.cgi cmd_param Param Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite INSERT"

• "ET WEB_SPECIFIC_APPS Flash Gallery wordpress plugin SQL Injection Attempt -- massedit_album.php gall_id ASCII"

• "ET WEB_SPECIFIC_APPS Bluetrait SQL Injection Attempt -- bt-trackback.php INSERT"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp parola UNION SELECT"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery output Parameter Remote Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php cid DELETE"

• "ET WEB_SPECIFIC_APPS uniForum SQL Injection Attempt -- wbsearch.aspx SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php t INSERT"

• "ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete DELETE"

• "ET WEB_SPECIFIC_APPS F5 Data Manager DiagCaptureFileListActionBody.do Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp l UNION SELECT"

• "ET WEB_SPECIFIC_APPS WP Cost Estimator Plugin AFI Vulnerability"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- printmain.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_eventcal mosConfig_absolute_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID INSERT"

• "ET WEB_SPECIFIC_APPS Manage Engine Service Desk Plus WorkOrder.do SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 8pixel.net simpleblog SQL Injection Attempt -- edit.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Jenkins Pre-auth User Information Leakage"

• "ET WEB_SPECIFIC_APPS Ixprim SQL Injection Attempt -- ixm_ixpnews.php story_id ASCII"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp uid ASCII"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php cat_id UPDATE"

• "ET WEB_SPECIFIC_APPS epay a_affil.php _REQUEST Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- index.asp ID INSERT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Joomla Simple RSS Reader admin.rssreader.php mosConfig_live_site Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm categoryid UNION SELECT"

• "ET WEB_SPECIFIC_APPS IBM Lotus Sametime Server stconf.nsf Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID DELETE"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp kullanici_ismi UPDATE"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- polls.php id INSERT"

• "ET WEB_SPECIFIC_APPS Vt-Forum Lite SQL Injection Attempt -- vf_memberdetail.asp user UNION SELECT"

• "ET WEB_SPECIFIC_APPS Syntax Desktop preview.php synTarget Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publication_view.asp InfoID INSERT"

• "ET WEB_SPECIFIC_APPS SaurusCMS class.writeexcel_workbook.inc.php class_path Remote File Inclusion Attempt"

• "ET EXPLOIT Joomla RCE (JDatabaseDriverMysqli)"

• "ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user DELETE"

• "ET WEB_SPECIFIC_APPS Nicola Asuni All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_functions_downloads.php download_category SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- ipsearch.admin.php ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare UNION SELECT"

• "ET WEB_SPECIFIC_APPS ACGVannu SQL Injection Attempt -- modif.html id_mod UNION SELECT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Nabopoll SQL Injection Attempt -- result.php surv UPDATE"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php did UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- ldap.php ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp currentpage INSERT"

• "ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- filecheck.php id SELECT"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publication_view.asp InfoID DELETE"

• "ET WEB_SPECIFIC_APPS OvBB admincp.php smilieid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS E-Xoopport Samsara Sections module secid Parameter Blind SQL Injection Exploit"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- product.asp productid SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- pfs.edit.inc.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp DELETE"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_user UPDATE"

• "ET WEB_SPECIFIC_APPS QUICKTEAM qte_result.php title Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php firstname UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid ASCII"

• "ET WEB_SPECIFIC_APPS OSClass file Parameter Remote File Access Attempt"

• "ET WEB_SPECIFIC_APPS Car Portal car Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php url DELETE"

• "ET WEB_SPECIFIC_APPS SnippetMaster pcltar.lib.php g_pcltar_lib_dir Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php code UPDATE"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- printview.php topic INSERT"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php cid UNION SELECT"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp secondgroup ASCII"

• "ET TROJAN ELF/Mirai User-Agent Observed (Outbound)"

• "ET WEB_SPECIFIC_APPS LWS php User Base unverified.inc.php template Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- showfile.asp fid UPDATE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Blog SQL Injection Attempt -- displayCalendar.asp date ASCII"

• "ET WEB_SPECIFIC_APPS NewSolved newsscript.php newsid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php post_id UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla Component com_jr_questionnaire Directory Traversal Attempt"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php category_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- prikazInformacije.php IDStranicaPodaci UNION SELECT"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- menu.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php id DELETE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewBugs.php s ASCII"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS ClanSphere 'CKEditorFuncNum' parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newmessage UPDATE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php cat_id ASCII"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php id SELECT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_search.asp query SELECT"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Possible OpenSiteAdmin pageHeader.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_joomtouch controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vehicleID INSERT"

• "ET WEB_SPECIFIC_APPS Tiki Wiki CMS ajax parameter XSS Vulnerability"

• "ET WEB_SPECIFIC_APPS PozScripts Classified Auctions id parameter SQL Injection"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS vBulletin sortorder parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp orderby INSERT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php Itemid INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php lastname UPDATE"

• "ET WEB_SPECIFIC_APPS Blogplus block_center_top.php Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla com_musicgallery Component Id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id UPDATE"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 26"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- mailer.w2b draft INSERT"

• "ET WEB_SERVER Generic Webshell Activity (Response)"

• "ET WEB_SPECIFIC_APPS Oracle E-Business Suite Financials jtfwcpnt.jsp UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_doc DELETE"

• "ET WEB_SERVER Suspected Webshell arp Command (Inbound)"

• "ET WEB_SPECIFIC_APPS ACGVannu SQL Injection Attempt -- modif.html id_mod SELECT"

• "ET WEB_SPECIFIC_APPS Simple Web Content Management System SQL Injection Attempt -- page.php id UPDATE"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_downloads.php did DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id INSERT"

• "ET WEB_SPECIFIC_APPS YourFreeWorld Autoresponder hosting tr.php id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid SELECT"

• "ET WEB_SPECIFIC_APPS Kolayindir Download (Yenionline) SQL Injection Attempt -- down.asp id INSERT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_search.asp query ASCII"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp year INSERT"

• "ET WEB_SPECIFIC_APPS WEB-PHP Wordpress enable-latex plugin url Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Possible AIOCP cp_html2xhtmlbasic.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick INSERT"

• "ET WEB_SPECIFIC_APPS Kolayindir Download (Yenionline) SQL Injection Attempt -- down.asp id DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id SELECT"

• "ET WEB_SERVER eval/base64_decode Exploit Attempt Inbound"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- save.php groupAddName SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID ASCII"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp pass UPDATE"

• "ET WEB_SPECIFIC_APPS Possible Docebo DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid SELECT"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nsbypass.php ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newname UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Project_ID UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php goTo UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- contacts.php text INSERT"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- faqDsp.asp catcode UPDATE"

• "ET WEB_SPECIFIC_APPS Horde XSS attempt colorpicker.php"

• "ET WEB_SPECIFIC_APPS Lotfian Request For Travel SQL Injection Attempt -- ProductDetails.asp PID INSERT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_comments.asp articleID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 ASCII"

• "ET WEB_SPECIFIC_APPS Oracle E-Business Suite Financials jtfwcpnt.jsp UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Interactive Web Solutions site_info.php SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_class DELETE"

• "ET WEB_SERVER Generic Webshell Accessed"

• "ET WEB_SPECIFIC_APPS nvisionix Roaming System sessions.php script Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- table_broken.php lid UPDATE"

• "ET WEB_SERVER Suspected Webshell ipconfig Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- print.php id INSERT"

• "ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id INSERT"

• "ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php post_id INSERT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla com_perchagallery Component id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS p-Table for WordPress wptable-tinymce.php ABSPATH Parameter RFI Attempt"

• "ET WEB_SPECIFIC_APPS FireStats window-add-excluded-url.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Manage Engine Service Desk Plus WorkOrder.do UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp orderby DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress Custom Contact Forms DB Upload/Download Auth Bypass"

• "ET WEB_SPECIFIC_APPS PHP Classifieds class.phpmailer.php lang_path Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- detail.asp p UPDATE"

• "ET WEB_SPECIFIC_APPS fipsForum SQL Injection Attempt -- default2.asp kat SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listmain.asp cat ASCII"

• "ET WEB_SPECIFIC_APPS Joomla YJ Contact Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- a_register.asp SELECT"

• "ET WEB_SPECIFIC_APPS Nuke Evolution Xtreme pid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php search UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Foobla Suggestions Component idea_id UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php message INSERT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- block-Old_Articles.php cat UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_quicknews Component newsid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Hedgehog CMS header.php c_temp_path Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS phpRS id parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Annonces Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp did ASCII"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_authorization.php xuser_name ASCII"

• "ET WEB_SPECIFIC_APPS iBrowser Plugin dir Parameter Cross Site Scripting Attempt-1"

• "ET WEB_SPECIFIC_APPS phpBMS invoices_discount_ajax.php id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Easyedit CMS page.php intpageID parameter sql injection"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php url UNION SELECT"

• "GPL EXPLOIT CodeRed v2 root.exe access"

• "ET WEB_SPECIFIC_APPS LiveCMS SQL Injection Attempt -- categoria.php cid INSERT"

• "ET WEB_SPECIFIC_APPS DesktopOnNet frontpage.php app_path Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- users.php id ASCII"

• "ET WEB_SPECIFIC_APPS Nuke Evolution Xtreme pid Parameter INSERT INTO SQL Injection Attempt"

• "GPL WEB_SERVER Tomcat null byte directory listing attempt"

• "ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cat INSERT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- G_Display.php iCategoryUnq SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_blog Component id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Online Web Building SQL Injection Attempt -- page.asp art_id SELECT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- login.asp sent UPDATE"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_Type_ID INSERT"

• "ET WEB_SPECIFIC_APPS WB News comments.php config Parameter Remote File Inclusion -1"

• "ET WEB_SPECIFIC_APPS WordPress Gallery Plugin filename_1 Parameter Remote File Access Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_mscomment controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Invision Power Board (IPB) SQL Injection Attempt -- class_session.php CLIENT_IP ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! CB Resume Builder 'group_id' Parameter SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Website Baker SQL Injection Attempt -- eWebQuiz.asp QuizID INSERT"

• "ET WEB_SPECIFIC_APPS MAXcms RFI attempt (4)"

• "ET WEB_SPECIFIC_APPS Kalptaru Infotech Automated Link Exchange Portal cat_id Parameter SQL Injection"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla Community component userid parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Community CMS view.php article_id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Apache Archive addNetworkProxy script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews INSERT"

• "ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword UNION SELECT"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy ASCII"

• "ET WEB_SPECIFIC_APPS evision cms addnewsletter.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla XGallery com_xgallery Component Local File Inclusion Attempt"

• "ET WEB_SERVER Likely Malicious Request for /proc//smaps"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php product_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordNew UPDATE"

• "ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id ASCII"

• "ET WEB_SPECIFIC_APPS PHP Classified ads software cid parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp page INSERT"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp parola UPDATE"

• "ET WEB_CLIENT Kageyama Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- login.php login_username SELECT"

• "ET WEB_SPECIFIC_APPS Interactive Web Solutions site_info.php UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS NetClassifieds Premium Edition SQL Injection Attempt -- ViewCat.php s_user_id ASCII"

• "ET EXPLOIT D-Link DCS-930L Remote Command Execution attempt"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- news.php item ASCII"

• "ET WEB_SPECIFIC_APPS Joomla FaceBook Component face_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Simplis CMS download_file Parameter Local File Inclusion Attempt"

• "ET WEB_SERVER Generic WSO Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS bbPress SQL Injection Attempt -- formatting-functions.php INSERT"

• "GPL SCAN nessus 1.X 404 probe"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- usermgr.php gid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_hdflvplayer Component id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WebMoney html.php page Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Possible IBM BladeCenter Management Module pm_temp.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_perchagallery Component id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- mainfile.php lang INSERT"

• "ET WEB_SPECIFIC_APPS Xtreme ASP Photo Gallery SQL Injection Attempt -- displaypic.asp sortorder DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- user.php email DELETE"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp pass INSERT"

• "ET WEB_SPECIFIC_APPS Digiappz DigiAffiliate SQL Injection Attempt -- visu_user.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Check New findoffice.php search parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS RecordPress header.php titledesc Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_dshop Component SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS evision cms add3rdparty.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-functions.php DELETE"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp sifre UNION SELECT"

• "ET WEB_SPECIFIC_APPS LiveCMS SQL Injection Attempt -- categoria.php cid UNION SELECT"

• "ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_rssreader controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ClickTech Click Blog SQL Injection Attempt -- displayCalendar.asp date SELECT"

• "ET WEB_SPECIFIC_APPS Coupon Script bus parameter Blind SQL Injection Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Blogplus window_down.php Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php blogid DELETE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- printmain.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla wgPicasa Component controller Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newname INSERT"

• "ET WEB_SPECIFIC_APPS AvailScript Photo Album Script pics.php sid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- fiche_membre.php idmembre UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php imageurl UNION SELECT"

• "ET WEB_SPECIFIC_APPS Apache Archive userlist script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php id DELETE"

• "ET WEB_SPECIFIC_APPS WordPress SocialGrid Plugin default_services Cross-Site Scripting Vulnerability"

• "ET WEB_SPECIFIC_APPS Pre Online Tests Generator Pro INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno ASCII"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress Download Monitor tags parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- update_profile.php username SELECT"

• "ET WEB_SPECIFIC_APPS Pet Listing Script type_id Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp sort INSERT"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- login.php login_username ASCII"

• "ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id ASCII"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp maingroup UNION SELECT"

• "ET WEB_SPECIFIC_APPS Reversed Pastebin Injection in Magento DB"

• "ET WEB_SPECIFIC_APPS Digiappz DigiAffiliate SQL Injection Attempt -- visu_user.asp id SELECT"

• "ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID INSERT"

• "ET WEB_SERVER Possible PHP Remote Code Execution CVE-2019-11043 PoC (Inbound)"

• "ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip INSERT"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- search.asp search ASCII"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php image_id INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 SELECT"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php comment UNION SELECT"

• "ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id UPDATE"

• "ET WEB_SERVER Suspected Webshell net Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php UPDATE"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp did DELETE"

• "ET WEB_SPECIFIC_APPS myBloggie mybloggie_root_path Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Audins Audiens SQL Injection Attempt -- index.php PHPSESSID DELETE"

• "GPL EXPLOIT unicode directory traversal attempt"

• "ET WEB_SPECIFIC_APPS eyeOS file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- linkslist.asp psearch UNION SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php category_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php goTo SELECT"

• "ET WEB_SPECIFIC_APPS Froxlor customer_ftp.php id Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS asaher pro left_menu.php row_y5_site_configuration Remote File Inclusion Attempt"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum.asp baslik UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newemail ASCII"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- compare_product.php id DELETE"

• "ET WEB_SPECIFIC_APPS WordPress church_admin Plugin id parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- pfs.edit.inc.php UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin INSERT"

• "ET WEB_SPECIFIC_APPS Mambo Component com_smf smf.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Featured Content param Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- send_password_preferences.asp INSERT"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php qid DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp typ INSERT"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category UNION SELECT"

• "ET WEB_SPECIFIC_APPS YourFreeWorld Reminder Service tr.php id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newemail UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla eZine Component d4m_ajax_pagenav.php Remote File Inclusion Attempt"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS SOPHIA CMS SQL Injection Attempt -- dsp_page.cfm pageid DELETE"

• "ET WEB_SPECIFIC_APPS DeltaScripts PHP Classifieds siteid parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_categories.asp catID INSERT"

• "ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_aut UNION SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp keyword INSERT"

• "ET WEB_SPECIFIC_APPS Xtreme ASP Photo Gallery SQL Injection Attempt -- displaypic.asp sortorder INSERT"

• "ET WEB_SPECIFIC_APPS Exponent file parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS GeekLog filemgt DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id INSERT"

• "ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id SELECT"

• "ET WEB_SPECIFIC_APPS evision cms addproduct.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS MiNT Haber Sistemi SQL Injection Attempt -- duyuru.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_jomestate Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Bookmark4U SQL Injection Attempt -- config.php sqlcmd SELECT"

• "ET WEB_SPECIFIC_APPS Enthusiast path parameter Remote File Inclusion"

• "ET EXPLOIT MMCS service (Little Endian)"

• "ET WEB_SPECIFIC_APPS Invision Gallery SQL Injection Attempt -- post.php img SELECT"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP kid UPDATE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp uid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board Lite SQL Injection Attempt -- thread.php threadvisit UPDATE"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- index.php p_skin UNION SELECT"

• "ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user DELETE"

• "ET WEB_SPECIFIC_APPS GlobalMegaCorp dvddb SQL Injection Attempt -- common.php user ASCII"

• "ET WEB_SPECIFIC_APPS Joomla Dada Mail Manager Component config.dadamail.php GLOBALS Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id INSERT"

• "ET WEB_SPECIFIC_APPS Telephone Directory 2008 edit1.php code Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php cat_id SELECT"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UNION SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla com_some controller Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Component com_hello INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Nuke Evolution Xtreme pid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS web wiz forums ForumID Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Acute Control Panel header.php theme_directory parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2"

• "ET WEB_SPECIFIC_APPS ContentNow SQL Injection Attempt -- index.php pageid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php boardids DELETE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordNew DELETE"

• "ET WEB_SPECIFIC_APPS phpRS id parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID INSERT"

• "ET WEB_SERVER SQL Injection BULK INSERT in URI to Insert File Content into Database Table"

• "ET WEB_SPECIFIC_APPS LightOpenCMS smarty.php cwd Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- users.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- giris.asp kullaniciadi INSERT"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-1"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Philboard SQL Injection Attempt -- philboard_forum.asp forumid ASCII"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp menuSelect UNION SELECT"

• "ET WEB_SPECIFIC_APPS Euchia CMS catalogo.php id_livello Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp id SELECT"

• "ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Volusion Chat ID Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS OpenX phpAdsNew phpAds_geoPlugin Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Online Web Building SQL Injection Attempt -- page.asp art_id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_collector Component Arbitrary File Upload Vulnerability"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare INSERT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php us SELECT"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp sifre UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- content.php where SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php login INSERT"

• "ET WEB_CLIENT Possible HTTP 500 XSS Attempt (External Source)"

• "ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori SELECT"

• "ET WEB_SPECIFIC_APPS Softsaurus CMS subHeader.php objects_path Parameter Remote File Inclusion -2"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- inc_secureloginmanager.asp sent DELETE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp harf SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- contacts.php text ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip UNION SELECT"

• "ET WEB_SPECIFIC_APPS CAT2 spaw_control.class.php spaw_root Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp In SELECT"

• "ET WEB_SPECIFIC_APPS LocazoList SQL Injection Attempt -- main.asp subcatID SELECT"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm langId UPDATE"

• "ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID ASCII"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- members.asp sent ASCII"

• "ET WEB_SERVER HTTP 414 Request URI Too Large"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewBugs.php s DELETE"

• "ET WEB_SPECIFIC_APPS WordPress UnGallery pic Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp typ SELECT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_ID INSERT"

• "ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID UPDATE"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- wallpaper.php wallpaperid INSERT"

• "ET WEB_SPECIFIC_APPS Joomla Component JE Story Submit view parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Hedgehog CMS footer.php c_temp_path Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- linkslist.asp psearch DELETE"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-functions.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_avosbillets Component id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid DELETE"

• "ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id SELECT"

• "ET WEB_SERVER possible IBM Rational Directory Server (RDS) Help system href browser redirect"

• "ET WEB_SPECIFIC_APPS Bahar Download Script aspkat.asp SQL Injection"

• "ET WEB_SPECIFIC_APPS MindTouch Deki Wiki link.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- openlink.asp LinkID UPDATE"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp state INSERT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- voirannonce.php no ASCII"

• "ET WEB_SPECIFIC_APPS JiRos FAQ Manager SQL Injection Attempt -- index.asp tID INSERT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp model ASCII"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id DELETE"

• "ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- dlwallpaper.php wallpaperid INSERT"

• "GPL WEB_SERVER Tomcat directory traversal attempt"

• "ET WEB_SPECIFIC_APPS ANGEL Learning Management Suite (LMS) SQL Injection Attempt -- default.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php productId UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Redirect Component view Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php newsid UPDATE"

• "ET WEB_SPECIFIC_APPS Guo Xu Guos Posting System (GPS) SQL Injection Attempt -- print.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- down.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID INSERT"

• "ET WEB_SPECIFIC_APPS Constructr CMS Injection Attempt -- constructrXmlOutput.content.xml.php page_id DELETE"

• "ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! Survey Manager Component INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_ID DELETE"

• "ET WEB_SERVER PHP Possible https Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php boardids SELECT"

• "ET WEB_SPECIFIC_APPS Sphider SQL Injection Attempt -- search.php category INSERT"

• "ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType DELETE"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp pass ASCII"

• "ET WEB_SERVER WPScan User Agent"

• "ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_joaktree Component treeId Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_class ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear INSERT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) Lite SQL Injection Attempt -- pms.php pmid ASCII"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Campsite article_id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Hazir Site SQL Injection Attempt -- giris_yap.asp sifre DELETE"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp kullanici DELETE"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- table_broken.php lid ASCII"

• "ET EXPLOIT Attempted D-Link ShareCenter (DNS-320/325) RCE (Inbound)"

• "ET WEB_SPECIFIC_APPS Dros function.config_load.php _compile_file Remote File Inclusion Attempt"

• "ET WEB_SERVER Possible Apache Struts OGNL Expression Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- letterman.class.php id DELETE"

• "ET WEB_SPECIFIC_APPS MiNT Haber Sistemi SQL Injection Attempt -- duyuru.asp id ASCII"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp manufacturer UPDATE"

• "ET EXPLOIT Stored XSS Vulnerability CVE-2021-31250 M4"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php productId UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text SELECT"

• "ET WEB_SPECIFIC_APPS Blogplus block_center_down.php Local File Inclusion"

• "ET WEB_SPECIFIC_APPS MindTouch Deki Wiki deki_plugin.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Pre Online Tests Generator Pro DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup UNION SELECT"

• "ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment DELETE"

• "ET WEB_SPECIFIC_APPS LI-Guestbook SQL Injection Attempt -- guestbook.php country UPDATE"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- userdetail.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Unique Ads (UDS) SQL Injection Attempt -- banner.php bid UNION SELECT"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 10"

• "ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori DELETE"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- search.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key SELECT"

• "ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword INSERT"

• "ET WEB_SPECIFIC_APPS LiveCMS SQL Injection Attempt -- categoria.php cid UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listmain.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php message SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- save.php groupAddName ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_hdflvplayer Component id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS OSSIM repository_attachment.php UPDATE SET SQL Injection Attempt"

• "ET TROJAN AntSword Webshell User-Agent Observed"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- index.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtUse UPDATE"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id SELECT"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i ASCII"

• "ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi UNION SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp categoryID_list DELETE"

• "ET WEB_SPECIFIC_APPS V-EVA Classified Script clsid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP Volunteer Management id parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newname SELECT"

• "ET WEB_SPECIFIC_APPS Sonicwall NSA E7500 XSS attempt (fwReg parameter)"

• "ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php Itemid UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newname DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp typ UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_hello DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Tunngavik CMS id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Possible APC Network Management Card Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! Soundset Component 'cat_id' Parameter INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS XOOPS Module dictionary 2.0.18 (detail.php) SQL Injection Attempt"

• "ET SCAN Havij SQL Injection Tool User-Agent Inbound"

• "ET WEB_SPECIFIC_APPS Simple Customer contact.php SQL injection"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserPass INSERT"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- autherror.cfm errorcode SELECT"

• "ET WEB_SPECIFIC_APPS Vizayn Haber SQL Injection Attempt -- haberdetay.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp kullanici_ismi INSERT"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- DocPay.w2b listDocPay DELETE"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php id SELECT"

• "ET WEB_SPECIFIC_APPS MyFusion last_seen_users_panel.php settings Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgAnalyse.asp Scoring XSS Attempt"

• "ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType INSERT"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS AJ Forum SQL Injection Attempt -- topic_title.php td_id UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla Dada Mail Manager Component config.dadamail.php GLOBALS Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- mainfile.php lang ASCII"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- index.cfm DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp l SELECT"

• "ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank INSERT"

• "ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 2"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php category_id INSERT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- members.asp sent DELETE"

• "ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php so INSERT"

• "ET WEB_SPECIFIC_APPS Joomla Foobla Suggestions Component idea_id INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP Address Book from Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php INSERT"

• "ET WEB_SPECIFIC_APPS SoftExpert Excellence Suite 2.0 SQL Injection"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- meal_rest.asp mealid INSERT"

• "ET WEB_SERVER Antsword Related Webshell Activity (Inbound)"

• "ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id INSERT"

• "ET WEB_SERVER possible SAP Crystal Report Server 2008 path parameter Directory Traversal vulnerability"

• "ET WEB_SPECIFIC_APPS Comtrend ADSL Router srvName parameter XSS attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- sections.php text UNION SELECT"

• "ET WEB_SPECIFIC_APPS Zabbix popup.php INSERT INTO SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII"

• "ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp ASCII"

• "ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id SELECT"

• "ET WEB_SPECIFIC_APPS SnippetMaster vars.inc.php _SESSION Parameter Local File Inclusion"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id DELETE"

• "ET WEB_SERVER WSO 4.2.6 Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- gmail.php INSERT"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- register.asp UserUpdate INSERT"

• "ET WEB_SPECIFIC_APPS Informacion General informacion_general.php INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Component City Portal (Itemid) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php us UNION SELECT"

• "ET WEB_SPECIFIC_APPS Unclassified NewsBoard forum.php __tplCollection Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php post_id ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php user_login_cookie UPDATE"

• "ET WEB_SPECIFIC_APPS Aigaion ID Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER Generic Mini Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp id SELECT"

• "ET WEB_SPECIFIC_APPS OrangeHRM uri Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ShopMaker product.php id Parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS evision cms addgame.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS DMXReady Site Engine Manager SQL Injection Attempt -- index.asp mid INSERT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php product_id INSERT"

• "ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid SELECT"

• "ET WEB_SPECIFIC_APPS RevokeSoft RevokeBB SQL Injection Attempt -- class_users.php INSERT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum2.asp soruid SELECT"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php INSERT"

• "ET WEB_SERVER Generic Webshell Activity (POST)"

• "ET WEB_SERVER Anonymous Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare DELETE"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- faqDsp.asp catcode SELECT"

• "ET WEB_SPECIFIC_APPS Possible VBulletin Unauthorized Admin Account Creation"

• "ET WEB_SPECIFIC_APPS Wordpress wp-livephp plugin wp-live.php Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! Foobla RSS Feed Creator Component 'id' Parameter INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publications_list.asp vjob UNION SELECT"

• "ET EXPLOIT Joomla RCE M3 (Serialized PHP in XFF)"

• "ET WEB_SERVER HP LaserJet Printer Cross Site Scripting Attempt"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Server"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 6"

• "ET WEB_SPECIFIC_APPS Possible Computer Associates SiteMinder Web Agent Smpwservices.FCC Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WebAuction lang parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- index.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- meal_rest.asp mealid UPDATE"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp parentid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Appointment Booking Pro view parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- albmgr.php cat UPDATE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp uid SELECT"

• "ET WEB_SPECIFIC_APPS MiNT Haber Sistemi SQL Injection Attempt -- duyuru.asp id INSERT"

• "ET WEB_SPECIFIC_APPS CafeEngine id Remote SQL Injection (dish.php)"

• "ET WEB_SPECIFIC_APPS Possible F5 BIG-IP AJP Request Smuggling Attempt (CVE-2023-46747)"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy SELECT"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q INSERT"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- thumbnails.asp ci ASCII"

• "ET WEB_SPECIFIC_APPS NewsOffice news_show.php newsoffice_directory Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Easyedit CMS news.php intPageID parameter sql injection"

• "ET WEB_SPECIFIC_APPS Piwik Backdoor Access 2"

• "ET WEB_SPECIFIC_APPS Fullaspsite Asp Hosting Sitesi SQL Injection Attempt -- windows.asp kategori_id ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms DELETE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- mesajkutum.asp mesajno ASCII"

• "ET WEB_SPECIFIC_APPS Fullaspsite Asp Hosting Sitesi SQL Injection Attempt -- windows.asp kategori_id UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- wp-trackback.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- mesajkutum.asp mesajno DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- category.php catid ASCII"

• "ET WEB_SPECIFIC_APPS MantisBT db_type Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WebRCSdiff viewver.php File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Emerson Network AllResults.aspx Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm categoryid SELECT"

• "ET WEB_SPECIFIC_APPS VP-ASP Shopping Cart SQL Injection Attempt -- shopgiftregsearch.asp LoginLastname ASCII"

• "ET SCAN Possible Nmap User-Agent Observed"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- set_preferences.asp SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress clickdesk-live-support-chat plugin cdwidgetid parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS MiNT Haber Sistemi SQL Injection Attempt -- duyuru.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp loc SELECT"

• "ET WEB_SPECIFIC_APPS SchoolMation studentmain.php session Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- detail.php id DELETE"

• "ET WEB_SPECIFIC_APPS Event Calendar PHP cal_year Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Fusion mguser fotoalbum album_id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Pro Desk Component include_file Local File Inclusion"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- printview.php topic UNION SELECT"

• "ET WEB_SPECIFIC_APPS Website Baker SQL Injection Attempt -- eWebQuiz.asp QuizID UPDATE"

• "ET WEB_SPECIFIC_APPS PSY Auction SQL Injection Attempt -- item.php id SELECT"

• "ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment SELECT"

• "ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php DELETE"

• "ET WEB_SPECIFIC_APPS dirLIST show_scaled_image.php Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Ban SQL Injection Attempt -- connexion.php id SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_g2bridge controller parameter Local File Inclusion Attempt"

• "GPL ATTACK_RESPONSE del attempt"

• "ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines DELETE"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_cat_id DELETE"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_authorization.php xuser_name UNION SELECT"

• "ET WEB_SPECIFIC_APPS Calendar MX BASIC SQL Injection Attempt -- calendar_detail.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- table_broken.php lid INSERT"

• "ET WEB_SPECIFIC_APPS Openscrutin droit.class.php path_om Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- slideshow.asp ci INSERT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- update.asp id DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php category_id SELECT"

• "ET WEB_SPECIFIC_APPS Galerie ShowGallery.php SQL Injection attempt"

• "ET WEB_SPECIFIC_APPS MyioSoft EasyBookMarker Parent parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) Lite SQL Injection Attempt -- pms.php pmid INSERT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- printarticle.asp INSERT"

• "ET WEB_SPECIFIC_APPS PunBB profile_send.php pun_user language Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS PSY Auction SQL Injection Attempt -- item.php id ASCII"

• "ET WEB_SPECIFIC_APPS Rapid Classified SQL Injection Attempt -- viewad.asp id INSERT"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating DELETE"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_categories.asp catID SELECT"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Cyberfolio css.php theme Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- weblinks.php where ASCII"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_comments.asp articleID DELETE"

• "ET WEB_SPECIFIC_APPS JE Ajax Event Calendar view Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-functions.php INSERT"

• "ET WEB_SPECIFIC_APPS phpMyAdmin Remote Code Execution Proof of Concept (p=)"

• "ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! JoomlaFacebook Component DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Turnkeyforms Software Directory showcategory.php cid parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- mainfile.php lang UPDATE"

• "ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla virtuemart Blind SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt"

• "ET WEB_SPECIFIC_APPS TEDE Simplificado processaPesquisa.php script INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid ASCII"

• "ET WEB_SPECIFIC_APPS Cisco Collaboration Server LoginPage.jhtml Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Rapid Classified SQL Injection Attempt -- viewad.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id UPDATE"

• "ET WEB_SPECIFIC_APPS iPortal X gallery_show.asp GID parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Zenphoto date parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordNew SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp order SELECT"

• "ET WEB_SPECIFIC_APPS Audins Audiens SQL Injection Attempt -- index.php PHPSESSID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Horde XSS attempt passwd/main.php"

• "ET DOS LOIC GET"

• "ET WEB_SPECIFIC_APPS WordPress Plugin Pie Register SQL Injection"

• "ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid INSERT"

• "ET WEB_SPECIFIC_APPS WordPress jRSS Widget url parameter Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp show_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS DaFun Spirit lgsl_settings.php lgsl_path Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla morfeoshow morfeoshow.html.php Remote File Inclusion Attempt"

• "ET WEB_SERVER Generic Stolen Credentials Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- default.asp page UNION SELECT"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php id INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_ztautolink controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS LI-Guestbook SQL Injection Attempt -- guestbook.php country UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID UPDATE"

• "ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress XCloner Plugin cloner.cron.php config Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum2.asp soruid INSERT"

• "ET WEB_SPECIFIC_APPS All In One Control Panel SQL Injection Attempt -- cp_menu_data_file.php menu INSERT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php so DELETE"

• "ET WEB_SPECIFIC_APPS WB News search.php config Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- slideshow.asp ci ASCII"

• "ET WEB_SPECIFIC_APPS PWP Technologies The Classified Ad System SQL Injection Attempt -- default.asp main UNION SELECT"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP id UPDATE"

• "ET WEB_SPECIFIC_APPS Sphider SQL Injection Attempt -- search.php category SELECT"

• "ET WEB_SPECIFIC_APPS CreateAuction SQL Injection Attempt -- cats.asp catid UNION SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- cat.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- register.asp UserUpdate UPDATE"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp pass INSERT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET EXPLOIT TOTOLINK Router Cross-site Scripting CVE-2021-34228 (boafrm) M1"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php order SELECT"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php UNION SELECT"

• "ET WEB_SERVER Attempt To Access MSSQL xp_enumdsn/xp_enumgroups/xp_ntsec_enumdomains Stored Procedure Via URI"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- default.asp page INSERT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- dlwallpaper.php wallpaperid SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_banners banners.class.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp uid UNION SELECT"

• "ET WEB_SERVER ColdFusion Path Traversal (locale 5/5)"

• "ET WEB_SPECIFIC_APPS Softsaurus CMS subHeader.php objects_path Parameter Remote File Inclusion -1"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php pid INSERT"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- openlink.asp LinkID UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newmessage ASCII"

• "ET WEB_SPECIFIC_APPS Possible AWStats awstats.pl Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DEDECMS feedback_js.php arcurl Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname ASCII"

• "ET WEB_SPECIFIC_APPS MAXcms fm_includes_special Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course SELECT"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- news.php item INSERT"

• "ET WEB_SPECIFIC_APPS Possible CactuShop User Invoices Persistent XSS Attempt"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp keyword SELECT"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtUse INSERT"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php DELETE"

• "ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_job Component id_job Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS GlobalMegaCorp dvddb SQL Injection Attempt -- common.php user UNION SELECT"

• "ET WEB_SPECIFIC_APPS Weekly Drawing Contest SQL Injection Attempt -- check_vote.php order UNION SELECT"

• "ET WEB_SPECIFIC_APPS GS Real Estate Portal email.php AgentID Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp page SELECT"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm newsId SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text DELETE"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name DELETE"

• "ET WEB_SPECIFIC_APPS SchoolMation studentmain.php session Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- list.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Simple Web Content Management System SQL Injection Attempt -- page.php id ASCII"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id UPDATE"

• "ET WEB_SPECIFIC_APPS DEDECMS feedback_js.php arcurl Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php url SELECT"

• "ET WEB_SPECIFIC_APPS ACGVannu SQL Injection Attempt -- modif.html id_mod ASCII"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- down.asp id INSERT"

• "ET EXPLOIT Cisco SD-WAN vManage Software Directory Traversal (CVE-2020-26073)"

• "ET WEB_SERVER Possible D-Link Router HNAP Protocol Security Bypass Attempt"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_show.asp id2006quant ASCII"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp pass ASCII"

• "ET WEB_SPECIFIC_APPS Joomla component com_jinc (newsid) Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php cid UPDATE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum.asp baslik DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp parentid DELETE"

• "ET WEB_CLIENT WSO 4.2.6 Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php cat_id INSERT"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp orderby INSERT"

• "ET WEB_SPECIFIC_APPS Tunngavik CMS id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Community component userid parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style UPDATE"

• "ET EXPLOIT phpMyAdmin 4.8.1 - Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Design4Online UserPages2 SQL Injection Attempt -- page.asp art_id SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp menuSelect INSERT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 20"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php INSERT"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_user SELECT"

• "ET WEB_SPECIFIC_APPS vSupport Integrated Ticket System SQL Injection Attempt -- vBSupport.php ticketid DELETE"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_doc ASCII"

• "ET WEB_SPECIFIC_APPS Openfoncier architecte.class.php script Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listfull.asp ID SELECT"

• "ET WEB_CLIENT SmailMax PHPMailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid DELETE"

• "ET WEB_SPECIFIC_APPS OSSIM repository_attachment.php DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp pass ASCII"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp agentid SELECT"

• "ET WEB_SPECIFIC_APPS Comersus Shop Cart SQL Injection Attempt -- comersus_optReviewReadExec.asp idProduct UPDATE"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm langId DELETE"

• "ET WEB_SERVER SHOW VARIABLES SQL Injection Attempt in URI"

• "ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id DELETE"

• "ET WEB_SPECIFIC_APPS CreateAuction SQL Injection Attempt -- cats.asp catid INSERT"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_user DELETE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP id UPDATE"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_doc INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_jreactions mosConfig_absolute_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS artmedic weblog artmedic_print.php date Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Havalite userId parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass UNION SELECT"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q UPDATE"

• "ET ACTIVEX EasyMail Object SMTP Component Buffer Overflow Function call Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listmain.asp cat INSERT"

• "ET WEB_SPECIFIC_APPS CreateAuction SQL Injection Attempt -- cats.asp catid ASCII"

• "ET WEB_SERVER AntSword Webshell Commands Inbound"

• "ET WEB_SPECIFIC_APPS dB Masters Curium CMS SQL Injection Attempt -- news.php c_id UPDATE"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id ASCII"

• "ET WEB_SPECIFIC_APPS 8pixel.net simpleblog SQL Injection Attempt -- edit.asp id UNION SELECT"

• "ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS V-EVA Classified Script clsid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x DELETE"

• "ET WEB_SPECIFIC_APPS ASP SiteWare autoDealer SQL Injection Attempt -- detail.asp iPro UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Download Monitor plugin uploader.php Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vin INSERT"

• "ET WEB_SPECIFIC_APPS ITechBids productid Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS jQuery Mega Menu Wordpress Plugin Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Easyedit CMS subcategory.php intSubCategoryID parameter sql injection"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla component Simple File Lister sflDir Parameter directory traversal attempt"

• "ET WEB_SPECIFIC_APPS Reversed Pastebin Injection in Magento DB 2"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- block-Old_Articles.php cat DELETE"

• "ET WEB_SPECIFIC_APPS Openscrutin utilisateur.class.php path_om Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php so ASCII"

• "ET WEB_SPECIFIC_APPS Cisco Unified Communications Manager xmldirectorylist.jsp SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating INSERT"

• "ET WEB_SPECIFIC_APPS Mole Group Vacation Estate Listing Script Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Ixprim SQL Injection Attempt -- ixm_ixpnews.php story_id DELETE"

• "ET WEB_SPECIFIC_APPS PunBB Functions_navlinks.php pun_user language Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text UPDATE"

• "ET WEB_SPECIFIC_APPS Sphider SQL Injection Attempt -- search.php category UNION SELECT"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery retva Parameter Remote Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress WPsc-MijnPress plugin rwflush parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid SELECT"

• "ET WEB_SPECIFIC_APPS PithCMS oldnews_reader.php lang Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgAnalyse.asp Dictionary XSS Attempt"

• "ET WEB_SPECIFIC_APPS digiSHOP cart.php UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp uid ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- download_image.asp image_id ASCII"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style UNION SELECT"

• "ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id DELETE"

• "ET WEB_SPECIFIC_APPS ANGEL Learning Management Suite (LMS) SQL Injection Attempt -- default.asp id DELETE"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php ps SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Bsadv controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP id UNION SELECT"

• "ET WEB_SPECIFIC_APPS ClearSite device_admin.php cs_base_path Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp manufacturer ASCII"

• "ET WEB_SPECIFIC_APPS phpRS id parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- weblinks.php where INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear UNION SELECT"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php newsid DELETE"

• "ET WEB_SPECIFIC_APPS WordPress WP-Cumulus Plugin tagcloud.swf Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PRADO PHP Framework functional.php Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php picID ASCII"

• "ET WEB_SERVER Attack Tool Revolt Scanner"

• "ET WEB_SPECIFIC_APPS BasicForum SQL Injection Attempt -- edit.asp id DELETE"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publications_list.asp vjob UPDATE"

• "ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno DELETE"

• "ET WEB_SPECIFIC_APPS phpBMS invoices_discount_ajax.php id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp sale_type ASCII"

• "ET ACTIVEX EasyMail Object IMAP4 Component Buffer Overflow Function call Attempt"

• "ET WEB_SPECIFIC_APPS CMScontrol 7.x (index.php id_menu) SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- login.php login_username UPDATE"

• "ET WEB_SPECIFIC_APPS phpPollScript include_class Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment ASCII"

• "ET WEB_SPECIFIC_APPS Possible Joomla Game Server Component id Parameter INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla com_hdflvplayer Component id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Calendar SQL Injection Attempt -- user.php id SELECT"

• "ET WEB_SPECIFIC_APPS CommonSpot Server longproc.cfm Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id UPDATE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- down.asp id DELETE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordOld UPDATE"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user UPDATE"

• "ET WEB_SPECIFIC_APPS evision cms addcontact.php module parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS iScripts MultiCart orderid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .aspx Filename Extension Parsing File Upload Security Bypass Attempt (aspx)"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- print.php id ASCII"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.php id ASCII"

• "ET WEB_SERVER Generic Cpanel Cracker Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Nucleus server.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_aut UPDATE"

• "ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS SchoolMation studentmain.php session Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.php id DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- mainfile.php lang SELECT"

• "ET WEB_SPECIFIC_APPS Solar Empire SQL Injection Attempt -- game_listing.php DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- weblinks.php where SELECT"

• "ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row DELETE"

• "ET WEB_SERVER Possible SQL Injection Attempt UPDATE SET"

• "ET WEB_SPECIFIC_APPS Super Link Exchange Script SQL Injection Attempt -- directory.php cat DELETE"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name UNION SELECT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_view.asp articleID UNION SELECT"

• "ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID DELETE"

• "ET WEB_SPECIFIC_APPS Openfoncier action.class.php script Remote File inclusion Attempt"

• "ET WEB_SERVER ImageMagick CVE-2016-3718 SSRF Inbound (mvg + fill + url)"

• "ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid UPDATE"

• "ET WEB_SPECIFIC_APPS MyStats SQL Injection Attempt -- mystats.php details INSERT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 13"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS SaurusCMS class.writeexcel_worksheet.inc.php class_path Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php f INSERT"

• "ET WEB_SPECIFIC_APPS Digitizing Quote And Ordering System SQL Injection Attempt -- search.asp ordernum INSERT"

• "ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id SELECT"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp show_id ASCII"

• "ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page ASCII"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- dispimage.asp id ASCII"

• "ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID INSERT"

• "GPL EXPLOIT WEB-MISC JBoss RMI class download service directory listing attempt"

• "ET WEB_SPECIFIC_APPS Joomla! Soundset Component 'cat_id' Parameter DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- wp-trackback.php ASCII"

• "ET WEB_SPECIFIC_APPS McAfee Email Gateway QtnType Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp maingroup UPDATE"

• "ET WEB_SPECIFIC_APPS Solar Empire SQL Injection Attempt -- game_listing.php SELECT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Project_ID DELETE"

• "ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id DELETE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp year UPDATE"

• "ET WEB_SERVER Suspicious PHP UNZIP Tool Accessed on Internal Possibly Compromised Server"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publications_list.asp vjob SELECT"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Possible Zenoss Network Monitoring Application SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ASP SiteWare autoDealer SQL Injection Attempt -- detail.asp iPro SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp uid SELECT"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- res_details.asp resid UPDATE"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publication_view.asp InfoID UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip DELETE"

• "ET WEB_SPECIFIC_APPS ThWboard SQL Injection Attempt -- index.php board DELETE"

• "ET WEB_SPECIFIC_APPS GeekLog filemgt SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php did UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserEmail UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp area ASCII"

• "ET WEB_SPECIFIC_APPS IBM Possible Lotus Domino readme.nsf Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- fiche_membre.php idmembre INSERT"

• "ET WEB_SERVER ColdFusion administrator access"

• "ET WEB_CLIENT WSO Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php code UNION SELECT"

• "ET WEB_SPECIFIC_APPS Google Urchin session.cgi Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Fullaspsite GeometriX Download Portal SQL Injection Attempt -- down_indir.asp id ASCII"

• "ET WEB_SPECIFIC_APPS DirectNews menu_layers.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Banana Dance name Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS IBM Lotus Sametime Server stconf.nsf Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- inc_secureloginmanager.asp sent ASCII"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category DELETE"

• "ET WEB_SPECIFIC_APPS PhotoSmash action Parameter Cross Site Scripting Attempt"

• "ET EXPLOIT Joomla RCE (JDatabaseDriverMysqli) M2"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla SQL Reports user_id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Design4Online UserPages2 SQL Injection Attempt -- page.asp art_id UPDATE"

• "GPL WEB_SPECIFIC_APPS PHPNuke Forum viewtopic SQL insertion attempt"

• "ET WEB_SPECIFIC_APPS bbPress SQL Injection Attempt -- formatting-functions.php SELECT"

• "ET WEB_SPECIFIC_APPS Weekly Drawing Contest SQL Injection Attempt -- check_vote.php order DELETE"

• "ET WEB_SPECIFIC_APPS web wiz forums ThreadPage Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DVD Rental Software cat_id parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Manage Engine Service Desk Plus WorkOrder.do DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- index.php blogid SELECT"

• "ET WEB_SPECIFIC_APPS 1024 CMS filename Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Nuke Evolution Xtreme pid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Madirish Webmail basedir Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Loggix Project RFI Attempt"

• "ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk UPDATE"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp show_id UPDATE"

• "ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS WORDPRESS Plugin Accept Signups email Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php INSERT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp author UPDATE"

• "ET EXPLOIT TIBCO JasperReports Authenticated Arbitrary File Read Attempt (CVE-2018-5430)"

• "ET WEB_SERVER Kageyama Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS PHP Labs JobSitePro SQL Injection Attempt -- search.php salary ASCII"

• "ET WEB_SPECIFIC_APPS PWP Technologies The Classified Ad System SQL Injection Attempt -- default.asp main INSERT"

• "ET WEB_SPECIFIC_APPS Possible Joomla Com_joomlub Component Union Select SQL Injection"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php from UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id SELECT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php f DELETE"

• "ET WEB_SPECIFIC_APPS Possible eFront database.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp harf UNION SELECT"

• "ET WEB_SPECIFIC_APPS Digiappz DigiAffiliate SQL Injection Attempt -- visu_user.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- content.php where INSERT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php boardids UNION SELECT"

• "ET WEB_SPECIFIC_APPS MGB OpenSource Guestbook SQL Injection Attempt -- email.php id DELETE"

• "ET WEB_SERVER Attempt To Access MSSQL sp_adduser Stored Procedure Via URI to Create New Database User"

• "ET EXPLOIT Xiongmai/HiSilicon DVR - Request for User Details - Possible CVE-2017-7577 Exploit Attempt"

• "ET WEB_CLIENT Cpanel Cracker Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup SELECT"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- openlink.asp LinkID DELETE"

• "ET WEB_SPECIFIC_APPS WordPress 2 Click Social Media Buttons plugin pinterest-url parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Nabopoll SQL Injection Attempt -- result.php surv ASCII"

• "ET WEB_SPECIFIC_APPS 8pixel.net simpleblog SQL Injection Attempt -- edit.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) SQL Injection Attempt -- functions.php id ASCII"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid UPDATE"

• "ET WEB_SPECIFIC_APPS Interactive Web Solutions site_info.php DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS e107 123 FlashChat Module 123flashchat.php e107path Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php sid INSERT"

• "ET WEB_SPECIFIC_APPS SalesCart Shopping Cart SQL Injection Attempt -- reorder2.asp ASCII"

• "ET WEB_SPECIFIC_APPS Concrete CMS approveImmediately parameter Cross-Site Scripting Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- contacts.php text DELETE"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp sifre SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- save.php groupAddName UNION SELECT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board Lite SQL Injection Attempt -- thread.php threadvisit ASCII"

• "ET WEB_SPECIFIC_APPS vSupport Integrated Ticket System SQL Injection Attempt -- vBSupport.php ticketid INSERT"

• "ET WEB_SPECIFIC_APPS Fuzzylime Forum SQL Injection Attempt -- low.php topic SELECT"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PWP Technologies The Classified Ad System SQL Injection Attempt -- default.asp main ASCII"

• "ET WEB_SERVER Possible SQL Injection Using MSSQL sp_configure Command in HTTP URI"

• "ET WEB_SPECIFIC_APPS Comersus Shop Cart SQL Injection Attempt -- comersus_optReviewReadExec.asp idProduct DELETE"

• "ET WEB_SPECIFIC_APPS Possible DoubleQlik RCE via HTTP Request Tunneling Payload (CVE-2023-41265)"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php goTo UNION SELECT"

• "ET WEB_SPECIFIC_APPS SchoolMation studentmain.php session Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress Newsletter Plugin newsletter Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- content.asp sent UNION SELECT"

• "ET WEB_SPECIFIC_APPS Abtp Portal Project skel_null.php Local File Inclusion Attempt"

• "ET EXPLOIT TIBCO JasperReports Directory Traversal Attempt (CVE-2018-18809)"

• "ET WEB_SPECIFIC_APPS AWCM header.php Remote File Inclusion Attempt"

• "ET WEB_SERVER PHP Possible glob Remote File Inclusion Attempt"

• "ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)"

• "ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M2"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-functions.php UPDATE"

• "ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! CB Resume Builder 'group_id' Parameter DELETE FROM SQL Injection"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentmail ASCII"

• "ET WEB_SPECIFIC_APPS impressCMS tinymce root_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid ASCII"

• "ET WEB_SPECIFIC_APPS SalesCart Shopping Cart SQL Injection Attempt -- reorder2.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Mailing List plugin wpabspath parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- printmain.asp ID ASCII"

• "ET WEB_CLIENT Leaf PHPMailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Hazir Site SQL Injection Attempt -- giris_yap.asp sifre SELECT"

• "ET WEB_SPECIFIC_APPS SlimCMS edit.php pageid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewBugs.php s UPDATE"

• "ET WEB_SPECIFIC_APPS Multi SEO phpBB pfad parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID DELETE"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS SOPHIA CMS SQL Injection Attempt dsp_page.cfm pageid SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.php id INSERT"

• "ET WEB_SPECIFIC_APPS ContentNow SQL Injection Attempt -- index.php pageid SELECT"

• "GPL ATTACK_RESPONSE directory listing"

• "ET WEB_SPECIFIC_APPS AJ Forum SQL Injection Attempt -- topic_title.php td_id DELETE"

• "ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment UPDATE"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- mailer.w2b draft ASCII"

• "ET WEB_SPECIFIC_APPS Michelles L2J Dropcalc SQL Injection Attempt -- i-search.php itemid ASCII"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php id ASCII"

• "ET WEB_SPECIFIC_APPS MyForum centre.php padmin Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Absolute Image Gallery SQL Injection Attempt -- gallery.asp categoryid SELECT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 27"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id DELETE"

• "ET WEB_SPECIFIC_APPS JBoss JMX Console Beanshell Deployer .WAR File Upload and Deployment Cross Site Request Forgery Attempt"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtPas UNION SELECT"

• "ET WEB_SPECIFIC_APPS Weekly Drawing Contest SQL Injection Attempt -- check_vote.php order ASCII"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp title INSERT"

• "ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (41)"

• "ET WEB_SPECIFIC_APPS IBM Rational RequisitePro ReqWebHelp maxHits Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! JBudgetsMagic 'bid' Parameter DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Count Per Day Plugin page parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS BaconMap updatelist.php filepath Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS CreateAuction SQL Injection Attempt -- cats.asp catid DELETE"

• "ET WEB_SPECIFIC_APPS Nicola Asuni All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_functions_downloads.php download_category UPDATE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id UPDATE"

• "ET WEB_SPECIFIC_APPS Fatwiki datumscalc.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp order INSERT"

• "ET WEB_SPECIFIC_APPS Horde XSS attempt test.php"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- linkslist.asp psearch SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS joomla com_djcatalog component UPDATE SET SQL Injection"

• "ET WEB_SPECIFIC_APPS Super Link Exchange Script SQL Injection Attempt -- directory.php cat ASCII"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp ak INSERT"

• "ET WEB_SPECIFIC_APPS RSS Simple News news.php pid parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla com_perchagallery Component id Parameter UPDATE SET SQL Injection Attempt"

• "ET EXPLOIT Stored XSS and Webpass IoT devices CVE-2021-31643"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- send_password_preferences.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_ID UPDATE"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid UPDATE"

• "ET WEB_SPECIFIC_APPS Sonicwall Global Management System XSS attempt (scrn_name parameter)"

• "ET WEB_SERVER Tilde in URI - potential .aspx source disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) SQL Injection Attempt -- functions.php id INSERT"

• "ET WEB_SPECIFIC_APPS Okul Web Otomasyon Sistemi SQL Injection Attempt -- etkinlikbak.asp id UNION SELECT"

• "ET WEB_SERVER SHOW TABLES SQL Injection Attempt in URI"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- faqDsp.asp catcode UNION SELECT"

• "ET WEB_SPECIFIC_APPS Possible HP Power Manager Management Web Server Login Remote Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId ASCII"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS Ve-EDIT debug_php.php _GET Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Simploo CMS x parameter Remote PHP Code Execution Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php search SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newmessage UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php cid ASCII"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_class INSERT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp gallery_id UPDATE"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname INSERT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- polls.php id DELETE"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- autherror.cfm errorcode ASCII"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS PHP-Nuke Module Emporium SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- db_ecard.php start DELETE"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- email.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- dlwallpaper.php wallpaperid UPDATE"

• "ET WEB_SPECIFIC_APPS BibCiter projects.php idp Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick_mod ASCII"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nsbypass.php INSERT"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- openlink.asp LinkID ASCII"

• "ET WEB_CLIENT Generic PHP Uploader Accessed on External Server"

• "ET WEB_SPECIFIC_APPS BibCiter contacts.php idc Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla! SportFusion Component INSERT INTO SQL Injection"

• "ET WEB_SPECIFIC_APPS SchoolMation studentmain.php session Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- block-Old_Articles.php cat ASCII"

• "ET WEB_SPECIFIC_APPS All In One Control Panel SQL Injection Attempt -- cp_menu_data_file.php menu ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Nuke viewslink module sid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid UPDATE"

• "ET WEB_SPECIFIC_APPS MyStats SQL Injection Attempt -- mystats.php details DELETE"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- default.asp page SELECT"

• "ET WEB_SPECIFIC_APPS MyStats SQL Injection Attempt -- mystats.php details ASCII"

• "ET WEB_SPECIFIC_APPS Apache Archive editAppearance script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS TFTgallery adminlangfile Parameter Local File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! Foobla RSS Feed Creator Component 'id' Parameter DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php code DELETE"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp show_id SELECT"

• "ET WEB_SERVER Bot Search RFI Scan (ByroeNet/Casper-Like planetwork)"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 INSERT"

• "ET WEB_SPECIFIC_APPS Services id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ndCMS editor.aspx index Parameter SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id SELECT"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_downloads.php did SELECT"

• "ET WEB_SPECIFIC_APPS Oxygen (O2PHP Bulletin Board) SQL Injection Attempt -- viewthread.php pid DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid SELECT"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Joomla! SportFusion Component UNION SELECT SQL Injection"

• "ET WEB_SPECIFIC_APPS LiveCMS SQL Injection Attempt -- categoria.php cid ASCII"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php code SELECT"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue UPDATE"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp maingroup DELETE"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- openPolicy.asp policy DELETE"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- group.php id SELECT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id INSERT"

• "ET WEB_CLIENT X-Sec Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user ASCII"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php cat_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- dlwallpaper.php wallpaperid DELETE"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- rating.asp id INSERT"

• "ET WEB_SPECIFIC_APPS EvimGibi Pro Resim Galerisi kat_id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgForwardToRiskFilter.asp ServerName XSS Attempt"

• "ET WEB_SPECIFIC_APPS Weekly Drawing Contest SQL Injection Attempt -- check_vote.php order INSERT"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php qid UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms UNION SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- dispimage.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS AdaptBB latestposts.php forumspath Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id UPDATE"

• "ET WEB_SPECIFIC_APPS Online Grades parents.php ADD Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla com_adsmanager mosConfig_absolute_path Remote File inclusion Attempt"

• "ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine)"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp model DELETE"

• "ET WEB_SPECIFIC_APPS vBulletin vBTube vidid Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php category_id SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserPass ASCII"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_show.asp id2006quant DELETE"

• "ET WEB_SERVER Onmouseover= in URI - Likely Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity INSERT"

• "ET WEB_SPECIFIC_APPS Easynet4u Link Host directory.php cat_id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php comment DELETE"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php cid ASCII"

• "ET WEB_SPECIFIC_APPS WordPress wp-admin/admin.php Module Configuration Security Bypass Attempt"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewBugs.php s UNION SELECT"

• "ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp did SELECT"

• "ET WEB_SPECIFIC_APPS American Bankers Association Cross Site Scripting Attempt"

• "ET WEB_SERVER Likely Malicious Request for /proc//cmdline"

• "ET WEB_SPECIFIC_APPS ClaSS export.php ftype parameter Information Disclosure"

• "ET WEB_SPECIFIC_APPS Wordpress NextGEN Gallery Plugin Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- DisplayResults.php iSearchID INSERT"

• "ET WEB_SPECIFIC_APPS Constructr CMS SQL Injection Attempt -- constructrXmlOutput.content.xml.php page_id SELECT"

• "ET WEB_SPECIFIC_APPS joomla com_edir controller parameter Local File Inclusion vulnerability"

• "ET WEB_SPECIFIC_APPS PHP Labs JobSitePro SQL Injection Attempt -- search.php salary SELECT"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid DELETE"

• "ET WEB_SPECIFIC_APPS Joomla mod_virtuemart_featureprod module Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp sort DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_jradio controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid SELECT"

• "ET WEB_SPECIFIC_APPS Nakid CMS CKEditorFuncNum parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php board DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php category_id ASCII"

• "ET WEB_SERVER Oracle BEA Weblogic Server 10.3 searchQuery XSS attempt"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand DELETE"

• "ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Dynamic Widgets plugin id parameter Cross-Site Scripting Attempt"

• "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (SWNetPerfMon.db) (CVE-2020-10148)"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php login SELECT"

• "ET WEB_SPECIFIC_APPS Softbiz Article Directory Script sbiz_id Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS SalesCart Shopping Cart SQL Injection Attempt -- reorder2.asp SELECT"

• "ET WEB_SPECIFIC_APPS Aigaion ID Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Site Engine Manager SQL Injection Attempt -- index.asp mid UPDATE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_cat_id ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp currentpage SELECT"

• "ET WEB_SERVER ElasticSearch Directory Traversal Attempt (CVE-2015-3337)"

• "ET WEB_SPECIFIC_APPS Possible Docebo UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php board ASCII"

• "ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user UPDATE"

• "ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-6"

• "ET WEB_SPECIFIC_APPS Jetik.net ESA diger.php KayitNo Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- list.asp INSERT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- list.asp ASCII"

• "ET WEB_SPECIFIC_APPS BasicForum SQL Injection Attempt -- edit.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp pass UPDATE"

• "ET SCAN abdullkarem Wordpress PHP Scanner"

• "ET WEB_SERVER SHOW CHARACTER SET SQL Injection Attempt in URI"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp keyword UPDATE"

• "ET WEB_SPECIFIC_APPS PHool mainnav Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS playSMS function.php apps_path libs parameter local file inclusion"

• "ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- admin.php uploadimage INSERT"

• "ET WEB_SPECIFIC_APPS NetClassifieds Premium Edition SQL Injection Attempt -- ViewCat.php s_user_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php website SELECT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp keyword ASCII"

• "ET WEB_SPECIFIC_APPS LogAnalyzer asktheoracle.php file XSS Attempt"

• "ET WEB_SPECIFIC_APPS JiRos FAQ Manager SQL Injection Attempt -- index.asp tID UPDATE"

• "ET WEB_SPECIFIC_APPS Michelles L2J Dropcalc SQL Injection Attempt -- i-search.php itemid INSERT"

• "ET WEB_SPECIFIC_APPS ACGVannu SQL Injection Attempt -- modif.html id_mod INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID ASCII"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp In UPDATE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- mesajkutum.asp mesajno SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id DELETE"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php t UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_dshop Component UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x UPDATE"

• "ET WEB_SPECIFIC_APPS Vlog System note parameter SQL Injection"

• "ET WEB_SERVER X-Sec Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter INSERT INTO SQL Injection Vulnerability"

• "ET ACTIVEX Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (3)"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_code ASCII"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php cat_id SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 UNION SELECT"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue SELECT"

• "ET WEB_SPECIFIC_APPS WordPress inline-gallery do parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS phptraverse mp3_id.php GLOBALS Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id UPDATE"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp ak DELETE"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler SELECT"

• "ET WEB_SPECIFIC_APPS FCMS familynews.php current_user_id Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php us INSERT"

• "ET WEB_SPECIFIC_APPS pragmaMx img_url parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- update_profile.php username INSERT"

• "ET WEB_SPECIFIC_APPS PHPizabi dac.php sendChatData Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_id ASCII"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup INSERT"

• "ET WEB_SPECIFIC_APPS TinyBrowser tinybrowser.php file Script Execution Attempt"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- letterman.class.php id ASCII"

• "ET WEB_SPECIFIC_APPS mcRefer SQL Injection Attempt -- install.php bgcolor SELECT"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp agent ASCII"

• "ET WEB_SPECIFIC_APPS Possible Joomla! Game Server Component 'id' Parameter DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Philboard SQL Injection Attempt -- philboard_forum.asp forumid UPDATE"

• "ET WEB_SPECIFIC_APPS Oxygen (O2PHP Bulletin Board) SQL Injection Attempt -- viewthread.php pid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp area UPDATE"

• "ET WEB_SPECIFIC_APPS Wordpress NextGEN Gallery plugin test-head parameter XSS Attempt"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp pass UNION SELECT"

• "ET WEB_SPECIFIC_APPS 8pixel.net simpleblog SQL Injection Attempt -- edit.asp id ASCII"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- save.php groupAddName UPDATE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php cat_id ASCII"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick_mod INSERT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php password INSERT"

• "ET WEB_SERVER ColdFusion path disclosure to get the absolute path"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SERVER Attempt To Access MSSQL xp_readerrorlogs Stored Procedure Via URI to View Error Logs"

• "ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite ASCII"

• "ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 INSERT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- preferences.asp ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS SocialEngine browse_classifieds.php Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS YouTube Blog cuerpo.php base_archivo Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID UPDATE"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- com_comment.php mcname INSERT"

• "ET WEB_SPECIFIC_APPS WordPress Download Manager cid parameter Cross-Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- faqDsp.asp catcode INSERT"

• "ET WEB_SPECIFIC_APPS 29o3 CMS pageDescriptionObject.php LibDir Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_cat_id INSERT"

• "ET WEB_SPECIFIC_APPS Digiappz DigiAffiliate SQL Injection Attempt -- visu_user.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_rsgallery2 Component catid Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS vSupport Integrated Ticket System SQL Injection Attempt -- vBSupport.php ticketid UNION SELECT"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- prikazInformacije.php IDStranicaPodaci UPDATE"

• "ET WEB_SPECIFIC_APPS RealtyListings detail.asp iPro Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php email UPDATE"

• "ET WEB_SPECIFIC_APPS WeBid ST_countries.php include_path Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Free Directory Script 1.1.1 API_HOME_DIR Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Mambo AHS Shop component UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Venalsur Booking Centre HotelID Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.register.inc.php ASCII"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php picID INSERT"

• "ET WEB_SPECIFIC_APPS uniForum SQL Injection Attempt -- wbsearch.aspx INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php cid UPDATE"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp orderby UPDATE"

• "ET WEB_SPECIFIC_APPS SiteGo get_templet.php of blue Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid ASCII"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- viewlinks.asp CategoryID SELECT"

• "ET WEB_SPECIFIC_APPS starCMS q parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordOld ASCII"

• "ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M3"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- users.php id DELETE"

• "ET WEB_SPECIFIC_APPS Joomla com_rwcards mosConfig_absolute_path Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS fipsCMS SQL Injection Attempt -- index.asp fid UPDATE"

• "ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 1"

• "ET WEB_SERVER WebResource.axd access without t (time) parameter - possible ASP padding-oracle exploit"

• "ET WEB_SPECIFIC_APPS WordPress Huge IT Image Gallery 1.0.0 SQL Injection"

• "ET WEB_SPECIFIC_APPS pfile file.php id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- search.asp search INSERT"

• "ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp INSERT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- preferences.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- thumbnails.asp ci SELECT"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php from ASCII"

• "ET WEB_SPECIFIC_APPS WordPress Chocolate WP Theme src Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS B-Cumulus tagcloud-ru.swf Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Job2C detail.php adtype Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- search.php search ASCII"

• "ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id UPDATE"

• "ET WEB_SPECIFIC_APPS LI-Guestbook SQL Injection Attempt -- guestbook.php country INSERT"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- register.asp UserUpdate UNION SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp categoryID_list SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Foobla Suggestions Component idea_id SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Absolute Image Gallery SQL Injection Attempt -- gallery.asp categoryid UPDATE"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php from INSERT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup ASCII"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 25"

• "ET WEB_SPECIFIC_APPS WarHound General Shopping Cart SQL Injection Attempt -- item.asp ItemID INSERT"

• "ET WEB_SERVER Possible HTTP 403 XSS Attempt (Local Source)"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- repass.php nick_mod DELETE"

• "ET WEB_CLIENT Leaf PHPMailer Accessed on External Server"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 5"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup ASCII"

• "ET WEB_SPECIFIC_APPS coRED CMS rubID Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Possible Joomla! Game Server Component 'id' Parameter UPDATE SET SQL Injection"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids DELETE"

• "ET WEB_SPECIFIC_APPS mySeatXT SQL Injection Attempt autocomplete.php field SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_job Component id_job Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Mambo AHS Shop component SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Papoo CMS message_class.php pfadhier Local File Inclusion"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php by DELETE"

• "ET WEB_SPECIFIC_APPS RevokeSoft RevokeBB SQL Injection Attempt -- class_users.php ASCII"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- a_register.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Keynect Ecommerce SQL Injection Attempt -- products.php ctf UPDATE"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 32"

• "ET WEB_SPECIFIC_APPS Mp3 Online Id Tag Editor getid3.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHPKit SQL Injection Attempt -- include.php catid UNION SELECT"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- search_listing.asp category UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 UPDATE"

• "ET WEB_SPECIFIC_APPS AstroSPACES profile.php SQL Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear UPDATE"

• "ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter SELECT FROM SQL Injection Vulnerability"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php user_login_cookie INSERT"

• "ET EXPLOIT AsusWRT RT-AC750GF Cross-Site Request Forgery"

• "ET WEB_SERVER MYSQL Benchmark Command in URI to Consume Server Resources"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 3"

• "ET WEB_SPECIFIC_APPS WordPress Lazyest Gallery Plugin image Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Invision Community Blog Mod SQL Injection Attempt -- entry_reply_entry.php eid DELETE"

• "ET WEB_SPECIFIC_APPS TinyButStrong bs_us_examples_0view.php script Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla com_perchagallery Component id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp agentid ASCII"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activenews_view.asp articleID INSERT"

• "ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! Foobla RSS Feed Creator Component 'id' Parameter SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 SELECT"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- voirannonce.php no INSERT"

• "ET WEB_SPECIFIC_APPS WordPress FSML Plugin fsml-hideshow.js.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- details.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS HIOX Star Rating System Script (HSRS) SQL Injection Attempt -- addrating.php url DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid DELETE"

• "ET WEB_SPECIFIC_APPS Bluetrait SQL Injection Attempt -- bt-trackback.php UPDATE"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name ASCII"

• "ET WEB_SPECIFIC_APPS Sourdough neededFiles Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS impressCMS dhtmltextarea root_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php picID SELECT"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- navigacija.php IDMeniGlavni INSERT"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- viewlinks.asp CategoryID UPDATE"

• "ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS coRED CMS rubID Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PhreeBooks js_include.php form Parameter Cross Site Scripting Attempt 2"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp menuSelect UPDATE"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php position UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_ckforms controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp UPDATE"

• "ET WEB_SPECIFIC_APPS Philboard SQL Injection Attempt -- philboard_forum.asp forumid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Sahana Agasti dao.php approot Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_avosbillets Component id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on Compromised External Server"

• "ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php boardids ASCII"

• "ET WEB_SPECIFIC_APPS Joomla Foobla Suggestions Component idea_id DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER Attempt To Access MSSQL xp_servicecontrol Stored Procedure Via URI"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php email INSERT"

• "ET WEB_SPECIFIC_APPS SunByte e-Flower popupproduct.php id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- okvalannonce.php idannonce DELETE"

• "ET WEB_SPECIFIC_APPS iScripts MultiCart orderid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS JiRos FAQ Manager SQL Injection Attempt -- index.asp tID DELETE"

• "ET WEB_SPECIFIC_APPS Digiappz DigiAffiliate SQL Injection Attempt -- visu_user.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- wp-trackback.php INSERT"

• "ET WEB_SPECIFIC_APPS Joomla com_obsuggest controller parameter Local File Inclusion Attempt"

• "ET WEB_CLIENT Possible HTTP 503 XSS Attempt (External Source)"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp pass INSERT"

• "ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp SELECT"

• "ET WEB_SPECIFIC_APPS Nicola Asuni All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_functions_downloads.php download_category DELETE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php id DELETE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vin UNION SELECT"

• "ET WEB_SPECIFIC_APPS ZyXEL ZyWALL LoginPassword/HiddenPassword Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- wp-trackback.php UPDATE"

• "ET WEB_SPECIFIC_APPS Michelles L2J Dropcalc SQL Injection Attempt -- i-search.php itemid UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp Keyword INSERT"

• "ET WEB_SPECIFIC_APPS Invision Community Blog Mod SQL Injection Attempt -- entry_reply_entry.php eid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Lantern CMS intPassedLocationID Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Manage Engine Service Desk Plus WorkOrder.do INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_Type_ID SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- users.php id SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newname ASCII"

• "ET WEB_SPECIFIC_APPS Jetik.net ESA sayfalar.php KayitNo Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp order ASCII"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- wallpaper.php wallpaperid UNION SELECT"

• "ET EXPLOIT Attempted ThinkPHP < 5.2.x RCE Outbound (CVE-2018-20062)"

• "ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_authorization.php xuser_name INSERT"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_Type_ID UPDATE"

• "ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Fullaspsite ASP Hosting Site SQL Injection Attempt -- listmain.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Outgoing_ID ASCII"

• "ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Possible APC Switched Rack PDU Web Administration Interface Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Possible JBoss/JMX InvokerServlet Auth Bypass Attempt"

• "ET WEB_SPECIFIC_APPS JiRos Links Manager SQL Injection Attempt -- viewlinks.asp CategoryID DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- print.php news_id DELETE"

• "ET WEB_SPECIFIC_APPS Xtreme ASP Photo Gallery SQL Injection Attempt -- displaypic.asp sortorder SELECT"

• "ET WEB_SPECIFIC_APPS All In One Control Panel (AIOCP) SQL Injection Attempt -- cp_authorization.php xuser_name SELECT"

• "ET WEB_SPECIFIC_APPS ProjectButler RFI attempt"

• "ET WEB_SPECIFIC_APPS Flash Quiz answers.php order_number Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS SalesCart Shopping Cart SQL Injection Attempt -- reorder2.asp DELETE"

• "ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user INSERT"

• "ET EXPLOIT Ecessa WANWorx WVR-30 Cross-Site Request Forgery"

• "ET WEB_SPECIFIC_APPS Joomla techfolio component UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Audio showfile Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS FreeWebShop startmodules.inc.php lang_file Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id ASCII"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- polls.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- journal.php w DELETE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- category.php catid INSERT"

• "ET WEB_SPECIFIC_APPS ASP ListPics SQL Injection Attempt -- listpics.asp ID DELETE"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp user UPDATE"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php id ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newwebsite ASCII"

• "ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- contacts.php text UNION SELECT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- send_password_preferences.asp DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress Google Doc Embedder plugin file parameter Local File Inclusion Attempt"

• "ET SCAN NMAP SQL Spider Scan"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm langId ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Daily delete.php id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key UPDATE"

• "ET WEB_SPECIFIC_APPS DynPage dynpage_load.php file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_zoomportfolio component SELECT FROM SQL Injection Attempt"

• "ET WEB_SERVER ColdFusion Path Traversal (locale 3/5)"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear ASCII"

• "ET WEB_SPECIFIC_APPS ASP SiteWare autoDealer SQL Injection Attempt -- detail.asp iPro UPDATE"

• "ET WEB_SPECIFIC_APPS Ban SQL Injection Attempt -- connexion.php id INSERT"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php user_login_cookie SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php message DELETE"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php sk UPDATE"

• "ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- weblinks.php where DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id SELECT"

• "ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment INSERT"

• "ET WEB_SERVER Gootkit Website Infection Receiving FTP Credentials from Control Server"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp sale_type UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla Component Ek rishta 2.10 - SQL Injection 1"

• "ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user SELECT"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_forum DELETE"

• "ET WEB_SPECIFIC_APPS FireStats window-new-edit-site.php Cross Site Scripting Attempt"

• "ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- detail.asp property_id SELECT"

• "ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Possible Achievo userid= Variable UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id ASCII"

• "ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Kolayindir Download (Yenionline) SQL Injection Attempt -- down.asp id UPDATE"

• "ET WEB_SERVER /bin/bash In URI, Possible Shell Command Execution Attempt Within Web Exploit"

• "ET WEB_SPECIFIC_APPS Blogplus block_right.php Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Joomla! JBudgetsMagic 'bid' Parameter UPDATE SET SQL Injection"

• "ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php from DELETE"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php id SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum2.asp soruid DELETE"

• "ET WEB_SPECIFIC_APPS Beerwins PHPLinkAdmin edlink.php linkid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php by UNION SELECT"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- com_comment.php mcname DELETE"

• "ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000"

• "ET WEB_CLIENT Generic Mailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- compare_product.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS VidShare Pro listing_video.php catid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Solar Empire SQL Injection Attempt -- game_listing.php UPDATE"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp keyword UNION SELECT"

• "ET WEB_SPECIFIC_APPS phPortal gunaysoft.php icerikyolu Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS eGroupware loaddetails.php script UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS While You Were Out (WYWO) InOut Board SQL Injection Attempt -- phonemessage.asp num ASCII"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- pfs.edit.inc.php DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- download_image.asp image_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PowerEasy ComeUrl Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank ASCII"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- print.php id SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php password UPDATE"

• "ET WEB_SPECIFIC_APPS Website Baker SQL Injection Attempt -- eWebQuiz.asp QuizID ASCII"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp pass DELETE"

• "ET WEB_SPECIFIC_APPS Zabbix popup.php DELETE FROM SQL Injection Vulnerability"

• "ET WEB_SERVER SELECT INSTR in URI Possible ORACLE Related Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Audins Audiens SQL Injection Attempt -- index.php PHPSESSID INSERT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SERVER jQuery File Upload Attempt"

• "ET WEB_SPECIFIC_APPS Minerva mod SQL Injection Attempt -- forum.php c ASCII"

• "ET WEB_SPECIFIC_APPS Alan Ward A-Cart Pro SQL Injection Attempt -- product.asp productid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listmain.asp cat UNION SELECT"

• "ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete INSERT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- content.asp sent INSERT"

• "ET WEB_SPECIFIC_APPS Apache Archive useredit script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php sk INSERT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 30"

• "ET WEB_SPECIFIC_APPS Audins Audiens SQL Injection Attempt -- index.php PHPSESSID UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_job Component id_job Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SERVER Possible SQL Injection Attempt DELETE FROM in HTTP URI"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- a_register.asp INSERT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- order-track.php orderNo UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_phocadownload folder Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler UNION SELECT"

• "ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName UNION SELECT"

• "GPL EXPLOIT iisadmpwd attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid INSERT"

• "ET WEB_SPECIFIC_APPS Mambo LaiThai SQL Injection Attempt -- mambo.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- content.asp sent UPDATE"

• "ET WEB_SPECIFIC_APPS Serendipity SQL Injection Attempt -- index.php serendipity UPDATE"

• "ET EXPLOIT NB8-04 - Possible Unauthed RCE via whitelist bypass"

• "ET TROJAN Polaris Botnet User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Potential Cewolf DOS attempt"

• "ET WEB_SPECIFIC_APPS Opencadastre soustab.php script Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS RevokeSoft RevokeBB SQL Injection Attempt -- class_users.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice DELETE"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP id SELECT"

• "ET WEB_SPECIFIC_APPS 29o3 CMS layoutManager.php LibDir Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- prikazInformacije.php IDStranicaPodaci DELETE"

• "ET WEB_SPECIFIC_APPS GlobalMegaCorp dvddb SQL Injection Attempt -- common.php user SELECT"

• "ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php f UPDATE"

• "ET WEB_SPECIFIC_APPS FireStats window-add-excluded-ip.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS phpBB SQL Injection Attempt -- admin_hacks_list.php hack_id SELECT"

• "ET WEB_SPECIFIC_APPS webEdition CMS openBrowser.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- wp-trackback.php SELECT"

• "ET WEB_SPECIFIC_APPS Dog Pedigree Online Database managePerson.php personId Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Magento Shoplift Exploit Inbound"

• "GPL EXPLOIT unicode directory traversal attempt"

• "ET WEB_SPECIFIC_APPS Hunkaray Duyuru Scripti SQL Injection Attempt -- oku.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice INSERT"

• "ET WEB_SPECIFIC_APPS CSSTidy css_optimiser.php url Parameter Cross Site Scripting Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS YourFreeWorld Classifieds Blaster tr.php id Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS DAMICMS Cross-Site Request Forgery (Add Admin)"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php email DELETE"

• "ET EXPLOIT Possible CVE-2017-12629 RCE Exploit Attempt (HTTP GET 1)"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- printmain.asp ID SELECT"

• "ET WEB_SPECIFIC_APPS WeBid active_auctions.php lan Parameter Local File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Serendipity SQL Injection Attempt -- index.php serendipity INSERT"

• "ET WEB_SPECIFIC_APPS PWP Technologies The Classified Ad System SQL Injection Attempt -- default.asp main UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php defaultLetter SELECT"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentmail UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_jphoto Component Id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp kullanici_ismi SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserType UPDATE"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- meal_rest.asp mealid SELECT"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- news.php news_cat_id UPDATE"

• "ET WEB_SPECIFIC_APPS Nucleus media.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS SchoolMation studentmain.php session Parameter Cross Site Scripting Attempt"

• "ET SCAN Nikto Web App Scan in Progress"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie ASCII"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- voirannonce.php no DELETE"

• "ET WEB_SERVER PHP Possible zlib Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- kullanicilistesi.asp harf DELETE"

• "ET WEB_SERVER 3Com Intelligent Management Center Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_blog Component id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- user.php email UNION SELECT"

• "ET WEB_SPECIFIC_APPS Appointment Hour Booking - WordPress Plugin - Stored XSS (CVE-2019-13505)"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- DisplayResults.php iSearchID DELETE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp kullanici UNION SELECT"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- users.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- modules.php active UPDATE"

• "ET WEB_SERVER Tilde in URI - potential .cgi source disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp AlphaSort INSERT"

• "ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php ASCII"

• "ET WEB_SPECIFIC_APPS WeBid ST_browsers.php include_path Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp kullanici UPDATE"

• "ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter SELECT FROM SQL Injection Attempt"

• "ET EXPLOIT Ubiquiti Networks UniFi Cloud Key Firm v0.6.1 Host Remote Command Execution attempt"

• "ET WEB_SPECIFIC_APPS digiSHOP cart.php UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- db_ecard.php start UPDATE"

• "ET WEB_SPECIFIC_APPS uniForum SQL Injection Attempt -- wbsearch.aspx UPDATE"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php ASCII"

• "ET WEB_SPECIFIC_APPS Ban SQL Injection Attempt -- connexion.php id ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp In DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Site Engine Manager SQL Injection Attempt -- index.asp mid UNION SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp categoryID_list INSERT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php category_id ASCII"

• "ET WEB_SPECIFIC_APPS TotalCalendar cms_detect.php include Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php ps INSERT"

• "ET WEB_SPECIFIC_APPS PhpTax Possible Remote Code Exec"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- index.cfm SELECT"

• "ET WEB_SPECIFIC_APPS Omegasoft SQL Injection Attempt -- OmegaMw7.asp UPDATE"

• "ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .asp Filename Extension Parsing File Upload Security Bypass Attempt (asp)"

• "ET WEB_SPECIFIC_APPS Joomla com_mailchimpccnewsletter controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating UNION SELECT"

• "ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk DELETE"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- print.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla Component com_communitypolls controller Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vehicleID DELETE"

• "ET WEB_SPECIFIC_APPS eGroupware loaddetails.php script SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP kid ASCII"

• "ET WEB_SPECIFIC_APPS WebSense Email security msgForwardToRiskFilter.asp Queue XSS Attempt"

• "ET WEB_SPECIFIC_APPS vBSupport SQL Injection Attempt -- vBSupport.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp Keyword ASCII"

• "ET WEB_SPECIFIC_APPS PHPCMS modelid Parameter SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Sphider SQL Injection Attempt -- search.php category UPDATE"

• "ET WEB_SPECIFIC_APPS Possible IBM BladeCenter Management Module power_module.php Cross Site Scripting Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS PHP-Nuke viewslink module sid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_doc UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpCow skin_file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum2.asp soruid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla mod_virtuemart_latestprod module Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS NewsOffice news_show.php newsoffice_directory Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id ASCII"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- recipe.php recipeid DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp currentpage ASCII"

• "ET WEB_SPECIFIC_APPS aFAQ SQL Injection Attempt -- faqDsp.asp catcode UPDATE"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- login.php login_username DELETE"

• "ET WEB_SPECIFIC_APPS Kalptaru Infotech Product Sale Framework customer.forumtopic.php forum_topic_id parameter SQL Injection"

• "ET CURRENT_EVENTS ANTIBOT Phishing Panel Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp currentpage DELETE"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php sk SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum.asp baslik INSERT"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- content.php where ASCII"

• "ET WEB_SPECIFIC_APPS Joomla AjaxChat Component ajcuser.php GLOBALS Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_show.asp id2006quant UPDATE"

• "ET WEB_SPECIFIC_APPS pfile file.php id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_CLIENT MINI MO Webshell Accessed on External Compromised Server"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 7"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp listing_price DELETE"

• "ET WEB_SPECIFIC_APPS Possible Docebo INSERT INTO Injection Attempt"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newwebsite INSERT"

• "ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- sections.php text ASCII"

• "ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id ASCII"

• "ET WEB_SPECIFIC_APPS NetClassifieds Premium Edition SQL Injection Attempt -- ViewCat.php s_user_id UPDATE"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_user UNION SELECT"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php name UNION SELECT"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Aigaion ID Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp sale_type INSERT"

• "ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id DELETE"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- wallpaper.php wallpaperid DELETE"

• "ET WEB_SPECIFIC_APPS DirectNews remote.php Remote File inclusion Attempt"

• "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"

• "ET WEB_SPECIFIC_APPS IBM Rational RequisitePro ReqWebHelp scope Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Unique Ads (UDS) SQL Injection Attempt -- banner.php bid INSERT"

• "ET WEB_SPECIFIC_APPS Constructr CMS SQL Injection Attempt -- constructrXmlOutput.content.xml.php page_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- list.asp DELETE"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- journal.php w UNION SELECT"

• "ET WEB_SPECIFIC_APPS WordPress Facebook-Page-Promoter-Lightbox settings-updated Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Immophp annonce parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS vBulletin vbBux vbplaza.php Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style ASCII"

• "ET WEB_SPECIFIC_APPS MyOWNspace getfeed.php file Parameter Local File Inclusion Attempt(2)"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php post_id SELECT"

• "ET WEB_SPECIFIC_APPS Worksystems linkbar.php cfile Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PowerPHPBoard header.inc.php settings Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS TotalCalendar config.php inc_dir Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler DELETE"

• "ET WEB_SPECIFIC_APPS Immophp annonce parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS CultBooking lang Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album ASCII"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- index.cfm UPDATE"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp UNION SELECT"

• "ET WEB_SPECIFIC_APPS Infinitytechs Restaurants CM SQL Injection Attempt -- meal_rest.asp mealid UNION SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- giris.asp kullaniciadi SELECT"

• "ET WEB_SPECIFIC_APPS WHCMS banco Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- modules.php active DELETE"

• "ET WEB_SPECIFIC_APPS Moodle PHPCOVERAGE_HOME Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentmail INSERT"

• "ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp categoryID_list ASCII"

• "ET WEB_SPECIFIC_APPS Metyus Okul Yonetim Sistemi SQL Injection Attempt -- uye_giris_islem.asp kullanici_ismi UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_bulkenquery controller parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template ASCII"

• "ET WEB_SPECIFIC_APPS Flash Quiz results_table_web.php quiz Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- details.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- status.asp id ASCII"

• "ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Project_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Lito Lite CMS cate.php cid parameter Remote SQL Injection"

• "ET WEB_SPECIFIC_APPS Vizayn Haber SQL Injection Attempt -- haberdetay.asp id INSERT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php ps UPDATE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS bug_actiongroup_page.php script Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice INSERT"

• "ET WEB_SPECIFIC_APPS WordPress PHP Speedy Plugin page Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php SELECT"

• "ET WEB_SPECIFIC_APPS Ultimate Survey Pro SQL Injection Attempt -- index.asp did DELETE"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- print.php news_id ASCII"

• "ET WEB_SPECIFIC_APPS Nabopoll SQL Injection Attempt -- result.php surv UNION SELECT"

• "ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID ASCII"

• "ET WEB_SPECIFIC_APPS Experts answer.php question_id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Neocrome Land Down Under (LDU) SQL Injection Attempt -- journal.php w ASCII"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtUse DELETE"

• "ET TROJAN Polaris Botnet User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name INSERT"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php product_id DELETE"

• "ET WEB_SPECIFIC_APPS Slooze Web Photo Album file Parameter Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.register.inc.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Realtor v_cat SQL Injection"

• "ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews SELECT"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- detail.asp p SELECT"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- DocPay.w2b listDocPay INSERT"

• "ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating SELECT"

• "ET WEB_SPECIFIC_APPS Serendipity SQL Injection Attempt -- index.php serendipity UNION SELECT"

• "ET WEB_SERVER Generic WSO Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php website UPDATE"

• "ET WEB_SPECIFIC_APPS Doug Luxem Liberum Help Desk SQL Injection Attempt -- forgotpass.asp uid DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress Token Manager Plugin tokenmanageredit page XSS Attempt"

• "ET EXPLOIT Cisco Viptela vManage Directory Traversal (CVE-2020-27128)"

• "ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID DELETE"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- gmail.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp order UPDATE"

• "ET WEB_SPECIFIC_APPS MyStats SQL Injection Attempt -- mystats.php details SELECT"

• "ET SCAN Tomcat Auth Brute Force attempt (admin)"

• "ET WEB_SPECIFIC_APPS WB News Archive.php config Parameter Remote File Inclusion -2"

• "ET WEB_SPECIFIC_APPS Jasmine CMS SQL Injection Attempt -- news.php item DELETE"

• "ET WEB_SPECIFIC_APPS ViArt Shop Evaluation previews_functions.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS LushiWarPlaner SQL Injection Attempt -- register.php id UPDATE"

• "GPL WEB_SERVER .htpasswd access"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php did ASCII"

• "ET WEB_SPECIFIC_APPS Achievo debugger.php config_atkroot parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php password UNION SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordNew UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! CB Resume Builder 'group_id' Parameter UPDATE SET SQL Injection"

• "ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank DELETE"

• "ET WEB_SERVER SELECT USER SQL Injection Attempt in URI"

• "ET WEB_SPECIFIC_APPS Keynect Ecommerce SQL Injection Attempt -- products.php ctf UNION SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp listing_price UPDATE"

• "ET WEB_SPECIFIC_APPS WHCMS smarty Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp manufacturer SELECT"

• "ET WEB_SPECIFIC_APPS mcRefer SQL Injection Attempt -- install.php bgcolor UPDATE"

• "ET WEB_SPECIFIC_APPS PHP-fusion Team Structure Infusion team_id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_joaktree Component treeId Parameter INSERT INTO SQL Injection Attempt"

• "ET CURRENT_EVENTS 16Shop Phishing Kit Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS ASP ListPics SQL Injection Attempt -- listpics.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS Possible Apache Tomcat Host Manager Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS CreateAuction SQL Injection Attempt -- cats.asp catid SELECT"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php lastname UNION SELECT"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentmail UNION SELECT"

• "ET WEB_SPECIFIC_APPS RecordPress header.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PozScripts Classified Ads 'store_info.php' SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id ASCII"

• "ET WEB_SPECIFIC_APPS Noname Media Photo Galerie Standard SQL Injection Attempt -- view.php id SELECT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserPass DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp loc DELETE"

• "ET WEB_SPECIFIC_APPS Link Exchange Lite SQL Injection Attempt -- search.asp SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear DELETE"

• "ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php firstname SELECT"

• "ET WEB_SPECIFIC_APPS Plogger phpThumb.php h Parameter Remote File Disclosure Attempt"

• "ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page DELETE"

• "ET WEB_SPECIFIC_APPS e107 IMAGES_DIRECTORY Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id UNION SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Novell ZENworks Patch Management (ZPM) SQL Injection Attempt -- downloadreport.asp pass SELECT"

• "ET WEB_SPECIFIC_APPS ScriptMate User Manager SQL Injection Attempt -- usermessages.asp mesid SELECT"

• "ET WEB_SPECIFIC_APPS Rematic CMS referenzdetail.php id parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Apache Archive addLegacyArtifactPath.action Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PHP Labs JobSitePro SQL Injection Attempt -- search.php salary DELETE"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp area DELETE"

• "ET WEB_SPECIFIC_APPS PHP-Fusion Members CV(job) Module members.php sortby parameter SQL injection"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name SELECT"

• "ET WEB_SPECIFIC_APPS Nuke Evolution Xtreme pid Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Recipes Complete Website SQL Injection Attempt -- list.php categoryid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchmain.asp cat INSERT"

• "ET WEB_SPECIFIC_APPS ANGEL Learning Management Suite (LMS) SQL Injection Attempt -- default.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x SELECT"

• "ET WEB_SPECIFIC_APPS AdaptCMS sitepath parameter Remote File Inclusion Vulnerability"

• "ET TROJAN ELF/Mirai Variant User-Agent (Outbound)"

• "ET WEB_SERVER Owl PHPMailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS BP Blog SQL Injection Attempt -- default.asp layout INSERT"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp state UPDATE"

• "ET WEB_SPECIFIC_APPS Wordpress Plugin Tinymce Thumbnail Gallery href parameter Remote File Disclosure Attempt"

• "ET WEB_SPECIFIC_APPS Guestbook guestbook.php mes_id SQL Injection attempt"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite DELETE"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- members.asp sent INSERT"

• "ET WEB_SPECIFIC_APPS Fixit iDMS Pro Image Gallery SQL Injection Attempt -- filelist.asp parentid SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp order SELECT"

• "ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName ASCII"

• "ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id SELECT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET EXPLOIT BlueCoat CAS v1.3.7.1 Report Email Command Injection attempt"

• "ET WEB_SPECIFIC_APPS 2FLY Gift Delivery 2fly_gift.php gameid Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- G_Display.php iCategoryUnq INSERT"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick UNION SELECT"

• "ET ACTIVEX DB Software Laboratory VImpX.ocx ActiveX Control Multiple Insecure Methods"

• "ET WEB_SPECIFIC_APPS Auto Listings Script moreinfo.php itemno Parameter SQL Injection"

• "ET EXPLOIT TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Command Execution"

• "ET WEB_SPECIFIC_APPS nicLOR CMS-School showarticle.php aID Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick_mod SELECT"

• "ET WEB_SPECIFIC_APPS WP Forum Server wordpress plugin SQL Injection Attempt -- feed.php topic ASCII"

• "ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- order-track.php orderNo ASCII"

• "ET WEB_SPECIFIC_APPS Amateur Photographer Image Gallery albumid parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS PointComma pctemplate.php pcConfig Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- dispimage.asp id SELECT"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php picID UNION SELECT"

• "ET WEB_SPECIFIC_APPS coRED CMS rubID Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserPass UPDATE"

• "ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id DELETE"

• "ET WEB_SPECIFIC_APPS BasicForum SQL Injection Attempt -- edit.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- userdetail.php id UPDATE"

• "ET WEB_SPECIFIC_APPS aFAQ SQL Injection Attempt -- faqDsp.asp catcode INSERT"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Abtp Portal Project skel_null.php Remote File Inclusion Attempt"

• "ET WEB_CLIENT ALFA TEaM Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup UPDATE"

• "ET WEB_SPECIFIC_APPS Connectix Boards SQL Injection Attempt -- admin.php uploadimage DELETE"

• "ET WEB_CLIENT Generic Mailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS WHM filtername Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp ASCII"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat DELETE"

• "ET WEB_SPECIFIC_APPS Michelles L2J Dropcalc SQL Injection Attempt -- i-search.php itemid SELECT"

• "ET WEB_SPECIFIC_APPS Possible Achievo userid= Variable DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp state UNION SELECT"

• "ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment UNION SELECT"

• "ET WEB_SPECIFIC_APPS Portix-PHP SQL Injection Attempt -- archive.php blogid SELECT"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp maingroup ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Fusion maincore.php folder_level Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php DELETE"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp currentpage DELETE"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS WP Jetpack/Twentyfifteen Possible XSS Request"

• "ET WEB_SERVER /bin/ksh In URI Possible Shell Command Execution Attempt"

• "ET WEB_SERVER Predator the Thief Password Prompt Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS E-Shop Shopping Cart Script search_results.php SQL Injection"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- mailer.w2b draft SELECT"

• "ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat SELECT"

• "ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- archives.php month SELECT"

• "ET WEB_SPECIFIC_APPS gpEasy CMS index.php file XSS Attempt"

• "ET WEB_SPECIFIC_APPS PMB Services id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id DELETE"

• "ET WEB_SPECIFIC_APPS WordPress Thinkun Remind Plugin dirPath Remote File Disclosure Vulnerability"

• "ET WEB_SPECIFIC_APPS Softwebs Nepal Ananda Real Estate SQL Injection Attempt -- list.asp agent UPDATE"

• "ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id UPDATE"

• "ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php comment SELECT"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp currentpage UNION SELECT"

• "ET WEB_SPECIFIC_APPS BLOG CMS nsextt parameter Cross Site Scripting Vulnerability"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-functions.php ASCII"

• "ET WEB_SPECIFIC_APPS gCards SQL Injection Attempt -- getnewsitem.php newsid SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_rsgallery2 Component catid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_CLIENT Generic Webshell Accessed on Compromised External Server"

• "ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php SELECT"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- slideshow.asp ci UPDATE"

• "ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row UNION SELECT"

• "ET WEB_SPECIFIC_APPS Possible Docebo UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress WP Custom Pages url parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Savas Guestbook SQL Injection Attempt -- add2.php country DELETE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp sale_type DELETE"

• "ET WEB_SPECIFIC_APPS PHPKit SQL Injection Attempt -- include.php catid UPDATE"

• "ET WEB_SPECIFIC_APPS chatwm SQL Injection Attempt -- SelGruFra.asp txtPas INSERT"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Softwebs Nepal Ananda Real Estate SQL Injection Attempt -- list.asp agent SELECT"

• "ET WEB_SPECIFIC_APPS 8pixel.net simpleblog SQL Injection Attempt -- edit.asp id INSERT"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- pfs.edit.inc.php SELECT"

• "ET WEB_SPECIFIC_APPS WebSense Email security viewHeaders.asp ServerName XSS Attempt"

• "ET WEB_SPECIFIC_APPS Calendar MX BASIC SQL Injection Attempt -- calendar_detail.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS Joomla FaceBook Component face_id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp secondgroup SELECT"

• "ET WEB_SPECIFIC_APPS gCards SQL Injection Attempt -- getnewsitem.php newsid INSERT"

• "ET WEB_SPECIFIC_APPS SoftMP3 search Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SERVER Suspected Webshell del Command (Inbound)"

• "ET WEB_SPECIFIC_APPS PWP Technologies The Classified Ad System SQL Injection Attempt -- default.asp main SELECT"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php user DELETE"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- artreplydelete.asp username SELECT"

• "ET WEB_SPECIFIC_APPS Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass SELECT"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- forum.asp baslik UNION SELECT"

• "ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id UPDATE"

• "ET WEB_SPECIFIC_APPS b2evolution inc_path Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Adobe JRun Directory Traversal"

• "ET WEB_SERVER PHP Possible phar Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Invision Community Blog Mod SQL Injection Attempt -- entry_reply_entry.php eid SELECT"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php login ASCII"

• "ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword DELETE"

• "ET WEB_SPECIFIC_APPS SoftMP3 search Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS PMB Services id Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID UNION SELECT"

• "ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template DELETE"

• "ET WEB_SPECIFIC_APPS Joomla portalid Component SELECT FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserEmail DELETE"

• "ET WEB_SPECIFIC_APPS vBSupport SQL Injection Attempt -- vBSupport.php ASCII"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- com_comment.php mcname UNION SELECT"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php galleryID ASCII"

• "ET WEB_SPECIFIC_APPS Wordpress eShop plugin viewemail parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS ButorWiki service Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- polls.php id DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp loc ASCII"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- gallery.asp currentpage UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- menu.php SELECT"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 DELETE"

• "ET WEB_SPECIFIC_APPS MGinternet Property Site Manager SQL Injection Attempt -- listings.asp typ UPDATE"

• "ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (44)"

• "ET WEB_SPECIFIC_APPS Zen Cart loader_file Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid DELETE"

• "ET WEB_SPECIFIC_APPS Blogplus window_top.php Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Scripts For Sites EZ e-store searchresults.php where Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Wallpaper Complete Website SQL Injection Attempt -- process.php login DELETE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserType UNION SELECT"

• "ET WEB_SERVER Likely Malicious Request for /proc/self/fd/"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- group.php id DELETE"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- ASPKAT.ASP id UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID UNION SELECT"

• "ET WEB_CLIENT Owl PHPMailer Accessed on External Server"

• "ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID ASCII"

• "ET WEB_SPECIFIC_APPS Minerva mod SQL Injection Attempt -- forum.php c DELETE"

• "ET WEB_SPECIFIC_APPS IBM Rational RequisitePro ReqWebHelp scopedSearch Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Noname Media Photo Galerie Standard SQL Injection Attempt -- view.php id UNION SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp stock_number UNION SELECT"

• "ET WEB_SPECIFIC_APPS Philboard SQL Injection Attempt -- philboard_forum.asp forumid SELECT"

• "ET WEB_SPECIFIC_APPS DesktopOnNet don3_requiem.php app_path Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS WordPress Contact Form Maker Plugin - SQL Injection 2"

• "ET WEB_SPECIFIC_APPS Openfoncier blocnote.class.php script Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid INSERT"

• "ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp AlphaSort UNION SELECT"

• "ET WEB_SPECIFIC_APPS asaher pro view_blog_comments.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ECSHOP user.php SQL INJECTION via Referer"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course ASCII"

• "ET WEB_SPECIFIC_APPS DirectNews lib.panier.php Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS LINK Content Management Server (CMS) SQL Injection Attempt -- prikazInformacije.php IDStranicaPodaci INSERT"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board Lite SQL Injection Attempt -- thread.php threadvisit DELETE"

• "ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php DELETE"

• "ET WEB_SERVER Tilde in URI - potential .asp source disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS PHP-fusion Team Structure Infusion team_id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SERVER CRLF Injection - Newline Characters in URL"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php position DELETE"

• "ET WEB_SPECIFIC_APPS DVD Rental Software cat_id parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DeZine DZcms products.php pcat parameter SQL injection"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- dispimage.asp id DELETE"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php url SELECT"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_photoblog component category Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php Itemid SELECT"

• "ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"

• "ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid DELETE"

• "ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_CLIENT Generic File Upload Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS RevokeSoft RevokeBB SQL Injection Attempt -- class_users.php SELECT"

• "ET WEB_SPECIFIC_APPS Xt-News SQL Injection Attempt -- show_news.php id_news UNION SELECT"

• "ET WEB_SPECIFIC_APPS Bexfront sid Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler ASCII"

• "ET WEB_SPECIFIC_APPS Uapplication UPhotoGallery SQL Injection Attempt -- slideshow.asp ci SELECT"

• "ET WEB_SERVER SQL Injection Attempt (Agent CZ32ts)"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php galleryID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Apache Archive deleteArtifact script Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- moscomment.php mcname ASCII"

• "ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- mainfile.php lang UNION SELECT"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- list.asp SELECT"

• "ET WEB_SPECIFIC_APPS DEDECMS feedback_js.php arcurl Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS dol storye SQL Injection Attempt -- dettaglio.asp id_doc UPDATE"

• "ET WEB_CLIENT Generic Webshell Accessed on External Server"

• "ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- mailer.w2b draft UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla Component com_jmsfileseller view Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php newsid INSERT"

• "ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user INSERT"

• "ET WEB_SPECIFIC_APPS z1exchange edit.php site parameter SQL injection"

• "ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie SELECT"

• "ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Dros core.write_compiled_include.php smarty Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_forum UNION SELECT"

• "ET WEB_SPECIFIC_APPS Falcon Series One sitemap.xml.php dir Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp sort ASCII"

• "ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno SELECT"

• "ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category ASCII"

• "ET WEB_SPECIFIC_APPS LI-Guestbook SQL Injection Attempt -- guestbook.php country ASCII"

• "ET WEB_SPECIFIC_APPS Vt-Forum Lite SQL Injection Attempt -- vf_memberdetail.asp user INSERT"

• "ET WEB_SPECIFIC_APPS Joomla Community component userid parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- voirannonce.php no UNION SELECT"

• "ET WEB_SPECIFIC_APPS B-Cumulus tagcloud.swf Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS TECHNOTE shop_this_skin_path Parameter Remote File Inclusion"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- table_broken.php lid SELECT"

• "ET WEB_SPECIFIC_APPS All In One Control Panel SQL Injection Attempt -- cp_menu_data_file.php menu SELECT"

• "ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- filecheck.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php ASCII"

• "ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (svg)"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID DELETE"

• "ET WEB_SPECIFIC_APPS FormMailer formmailer.admin.inc.php BASE_DIR Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i DELETE"

• "ET WEB_SPECIFIC_APPS Comersus Shop Cart SQL Injection Attempt -- comersus_optReviewReadExec.asp idProduct INSERT"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- ogretmenkontrol.asp id SELECT"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick_mod UPDATE"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- user_confirm.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Fullaspsite GeometriX Download Portal SQL Injection Attempt -- down_indir.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_comments.asp articleID SELECT"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- moscomment.php mcname UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserPass UNION SELECT"

• "ET WEB_SPECIFIC_APPS Unique Ads (UDS) SQL Injection Attempt -- banner.php bid UPDATE"

• "ET WEB_SPECIFIC_APPS RoseOnline CMS LFI Attempt"

• "ET WEB_SPECIFIC_APPS Joomla Component com_hello SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS WordPress FeedList Plugin i Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row ASCII"

• "ET WEB_SPECIFIC_APPS PozScripts Business Directory Script cid parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php id ASCII"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php url UNION SELECT"

• "ET WEB_SPECIFIC_APPS Wordpress whois search domain Parameter Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- gallery.php image_id ASCII"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- fiche_membre.php idmembre UPDATE"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 11"

• "ET WEB_SPECIFIC_APPS BPG-InfoTech Content Management System SQL Injection Attempt -- publication_view.asp InfoID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Mamboleto Joomla component mamboleto.php Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter INSERT INTO SQL Injection Attempt"

• "ET ACTIVEX AoA Audio Extractor ActiveX Control Buffer Overflow Attempt"

• "ET WEB_SERVER ALFA TEaM Webshell Accessed on Internal Compromised Server"

• "ET EXPLOIT NB8-01 - Unauthed RCE via bprd"

• "ET WEB_SPECIFIC_APPS YACS update_trailer.php context Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS PHPKit SQL Injection Attempt -- include.php catid SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare UPDATE"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php code INSERT"

• "ET WEB_SERVER LANDesk Command Injection Attempt"

• "ET WEB_SPECIFIC_APPS Possible Docebo UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Virtuemart SQL Injection Attempt -- virtuemart_parser.php Itemid ASCII"

• "ET EXPLOIT [ConnectWise CRU] Potential Sonicwall SMA Authentication Bypass (management) (CVE-2021-20016)"

• "ET WEB_SPECIFIC_APPS Softwebs Nepal Ananda Real Estate SQL Injection Attempt -- list.asp agent INSERT"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php ps DELETE"

• "ET WEB_SPECIFIC_APPS LocazoList SQL Injection Attempt -- main.asp subcatID INSERT"

• "ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id UNION SELECT"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php galleryID DELETE"

• "ET WEB_SPECIFIC_APPS vBSupport SQL Injection Attempt -- vBSupport.php DELETE"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- update_profile.php username UPDATE"

• "ET WEB_SPECIFIC_APPS Simple PHP Forum SQL Injection Attempt -- logon_user.php username UNION SELECT"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- printarticle.asp DELETE"

• "ET WEB_SPECIFIC_APPS vSupport Integrated Ticket System SQL Injection Attempt -- vBSupport.php ticketid ASCII"

• "ET WEB_SPECIFIC_APPS Pre Online Tests Generator Pro UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- inc_secureloginmanager.asp sent INSERT"

• "ET EXPLOIT [ConnectWise CRU] Potential Sonicwall SMA User-Level Authentication Bypass (portal) (CVE-2021-20016)"

• "ET WEB_SPECIFIC_APPS AnnonceScriptHP SQL Injection Attempt -- email.php id ASCII"

• "ET SCAN JCE Joomla Scanner"

• "ET WEB_SPECIFIC_APPS DVD Rental Software cat_id parameter SELECT FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS JGBBS SQL Injection Attempt -- search.asp title SELECT"

• "ET WEB_SPECIFIC_APPS Possible Zenoss Cross Site Request Forgery Attempt"

• "ET WEB_SPECIFIC_APPS Softwebs Nepal Ananda Real Estate SQL Injection Attempt -- list.asp agent ASCII"

• "ET WEB_SPECIFIC_APPS Flatchat pmscript.php with Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp model SELECT"

• "ET WEB_SPECIFIC_APPS Gallo gfw_smarty.php gfwroot Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Ixprim SQL Injection Attempt -- ixm_ixpnews.php story_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS WebSense Email security viewHeaders.asp IsolatedMessageID XSS Attempt"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board Lite SQL Injection Attempt -- thread.php threadvisit INSERT"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- compare_product.php id ASCII"

• "ET WEB_SPECIFIC_APPS Ublog Reload SQL Injection Attempt -- badword.asp DELETE"

• "ET EXPLOIT TOTOLINK Router Cross-site Scripting CVE-2021-34228 (boafrm) M4"

• "ET WEB_SPECIFIC_APPS Invision Power Board (IPB) SQL Injection Attempt -- class_session.php CLIENT_IP SELECT"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp maingroup SELECT"

• "ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID DELETE"

• "ET ACTIVEX Softek Barcode Reader Toolkit ActiveX Control Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS WP Forum Server wordpress plugin SQL Injection Attempt -- feed.php topic INSERT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 DELETE"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- sendarticle.asp INSERT"

• "ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row UPDATE"

• "ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId UPDATE"

• "ET WEB_SPECIFIC_APPS GeekLog filemgt INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Demium CMS tracking.php follow_kat Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key INSERT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php sid SELECT"

• "ET WEB_SPECIFIC_APPS WebSense Email security viewHeaders.asp FileName XSS Attempt"

• "ET WEB_SPECIFIC_APPS Grayscale Blog SQL Injection Attempt -- jump.php url UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- example.php DELETE"

• "ET WEB_SPECIFIC_APPS Simple Machines Forum ssi_function parameter path disclosure vulnerability"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp sort UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpAddEdit editform parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp listing_price SELECT"

• "ET WEB_SPECIFIC_APPS Raymond BERTHOU script SQL Injection Attempt -- login.asp user SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listfull.asp ID UPDATE"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_list.asp secondgroup DELETE"

• "ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course INSERT"

• "ET WEB_SPECIFIC_APPS LushiWarPlaner SQL Injection Attempt -- register.php id SELECT"

• "ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Wordpress Token Manager Plugin tokenmanagertypeedit page XSS Attempt"

• "ET WEB_SPECIFIC_APPS Noname Media Photo Galerie Standard SQL Injection Attempt -- view.php id UPDATE"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php qid ASCII"

• "ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php language DELETE"

• "ET WEB_SPECIFIC_APPS Wordpress disclosure policy plugin Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- gallery.php picID DELETE"

• "ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listmain.asp cat SELECT"

• "ET WEB_SPECIFIC_APPS Absolute Image Gallery SQL Injection Attempt -- gallery.asp categoryid ASCII"

• "ET WEB_SPECIFIC_APPS Horde XSS attempt colorpicker.php (2)"

• "ET WEB_SPECIFIC_APPS Possible IBM BladeCenter Management Module blade_leds.php Cross Site Scripting Attempt"

• "ET WEB_SPECIFIC_APPS Newsletter MX SQL Injection Attempt -- admin_mail_adressee.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php newuserType INSERT"

• "ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php UPDATE"

• "ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- dl.php f UNION SELECT"

• "GPL EXPLOIT ISAPI .idq attempt"

• "ET WEB_SPECIFIC_APPS NukeSentinel SQL Injection Attempt -- nsbypass.php UNION SELECT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat INSERT"

• "ET WEB_SPECIFIC_APPS BtitTracker SQL Injection Attempt -- torrents.php by INSERT"

• "ET WEB_SPECIFIC_APPS Aspee and Dogantepe Ziyaretci Defteri SQL Injection Attempt -- giris.asp parola INSERT"

• "ET WEB_SERVER Generic Mailer Accessed on Internal Server"

• "ET TROJAN Mirai Variant User-Agent (Outbound)"

• "ET WEB_SPECIFIC_APPS Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS vSpin.net Classified System SQL Injection Attempt -- search.asp state DELETE"

• "ET WEB_SERVER /bin/csh In URI Possible Shell Command Execution Attempt"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP kid SELECT"

• "ET WEB_SPECIFIC_APPS VerliAdmin SQL Injection Attempt -- verify.php nick UPDATE"

• "ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete UPDATE"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Possible Joomla! com_album Component Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY SQL Injection Attempt -- detail.asp property_id UPDATE"

• "ET WEB_SPECIFIC_APPS ASP SiteWare autoDealer SQL Injection Attempt -- detail.asp iPro INSERT"

• "ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid ASCII"

• "ET WEB_SPECIFIC_APPS Neocrome Seditio SQL Injection Attempt -- users.register.inc.php SELECT"

• "ET WEB_SPECIFIC_APPS Online Web Building SQL Injection Attempt -- page.asp art_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS mySeatXT SQL Injection Attempt autocomplete.php field UNION SELECT"

• "ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1"

• "ET WEB_SPECIFIC_APPS ClickTech Click Gallery SQL Injection Attempt -- view_gallery.asp currentpage UPDATE"

• "ET WEB_SERVER PHP Scan Precursor"

• "ET WEB_SPECIFIC_APPS Zindizayn Okul Web Sistemi SQL Injection Attempt -- mezungiris.asp pass SELECT"

• "ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID UPDATE"

• "ET WEB_SERVER PHP Generic Remote File Include Attempt (FTPS)"

• "ET WEB_SPECIFIC_APPS CiscoWorks Help Servlet Reflective XSS Attempt"

• "ET WEB_SPECIFIC_APPS Outfront Spooky Login SQL Injection Attempt -- a_register.asp ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_media file parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listmain.asp cat UPDATE"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php defaultLetter UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpRS id parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS MiNT Haber Sistemi SQL Injection Attempt -- duyuru.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Burak Yylmaz Download Portal SQL Injection Attempt -- HABERLER.ASP kid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla portalid Component DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS Joomla Community component userid parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- usermgr.php gid DELETE"

• "ET WEB_SPECIFIC_APPS eFiction toplists.php list Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS Comersus Shop Cart SQL Injection Attempt -- comersus_optReviewReadExec.asp idProduct ASCII"

• "ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php t DELETE"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp model UNION SELECT"

• "ET WEB_SPECIFIC_APPS PHP JackKnife SQL Injection Attempt -- G_Display.php iCategoryUnq UPDATE"

• "ET WEB_SPECIFIC_APPS A Better Member-Based ASP Photo Gallery view.asp entry parameter SQL injection"

• "ET WEB_SPECIFIC_APPS BetMore Site Suite mainx_a.php bid Parameter Blind SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Superfreaker Studios UPublisher SQL Injection Attempt -- sendarticle.asp SELECT"

• "ET WEB_SPECIFIC_APPS Kolayindir Download (Yenionline) SQL Injection Attempt -- down.asp id SELECT"

• "ET WEB_SPECIFIC_APPS PHP Booking Calendar page_info_message parameter Cross-Site Scripting Vulnerability"

• "ET WEB_SPECIFIC_APPS Help Center Live file parameter Local File Inclusion vulnerability"

• "ET WEB_SPECIFIC_APPS ActiveNews Manager SQL Injection Attempt -- activeNews_categories.asp catID UNION SELECT"

• "ET WEB_SPECIFIC_APPS Xoops SQL Injection Attempt -- group.php id ASCII"

• "ET WEB_SPECIFIC_APPS Plogger plog-download.php checked Parameter SQL Injection"

• "ET WEB_SPECIFIC_APPS CandyPress Store SQL Injection Attempt -- prodList.asp brand UPDATE"

• "ET WEB_SPECIFIC_APPS MantisBT db_type Parameter Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Sphider SQL Injection Attempt -- search.php category DELETE"

• "ET WEB_SPECIFIC_APPS Orlando CMS stage6.php GLOBALS Parameter Local File Inclusion"

• "ET WEB_SPECIFIC_APPS Hunkaray Duyuru Scripti SQL Injection Attempt -- oku.asp id SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp page UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla! SportFusion Component DELETE FROM SQL Injection"

• "ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID ASCII"

• "ET WEB_SPECIFIC_APPS phPortal gunaysoft.php uzanti Parameter Remote File Inclusion"

• "ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server"

• "ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template INSERT"

• "ET WEB_SPECIFIC_APPS PRADO PHP Framework functional_tests.php Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_profile controller parameter Local File Inclusion Vulnerability"

• "ET WEB_SPECIFIC_APPS RIPS function.php Local File Inclusion Vulnerability"

• "ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (mvg)"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp Keyword UNION SELECT"

• "ET WEB_SPECIFIC_APPS Openfoncier bible.class.php script Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile SELECT"

• "ET WEB_SPECIFIC_APPS eNdonesia SQL Injection Attempt -- mod.php did SELECT"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_class SELECT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vin DELETE"

• "ET WEB_SERVER Casper Bot Search RFI Scan"

• "ET WEB_SPECIFIC_APPS Joomla com_musicgallery Component Id Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS mcRefer SQL Injection Attempt -- install.php bgcolor ASCII"

• "ET WEB_SPECIFIC_APPS Joomla com_photoblog component category Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) SQL Injection Attempt -- functions.php id SELECT"

• "ET WEB_SPECIFIC_APPS Fullaspsite Asp Hosting Sitesi SQL Injection Attempt -- windows.asp kategori_id UNION SELECT"

• "ET WEB_SPECIFIC_APPS phpBB2 Plus SQL Injection Attempt -- admin_acronyms.php id ASCII"

• "ET WEB_SPECIFIC_APPS Mambo SQL Injection Attempt -- moscomment.php mcname UNION SELECT"

• "ET WEB_SPECIFIC_APPS Joomla com_visa controller Local File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid UNION SELECT"

• "ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- listfull.asp ID INSERT"

• "ET WEB_SPECIFIC_APPS MidiCart ASP Shopping Cart and ASP Plus Shopping Cart SQL Injection Attempt -- item_show.asp id2006quant SELECT"

• "ET WEB_SPECIFIC_APPS phpBMS invoices_discount_ajax.php id Parameter UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- autherror.cfm errorcode INSERT"

• "ET WEB_SPECIFIC_APPS programsrating rate.php id XSS attempt"

• "ET WEB_SPECIFIC_APPS Interactive Web Solutions site_info.php UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Campsite article_id Parameter UPDATE SET SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- save.php groupAddName INSERT"

• "ET WEB_SPECIFIC_APPS TorrentTrader Classic delreq.php categ Parameter Sql Injection"

• "ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- usermgr.php gid UPDATE"

• "ET WEB_SPECIFIC_APPS Joomla com_jshop component pid Parameter INSERT INTO SQL Injection Attempt"

• "ET ACTIVEX Ask.com Toolbar askBar.dll ActiveX ShortFormat Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS iGeneric iG Shop SQL Injection Attempt -- display_review.php user_login_cookie DELETE"

• "ET WEB_SPECIFIC_APPS cPanel dir Parameter Cross Site Scripting Attempt"

• "ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server"

• "ET SCAN Tomcat Auth Brute Force attempt (tomcat)"

• "ET WEB_SPECIFIC_APPS PHP-Update SQL Injection Attempt -- guestadd.php newmessage DELETE"

• "ET WEB_SPECIFIC_APPS vBSupport SQL Injection Attempt -- vBSupport.php UPDATE"

• "ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Serendipity SQL Injection Attempt -- index.php serendipity ASCII"

• "ET WEB_SPECIFIC_APPS Francisco Burzi PHP-Nuke SQL Injection Attempt -- index.php ad_code SELECT"

• "ET WEB_SPECIFIC_APPS Philboard SQL Injection Attempt -- philboard_forum.asp forumid INSERT"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp vin ASCII"

• "ET WEB_SERVER Tilde in URI - potential .pl source disclosure vulnerability"

• "ET TROJAN D-Link ShareCenter (DNS-320/325) RCE (Outbound)"

• "ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- sections.php text INSERT"

• "ET WEB_SPECIFIC_APPS WB News News.php config Parameter Remote File Inclusion -2"

• "ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id ASCII"

• "ET WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt -- vehiclelistings.asp categoryID_list UNION SELECT"

• "ET WEB_SPECIFIC_APPS HotNews hnmain.inc.php3 incdir Parameter Remote File Inclusion Attempt"

• "ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php SELECT"

• "ET WEB_SPECIFIC_APPS Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) SQL Injection Attempt -- functions.php id UPDATE"

• "ET WEB_SPECIFIC_APPS University Of Vermont intro Parameter Remote File inclusion Attempt"

• "ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- artreplydelete.asp username DELETE"

• "ET WEB_SPECIFIC_APPS T-Content Management System id_novedad Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SERVER ATTACKER WebShell - Zehir4.asp"

• "ET WEB_SPECIFIC_APPS Future Internet SQL Injection Attempt -- index.cfm categoryid ASCII"

• "ET WEB_SERVER Suspected Webshell netstat Command (Inbound)"

• "ET WEB_SPECIFIC_APPS Joomla FaceBook Component face_id Parameter DELETE FROM SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Joomla com_rsgallery2 Component catid Parameter INSERT INTO SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id UNION SELECT"

• "ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewBugs.php s SELECT"

• "ET WEB_SPECIFIC_APPS Image Gallery with Access Database SQL Injection Attempt -- default.asp order ASCII"

• "ET WEB_SPECIFIC_APPS Guo Xu Guos Posting System (GPS) SQL Injection Attempt -- print.asp id INSERT"

• "GPL EXPLOIT .cmd executable file parsing attack"

• "ET WEB_SPECIFIC_APPS Eclectic Designs CascadianFAQ SQL Injection Attempt -- index.php catid ASCII"

• "ET WEB_SPECIFIC_APPS Woltlab Burning Board (wBB) SQL Injection Attempt -- search.php boardids INSERT"

• "ET WEB_SPECIFIC_APPS WarHound General Shopping Cart SQL Injection Attempt -- item.asp ItemID UPDATE"

• "ET WEB_SPECIFIC_APPS CrushFTP Arbitrary File Read Attempt (CVE-2024-4040)"

• "ET WEB_SPECIFIC_APPS Ivanti Connect Secure XXE Attempt (CVE-2024-22024)"

trojan-activity

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2023-02-22"

• "ET TROJAN Knockbot Proxy Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j5m .biz)"

• "ET TROJAN Linux DarkRadiation Ransomware Telegram Activity M3"

• "ET TROJAN TA428 Tmanger Checkin"

• "ET TROJAN Kimsuky Related CnC Activity"

• "ET TROJAN WEBC2-CSON Checkin - APT1 Related"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M5"

• "ET TROJAN ErbiumStealer Response From CnC"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M9"

• "ET CURRENT_EVENTS Successful Apple Account Phish Feb 17 2017"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-03-18"

• "ET TROJAN Win32/Packed.BlackMoon.A Checkin"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2019-11-15)"

• "ET TROJAN Slugin.A PatchTimeCheck.dat Request"

• "ET TROJAN Observed DNS Query for MageCart Data Exfil Domain"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Enchanim Process List Dump"

• "ET TROJAN Backdoor.Win32.DarkComet Screenshot Upload Successful"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Hawkshaw.a (phoenix-panel .firebaseio .com in DNS Lookup)"

• "ET TROJAN DustySky/Gaza Cybergang Group1 CnC Domain in DNS Lookup (dji-msi .2waky .com)"

• "ET TROJAN TA402/Molerats Related VBS Retrieval"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Cobalt Strike User-Agent"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET USER_AGENTS Suspicious UA Observed (Quick Macros)"

• "ET TROJAN Chaos Botnet CnC Domain (ars1 .wemix .cc) in DNS Lookup"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN Win32/STEALBIT Data Exfiltration Tool Activity (PUT)"

• "ET CURRENT_EVENTS ING Group Credential Phish Landing Page 2022-12-02"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Windows/OriginLogger CnC Domain (originpro .me) in DNS Lookup"

• "ET TROJAN Arid Viper APT DNS Lookup (flushupate.com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (i1 .pm)"

• "ET CURRENT_EVENTS Fiesta Flash Exploit Download"

• "ET USER_AGENTS Seetrol Client Remote Administration Tool User-Agent"

• "ET TROJAN HackerDefender Root Kit Remote Connection Attempt Detected"

• "ET TROJAN Observed Gamaredon APT Related Domain (adiantumso .ru in TLS SNI)"

• "ET CURRENT_EVENTS Successful Facebook Credential Phish 2021-11-16"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2022-10-11"

• "ET TROJAN Possible Win32/Petya Conn Check"

• "ET TROJAN Win32/Laturo Stealer CnC Checkin"

• "ET TROJAN Zingo/GinzoStealer Data Command List Fetch"

• "ET TROJAN Cobalt Strike Malleable C2 Profile (btn_bg)"

• "ET CURRENT_EVENTS Tech Support Scam - Windows Firewall M3 2021-08-17"

• "ET TROJAN Woody RAT CnC Domain (kurmakata .duckdns .org) in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (qji6 .com)"

• "ET TROJAN FIN8 ShellTea CnC in DNS Lookup"

• "ET TROJAN Machete FTP activity"

• "ET CURRENT_EVENTS Greatness Phish Kit Landing Page M1 2023-05-15"

• "ET TROJAN Trojan.Win32.Cosmu.xet CnC Beacon"

• "ET MALWARE Context Plus Spyware User-Agent (Envolo)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (majzolimka .com)"

• "ET TROJAN Observed DNS Query to TA444 Domain (cloud .jbic .us)"

• "ET TROJAN Suspected Gamaredon Downloader Activity"

• "ET TROJAN Scarlet Mimic DNS Lookup 26"

• "ET TROJAN Suspected Muggle Stealer Activity M2"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (registration-adnoc .com) 2022-12-05"

• "ET TROJAN Wintervivern Checkin"

• "ET TROJAN Qarallax RAT Keepalive C2"

• "ET TROJAN Carderbee APT Related Activity"

• "ET CURRENT_EVENTS Successful W3LL STORE Credential Phish 2023-05-10"

• "ET CURRENT_EVENTS Generic Credential Phish Activity POST"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN DCRat CnC Activity"

• "ET MALWARE Suspicious User-Agent (MediaLabsSiteInstaller)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to avsvmcloud .com"

• "ET TROJAN Linux DarkRadiation Ransomware Activity Attack Check"

• "ET TROJAN Linux DarkRadiation Ransomware Activity (curl)"

• "ET TROJAN ELF/Miner Loader Activity M2 (GET)"

• "ET TROJAN Legion Loader Activity Observed"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M1 2022-06-08"

• "ET TROJAN Powershell Octopus Backdoor Activity (POST)"

• "ET TROJAN LYCEUM MSIL/DanBot CnC Checkin"

• "ET TROJAN DNS Query for Cloud Atlas blackberry-support.herokuapp.com"

• "ET TROJAN ServHelper CnC Domain"

• "ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 4"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (marybskitchen .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (mail-presidency .com in DNS Lookup)"

• "ET TROJAN Observed Malicious SSL Cert (OSX/Nukesped CnC)"

• "ET TROJAN OSX/OceanLotus.D CnC DNS Lookup (s3 .hiahornber .com)"

• "ET TROJAN Win32/Recslurp.D C2 Response"

• "ET CURRENT_EVENTS Observed TOAD Domain (hscare .cc in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET USER_AGENTS Suspicious User Agent (Zadanie)"

• "ET TROJAN Jasper URI Path Observed M2"

• "ET MOBILE_MALWARE Android APT-C-23 (black-honey .club in DNS Lookup)"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (wpsys .zip)"

• "ET MOBILE_MALWARE Android/GPlayed (sub1 .tdsworker .ru in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Key Bank Phish M2 2015-08-20"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 54"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET CURRENT_EVENTS Chase Phishing Landing 2018-01-18"

• "ET CURRENT_EVENTS Possible Successful Craigslist Phishing Domain Feb 07 2017"

• "ET TROJAN LazyScripter Related Activity (GET)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/DarkRAT CnC Activity"

• "ET TROJAN JS/Nemucod.M.gen downloading PDF payload"

• "ET TROJAN PyPI Malicious Library Update Payload Checkin"

• "ET TROJAN Stonefly APT Related Domain in DNS Lookup (semiconductboard .com)"

• "ET TROJAN Kimsuky Related Activity (down)"

• "ET CURRENT_EVENTS Generic T.Goe Phishing Landing"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Metador CnC Domain (networkselfhelp .com) in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (graceygretchen .info in DNS Lookup)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (c2care .us)"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (user .nikanps .top)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bscare .live)"

• "ET TROJAN Observed Cobalt Strike CnC Domain in DNS Lookup (nirsoft .me)"

• "ET TROJAN Query to Known CnC Domain msnsolution.nicaze.net"

• "ET TROJAN DNS Query to Raspberry Robin Domain (w6 .nz)"

• "ET MALWARE OSX ADWARE/AD Injector"

• "ET TROJAN SmokeLoader Checkin"

• "ET MOBILE_MALWARE Fake Rocket Alerts App Sending Phone Information (POST)"

• "ET TROJAN Win32/Bisonal Backdoor CnC Domain in DNS Lookup"

• "ET TROJAN Win32/GandCrab Ransomware CnC Activity M2"

• "ET TROJAN FROZENLAKE (APT 28) Related Domain in DNS Lookup (robot-876 .frge .io)"

• "ET TROJAN Observed StrongPity CnC Domain (applicationrepo .com in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (machinetext .org)"

• "ET TROJAN Win32/RisePro CnC Command Outbound (get_marks)"

• "ET TROJAN APT15/NICKEL KETRUM CnC Activity (POST)"

• "ET TROJAN Scarlet Mimic DNS Lookup 25"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (nahtizi .ru)"

• "ET TROJAN Confucious APT Related Domain in DNS Lookup (bonimoni .xyz)"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-03"

• "ET TROJAN Observed Malicious SSL Cert (JS/Ostap CnC)"

• "ET POLICY External IP Lookup (www .net .cn)"

• "ET TROJAN Observed Malicious SSL Cert (MICROPSIA CnC Domain)"

• "ET TROJAN Observed DNS Query to RisePro Domain (uc-files .com)"

• "ET TROJAN [ANY.RUN] RisePro TCP (Token)"

• "ET TROJAN OSX/iWebUpdate CnC Activity"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Dec 13 2016"

• "ET INFO suspicious - uncompressed pack200-ed JAR"

• "ET TROJAN Golang Easy Stealer Activiy M2 (POST)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (muhvanazi .ru)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Drop.Agent.bfsv HTTP Activity (UsER-AgENt)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0i .pm)"

• "ET TROJAN RisePro CnC Activity (Outbound)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (uteroma .ru)"

• "ET TROJAN Backdoored Xpopup Domain (xpopup .pe .kr) in DNS Lookup"

• "ET TROJAN DarkHotel CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to Pegasus Domain"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 5"

• "ET TROJAN Drovorub cloud.auth Module Server Response"

• "ET TROJAN Win32.Agent.OSCF CnC Checkin"

• "ET CURRENT_EVENTS Successful Ebay Phish 2016-12-12"

• "ET TROJAN DNS Query For TURNEDUP.Backdoor CnC (chromup)"

• "ET TROJAN MagikPOS CnC Beacon"

• "ET MALWARE Win32/Atshz.A Checkin M2"

• "ET MOBILE_MALWARE Arid Viper (goerge-amper .website in DNS Lookup)"

• "ET MALWARE Win32.Perinet CnC Checkin"

• "ET TROJAN OilRig OopsIE CnC Checkin M4"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M7"

• "ET TROJAN Observed MageCart Group 12 Domain (toolser .pw in TLS SNI)"

• "ET TROJAN Pingback Upload Command Issued"

• "ET TROJAN Observed Certificate Containing Double Base64 Encoded Executable Inbound"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (galaxysupdates .com)"

• "ET TROJAN KeyBoy DNS Lookup (tibetvoices .com)"

• "ET MALWARE NOBELIUM Win32/VaporRage Loader CnC Checkin"

• "ET TROJAN Possible CryptXXX Ransomware Renaming Encrypted File SMB v2"

• "ET TROJAN Loki Locker Ransomware Server Response (Public Key) M2"

• "ET CURRENT_EVENTS Likely Driveby Delivered Malicious PDF"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zk .qa)"

• "ET MOBILE_MALWARE NSO Pegasus iOS Megalodon Gatekeeper Activity (GET)"

• "ET TROJAN Observed Evrial Domain (projectevrial .ru in TLS SNI)"

• "ET TROJAN Magecart/Skimmer - AngryBeaver Exfil Attempt"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (APT-C-55/BabyShark Staging Domain)"

• "ET TROJAN TinyLoader.A Checkin x86"

• "ET TROJAN Suspected ToddyCat APT Curlu Related Activity M2"

• "ET CURRENT_EVENTS WalletConnect Stealer Landing Page 2022-11-23"

• "ET TROJAN DNS Query to TA444 Domain (altair-vc .info)"

• "ET TROJAN Diezen/Sakabota CnC Domain Observed in DNS Query"

• "ET TROJAN Observed OSX/NukeSped Variant CnC Domain (fudcitydelivers .com) in TLS SNI"

• "ET TROJAN Known Sinkhole Response Header"

• "ET CURRENT_EVENTS Successful Credential Phish (Multiple Brands) 2016-11-18"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor DELETEFILE Command (Inbound)"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (packetbite .live)"

• "ET TROJAN Kimsuky CnC Domain (jojoa .mypressonline .com) Observed in DNS Query"

• "ET USER_AGENTS Suspicious User-Agent (firefox)"

• "ET CURRENT_EVENTS DRIVEBY EXE Embeded in Page Likely Evil M1"

• "ET CURRENT_EVENTS Successful Chase Phish 2015-12-22"

• "ET TROJAN Cryptowall 3.0 .onion Proxy Domain"

• "ET TROJAN TorrentLocker DNS Lookup (server38.info)"

• "ET TROJAN Observed Cobalt Strike Related Domain (mail .igov-service .net in TLS SNI)"

• "ET CURRENT_EVENTS Multibank Captcha Phishing Landing"

• "ET TROJAN Observed Malicious SSL Cert (Turla/APT34 CnC Domain)"

• "ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS EITest SocEng Inject Jan 15 2017 M2"

• "ET TROJAN Win64/Havex Checkin"

• "ET MALWARE User-Agent (???)"

• "ET MOBILE_MALWARE Android APT-C-23 (hoopoechat .com in DNS Lookup)"

• "ET TROJAN TA444 Domain in TLS SNI (indaddy .xyz)"

• "ET TROJAN Win32/Onliner Requesting Additional Modules"

• "ET CURRENT_EVENTS Observed TOAD Domain (bgcare .info in TLS SNI)"

• "ET MALWARE User-Agent (User Agent) - Likely Hostile"

• "ET TROJAN Observed Certificate Containing Possible Base64 Encoded Powershell Inbound"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2021-03-18"

• "ET TROJAN Qbot Related Activity (POST)"

• "ET TROJAN Suspected Smokeloader Activity (POST)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Exfil Domain)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (hloyagorepa .com)"

• "ET TROJAN APT SuperhardCorp DNS Lookup (books.mrface.com)"

• "ET TROJAN [ANY.RUN] TheBoxClipper (updatebildchange)"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (pbxcloudeservices .com)"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (gigiman .xyz)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (c7 .lc)"

• "ET TROJAN Suspicious User-Agent Possible Trojan Downloader Shell"

• "ET TROJAN Observed Malicious SSL Cert (Baka Skimmer Staging CnC)"

• "ET TROJAN Anchor_DNS stickseed Variant CnC Checkin"

• "ET TROJAN Malicious lnk Activity"

• "ET TROJAN Win32/SiMay RAT Activity M2 (GET)"

• "ET TROJAN W32/Bilakip.A Downloader API Ping CnC Beacon"

• "ET CURRENT_EVENTS Common Form POST - Paypal Phishing Landing 2020-06-11"

• "ET TROJAN Observed Maldoc Domain (travelcrimea .info in TLS SNI)"

• "ET TROJAN Probable Keylogger Report SMTP"

• "ET TROJAN Win32/Cryptrun.B Connectivity check"

• "ET MOBILE_MALWARE Android APT-C-23 (mediauploader .info in TLS SNI)"

• "ET CURRENT_EVENTS Generic Phishkit Landing Page M3"

• "ET TROJAN X2000M.Agent Checkin Jan 24 2017"

• "ET TROJAN Grandoreiro CnC Activity (iso)"

• "ET TROJAN Worm.VBS.Jenxcus.H User Agent"

• "ET CURRENT_EVENTS Successful Office 365 Phish 2016-10-31"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 24"

• "ET TROJAN TA401 Domain in TLS SNI (jayyburrows .icu)"

• "ET TROJAN ShadowPad CnC Domain in DNS Lookup (ns .rtechs .org)"

• "ET MOBILE_MALWARE Android APT-C-23 (accounts-gocgle .com in DNS Lookup)"

• "ET TROJAN Suspected Tunna Proxy M4"

• "ET TROJAN Observed Malicious SSL Cert (TinyNuke Variant CnC) 2020-02-09"

• "ET TROJAN Win32/Remcos RAT Checkin 27"

• "ET TROJAN Win32/Remcos RAT Checkin 30"

• "ET TROJAN Win32/Fareit Checkin 2"

• "ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M3"

• "ET TROJAN Generic.Malware.SFL User-Agent (Rescue/9.11)"

• "ET TROJAN Observed Malicious SSL Cert (RampantKitten CnC)"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .pd .linkpc .net)"

• "ET TROJAN Possible Net Crawler SMB Share Access unicode (Operation Cleaver)"

• "ET MOBILE_MALWARE Android APT-C-23 (exvsnomy .club in TLS SNI)"

• "ET TROJAN ToddyCat Ninja Backdoor CnC"

• "ET TROJAN Unknown Mailer CnC Beacon 2"

• "ET USER_AGENTS Observed DonotGroup Related UA (Chrome Edge)"

• "ET CURRENT_EVENTS Successful Team IPwned Phish 2016-08-24"

• "ET TROJAN Arid Viper APT DNS Lookup (mediahitech.info)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MirrorBlast CnC Activity M3"

• "ET TROJAN Observed Win32/Orion Logger SMTP Exfil Subject Line"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (bigbricks .org"

• "ET TROJAN AHK Bot Domain Profiler CnC Activity"

• "ET EXPLOIT Netgear R6260 Mini_httpd Buffer Overflow Attempt - Possible RCE (CVE-2021-34979)"

• "ET TROJAN Tendrit CnC Beacon 1"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (baoris .ru)"

• "ET TROJAN TorrentLocker DNS Lookup (bigcrashcar.net)"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (uk2privat .com) in DNS Lookup"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET EXPLOIT IBM Data Risk Manager Arbitrary File Download Attempt"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (fileserve .work)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cdn-aws .net)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST M2"

• "ET TROJAN Aerial Keylogger DNS Request"

• "ET TROJAN DNS Query to TA444 Domain (docsend-host .cloud)"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.1 Domain (gabriellalovecats .com) in TLS SNI"

• "ET TROJAN Cobalt Strike Beacon (Amazon Profile) M2"

• "ET CURRENT_EVENTS Dadong Exploit Kit Downloaded"

• "ET TROJAN Netwire RAT Check-in (set)"

• "ET TROJAN W32/TrojanSpy.MSIL Fetch Header CnC Beacon"

• "ET TROJAN SolarSys CnC Activity M1"

• "ET MOBILE_MALWARE Android APT-C-23 (davos-seaworth .info in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1j .pm)"

• "ET TROJAN Possible Ransomware HTTP POST to Onion Link Domain"

• "ET TROJAN Win32/Backdoor.Agent.qweydh CnC Checkin M2"

• "ET TROJAN Win32 Cloaker Related Post Infection Checkin"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Gozi/BlackNet Checkin"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (kotlinn .xyz)"

• "ET MALWARE Cpushpop.com Spyware User-Agent (CPUSH_UPDATER)"

• "ET TROJAN Observed Gamaredon Domain (for30 .procellarumbi .ru in TLS SNI)"

• "ET TROJAN LooCipher Ransomware Onion Domain"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET TROJAN DNS Query to Teal Kurma Domain (lo0 .systemctl .network)"

• "ET TROJAN GoLinux/GoTrim CnC Checkin"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Agniane Stealer CnC Activity (GET) M3"

• "ET CURRENT_EVENTS Successful CenturyLink Credential Phish 2023-03-01"

• "ET CURRENT_EVENTS Successful Bradesco Bank Phish M2 Jan 05 2017"

• "ET TROJAN Patchwork APT BADNEWS Variant CnC Checkin M1"

• "ET TROJAN DNS Query to Gamaredon Domain (iknatonpa .ru)"

• "ET TROJAN Observed Malicious SSL Cert (Baka Skimmer Staging CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible Graftor EXE Download Common Header Order"

• "ET MALWARE AdWare.MSIL.Solimba.b POST"

• "ET TROJAN Observed DNS Query to Ursnif Domain (dodstep .cyou)"

• "ET USER_AGENTS sysWeb User-Agent"

• "ET TROJAN RShell CnC Domain (time .ntp-server .asia) in DNS Lookup"

• "ET TROJAN Malicious VBS Downloader fake image zip"

• "ET TROJAN MuddyWater Payload Requesting Command from CnC"

• "ET TROJAN TorrentLocker DNS Lookup (allwayshappy.ru)"

• "ET TROJAN CrownAdPro CnC Activity M2"

• "ET TROJAN TeleBots BCS-server CnC Beacon"

• "ET TROJAN APT DarkHydrus DNS Lookup 15"

• "ET TROJAN Ponmocup HTTP Request (generic) M2"

• "ET TROJAN [CrowdStrike] ANCHOR PANDA - Adobe Gh0st Beacon"

• "ET TROJAN GravityRAT CnC Domain (enigma .net .in in DNS Lookup)"

• "ET TROJAN Conficker/KernelBot/MS08-067 related Trojan Checkin"

• "ET CURRENT_EVENTS Successful Generic Credential Phish Activity POST"

• "ET TROJAN Cryptmen FakAV page Title"

• "ET TROJAN TA444 Domain in DNS Lookup (gdocshare .one)"

• "ET TROJAN Asylum Ambuscade Related CnC Activity (GET) M1"

• "ET MOBILE_MALWARE Android APT-C-23 (david-moris .website in DNS Lookup)"

• "ET TROJAN Observed Malicious SSL Cert (CONFUCIOUS_B CnC)"

• "ET TROJAN TinyLoader.A Checkin x64"

• "ET TROJAN NetSupport RAT with System Information"

• "ET TROJAN SolarMarker Backdoor Related Domain in DNS Lookup (noelfpar .com)"

• "ET TROJAN Arid Viper APT DNS Lookup (plmedgroup.com)"

• "ET TROJAN Ave Maria/Warzone RAT Credential Exfil"

• "ET MALWARE LNKR Possible Response for LNKR js file"

• "ET TROJAN MSIL/Matrix Ransomware CnC Activity"

• "ET MALWARE Suspicious User-Agent (ClickAdsByIE)"

• "ET TROJAN Observed Magecart Domain (webscriptly .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed SSV Agent CnC Domain (drmtake .tk in TLS SNI)"

• "ET CURRENT_EVENTS Successful Yahoo Phish 2016-07-11"

• "ET TROJAN SocGholish Domain in DNS Lookup (standard .architech3 .com)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 11"

• "ET TROJAN Win32/Cutwail.BE Checkin 1"

• "ET TROJAN Potential Juniper Phar Deserialization RCE Attempt (CVE-2022-22241)"

• "ET TROJAN Cobalt Strike Related Activity (POST)"

• "ET TROJAN Observed TraderTraitor Domain (nomadpkg .com in TLS SNI)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-schnellvpn .com)"

• "ET MOBILE_MALWARE Arid Viper (wendy-johnston .pw in DNS Lookup)"

• "ET TROJAN MedusaHTTP CnC Checkin"

• "ET TROJAN Emotet Post Drop C2 Comms"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET TROJAN Trojan Downloader GetBooks UA"

• "ET TROJAN TA401 Domain in DNS Lookup (jessicakphillips .icu)"

• "ET TROJAN W32/Fsysna.Downloader CnC Beacon"

• "ET CURRENT_EVENTS Successful Generic Miarroba Phish 2019-07-11"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (consultant-ae-enoc .com) 2022-12-05"

• "ET TROJAN Possible CopyKitten DNS Lookup (newsfeeds-microsoft .press)"

• "ET TROJAN Kimsuky Related CnC Activity"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Redline Stealer TCP CnC Activity"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/S1deload Stealer CnC Checkin"

• "ET TROJAN WEBC2-CLOVER Checkin APT1 Related"

• "ET WEB_CLIENT pshell dl/execute primitives in wideb64 2"

• "ET TROJAN Win32/Luca Stealer Sending System Information via Telegram (GET)"

• "ET TROJAN DNSMessenger Payload (TXT base64 gzip header)"

• "ET TROJAN W32/AGENT.NXNX Checkin 2"

• "ET TROJAN Mac Flashback Checkin 1"

• "ET TROJAN Grandoreiro Downloader Activity"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (alismaso .ru)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (team-meeting .pro)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (3p .ms)"

• "ET TROJAN Win32/MuggleStealer CnC ChromePwd Exfil (POST)"

• "ET TROJAN Hupigon User Agent Detected (??)"

• "ET TROJAN Win32/Pterodo CnC Activity (POST)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET WEB_CLIENT Blatantly Evil JS Function"

• "ET MOBILE_MALWARE NSO Related Domain 11"

• "ET USER_AGENTS Suspicious User-Agent (MS Internet Explorer)"

• "ET CURRENT_EVENTS Successful Email Credential Phish 2015-08-12"

• "ET TROJAN CryptoWall CryptoWall 3.0 Check-in"

• "ET CURRENT_EVENTS PerSwaysion Phishkit Javascript Config Variables"

• "ET CURRENT_EVENTS Successful Santander Phish M1 Oct 04 2017"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (alisonparker .club in TLS SNI)"

• "ET TROJAN ELF/muBoT IRC Activity 7 (bindshell)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN MSIL/Firebird RAT CnC Checkin"

• "ET TROJAN ELF/Emptiness v2 XOR Update Command Inbound"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2022-07-18"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ejk .bz)"

• "ET TROJAN BBSRAT POST request CnC"

• "ET TROJAN Vidar/Arkei/Megumin Stealer Keywords Retrieved"

• "ET CURRENT_EVENTS Successful Generic Email Account Phish 2019-12-10"

• "ET TROJAN Bolek HTTP Checkin"

• "ET CURRENT_EVENTS Generic Phishing domain observed in TLS SNI (info-getting-eu. com)"

• "ET TROJAN Kimsuky KGH Malware Suite Checkin M2"

• "ET MOBILE_MALWARE Android APT-C-23 (geny-wise .com in TLS SNI)"

• "ET TROJAN Subterranean Crimson Rat - GetClientLog Command"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hscare .live)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (minkazi .ru)"

• "ET TROJAN Observed Malicious SSL Cert (APT MustangPanda CnC)"

• "ET MOBILE_MALWARE Android APT-C-23 (cecilia-dobrev .com in DNS Lookup)"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET MALWARE Sidetab or Related Trojan Checkin"

• "ET TROJAN MacOS/Adload CnC Beacon"

• "ET CURRENT_EVENTS Possible Successful Gmail Phish Nov 21 2012"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Unknown Stealer Command (geoblock) (Outbound)"

• "ET TROJAN [401TRG] SUNBURST Related DNS Lookup to infinitysoftwares .com"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (bigmir .space)"

• "ET MOBILE_MALWARE NSO Related Domain 30"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-schnellvpn .xyz)"

• "ET CURRENT_EVENTS Tectite Web Form Submission - Possible Successful Phish"

• "ET TROJAN ELF/Mirai.shiina CnC Domain in DNS Query"

• "ET TROJAN Windows nbtstat -n Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN TA453 ClumsyCover Maldoc Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Oct 13 2016"

• "ET TROJAN W32/Antifulai.APT CnC Beacon 1"

• "ET TROJAN Observed TA453 Domain (washingtonlnstitute .org in TLS SNI)"

• "ET TROJAN Win64/Spy.Agent.EU CnC Checkin"

• "ET TROJAN Arid Viper APT DNS Lookup (ahmedfaiez.info)"

• "ET MALWARE OSX ADWARE/Mackeeper Checkin"

• "ET INFO Miniproxy Cloned Page - Possible Phishing Landing"

• "ET TROJAN BlackshadesRAT Reporting"

• "ET CURRENT_EVENTS Observed TOAD Domain (g2care .us in TLS SNI)"

• "ET TROJAN Downbot/Shady Rat Remote Shell Connection"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN APT28 Komplex DNS Lookup (apple-iclouds .net)"

• "ET TROJAN Win32/Kryptik.BSYO Checkin"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET CURRENT_EVENTS Google Drive Phish Landing 2016-09-01"

• "ET MOBILE_MALWARE Android APT-C-23 (cerseilannister .info in TLS SNI)"

• "ET CURRENT_EVENTS Successful Yahoo Phish 2016-12-08"

• "ET TROJAN Observed Malicious SSL Cert (MageCart)"

• "ET TROJAN Observed DNS Query to Ursnif SAIGON Variant CnC Domain"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET CURRENT_EVENTS Successful Alibaba Phish 2016-10-28"

• "ET TROJAN DNS Query to Raspberry Robin Domain (60i .nl)"

• "ET EXPLOIT Possible CVE-2016-2209 Symantec PowerPoint Parsing Buffer Overflow M1"

• "ET TROJAN Win32/WarHawk/Spyder Sending Windows System Information (POST) M2"

• "ET TROJAN General Downloader Checkin URL (GUID+)"

• "ET TROJAN PUSHCHA Related Domain in DNS Lookup (meta-l .space)"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup"

• "ET TROJAN Observed Gamaredon APT Related Domain (baruta .ru in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-09-30"

• "ET CURRENT_EVENTS Successful Generic Phish Phish 2018-08-21"

• "ET TROJAN SockRacket/KANDYKORN CnC Response (Nonce)"

• "ET TROJAN [ANY.RUN] Win32/EternityClipper CnC Activity (Successful Installation) (POST)"

• "ET TROJAN GravityRAT CnC Domain (savitabhabi .co .in in DNS Lookup)"

• "ET TROJAN Wintervivern Activity (GET) M3"

• "ET TROJAN Cobalt Strike Malleable C2 Profile (bg)"

• "ET WEB_CLIENT Microsoft Tech Support Scam 2020-03-24"

• "ET TROJAN ChamelGang Related CnC Domain in DNS Lookup (centralgoogle .com)"

• "ET TROJAN Red Wolf/RedCurl Domain in DNS Lookup (earthmart .c1 .biz)"

• "ET TROJAN AHK.CREDSTEALER.A CnC Exfil"

• "ET MOBILE_MALWARE Android APT-C-23 (christopher .fun in DNS Lookup)"

• "ET TROJAN Cobalt Strike Malleable C2 (TrevorForget Profile)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (biding-enoc .com) 2022-12-05"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (companyllc .top)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible Winnti-related Destination"

• "ET MOBILE_MALWARE Android APT-C-23 (liz-keen .website in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Apple ID Phish 2016-10-25"

• "ET TROJAN BartCrypt Payment DNS Query to .onion proxy Domain (khh5cmzh5q7yp7th)"

• "ET TROJAN DarkHotel CnC Domain in DNS Lookup"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 87"

• "ET TROJAN PunkeyPOS HTTP CnC Beacon 2"

• "ET TROJAN Observed Glupteba CnC Domain (ninhaine .com in TLS SNI)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 14"

• "ET INFO Data Submitted to ukit domain - Possible Phishing M1 2016-06-29"

• "ET TROJAN Gazer HTTP POST Checkin"

• "ET CURRENT_EVENTS Successful Docusign/O365 Phish 2016-07-15"

• "ET WEB_CLIENT c3284d Malware Network Compromised Redirect (comments 2)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0x9 .biz)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (to30 .procellarumbi .ru)"

• "ET TROJAN W2KM_BARTALEX Downloading Payload 2"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (helpyoume .linkpc.net)"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (wpsys .zip)"

• "ET TROJAN MuddyWater Payload Sending Screenshot to CnC"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Spox Phishkit Landing Page Inbound"

• "ET MALWARE Misspelled Mozilla User-Agent (Mozila)"

• "ET WEB_CLIENT Fake Virus Phone Scam Landing Mar 9 M2"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-chat .xyz)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (creditals-email .space in TLS SNI)"

• "ET CURRENT_EVENTS Possible Discover Phishing Domain Feb 02 2017"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page M2 2022-05-27"

• "ET TROJAN [ANY.RUN] TheBoxClipper (addbild)"

• "ET INFO 302 Redirect to run .mocky .io"

• "ET MALWARE AskSearch Toolbar Spyware User-Agent (AskBar)"

• "ET TROJAN Win32/HackTool.Agent.CS SMTP activity"

• "ET TROJAN Downloader Retrieving Malicious Powershell in DNS Response"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Caixa Credential Phish 2022-07-05"

• "ET TROJAN TA453 Related Domain in DNS Lookup (mailer-daemon .org)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M13"

• "ET CURRENT_EVENTS KaiXin Landing M4"

• "ET CURRENT_EVENTS Successful Phishing Attempt via GetGoPhish Phishing Tool"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bghelp .us)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor CMD Command (Inbound)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN SolarBot Plugin Download WalletSteal"

• "ET TROJAN Observed Malicious SSL Cert (MirrorThief CnC)"

• "ET CURRENT_EVENTS Successful DHL Account Phish 2015-11-03"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (wadibo .ru)"

• "ET CURRENT_EVENTS Common Form POST - M&T Bank Phishing Landing 2020-06-11"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (bitsbfree .com)"

• "ET TROJAN Win32/Remcos RAT Checkin 109"

• "ET MALWARE CoolWebSearch Spyware (Feat)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (suvfix .us)"

• "ET TROJAN Observed Teal Kurma Domain (anfturkce .news in TLS SNI)"

• "ET TROJAN RedControle Probing Infected System"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (ksew .kpt-gov .org)"

• "ET TROJAN NetWire / Ozone / Darktrack Alien RAT - Server Hello"

• "ET TROJAN Suspected Middle East Threat Group Domain in DNS Lookup (dnsnamefinder .com)"

• "ET MOBILE_MALWARE Arid Viper (log-yoahao .co in DNS Lookup)"

• "ET TROJAN Trojan Generic - POST To gate.php with no accept headers"

• "ET CURRENT_EVENTS iTunes Connect Phishing Landing"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Playful Taurus CnC Domain (mail .indiarailways .net) in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE DNS Android/Spy.Feabme.A Query"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Generic Phishing Landing Hosted via Weebly"

• "ET CURRENT_EVENTS Observed TOAD Domain (n2care .cc in TLS SNI)"

• "ET TROJAN SIDESHOW CnC Authentication Over HTTP"

• "ET CURRENT_EVENTS Successful Royal Bank of Canada Credential Phish 2022-03-02"

• "ET MOBILE_MALWARE Arid Viper (samehnew-10a7c .appspot .com in DNS Lookup)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b DNS Lookup"

• "ET CURRENT_EVENTS Unknown Malicious Second Stage Download URI Struct M2 Feb 06 2015"

• "ET CURRENT_EVENTS Silicon Valley Bank Credential Phish Landing Page M2"

• "ET CURRENT_EVENTS Successful Exmo Cryptocurrency Exchange Phish Aug 28 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (CryptoMimic Staging CnC)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 40"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M18"

• "ET TROJAN APT28/Sofacy Zebrocy Go Variant Checkin"

• "ET TROJAN Kronos Checkin"

• "ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016"

• "ET CURRENT_EVENTS Nourblog1 Phish Kit"

• "ET TROJAN Cobalt Strike Beacon Activity (Wordpress Profile)"

• "ET WEB_SERVER FOX-SRT - Backdoor - CryptoPHP Shell C2 POST (fsockopen)"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1qp2we64k79237y0npqehprfgynlz02fwpktlwte .com)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (proposals-ae-enoc .com) 2022-12-05"

• "ET CURRENT_EVENTS Possible MSFVenom Exploit via Browser"

• "ET CURRENT_EVENTS Known Phishing Related Domain in DNS Lookup (schseels .com)"

• "ET CURRENT_EVENTS Successful Keybank Phish 2016-09-29"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 16"

• "ET TROJAN Possible Winnti-related DNS Lookup (job .yoyakuweb .technology)"

• "ET TROJAN Casbaneiro CnC Host Checkin M2"

• "ET MALWARE Loadmoney.A Checkin 3"

• "ET TROJAN Tenorshare Google Analytics Checkin"

• "ET TROJAN Inbound MonetizeUs/LNKR Struct"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (specgulfae .com) 2022-12-05"

• "ET TROJAN Observed Default CobaltStrike SSL Certificate"

• "ET TROJAN Volatile Cedar Win32.Explosive CnC Beacon 3"

• "ET TROJAN Cobalt Strike Beacon Observed (MASB UA)"

• "ET TROJAN OceanLotus Stage 2 Domain in DNS Lookup (sskimresources .com)"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET WEB_CLIENT Possible Phishing Data Submitted to yolasite.com"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (hemispheredonkkl .pw)"

• "ET TROJAN Possible Pegasus/Trident Related HTTP Beacon 2"

• "ET TROJAN Likseput.B Checkin"

• "ET TROJAN AgentTesla Exfil Via SMTP"

• "ET TROJAN ELF/Emptiness v1.1 HTTP Flood Command Inbound"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Oct 26 2017"

• "ET TROJAN ReflectiveGnome Download Activity"

• "ET TROJAN Win32/Ursnif Connectivity Check"

• "ET CURRENT_EVENTS Successful Commerce Bank Phish 2022-07-30"

• "ET MOBILE_MALWARE Android/HeHe.Spy LoginRequest CnC Beacon"

• "ET TROJAN DonotGroup CnC Domain Observed in DNS Query"

• "ET TROJAN MSIL/GravityRAT CnC Domain (msoftupdates .eu in DNS Lookup)"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to incomeupdate .com"

• "ET TROJAN W32/Symmi Remote File Injector Initial CnC Beacon"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (ministry-pk .net)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (skqv .eu)"

• "ET TROJAN TA410 APT FlowCloud Hardcoded Request (POST)"

• "ET TROJAN Win32/Umbral-Stealer CnC Exfil via Discord (POST)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (mzjc .is)"

• "ET TROJAN Observed Malicious SSL Cert (Various CnC)"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET TROJAN [ANY.RUN] RisePro TCP (Activity)"

• "ET MOBILE_MALWARE Android/HeHe.Spy ReportMessageRequest CnC Beacon"

• "ET CURRENT_EVENTS Suspicious GitHack TLS SNI Request - Possible PurpleFox EK"

• "ET MALWARE Loadmoney.A Checkin 8"

• "ET CURRENT_EVENTS Outlook Webmail Phishing Landing 2015-11-21"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN DPRK HIDDEN COBRA Botnet C2 Host Beacon"

• "ET WEB_SERVER WebShell - Pouya - URI - action="

• "ET CURRENT_EVENTS SunDown EK RIP Landing M3 B643"

• "ET TROJAN AgentTesla PWS HTTP CnC Checkin"

• "ET CURRENT_EVENTS Possible Apple Store Phish Landing 2015-07-30"

• "ET CURRENT_EVENTS Chalbhai Phishing Landing Oct 23 2017"

• "ET CURRENT_EVENTS Successful Halkbank Phish M2 2018-04-16"

• "ET MALWARE Predator Anti Ban CnC Activity"

• "ET CURRENT_EVENTS Successful Axie Infinity Credential Phish M1 2022-05-18"

• "ET TROJAN Operation Cobra Venom WSF Stage 1 - CnC Checkin"

• "ET MOBILE_MALWARE Arid Viper (richardbeman .info in DNS Lookup)"

• "ET TROJAN Proxychecker Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (lindarealtytulum .com)"

• "ET CURRENT_EVENTS Successful Chase Phish 2020-10-14"

• "ET MALWARE DNS Query to Neoreklami (check-data .xyz)"

• "ET TROJAN Zeus Bot GET to Bing checking Internet connectivity"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Observed APT/SideWinder CnC Domain in TLS SNI"

• "ET TROJAN Win32/Unk.BrowserStealer CnC Checkin"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 4"

• "ET TROJAN Genome User-Agent (Http Down)"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (bk .957wan .com)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (undesirable .ru)"

• "ET USER_AGENTS Long Fake wget 3.0 User-Agent Detected"

• "ET TROJAN DarkCloud Stealer File Grabber Function Exfiltrating Data via Telegram"

• "ET TROJAN DNS Query for IcedID Domain (magiketchinn .com)"

• "ET TROJAN Volex - OceanLotus System Profiling JavaScript (linkStorage.x00SOCKET)"

• "ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M2"

• "ET TROJAN Observed Fake Chrome Landing Domain (chromiumtxt .space in TLS SNI)"

• "ET TROJAN Win32/BeamWinHTTP CnC Activity M2 (GET)"

• "ET MALWARE W32/MultiPlug.Adware Adfraud Traffic"

• "ET CURRENT_EVENTS Possible Ebay Phishing Domain Jan 30 2017"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (rustampo .ru)"

• "ET MALWARE MALWARE W32/WinWrapper.Adware POST CnC Beacon"

• "ET CURRENT_EVENTS DotkaChef EK initial landing from Oct 02 2013 mass-site compromise EK campaign"

• "ET TROJAN ATTACKER IRCBot - net localgroup - PRIVMSG Command"

• "ET TROJAN APT-C-48 Related CnC Domain in DNS Lookup (ntc-pk .sytes .net)"

• "ET CURRENT_EVENTS Successful Barclays Phish M2 2016-09-09"

• "ET TROJAN Gamaredon Maldoc Activity (GET)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (bid-adnoc .com) 2022-12-05"

• "ET TROJAN BlackMatter CnC Domain in DNS Lookup (nowautomation .com)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (abbrossgeneralhospital .com) 2022-12-05"

• "ET TROJAN Octopus Malware Initial Connectivity Check"

• "ET TROJAN Likely Fake Antivirus Download InternetAntivirusPro.exe"

• "ET TROJAN Cobalt Strike CnC Activity"

• "ET TROJAN Observed DNS Query to RisePro Domain (vi-files .com)"

• "ET TROJAN IRC Channel topic scan/exploit command"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (svnservices .com)"

• "ET CURRENT_EVENTS Generic Phishing Landing M1 2017-02-13"

• "ET TROJAN Possible Zeus GameOver Connectivity Check"

• "ET TROJAN UAC-0114/Winter Vivern File Exfilration"

• "ET TROJAN Joanap CnC Checkin"

• "ET TROJAN ZuoRAT send_http_msg_php Call to ssid.php"

• "ET TROJAN W32/Banload.VZS Banker POST CnC Beacon 1"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M6"

• "ET TROJAN Kimsuky Related Activity (ping)"

• "ET TROJAN Covenant Framework Default HTTP Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (david-mclean .club in TLS SNI)"

• "ET TROJAN Win32/Repl_it Coin Miner CnC Checkin"

• "ET TROJAN APT28 DealersChoice.B DNS Lookup (appexsrv .net)"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET TROJAN TA444 Domain in DNS Lookup"

• "ET TROJAN njRAT/Bladabindi Variant (Lime) CnC Checkin"

• "ET TROJAN DNS Query to TA444 Domain (j-ic .co .in)"

• "ET TROJAN Suspicious User-Agent - Possible Trojan Downloader (WinInet)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (flylinkimmigration .com) 2022-12-05"

• "ET TROJAN FoggyWeb Backdoor Incoming Request (GET)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11"

• "ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)"

• "ET TROJAN APT28/SEDNIT Uploader Variant DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ri7 .biz)"

• "ET TROJAN Alina Server Response Code"

• "ET TROJAN Win32/Irafau Backdoor CnC Activity (POST)"

• "ET MOBILE_MALWARE Android APT-C-23 (kristy-milligan .website in DNS Lookup)"

• "ET TROJAN Win32/Hyteod CnC Beacon"

• "ET TROJAN Observed DNS Query to Known Gelsemium CnC"

• "ET TROJAN Raspberry Robin CnC Domain in DNS Lookup (w0 .pm)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (u7u .ro)"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Zeus CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Unknown - Java Request - gt 60char hex-ascii"

• "ET TROJAN Ransomware/Cerber Checkin M3 (7)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN TrochilusRAT CnC Beacon 2"

• "ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)"

• "ET TROJAN PowerTrick Task Checkin M1"

• "ET TROJAN W32/Zeus.BitcoinMiner Variant CnC Beacon"

• "ET TROJAN Possible Pegasus Related DNS Lookup (newtarrifs .net)"

• "ET TROJAN Win32/Qihoo360.J Variant Install Report"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (rce .ee)"

• "ET CURRENT_EVENTS Successful Binance Credential Phish 2022-10-07"

• "ET MALWARE Malicious Chrome Ext. DNS Query For Adware CnC (search.feedvertizus)"

• "ET TROJAN Win32/Agent.AAIB Variant CnC"

• "ET TROJAN TA456 GrumpyGrocer Related Domain in DNS Lookup (hotjar .info)"

• "ET TROJAN Trojan.FakeMS Checkin"

• "ET MALWARE Best-targeted-traffic.com Spyware Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (qmpo .art)"

• "ET CURRENT_EVENTS Underminer EK IE Exploit"

• "ET TROJAN Perfect Keylogger FTP Initial Install Log Upload (Null obfuscated)"

• "ET CURRENT_EVENTS Successful Sparkasse Credential Phish M1 2022-04-13"

• "ET TROJAN UAC-006 Domain in TLS SNI (ukr-net-download-files-php-name .ru)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5j8 .xyz)"

• "ET TROJAN Cknife Shell Command Struct Inbound (PHP)"

• "ET TROJAN Win32/Beapy/Lemon_Duck CnC Checkin"

• "ET TROJAN LinPEAS Privilege Escalation Script Response (Without Banner)"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET CURRENT_EVENTS Successful HealthEquity Phish 2016-09-01"

• "ET CURRENT_EVENTS Successful Coinbase Phish 2022-07-18"

• "ET TROJAN Linux/Ssemgrvd sshd Backdoor HTTP CNC 2"

• "ET MALWARE Win32/Adware.Neoreklami.MI Activity M1"

• "ET MOBILE_MALWARE NSO Related Domain 36"

• "ET TROJAN Wrapper/Gholee/Wedex Checkin"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-blog .com)"

• "ET TROJAN CloudAtlas APT Related CnC Domain in DNS Lookup (checklicensekey .com)"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-10-06"

• "ET CURRENT_EVENTS RIG EK Broken/Filtered Payload Download Jun 19 2017"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (bluegaslamp .org)"

• "ET TROJAN RedDelta Poison Ivy Domain in DNS Lookup"

• "ET TROJAN Possible Ursnif/Gamaredon Related VNC Module CnC Beacon"

• "ET TROJAN EtumBot Registration Request"

• "ET CURRENT_EVENTS Mailbox Shutdown Phishing Landing 2017-12-11"

• "ET TROJAN XDMonitor Sending Debug Messages"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (administrator-enoc .com) 2022-12-05"

• "ET MOBILE_MALWARE Android APT-C-23 (appuree .info in TLS SNI)"

• "ET TROJAN Win32/Tofsee Pharma Spam Template Active - Outbound Email Spam"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET TROJAN Gamaredon File Stealer POST"

• "ET TROJAN BlackTech/PLEAD TSCookie CnC Checkin M1"

• "ET TROJAN STARSYPOUND Client Checkin"

• "ET WEB_SPECIFIC_APPS Possible Ivanti Endpoint Manager Mobile CVE-2023-35078 Check/Exploitation Attempt"

• "ET TROJAN Possible XServer Backdoor Certificate Observed"

• "ET TROJAN DNS Query to Raspberry Robin Domain (p0 .wf)"

• "ET TROJAN Operation Baby Coin syschk CnC Communication"

• "ET TROJAN ChamelGang Related CnC Domain in DNS Lookup (cdn-chrome .com)"

• "ET TROJAN Higasia CnC Activity"

• "ET WEB_SERVER c99 Shell Backdoor Var Override URI"

• "ET TROJAN Covenant .NET Framework P2P C&C Protocol Gruntsvc Named Pipe Interaction"

• "ET WEB_CLIENT Fake Virus Phone Scam Audio Oct 30"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN r0 CnC Check"

• "ET CURRENT_EVENTS French Government COVID-19 Landing Page"

• "ET TROJAN PXJ Ransomware CnC Activity"

• "ET TROJAN Upatre Common URI Struct July 15 2014"

• "ET MOBILE_MALWARE Android APT-C-23 (new .filetea .me in DNS Lookup)"

• "ET CURRENT_EVENTS Disdain EK URI Struct Aug 23 2017 M2"

• "ET CURRENT_EVENTS Adobe Online Document Phishing Landing 2016-05-02"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed DNS Query to Known Indexsinas CnC Domain"

• "ET CURRENT_EVENTS cPanel Phishing Landing 2015-12-01"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (APT-C-55/BabyShark Staging Domain)"

• "ET TROJAN Netbounce Proxy User-Agent (idk)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (tenders-adnoc .com) 2022-12-05"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1q8hn7d0uhpspz9xcp3hl9e5erddlew .com in TLS SNI)"

• "ET TROJAN CryptoWall Check-in M2"

• "ET TROJAN [PTsecurity] W32/Rodecap.StealRat C2 Payload (GIF)"

• "ET TROJAN Observed Gamaredon APT Related Domain (saharabo .ru in TLS SNI)"

• "ET MALWARE W32/RocketfuelNextUp.Adware CnC Beacon"

• "ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.in)"

• "ET TROJAN W32/Ke3chang.MyWeb.APT Eourdegh Campaign CnC Beacon"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (catreenpr .is)"

• "ET MALWARE LNKR Request for validate-site.js"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET TROJAN OSX/WizardUpdate CnC Activity"

• "ET USER_AGENTS Suspicious User-Agent (Forthgoner) - Possible Trojan Downloader GET Request"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN FakeAV security_scanner.exe"

• "ET TROJAN Win32/Orchard Botnet Activity"

• "ET TROJAN Pyramid Framework Payload Request (base-DonPAPI.py)"

• "ET TROJAN DNS query for known Anunak APT Domain (coral-trevel.com)"

• "ET CURRENT_EVENTS Successful Bank of America Phish 2016-10-14"

• "ET TROJAN MASSLOGGER Client Data Exfil (POST) M2"

• "ET TROJAN Mystic Stealer Admin Panel 2023-06-16"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (Knotweed/SubZero)"

• "ET MALWARE Crossrider Spyware Checkin"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN [PTsecurity] Bitter RAT C2 Response"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M1 2016-09-30"

• "ET CURRENT_EVENTS Hikvision DVR attempted Synology Recon Scan"

• "ET TROJAN iKittens OSX MacDownloader DNS Lookup (officialswebsites .info)"

• "ET MALWARE User-Agent (Gbot)"

• "ET CURRENT_EVENTS ClearFake Fingerprinting Domain in TLS SNI (stats-best .site)"

• "ET CURRENT_EVENTS Observed TOAD Domain (dfhelp .live in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (euya .cn)"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M6"

• "ET TROJAN Mozart Loader Command Request (reportupdates)"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-10-07"

• "ET TROJAN DTLoader Domain (ahgwqrq .xyz in TLS SNI)"

• "ET TROJAN ErbiumStealer CnC Domain (www .f0679086 .xsph .ru) in DNS Lookup"

• "ET TROJAN Night Dragon CnC Beacon Outbound"

• "ET TROJAN PoisonIvy HTTP CnC Beacon"

• "ET TROJAN Win32/Small.XR Checkin 2 WEBC2-CSON APT1 Related"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ldnr .net)"

• "ET TROJAN APT28 Zebrocy/Zekapab Reporting to CnC M3"

• "ET TROJAN DNS Query to Raspberry Robin Domain (cb3u .com)"

• "ET MOBILE_MALWARE Arid Viper (stand-by-97c5c .appspot .com in DNS Lookup)"

• "ET TROJAN Observed Suspected TA453 Related Domain (metaemailsecurity .com in TLS SNI)"

• "ET TROJAN Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 2"

• "ET TROJAN Matryoshka CnC Beacon 1"

• "ET TROJAN W32/Snojan.BNQKZQH CnC Activity"

• "ET MOBILE_MALWARE Android.BankBot.11270 (TLS SNI)"

• "ET TROJAN APT 41 CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Instagram Phish Mar 14 2017"

• "ET TROJAN W32/Asprox.ClickFraudBot CnC Beacon"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.2 Domain (count .trackstatisticsss .com) in TLS SNI"

• "ET CURRENT_EVENTS [eSentire] OneDrive Phishing Landing 2018-06-15"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-09-21"

• "ET MOBILE_MALWARE Arid Viper (fasebaok .co in DNS Lookup)"

• "ET INFO Possible PHP Backdoor Command Execution"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (soundvista .club)"

• "ET MALWARE Luxsoft Win32/ICLoader User-Agent"

• "ET TROJAN Observed Teal Kurma Domain (alhurra .online in TLS SNI)"

• "ET MALWARE User-Agent (HTTP)"

• "ET CURRENT_EVENTS Generic Credit Card Information in HTTP POST - Possible Successful Phish Jun 12 2017"

• "ET TROJAN Win32/TaskPerformer Downloader CnC Activity"

• "ET MOBILE_MALWARE Observed Android/IRATA Domain (rimotgozaran .tk) in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET TROJAN Ruskill/Palevo Download Command"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN ZenRAT Ping Command"

• "ET TROJAN AlphaCrypt CnC Beacon 5"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (bitscrunch .myvnc .com)"

• "ET MALWARE SurfSidekick Activity"

• "ET TROJAN Possible CopyKittens DNS Lookup (windowskernel.in)"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (tomond .ru)"

• "ET TROJAN Observed CobaltStrike CnC Domain (stg .pesrado .com in TLS SNI)"

• "ET TROJAN Lop.gfr/Swizzor HTTP Update/Checkin (usually host-domain-lookup.com related)"

• "ET TROJAN Win32/DarkPink KamiKakaBot CnC Exfil (POST)"

• "ET TROJAN Innostealer Domain in DNS Lookup (windows11-upgrade .com)"

• "ET TROJAN Vawtrak/NeverQuest Posting Data"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET CURRENT_EVENTS Successful Three Step Gmail Phish (2 of 3) Phish 2016-12-02"

• "ET TROJAN Trojan.BackDoor-DRV.gen.c Reporting-1"

• "ET POLICY poclbm BitCoin miner"

• "ET TROJAN Win32/Beapy CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Webmail Phish M1 2016-06-22"

• "ET TROJAN Observed PoetRAT Domain (dellgenius .hoptop .org in TLS SNI)"

• "ET MOBILE_MALWARE Android/HeHe.Spy GetTaskRequest CnC Beacon"

• "ET MALWARE Win32/Adware.Agent.NPP CnC Activity"

• "ET TROJAN Lazarus FALLCHILL Fake SSL Checkin 2"

• "ET TROJAN FrauDrop UA LETITGO"

• "ET MOBILE_MALWARE NSO Related Domain 9"

• "ET CURRENT_EVENTS Webshell Landing Outbound - Possibly Iran-based"

• "ET CURRENT_EVENTS Nemucod JS Downloader Aug 01 2017"

• "ET TROJAN Bitcoin variant Checkin"

• "ET TROJAN Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 ASCII"

• "ET MOBILE_MALWARE Android/Spy.Agent.ANA (sharpion .org in DNS Lookup)"

• "ET CURRENT_EVENTS Unknown Malicious Second Stage Download URI Struct Sept 15 2015"

• "ET TROJAN Trojan-Banker.Win32.Agent Checkin"

• "ET CURRENT_EVENTS Successful Bank of America Phish 2016-10-03"

• "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2"

• "ET TROJAN APT-Q-37/Manling Flower Payload - CnC Checkin"

• "ET TROJAN Mustang Panda/RedDelta Activity"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (scott-chapin .com in DNS Lookup)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (akamaitechcloudservices .com)"

• "ET TROJAN Win32/Pteranodon CnC Exfil (POST) M2"

• "ET TROJAN CenterPOS CnC 2"

• "ET TROJAN CommentCrew Possible APT backdoor stage 2 download base64 update.gif"

• "ET TROJAN Lemon_Duck Powershell - RDP Credential Exfil"

• "ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response M2"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (wallanews .publicvm.com)"

• "ET TROJAN MSIL/JobCrypter Ransomware Checkin via SMTP"

• "ET WEB_CLIENT CookieBomb Generic HTML Format"

• "ET TROJAN Observed GhostWriter APT Related Cobalt Strike Domain (ao3 .hmgo .pw in TLS SNI)"

• "ET CURRENT_EVENTS Possible Unknown TDS /top2.html"

• "ET TROJAN Scarlet Mimic DNS Lookup 45"

• "ET TROJAN Blue Bot DDoS Target Request"

• "ET TROJAN Linux/ChinaZ DDoS Bot Checkin"

• "ET CURRENT_EVENTS TDS - in.php"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (koolstoredeluxe .com)"

• "ET CURRENT_EVENTS Possible Generic Phishing Landing Jul 28 2015"

• "ET MOBILE_MALWARE Android APT-C-23 (jimmykudo .online in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (everyservices .space in DNS Lookup)"

• "ET TROJAN LDPinch Checkin (3)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 47"

• "ET TROJAN WinGo/Go-rod signInUrls Failed Data Exfiltration attempt"

• "ET TROJAN BazaLoader Activity (GET)"

• "ET TROJAN Quant Loader Download Response"

• "ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M2"

• "ET TROJAN Suspected Chinese Based APT Malware Retrieving File (GET)"

• "ET TROJAN Win32/Aurora Stealer Accept Command"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 2]"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN WEBC2-QBP Checkin Response 1 - Embedded CnC APT1 Related"

• "ET TROJAN Lazarus Decafett DNS Lookup 1"

• "ET CURRENT_EVENTS Successful Telstra Phish M1 2015-09-05"

• "ET TROJAN ZeroLocker Activity"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to thedoccloud .com"

• "ET CURRENT_EVENTS Possible Successful CDC Coronavirus Related Phish 2020-04-07"

• "ET MALWARE Observed Win32/Foniad Domain (efishedo .info in TLS SNI)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (buritoc .ru)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (agonizing .ru)"

• "ET MOBILE_MALWARE Android BatteryBotPro Checkin"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-03-13"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Prometei Botnet CnC Checkin"

• "ET CURRENT_EVENTS Spotify Phishing Landing 2020-04-14"

• "ET TROJAN Fake ProtonVPN/AZORult CnC Domain Query"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (whitedrill .org)"

• "ET TROJAN Observed TA444 Domain (pre .alwayswait .site) in TLS SNI"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2015-11-06"

• "ET TROJAN Possible IoT_reaper ELF Binary Request M1 (set)"

• "ET CURRENT_EVENTS Generic Tombol Microsoft Account Phishing Landing 2020-12-16"

• "ET CURRENT_EVENTS Generic Phish Landing Page 2022-01-14"

• "ET EXPLOIT Possible Cisco RV320 RCE Attempt (CVE-2019-1652)"

• "ET TROJAN Win32/0xtaRAT CnC Activity M5 (POST)"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-10-31"

• "ET TROJAN Known Sinkhole Response Header"

• "ET TROJAN Observed Malicious Powershell Payload Delivery Domain (onerecovery .click) in TLS SNI"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab890e964c34 .com) Oct 2017"

• "ET MALWARE MSIL.Amiricil.gen HTTP Checkin"

• "ET TROJAN Backdoor.Egobot Checkin"

• "ET TROJAN Dropper.Win32.Agent.bpxo Checkin"

• "ET WEB_SPECIFIC_APPS ManageEngine Desktop Central Administrator Account Creation"

• "ET TROJAN APT/Bitter Related CnC Domain in DNS Lookup"

• "ET TROJAN Observed Sidewinder APT User-Agent"

• "ET CURRENT_EVENTS Fragus Exploit jar Download"

• "ET TROJAN Win32/RisePro CnC Server Response M2"

• "ET TROJAN Zentom FakeAV Checkin"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 21"

• "ET TROJAN Win32/AMGO Keylogger - Keylogger Started Message via Telegram (POST)"

• "ET TROJAN Observed PoetRAT Domain (slimip .accesscam .org in TLS SNI)"

• "ET TROJAN TA428 Infostealer CnC Host Checkin"

• "ET TROJAN Worm.Win32.Balucaf.A Checkin"

• "ET USER_AGENTS Metafisher/Goldun User-Agent (z)"

• "ET TROJAN Known Sinkhole Response Header INetSim"

• "ET TROJAN Pandemiya User-Agent"

• "ET TROJAN TitanStealer Data Exfiltration Attempt"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-10-05"

• "ET TROJAN ELF/Roboto - Communicating with Hardcoded Peer 2"

• "ET TROJAN Ransomware/Cerber Checkin M3 (2)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jan 03 2017"

• "ET TROJAN DNS Query to Teal Kurma Domain (anfturkce .news)"

• "ET TROJAN Sidewinder CnC DNS Query"

• "ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup"

• "ET MALWARE CoinSurf Proxy Client Login"

• "ET TROJAN Observed Gamaredon APT Related Domain (alismaso .ru in TLS SNI)"

• "ET TROJAN DonotGroup Pult Downloader Activity (POST)"

• "ET TROJAN TA452 Related Domain in DNS Lookup"

• "ET TROJAN Observed Gamaredon APT Related Domain (nicsan .ru in TLS SNI)"

• "ET CURRENT_EVENTS Possible JS Credit Card Stealer Inbound"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed APT29 Domain (edenparkweddings .com) in TLS SNI"

• "ET MOBILE_MALWARE Android APT-C-23 (accuant-googlc .com in DNS Lookup)"

• "ET TROJAN Win32.Lager Trojan Reporting (gcu)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba Lure (Package Delivery)"

• "ET TROJAN Kimsuky Related Script Activity (GET)"

• "ET TROJAN Taidoor Checkin"

• "ET TROJAN MSIL/Khonsri Ransomware CnC Activity"

• "ET WEB_CLIENT DRIVEBY FakeSupport - URI - windows-firewall.png"

• "ET TROJAN PS/Beapy CnC Checkin"

• "ET TROJAN ATTACKER IRCBot - PRIVMSG Response - Directory Listing"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (elcapolis .com)"

• "ET TROJAN MSIL/PSW.Agent.RXP Checkin"

• "ET TROJAN Observed AHK Downloader Request Structure"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (n2care .us)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 3]"

• "ET TROJAN Ruskill/Palevo CnC PONG"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN LokiBot Fake 404 Response"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (allinfostudio .com)"

• "ET TROJAN Linux/dtool IRC Command (TCPFLOOD)"

• "ET TROJAN BlackMatter CnC Activity"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 57"

• "ET EXPLOIT Metasploit Plugin-Detect Posting Data 5"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (gc .wb51 .com)"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Arid Viper APT Possible User-Agent (Skype)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Suspected CHAOS CnC Inbound (persistence enable)"

• "ET TROJAN Legion Loader Activity Observed (heil_satan)"

• "ET TROJAN Mimikatz x86 Executable Download Over HTTP"

• "ET CURRENT_EVENTS Successful Outlook Phish 2016-08-31"

• "ET MALWARE Win32/Pearfoos.B!ml Checkin"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to Mirai Domain (miraistealer .xyz)"

• "ET TROJAN WarHawk/Spyder Activity (Deploy) M1"

• "ET TROJAN Malicious Chrome Extension Domain Request (change-request .info in DNS Lookup)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M9"

• "ET TROJAN Tick Group APT Activity (GET)"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(DEMOMAKE)"

• "ET TROJAN Vicious Panda Checkin"

• "ET TROJAN Hyperion Obfuscator Payload Inbound"

• "ET CURRENT_EVENTS Underminer EK Resource File Download M1"

• "ET TROJAN SmugX Domain in DNS Lookup (jcswcd .com)"

• "ET TROJAN Suspected Malicious JS Loader Activity (GET)"

• "ET TROJAN Scarlet Mimic DNS Lookup 33"

• "ET TROJAN r0 CnC Architecture POST 1"

• "ET ATTACK_RESPONSE Hostile FTP Server Banner (Reptile)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.GoatRat CnC Domain in DNS Lookup"

• "ET TROJAN Banker Trojan CnC AddNew Command"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M1 2023-02-22"

• "ET TROJAN Win32/CollectorStealer CnC Exfil M3"

• "ET TROJAN DarkHotel Initial Beacon"

• "ET TROJAN Dark Halo/SUNBURST CnC Domain (globalnetworkissues .com in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (Unattributed CnC)"

• "ET USER_AGENTS Suspicious User-Agent (contains loader)"

• "ET TROJAN Win32/Aura Ransomware CnC Activity"

• "ET INFO Successful Tectite Web Form Submission - Possible Phishing"

• "ET MOBILE_MALWARE Android APT-C-23 (mauricefischer .club in TLS SNI)"

• "ET CURRENT_EVENTS Observed UK Gov Support Landing 2021-06-01"

• "ET TROJAN Red Wolf/RedCurl Domain (servicehost .click) in TLS SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN SocGholish Domain in TLS SNI (modification .grebcocontractors .com)"

• "ET MALWARE Regnow.com Access"

• "ET TROJAN DNS Query to Raspberry Robin Domain (79r .nl)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (alliumso .ru)"

• "ET TROJAN Lazarus APT Related Activity (GET)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (helpset123 .site)"

• "ET MOBILE_MALWARE Android APT-C-23 (exvsnomy .club in DNS Lookup)"

• "ET TROJAN Nerbian RAT CnC Checkin"

• "ET TROJAN IcedID/Emotet Certificate Observed M1"

• "ET TROJAN Tick Group Payload - Submitting Encrypted Data to CnC"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 6"

• "ET TROJAN APT32/OceanLotus Associated Domain in DNS Lookup (thundernews .org)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 12"

• "ET TROJAN TA450 Nagual CnC Activity"

• "ET TROJAN Win32/LODEINFO v0.4.x CnC Checkin"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Activity (Activity)"

• "ET MALWARE Sogou Toolbar Checkin"

• "ET TROJAN W32/DirCrypt.Ransomware CnC Checkin"

• "ET TROJAN ConnectWise ScreenConnect Payload Delivery Domain (win04 .xyz) in DNS Lookup"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (marybskitchen .com)"

• "ET CURRENT_EVENTS Successful Made In China Phish 2016-09-28"

• "ET TROJAN Possible Adwind/jSocket SSL Cert (assylias.Inc)"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (8as1s2 .com)"

• "ET TROJAN NSO Group Pegasus Related Data Exfil (POST)"

• "ET MOBILE_MALWARE Android APT-C-23 (esofiezo .website in DNS Lookup)"

• "ET TROJAN VirRansom/VirLock Checkin Response"

• "ET TROJAN EVILNUM CnC Host Checkin"

• "ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Guerrilla.h CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Tycoon Landing Page"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (printersolutions .live)"

• "ET CURRENT_EVENTS Office 365 Phishing Landing 2018-01-18"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN VBS/TrojanDownloader.Agent.YLH Payload Inbound"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 10"

• "ET TROJAN Malicious SSL Cert (Magecart)"

• "ET TROJAN Marai Variant Activity (Inbound)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET CURRENT_EVENTS Successful Paypal (DE) Phish 2016-12-19"

• "ET WORM TheMoon.linksys.router 1"

• "ET TROJAN VBS/TrojanDownloader.Agent.SEB Reporting Network Info"

• "ET TROJAN GCleaner Related Downloader User-Agent"

• "ET TROJAN Ransomware Locky .onion Payment Domain"

• "ET TROJAN Observed DNS Query to TA444 Domain (privacysign .org)"

• "ET TROJAN W32/Patchwork.Backdoor Communicating with CnC"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC)"

• "ET TROJAN Base64 Encoded Windows Command Prompt (Outbound)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (kjaj .top)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Maldoc Domain in DNS Lookup (aljazeera .cc)"

• "ET CURRENT_EVENTS Likely Malicious Windows SCT Download MSXMLHTTP AX"

• "ET TROJAN FrauDrop UA single"

• "ET TROJAN Suspicious User-Agent build - possibly Delf/Troxen/Zema"

• "ET TROJAN SLOTHFULMEDIA RAT CnC (POST)"

• "ET TROJAN Win32/nstealer CnC Exfiltration (POST) M1"

• "ET P2P BearShare P2P Gnutella Client HTTP Request"

• "ET TROJAN PurpleFox Backdoor/Rootkit Download Request M1"

• "ET TROJAN Observed Jupyter Stealer CnC Domain (vincentolife .com in TLS SNI)"

• "ET TROJAN Codesoft PW Stealer Email Report Outbound"

• "ET CURRENT_EVENTS Possible Successful Outlook Web App Phish 2016-12-28"

• "ET TROJAN Patchwork Domain (randreports .org in DNS Lookup)"

• "ET TROJAN Win32/Predator Variant Dropper Activity"

• "ET TROJAN CommentCrew Possible APT c2 communications sleep3"

• "ET TROJAN Malicious Powershell Activity (GET)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Observed Remcos Domain (listpoints .online in TLS SNI)"

• "ET TROJAN AutoHotKey offthewall Downloader Requesting Payload"

• "ET TROJAN Medfos/Midhos Checkin"

• "ET TROJAN Win32/Frosparf.B Downloading Hosts File"

• "ET TROJAN Wintervivern Related CnC Domain in DNS Lookup (centr-security .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Matsnu Checkin"

• "ET TROJAN SuperKillerX CnC Activity"

• "ET TROJAN Cayosin Botnet User-Agent Observed M1"

• "ET TROJAN Observed TA444 Domain (mufg .ink in TLS SNI)"

• "ET TROJAN Zhelatin npopup Update Detected"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (belochkaneprihoditodna .top in TLS SNI)"

• "ET USER_AGENTS Suspicious User-Agent (miip)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 2"

• "ET TROJAN Backdoor.Win32/Likseput.A Checkin Windows Vista/7/8"

• "ET MOBILE_MALWARE Android.KorBanker Successful Fake Banking App Install CnC Server Acknowledgement"

• "ET TROJAN [ANY.RUN] Observed Malicious Powershell Related Activity (GET)"

• "ET TROJAN W32/Eclipse.DDOSBot CnC Beacon Response"

• "ET TROJAN MSIL/Agent.PYO Possible net.tcp CnC Beacon (stat)"

• "ET TROJAN Hupigon.DF Checkin"

• "ET TROJAN MSIL/Black Hat Worm Server Response"

• "ET TROJAN DistTrack/Shamoon CnC Beacon M1"

• "ET TROJAN MargulasRAT Keep-Alive Inbound M2"

• "ET TROJAN Arid Viper APT DNS Lookup (flushupdate.com)"

• "ET TROJAN DonotGroup CnC Observed in DNS Query"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/BlackNET CnC Requesting Command"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to databasegalore .com"

• "ET TROJAN Possible DACLS RAT Log Collector Download"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup FireStarter CnC)"

• "ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (apkapps .pro in DNS Lookup)"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN Symbiote CnC Domain in DNS Lookup (assets .fans)"

• "ET WEB_CLIENT Fake AV Phone Scam Domain M1 Mar 3"

• "ET TROJAN Observed Malicious SSL Cert (TaurusStealer CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN W32/Nolja Trojan Downloader Initial Checkin"

• "ET TROJAN GravityRAT CnC Domain (x-trust .net in DNS Lookup)"

• "ET TROJAN APT32 Komprogo DNS Lookup"

• "ET TROJAN WaterDropX PRISM CnC Checkin"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN Bazaloader Variant Activity"

• "ET TROJAN OilRig QUADAGENT CnC Domain in SNI"

• "ET CURRENT_EVENTS Underminer EK Key POST"

• "ET TROJAN FaceBook IM & Web Driven Facebook Trojan Posting Data"

• "ET TROJAN Observed MageCart CnC Domain (mcdnn .net in TLS SNI)"

• "ET TROJAN Win32/PSW.Agent.OIN CnC Activity"

• "ET TROJAN TA453/CharmingKitten HYPERSCRAPE Tool Identity Check Activity (GET)"

• "ET TROJAN W32/DoubleTap.APT Downloader Socks5 Setup Request"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2016-09-14"

• "ET TROJAN Backdoor.Win32.VB.Alsci/Dragon Eye RAT Checkin (sending user info)"

• "ET TROJAN FortDisco Reporting Status"

• "ET TROJAN Trojan.Win32.Antavmu.guw Checkin"

• "ET TROJAN Observed TA444 Domain in TLS SNI"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 20"

• "ET TROJAN Suspected Tunna Proxy M1"

• "ET CURRENT_EVENTS Successful Ebay Phish M1 2016-12-29"

• "ET TROJAN Mirai pTea Variant - Bot Upload Command Inbound"

• "ET CURRENT_EVENTS Apple Phishing Landing 2016-03-01 M3"

• "ET TROJAN Winsoft.E Checkin 2"

• "ET CURRENT_EVENTS Successful American First CU Credential Phish 2023-01-03"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (viewnet .better-than.tv)"

• "ET MOBILE_MALWARE Android APT-C-23 (eleanor-guthrie .info in DNS Lookup)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (wendypior .ink)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (gimmegimmejimmy .top in TLS SNI)"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN TA444 Domain in TLS SNI (document .shared-link .line .pm)"

• "ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup"

• "ET TROJAN ZenRAT Tasking Command"

• "ET TROJAN Win32.Cerberus RAT Client pong"

• "ET MALWARE Downloader.NSIS.OutBrowse.b Checkin"

• "ET CURRENT_EVENTS Successful Apple Phish (FR) M1 2016-10-07"

• "ET TROJAN MSIL/SkidRat CnC Checkin M3"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (rus .feedpolicy .xyz)"

• "ET TROJAN Hacking Team Elite Windows Implant Exfiltration"

• "ET TROJAN Blackenergy Bot Checkin to C&C (2)"

• "ET TROJAN Win32/Gamaredon CnC Activity"

• "ET TROJAN MINEBRIDGE CnC Response"

• "ET TROJAN Observed DNS Query to Ursnif Domain (gigiman .xyz)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET TROJAN Win32/zgRAT CnC Activity (GET)"

• "ET TROJAN Qbot Payload Request (2023-03-21) M9"

• "ET CURRENT_EVENTS Observed TOAD Domain (j2care .us in TLS SNI)"

• "ET USER_AGENTS Suspicious User-Agent _updater_agent"

• "ET TROJAN VikroStealer Retrieving Config"

• "ET TROJAN Possible Pegasus/Trident Related HTTP Beacon 1"

• "ET TROJAN CopyKittens Matryoshka DNS Lookup 2 (twiter-statics . info)"

• "ET TROJAN JS/Nemucod.M.gen downloading EXE payload"

• "ET TROJAN Kimsuky APT CnC Domain in DNS Lookup"

• "ET TROJAN Compromised Chat Application Related User-Agent (Chrorne)"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (bestfindthetruth .com)"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2015-11-04"

• "ET TROJAN Observed Malicious SSL Cert (Gozi ISFB)"

• "ET TROJAN Win64/Agent.BP System Info Exfil"

• "ET MOBILE_MALWARE Android APT-C-23 (appchecker .us in TLS SNI)"

• "ET TROJAN Win32/Vidar Variant/Mars CnC Activity (GET)"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET CURRENT_EVENTS IRS Credential Phish Direct Deposit Payment Data Exfil"

• "ET TROJAN Observed Malicious Powershell Loader Payload Request (GET)"

• "ET MALWARE Malicious Chrome Ext. DNS Query For Adware CnC (opurie)"

• "ET TROJAN Win32/Phoenix Keylogger SMTP Exfil - Passwords"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET MALWARE User-Agent (SogouExplorerMiniSetup)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M16"

• "ET TROJAN Sharik/Smoke CnC Beacon 7"

• "ET TROJAN Suspected Cobalt Strike Beacon Activity (DNS)"

• "ET TROJAN Pyramid Framework Payload Request (base-bof.py)"

• "ET CURRENT_EVENTS Successful Docusign/Outlook Phish 2016-08-17"

• "ET CURRENT_EVENTS Possible Successful Generic Phish 2016-06-22"

• "ET TROJAN Stobox Connectivity Check"

• "ET TROJAN MSIL APT28 Zebrocy/Zekapab Reporting to CnC"

• "ET TROJAN Win32/Pterodo Activity (POST)"

• "ET TROJAN Win32.YordanyanActiveAgent CnC Reporting"

• "ET TROJAN Observed Malicious DNS Query (ReactGet Group)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (b2care .us)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN LNK/Sherlock Stealer Host Process List Exfil (POST)"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET TROJAN Possible Sharik/Smoke Loader Microsoft Connectivity check M2"

• "ET TROJAN China Chopper Command Struct"

• "ET TROJAN DNS Query For TURNEDUP.Backdoor CnC (googlmail)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (sithoparka .com)"

• "ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to seobundlekit .com"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Webshell Upload Command Inbound - Possibly Iran-based"

• "ET EXPLOIT Metasploit Browser Exploit Server Plugin Detect"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (david-gardiner .website in DNS Lookup)"

• "ET TROJAN Win32/Stealc Requesting browsers Config from C2"

• "ET TROJAN FatDuke Domain Observed"

• "ET TROJAN Observed TWISTEDPANDA Domain in TLS SNI (www .miniboxmail .com)"

• "ET CURRENT_EVENTS Adobe Phishing Landing 2016-03-10"

• "ET TROJAN Observed TA444 Domain (tp-globa .xyz) in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MOBILE_MALWARE Android APT-C-23 (harrykane .online in TLS SNI)"

• "ET MALWARE LNKR landing page (possible compromised site) M4"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Alpha Stealer v1.5 PWS Exfil via HTTP"

• "ET TROJAN Parallax CnC Response Activity M8"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (hierodula .online)"

• "ET TROJAN Observed Pirate Stealer Domain in DNS Lookup (socket .bby .gg)"

• "ET TROJAN SoulSearcher Checkin M1"

• "ET TROJAN Win32/Cryptbotv2 CnC Activity (POST) M3"

• "ET TROJAN MICROPSIA Screenshot Upload M3"

• "ET TROJAN Observed Sharp Panda APT Related Activity M2"

• "ET TROJAN Win32/Trickbot Data Exfiltration M4"

• "ET TROJAN Observed Gootloader Domain in DNS Lookup (jp .imonitorsoft .com)"

• "ET TROJAN W32/Patchwork.Backdoor CnC Check-in M2"

• "ET CURRENT_EVENTS HTTP POST Contains Only Password (xyz) 2021-04-05"

• "ET TROJAN TA444 MacOS/ProcessRequest CnC Checkin"

• "ET TROJAN AstroBot CnC Activity"

• "ET TROJAN Backdoor.Win32.VB.cfi (related) System Info Upload via FTP"

• "ET CURRENT_EVENTS JavaScript DOS Injection"

• "ET WEB_CLIENT DRIVEBY FakeUpdate - URI - /styles/javaupdate.css"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (habbybearshop .top)"

• "ET TROJAN Win32/IcedID Request Cookie"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6xj .xyz)"

• "ET TROJAN TickGroup Datper CnC Checkin M3"

• "ET CURRENT_EVENTS Successful iTunes Phish Mar 21 2014"

• "ET TROJAN Ransomware Win32/WinPlock.A CnC Beacon 2"

• "ET CURRENT_EVENTS Observed TOAD Domain (bscare .cc in TLS SNI)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (mojavebo .ru)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-05-24"

• "ET TROJAN Win32/Aurora Stealer Sending System Information"

• "ET TROJAN Ransomware/Cerber Checkin M3 (5)"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (zxcdota2huysasi .com)"

• "ET TROJAN Win32/Chekafe.A or Related Infection Checkin"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M13"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Unusual FTP Server Banner (NzmxFtpd)"

• "ET TROJAN Suspected Polonium CnC Initial Checkin M1"

• "ET MOBILE_MALWARE Android APT-C-23 (myboon .website in DNS Lookup)"

• "ET MALWARE Elitemediagroup.net Spyware Config Download"

• "ET CURRENT_EVENTS Terror EK Payload Download M2 Mar 14 2017"

• "ET TROJAN Win32/Bisonal Backdoor CnC Activity (POST)"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET MOBILE_MALWARE iOS DualToy Checkin"

• "ET TROJAN DNS query for known Anunak APT Domain (worldnewsonline.pw)"

• "ET INFO Suspicious User-Agent (record)"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (eastrenclouds .com)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-12-09"

• "ET TROJAN Win32/HackTool.Agent.CS SMTP Scanner CnC Checkin"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Instagram Like Bot (like4u) CnC Activity M2"

• "ET CURRENT_EVENTS PurpleFox EK Domain in DNS Lookup"

• "ET TROJAN Observed SSV Agent CnC Domain (edgecloudc .com in TLS SNI)"

• "ET TROJAN Yahoo550.com Related Downloader/Trojan Checkin"

• "ET TROJAN Maldoc Checkin Activity (GET)"

• "ET TROJAN APT 41 LOWKEY Backdoor - Ping Error Code sent to CnC"

• "ET TROJAN Win32/PirateMatryoshka CnC DNS Query"

• "ET TROJAN BernhardPOS Possible Data Exfiltration via DNS Lookup (29a.de)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS BegOpEK - TDS - icon.php"

• "ET TROJAN Win32/Bulta CnC Beacon"

• "ET CURRENT_EVENTS Universal Webmail Phishing Landing 2016-08-19"

• "ET CURRENT_EVENTS Email Storage Upgrade Phishing Landing 2016-08-15"

• "ET TROJAN Win32/Ramsay CnC Domain in DNS Query"

• "ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain"

• "ET CURRENT_EVENTS BegOpEK - Landing Page"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (coupang-networks .pics in TLS SNI)"

• "ET TROJAN Malicious SSL Cert (Magecart)"

• "ET TROJAN IMDDOS Botnet User-Agent YTDDOS"

• "ET CURRENT_EVENTS Observed TOAD Domain (bgcare .us in TLS SNI)"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET CURRENT_EVENTS Successful DHL Phish (Meta HTTP-Equiv Refresh) 2017-02-08"

• "ET TROJAN Observed Gamaredon APT Related Domain (aconitumso .ru in TLS SNI)"

• "ET TROJAN Unk.VBSLoader Retrieving Payload"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (davos-seaworth .info in DNS Lookup)"

• "ET TROJAN InfoBot Sending Machine Details"

• "ET MALWARE W3i Related Adware/Spyware"

• "ET TROJAN FakeAV.dfze/FakeAV!IK Checkin"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (illboardinj .com)"

• "ET USER_AGENTS Suspicious User-Agent (AutoHotkey)"

• "ET TROJAN Panda Banker Injects Domain (urimchi3dt4 .website in TLS SNI)"

• "ET TROJAN Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 5"

• "ET MALWARE User-Agent (XieHongWei-HttpDown/2.0)"

• "ET MALWARE overtls.com adware request"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET USER_AGENTS Suspicious User Agent (agent)"

• "ET TROJAN SocGholish Domain in TLS SNI (pluralism .themancav .com)"

• "ET TROJAN slock Ransomware CnC Activity"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST Struct M1"

• "ET TROJAN DNS Query for Cloud Atlas ecolines.es"

• "ET TROJAN Windows systeminfo Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN W32.Nemim Checkin"

• "ET TROJAN Win32/Trojan.Nymeria CnC Activity (GET) M3"

• "ET CURRENT_EVENTS Navy Federal Credit Union Credential Phish Landing Page 2022-07-05"

• "ET MOBILE_MALWARE Arid Viper (fasebcak .co in DNS Lookup)"

• "ET CURRENT_EVENTS Successful AOL Phish M3 2016-07-14"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (dgormiugatox .com)"

• "ET TROJAN Ixeshe/Mecklow Checkin 2"

• "ET TROJAN [DCSO] Possible Andariel Exfil Activity"

• "ET TROJAN Win32/TrickBot maserv Module Command"

• "ET TROJAN [ANY.RUN] PovertyStealer Exfiltration M1"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (msstorageazure .com)"

• "ET TROJAN Vobus/Beebone Sinkhole DNS Reply"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (redsnowynose .org)"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Arid Viper (lordblackwood .club in DNS Lookup)"

• "ET TROJAN Likely Mirai Related Outbound Shell Request"

• "ET TROJAN Generic Trojan with /? and Indy Library User-Agent"

• "ET TROJAN Chinotto CnC Activity (file)"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected"

• "ET TROJAN Netwire RAT Client Check-in (socket created)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Teslacrypt Ransomware .onion domain (63ghdye17.com)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (aphelp .us)"

• "ET MALWARE Artro Downloader User-Agent Detected"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Single char EXE direct download likely trojan (multiple families)"

• "ET MOBILE_MALWARE Android/Drinik Activity M2 (POST)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/Karmen Ransomware CnC Activity"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (linda-gaytan .website in DNS Lookup)"

• "ET TROJAN W32/Emotet Empty CnC Beacon"

• "ET TROJAN Win32/Injector.BBYK Checkin"

• "ET TROJAN Observed NimPlant Server Response (Inbound)"

• "ET TROJAN Potential Dridex.Maldoc Minimal Executable Request"

• "ET TROJAN DNS Query to Raspberry Robin Domain (c4z .pl)"

• "ET TROJAN GhostWriter APT Related Cobalt Strike Domain in DNS Lookup (hmgo .pw)"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-schnellvpn .com)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 35"

• "ET CURRENT_EVENTS Successful Tesco Phish (set) M2 Jul 18 2017"

• "ET WEB_CLIENT Malicious Chrome Extension Domain Request (nyoogle .info in DNS Lookup)"

• "ET TROJAN Scieron DNS Lookup (yellowblog.flnet.org)"

• "ET CURRENT_EVENTS Possible Phishing Landing Hosted on CodeSandbox.io M3"

• "ET TROJAN MirrorBlast Checkin"

• "ET TROJAN Bamital Headers - Likely CnC Beacon"

• "ET TROJAN Arid Viper APT File information"

• "ET CURRENT_EVENTS Office Related Appspot Hosted Shared Document Phishing Landing"

• "ET TROJAN Red Leaves HTTP CnC Beacon (APT10 implant)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish Jan 14 2016"

• "ET TROJAN Win32/Kumquat Loader Activity (Subscribe)"

• "ET TROJAN Legion Loader Activity Observed (salmonella-symptome)"

• "ET TROJAN DNS Query to TA444 Domain (werfaultserver .com)"

• "ET TROJAN Win32/Pift DNS TXT CnC Lookup ppidn.net"

• "ET TROJAN nspps Backdoor CnC Activity"

• "ET TROJAN Observed DecryptmyFiles Ransomware User-Agent (uniquesession)"

• "ET MOBILE_MALWARE Android APT-C-23 (natemunson .com in DNS Lookup)"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup"

• "ET TROJAN HTTPTool User-Agent"

• "ET TROJAN Observed TraderTraitor Domain (toyourownbeat .com in TLS SNI)"

• "ET TROJAN Possible IceRat CnC Acitivty"

• "ET TROJAN Py/MechaFlounder CnC Checkin"

• "ET TROJAN Desert Falcon Related APT DNS Lookup (tvgate.rocks)"

• "ET TROJAN Diavol Communicating with CnC - Services Request"

• "ET TROJAN Observed Gootloader Domain in DNS Lookup (kristinee .com)"

• "ET TROJAN BazaLoader CnC Activity"

• "ET TROJAN W32/GMUnpacker.Downloader Download Instructions Response From CnC"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (wantddantiprot .space in DNS Lookup)"

• "ET TROJAN Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (windowservicecemter .com)"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunchtech .linkpc .net)"

• "ET TROJAN JS.ElectronBot Payload Inbound"

• "ET TROJAN W32/TrojanSpy.MSIL Get New MAC CnC Beacon"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-blog .com)"

• "ET CURRENT_EVENTS Generic Survey Credential Phish Landing Page 2022-06-20"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-11-18"

• "ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download"

• "ET TROJAN Win32/Zeprox.B Checkin"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Nov 16 2016"

• "ET TROJAN Redline Stealer Related Domain in DNS Lookup (windows-upgraded .com)"

• "ET TROJAN Drovorub tunnel Module Server Response"

• "ET TROJAN Dridex POST Checkin"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M4"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS HTTP POST Contains Only Password (cf) 2021-04-05"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (rogac .ru)"

• "ET TROJAN Screenblaze SCR Related Backdoor - GET"

• "ET TROJAN DNS Query to Malicious Domain (hijackson .org)"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected"

• "ET TROJAN Inter Skimmer CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 103"

• "ET TROJAN Trojan.Generic.5325921 Checkin"

• "ET TROJAN TA453 Domain in DNS Lookup (washingtonlnstitute .org)"

• "ET TROJAN Papercut MF/NG User/Group Sync FTP Backdoor trigger"

• "ET TROJAN Possible Winnti-related DNS Lookup (css .google-statics .com)"

• "ET TROJAN Observed Teal Kurma Domain (systemctl .network in TLS SNI)"

• "ET TROJAN WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related"

• "ET TROJAN Sarwent CnC Command (download)"

• "ET TROJAN SocGholish Domain in DNS Lookup (modification .grebcocontractors .com)"

• "ET TROJAN Win32/VB.QTV CnC Checkin"

• "ET TROJAN Donot Group Related Activity (Response)"

• "ET CURRENT_EVENTS Possible PDF Dictionary Entry with Hex/Ascii replacement"

• "ET INFO PhishMe.com Phishing Exercise - Client Plugins"

• "ET TROJAN Observed Sandman APT LuaDream Backdoor Domain (mode .encagil .com) in TLS SNI"

• "ET MALWARE Common Adware Library ISX User Agent Detected"

• "ET CURRENT_EVENTS SWF filename used in IE 2014-0322 Watering Hole Attacks"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET TROJAN Android/AhMyth RAT Command Inbound (Contacts Manager)"

• "ET TROJAN Possible SSH Linux.Fokirtor backchannel command"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (draggedline .org)"

• "ET MALWARE Win32/InstallDisck SMTP Checkin"

• "ET MALWARE Observed Win32/Foniad Domain (suggedin .info in TLS SNI)"

• "ET MOBILE_MALWARE Android/Gigabud CnC Domain (bweri6 .cc) in DNS Lookup"

• "ET TROJAN Nyanw0rm CnC Keep-Alive (Outbound) M1"

• "ET TROJAN Blackshades Payload Download Command"

• "ET CURRENT_EVENTS Successful Email Settings Phish 2016-10-28"

• "ET TROJAN Win32/Disabler.NPR Checkin"

• "ET CURRENT_EVENTS Successful Impots.gouv.fr Phish M1 2015-08-21"

• "ET MOBILE_MALWARE Android/FakeKakao checkin 1"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (fdn-trace .net)"

• "ET TROJAN Naoinstalad Checkin"

• "ET TROJAN Win32/Unk.BrowserStealer Data Exfil M2"

• "ET CURRENT_EVENTS SofosFO/GrandSoft landing applet plus class Mar 03 2013"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 88"

• "ET TROJAN AppleJeus - Kupay Wallet CnC Domain in DNS Lookup (levelframeblog .com)"

• "ET CURRENT_EVENTS Successful View Invoice Phish M2 2016-10-05"

• "ET CURRENT_EVENTS Successful Credential Phish M3 2022-09-23"

• "ET TROJAN 44 Caliber Stealer Data Exfil via Discord"

• "ET TROJAN Observed Malicious Filename in Outbound POST Request (Browsers/Cookies/Microsoft Edge_)"

• "ET TROJAN Sharik/Smoke CnC Beacon 12"

• "ET TROJAN Ransomware Locky CnC Beacon 21 May"

• "ET MOBILE_MALWARE Android APT-C-23 (eleanorguthrie .site in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (FIN8 ShellTea CnC)"

• "ET MALWARE W32/SearchSuite Install CnC Beacon"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-02-13"

• "ET TROJAN Win32/Eternity Ransomware Retrieving Image (GET)"

• "ET TROJAN Possible ToneShell CnC Checkin M3"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M22"

• "ET MALWARE Win32/Agent.PMS Variant CnC Activity"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M6"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (support .cisco-webex .online)"

• "ET CURRENT_EVENTS Successful Three Step Gmail Phish (1 of 3) 2016-12-02"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access takeCameraPicture"

• "ET MOBILE_MALWARE Android APT-C-23 (fatehmedia .site in DNS Lookup)"

• "ET TROJAN HTTP Andromeda File Request"

• "ET USER_AGENTS Suspicious User-Agent (RestoroMainExe)"

• "ET TROJAN Tibs Checkin"

• "ET TROJAN Filename server.exe Download - Common Hostile Filename"

• "ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2"

• "ET TROJAN Observed Adwind RAT CnC DNS Query"

• "ET TROJAN Moose CnC Request M1"

• "ET TROJAN Backdoor.Win32.Fynloski.A/DarkRat Checkin Outbound"

• "ET TROJAN Observed DNS Query to AppleJeus Domain (wirexpro .com)"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN NSO Group Pegasus Related Data Exfil (POST) M2"

• "ET TROJAN Babar POST Request"

• "ET CURRENT_EVENTS Successful Outlook Password Update Phish M2 2016-09-01"

• "ET TROJAN DNS Query to Raspberry Robin Domain (jrx .fr)"

• "ET TROJAN Win32/Injector.BXEW Variant HTTP CnC Beacon 2"

• "ET TROJAN Win32/Sality.NBA Exfil"

• "ET POLICY Inbound PowerShell Capable of Enumerating Internal Network via WMI"

• "ET TROJAN Possible Pegasus Related DNS Lookup (manoraonline .net)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN NanoCore RAT Keepalive Response 1"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.2 Domain (clon .collectfasttracks .com) in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (RedGuard Framework)"

• "ET MALWARE W32/Linkular.Adware Icons.dat Second Stage Download"

• "ET CURRENT_EVENTS Adobe Shared Document Phish Landing 2015-11-14"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher DNS Lookup"

• "ET TROJAN XDUpload Uploading Files"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (limeerror .org)"

• "ET MALWARE Zredirector.com Related Spyware User-Agent (BndDriveLoader)"

• "ET CURRENT_EVENTS Observed DNS Query to Browser Coinminer (crypto-loot[.]com)"

• "ET TROJAN linux.backdoor.wordpressexploit.2 CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT_NGO_wuaclt PDF file"

• "ET TROJAN DNS Query to Raspberry Robin Domain (tu6p .com)"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)"

• "ET WEB_SERVER WebShell - Generic - GIF Header With HTML Form"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (cinaprofilm .com)"

• "ET MALWARE Win32/DealPly Configuration File Inbound"

• "ET MALWARE Searchmeup Spyware Install (prog)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Apple Phish Oct 31 2016"

• "ET TROJAN Konni APT MalDoc Activity (GET)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (online-processing .online)"

• "ET TROJAN Ursnif Checkin"

• "ET CURRENT_EVENTS Successful Mailbox Shutdown Phish M2 2016-05-16"

• "ET TROJAN Drive Receiving IP DDoS instructions"

• "ET TROJAN Query for Known Hostile *test.3322.org.cn Domain"

• "ET CURRENT_EVENTS IRS Credential Phish Credit Card Payment Data Exfil"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Mozilla JS Class Creation"

• "ET MALWARE Toplist.cz Related Spyware Checkin"

• "ET TROJAN Win32/BlackCarat XORed (0x77) CnC Checkin"

• "ET MALWARE Win32/Adware.Qjwmonkey.H Variant CnC Activity M2"

• "ET TROJAN Observed Malicious SSL Cert (Go/Chaos Botnet)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT DarkHydrus DNS Lookup 18"

• "ET TROJAN Observed Scattered Spider Domain (victimname-sso .com in TLS SNI)"

• "ET TROJAN Suspicious User-Agent (WindowsNT) With No Separating Space"

• "ET TROJAN Bitter RAT HTTP CnC Beacon"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Caypnamer.A RAT CnC Initial Checkin"

• "ET USER_AGENTS Suspicious User-Agent (Accessing)"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET TROJAN Scarlet Mimic DNS Lookup 46"

• "ET TROJAN Volatile Cedar DNS Lookup (dotntexplorere.info)"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET WEB_CLIENT Tech Support Scam Landing M1 2019-04-15"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (amazonascash .com)"

• "ET CURRENT_EVENTS Successful Banque Populaire (FR) Phish 2016-12-12"

• "ET TROJAN Possible Vidar Stealer C2 Config In Steam Profile"

• "ET TROJAN METALJACK APT32 DNS Lookup (libjs.inquirerjs.com)"

• "ET TROJAN Win32/RecordBreaker CnC Exfil (Cookies)"

• "ET TROJAN GoBrut/StealthWorker Service Bruter CnC Activity"

• "ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (bluegaslamp .org)"

• "ET MALWARE Win32 Handy Cafe Checkin"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-12-05"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (launchruse .com)"

• "ET CURRENT_EVENTS Successful DHL Phish 2019-10-18"

• "ET TROJAN Gamaredon CnC Observed in DNS Query"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (helpfulsteepyi .pw)"

• "ET EXPLOIT Metasploit Plugin-Detect Posting Data 3"

• "ET TROJAN Towerweb Ransomware Landing Page"

• "ET CURRENT_EVENTS Successful PNC Bank Phish 2016-01-09"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (chretiendaujoudhui .com)"

• "ET TROJAN Loki Locker Ransomware CnC Activity"

• "ET TROJAN Backdoor.Win32.ZZSlash/Redosdru.E checkin"

• "ET CURRENT_EVENTS Inbound JS with Possible 1px-1px Exfiltration Image"

• "ET MALWARE Haken Clicker CnC Activity"

• "ET TROJAN NewPosThings Checkin"

• "ET TROJAN Qarallax RAT Keepalive C2 (set)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 22"

• "ET WEB_SERVER Insomnia Shell HTTP Request"

• "ET TROJAN NanoCore RAT CnC 7"

• "ET TROJAN MargulasRAT Keep-Alive Inbound M1"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Discover Phish Feb 02 2017"

• "ET TROJAN x0Proto Ping"

• "ET TROJAN GCleaner Downloader Activity M3"

• "ET TROJAN Win32.Hack.PcClient.g CnC (OUTBOUND) XOR b5"

• "ET EXPLOIT Remote Command Execution via Android Debug Bridge"

• "ET TROJAN APT Related - BLACKCOFFEE Command Delimiters in HTTP Response M1"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET WEB_CLIENT Possible Credentials Sent to Suspicious TLD via HTTP GET"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (gawocag .com)"

• "ET TROJAN Inter Skimmer CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Manhattan College Credential Phish 2022-01-10"

• "ET TROJAN Possible Dyre SSL Cert Jan 22 2015"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 28"

• "ET TROJAN DNS Query to Raspberry Robin Domain (fnx .wf)"

• "ET TROJAN Cobalt Strike Beacon Activity"

• "ET TROJAN Embedded Android Dalvik Executable File With Fake Windows Executable Header - Possible AV Bypass Attempt"

• "ET TROJAN Miniduke variant C&C activity"

• "ET TROJAN Ponmocup HTTP Request (generic) M7"

• "ET TROJAN MalDoc Retrieving msiexec Commands via DNS TXT"

• "ET TROJAN Observed Malicious SSL Cert (FIN8 CnC)"

• "ET CURRENT_EVENTS Possible BACKSWING JS Framework POST Observed"

• "ET TROJAN Observed Python Stealer/Clipper Related Domain (kekwltd .ru in TLS SNI)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M10"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET TROJAN DonotGroup CnC Domain Observed in DNS Query"

• "ET TROJAN Windows Command Prompt OUTBOUND"

• "ET TROJAN Trojan.SpamBanker Report via SMTP"

• "ET TROJAN BlackDolphin Ransomware Builder Landing Page M3"

• "ET TROJAN UIWIX Ransomware .onion Payment Domain (4ujngbdqqm6t2c53)"

• "ET CURRENT_EVENTS Successful Generic Phish 2018-02-26 (set)"

• "ET CURRENT_EVENTS Cool PDF July 15 2013"

• "ET CURRENT_EVENTS Possible Cartasi Phishing Domain Nov 08 2016"

• "ET MOBILE_MALWARE Android/BasBanke CnC Checkin"

• "ET CURRENT_EVENTS Possible Phishing Landing Obfuscation 2016-02-26"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (seedkraproboy .com)"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (dakareypa .ru)"

• "ET TROJAN APT OSX.XSLCmd CnC Beacon"

• "ET TROJAN JS.ElectronBot.B.F7A4D930 Downloader (GET)"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (norayowell .info)"

• "ET TROJAN Win32/Unknown VBScript Backdoor Activity (GET)"

• "ET MOBILE_MALWARE Arid Viper (tim-jordan .info in DNS Lookup)"

• "ET CURRENT_EVENTS Observed DNS Query to ING Group Phishing Domain"

• "ET TROJAN Observed Buer Loader CnC Domain (kkjjhhdff .site in TLS SNI)"

• "ET CURRENT_EVENTS TeamIPwned/Hellion Phishing Landing 2016-08-30"

• "ET CURRENT_EVENTS Chalbhai Phishing Landing 2020-06-22"

• "ET TROJAN WorldWind Stealer Checkin via Telegram (GET)"

• "ET CURRENT_EVENTS Successful Amazon (UK) Phish 2016-10-17"

• "ET CURRENT_EVENTS Successful Credit Agricole Bank (FR) Phish M2 2016-10-19"

• "ET CURRENT_EVENTS L33bo Phishing Landing 2016-03-29"

• "ET TROJAN EvilNum APT Related Domain in DNS Lookup (estimefm .org)"

• "ET TROJAN APT/Bitter Related CnC Activity"

• "ET TROJAN Blackenergy Bot Checkin to C&C"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (emarataljabrisolicitors .com) 2022-12-05"

• "ET TROJAN Observed Malicious SSL Cert (Baka Skimmer Staging CnC)"

• "ET TROJAN Zbot .onion Proxy domain in SNI Aug 04 2014"

• "ET CURRENT_EVENTS Successful Key Bank Phish M1 2015-08-20"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Likely Evil Macro EXE DL mar 28 2016"

• "ET CURRENT_EVENTS Possible Successful Apple Phish 2015-07-27"

• "ET MOBILE_MALWARE NSO Related Domain 12"

• "ET TROJAN APT28/Sofacy Zebrocy CnC DNS Lookup (support-cloud .life)"

• "ET TROJAN MSIL/TrojanDownloader.Agent.KUO CnC Activity M2"

• "ET TROJAN ChamelGang Related CnC Domain in DNS Lookup (microsoft-support .net)"

• "ET TROJAN Perl/Calfbot C&C DNS request"

• "ET MOBILE_MALWARE Android APT-C-23 (bellamy-bob .life in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN WP CharCode Inject"

• "ET TROJAN KeyloggerOnline Keylogger Checkin (go https)"

• "ET TROJAN Win32/Grandoreiro TCP CnC Activity"

• "ET WEB_CLIENT Fake AV Phone Scam Domain M3 Mar 3"

• "ET TROJAN Observed Magecart Skimmer Domain (static-zdassets .com in TLS SNI)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-cdn .xyz)"

• "ET TROJAN SPEAR CnC Beacon 2"

• "ET MALWARE Ads2Srv Bundle Installer Offer Request"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Patchwork APT Related Activity M2 (POST)"

• "ET TROJAN Carberp file download"

• "ET CURRENT_EVENTS Successful UK Tax Phishing M1 2016-02-01"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN PRG/wnspoem/Zeus InfoStealer Trojan Config Download"

• "ET CURRENT_EVENTS Successful Yahoo Credential Phish 2023-06-30"

• "ET TROJAN Win32/VBS.Sload Activity (GET)"

• "ET TROJAN System Progressive Detection FakeAV (AuthenticAMD)"

• "ET TROJAN TA453 BellaCiao CnC Domain in DNS Lookup (maill-support .com)"

• "ET TROJAN Probable OneLouder downloader (Zeus P2P)"

• "ET TROJAN Win32/DarkCloud Exfil Over SMTP (Subject)"

• "ET TROJAN W32/Caphaw CnC Configuration File Request"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (arauas .com)"

• "ET TROJAN Possible APT28 Maldoc CnC Checkin"

• "ET TROJAN FOX-SRT ShimRat check-in (Data)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN MSIL/NewHT Ransomware CnC Checkin"

• "ET TROJAN HTTPCore CnC Tasking File"

• "ET MALWARE klm123.com Spyware User Agent"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Bancos/DarkTequila CnC)"

• "ET TROJAN Generic VBS Backdoor Sending Windows Information (POST)"

• "ET TROJAN BACKCONFIG CnC Downloader Activity"

• "ET TROJAN Win32.Virut - GET"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 9"

• "ET TROJAN Win32/Fujacks Variant CnC Activity"

• "ET MOBILE_MALWARE Android APT-C-23 (activedardash .club in TLS SNI)"

• "ET TROJAN Dialer.MC(vf) HTTP Request - Checkin"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (on-global .xyz)"

• "ET TROJAN TA421/YTTRIUM/APT29 TLS Certificate M1"

• "ET TROJAN Higaisa CnC (ipconfig)"

• "ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M6"

• "ET TROJAN Variant.Strictor Dropper"

• "ET TROJAN Observed Win32.Raccoon Stealer Domain (cheapfacechange .top in TLS SNI)"

• "ET TROJAN Magecart CnC Domain in DNS Lookup (saylor2xbtc .com)"

• "ET TROJAN APT28/Sednit DNS Lookup (defenceiq .us)"

• "ET MALWARE Adware.PUQD Checkin"

• "ET TROJAN WebDAV Retrieving .exe from .url M1 (CVE-2023-36025)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 76"

• "ET TROJAN Win32/S1deload Stealer CnC Checkin - Get Tasking"

• "ET CURRENT_EVENTS DRIVEBY GENERIC ShellExecute in Hex No Seps"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-01-30"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST M3"

• "ET TROJAN Suspected APT-Q-37 Related Activity (Outbound)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4q .pm)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Suntrust Captcha Phishing Landing"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish M1 2016-11-22"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 8"

• "ET CURRENT_EVENTS Suspicious Form with Action Value Equal to bit .ly"

• "ET TROJAN Smurf2 CnC Checkin"

• "ET TROJAN Cobalt Strike Malleable C2 Profile (Teams) M2"

• "ET TROJAN TA444 Domain in TLS SNI (internal .group .link-net .publicvm .com)"

• "ET TROJAN Observed BazarLoader Domain (sh78bug .xyz in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (wagringamuk .com)"

• "ET TROJAN MAGICHOUND-related DNS Lookup (timezone .live)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (jsqur .com)"

• "ET TROJAN Possible DarkHotel Landing M1"

• "ET TROJAN MintStealer Discord Activity (GET)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (gpksanfrancisco .com)"

• "ET TROJAN OneLouder EXE download possibly installing Zeus P2P"

• "ET CURRENT_EVENTS Successful Facebook (TR) Phish 2016-12-08"

• "ET MALWARE Loadmoney.A Checkin 6"

• "ET TROJAN TrojanSpy.KeyLogger.acqh User-Agent(EMSFRTCBVD)"

• "ET CURRENT_EVENTS DRIVEBY Generic URLENCODED CollectGarbage"

• "ET TROJAN Vobfus Check-in"

• "ET TROJAN Optix Pro Trojan/Keylogger Reporting Installation via HTTP-Email Post"

• "ET TROJAN Win32/Onliner Template 1 Active - Malicious Outbound Email Spam"

• "ET TROJAN nspps Backdoor - Task Response"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (shehootastayonwhatshelirned .top)"

• "ET TROJAN MICROPSIA HTTP Failover CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (TA456 GrumpyGrocer)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 101"

• "ET CURRENT_EVENTS Successful Facebook Phish 2019-04-12"

• "ET TROJAN Observed DNS Query to Ursnif SAIGON Variant CnC Domain"

• "ET TROJAN Kimsuky Related Maldoc Retrieving Template (GET)"

• "ET CURRENT_EVENTS Terse POST to Wordpress Folder - Probable Successful Phishing"

• "ET CURRENT_EVENTS Sakura obfuscated javascript Jun 1 2013"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ej3 .xyz)"

• "ET TROJAN Danabot Key Exchange Request"

• "ET TROJAN Linux/KDefend Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (dj2 .biz)"

• "ET TROJAN Win32/Vools Variant CnC Checkin"

• "ET TROJAN DNS Query to Gamaredon Domain (goruspa .ru)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [Fireeye] Backdoor.BEACON SSL Cert Inbound (zupertech .com)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (ijoyzymama .com)"

• "ET USER_AGENTS Suspicious User-Agent (Inet_read)"

• "ET TROJAN GORGON APT Download Activity M2"

• "ET TROJAN [Fireeye] Backdoor.BEACON M2"

• "ET TROJAN Malicious Mega Chrome Extension Exfil Domain (www .megaopac .host in TLS SNI)"

• "ET TROJAN TrueBot/Silence.Downloader CnC Checkin 3"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN TA404/Zinc Trojanized muPDF/Subliminal CnC Checkin"

• "ET MALWARE W32/SmartPops Adware Outbound Off-Port MSSQL Communication"

• "ET TROJAN APT28/Sednit DNS Lookup (unitednationsnews .eu)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zk4 .me)"

• "ET CURRENT_EVENTS Fiesta SilverLight 5.x Exploit URI Struct"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (neurotonix--buy .us)"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2015-11-03"

• "ET TROJAN Operation Mystery Baby syschk CnC Communication"

• "ET TROJAN Win32/Blacklegion Ransomware CnC Checkin"

• "ET MALWARE AppControls.com User-Agent"

• "ET CURRENT_EVENTS Navy Federal Credit Union Phishing Landing 2016-01-30"

• "ET TROJAN Observed Pegasus Domain (hooklevel .com in TLS SNI)"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET MALWARE Win32/Adware.Agent.NSF CnC Checkin M1"

• "ET MOBILE_MALWARE Android APT-C-23 (lincoln-blake .website in DNS Lookup)"

• "ET MALWARE FLV/Youtube Downloader Install Activity"

• "ET CURRENT_EVENTS Successful Webmail Validator Phish M1 2016-09-02"

• "ET TROJAN HTTP Request to a *.pw domain with direct request/fake browser (multiple families flowbit set)"

• "ET TROJAN WSF/JS Downloader Jan 30 2017 M1"

• "ET TROJAN Possible Covenant Framework Grunt MSBuild Stager HTTP Download"

• "ET TROJAN SolarBot Plugin Download MessageBox"

• "ET TROJAN Nemty Ransomware CnC Checkin"

• "ET CURRENT_EVENTS Parrot TDS Cleared Response"

• "ET TROJAN Observed Malicious DNS Query (Mirrorthief Group)"

• "ET TROJAN MSIL/Modi RAT CnC Command Inbound (in)"

• "ET TROJAN Mermaid Ransomware Variant CnC Activity M4"

• "ET TROJAN ErbiumStealer Variant CnC Activity (getstub)"

• "ET TROJAN MSSQL maggie backdoor ls Query Observed"

• "ET TROJAN Cobalt Strike Malleable C2 Request (Stackoverflow Profile)"

• "ET TROJAN Mercury APT Related Domain in DNS Lookup (sygateway .com)"

• "ET TROJAN OSX Backdoor Quimitchin DNS Lookup"

• "ET CURRENT_EVENTS Possible CVE-2014-6332 DECS2"

• "ET TROJAN Suspected BTC Swapper Activity (GET)"

• "ET CURRENT_EVENTS Inbound PowerShell Executing Base64 Decoded VBE from Temp 2018-11-29"

• "ET TROJAN Win32/FlawedAmmyy RAT CnC Checkin"

• "ET TROJAN JackPOS XOR Encoded HTTP Client Body (key AA)"

• "ET MALWARE Observed Win32/Foniad Domain (enclosely .info in TLS SNI)"

• "ET TROJAN XcodeGhost CnC Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (wpsrv .zip)"

• "ET TROJAN Suspected Polonium CnC Initial Checkin M2"

• "ET TROJAN Win32/LockScreen.BW Payment Info"

• "ET CURRENT_EVENTS Webmail Update Phishing Landing 2016-01-15"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (tiena .einei .line .pm)"

• "ET TROJAN Knock.php Shiz or Rohimafo CnC Server Contact URL"

• "ET MALWARE Hotbar Spyware User-Agent (Hotbar)"

• "ET MALWARE W32/BettrExperience.Adware Update Checkin"

• "ET TROJAN ELF/BASHLITE CnC Activity (Response)"

• "ET CURRENT_EVENTS GrandSoft EK IE Exploit Jan 30 2018"

• "ET TROJAN W32/Witch.3FA0!tr CnC Activity M2"

• "ET TROJAN DarkHotel Downloader CnC Beacon 1"

• "ET MOBILE_MALWARE NSO Related Domain 26"

• "ET CURRENT_EVENTS Adobe Phishing Landing"

• "ET CURRENT_EVENTS Likely Evil EXE download from WinHttpRequest non-exe extension"

• "ET TROJAN DNS Query to Raspberry Robin Domain (3h1 .xyz)"

• "ET TROJAN Suspected Stealth Soldier Backdoor Related Activity M4 (GET)"

• "ET TROJAN PoisonIvy.E Keepalive to CnC"

• "ET CURRENT_EVENTS Successful Telstra Refund Phish 2016-12-13"

• "ET TROJAN Win32.Banker.bqba Checkin"

• "ET CURRENT_EVENTS Successful RBC Royal Bank Phish M1 Aug 17 2017"

• "ET TROJAN Observed DeltaStealer Domain (deltaproject .us) in TLS SNI"

• "ET MALWARE dns-look-up.com Spyware User-Agent (KRSystem)"

• "ET TROJAN Sofacy DNS Lookup adawareblock.com"

• "ET TROJAN Scanbox Sending Host Data"

• "ET WEB_SERVER Compromised Wordpress Install Serving Malicious JS"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN Atomic macOS (AMOS) Stealer Domain in DNS Lookup (amos-malware .ru)"

• "ET TROJAN Suspected SmokeLoader Retrieving Next Stage (GET)"

• "ET TROJAN TorrentLocker DNS Lookup (tweeterplanet.ru)"

• "ET WEB_SERVER DNS Query for Suspicious 9507c4e8.com Domain - Anuna Checkin - Compromised PHP Site"

• "ET TROJAN TA408 Related Activity (GET)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (id .bigmir .space in TLS SNI)"

• "ET MALWARE Searchmeup Spyware Install (systime)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ynns .uk)"

• "ET TROJAN Win32/Sephora Related Activity (GET)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (procellarumbi .ru)"

• "ET TROJAN Rhadamanthys Stealer - Payload Download Request"

• "ET TROJAN Steganographic Encoded WAV File Inbound via HTTP M2"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET CURRENT_EVENTS Caixa Credential Phish Landing Page 2022-07-05"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-26"

• "ET EXPLOIT Metasploit Plugin-Detect Posting Data 1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0dz .me)"

• "ET TROJAN Possible CopyKittens DNS Lookup (patch7-windows.com)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-10-18"

• "ET TROJAN ZeroAccess Checkin"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M24"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M2"

• "ET TROJAN Possible Kelihos.F EXE Download Common Structure"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (flowdivison .club in TLS SNI)"

• "ET TROJAN MAZE Ransomware Payment Domain DNS Lookup"

• "ET TROJAN TeleBots VBS Backdoor CnC Beacon 1"

• "ET MOBILE_MALWARE Android/Spy.Agent.AKS CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Canada Revenue Agency COVID-19 Assistance Eligability (FR) Phish 2020-04-01"

• "ET TROJAN a310Logger Stealer Exfil (SMTP)"

• "ET WEB_CLIENT Microsoft Tech Support Phone Scam M4 Jul 07 2017"

• "ET TROJAN Win32/Vidar Variant/Mars Stealer CnC Exfil"

• "ET MALWARE LNKR landing page (possible compromised site) M1"

• "ET TROJAN Windows Microsoft Windows DOS prompt command Error not recognized"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Gamaredon CnC Activity (POST) M1"

• "ET MOBILE_MALWARE Android APT-C-23 (accaunts-googlc .com in DNS Lookup)"

• "ET TROJAN BF Botnet CnC Checkin"

• "ET TROJAN CustomRAT DNS lookup"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-01-03"

• "ET CURRENT_EVENTS Phishing Landing via Tripod.com (set) 2016-03-31"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (contract-snoc .com) 2022-12-05"

• "ET MOBILE_MALWARE Android APT-C-23 (lincoln-blake .website in TLS SNI)"

• "ET TROJAN Malicious SSL Cert (Magecart)"

• "ET MALWARE W32/PlaySushi User-Agent"

• "ET TROJAN Suspected Tunna Proxy M2"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 5"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky C2)"

• "ET TROJAN DNS Query For TURNEDUP.Backdoor CnC (securityupdated)"

• "ET TROJAN APT28 DealersChoice CnC Beacon Response"

• "ET TROJAN JS/Nemucod requesting EXE payload 2015-12-01"

• "ET TROJAN Possible PowerShell Empire Activity Outbound"

• "ET TROJAN Backdoor.Linux.Turla Download"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.RedAlert CnC Beacon"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (damnater .com)"

• "ET TROJAN Win32/Ramgex.D Checkin"

• "ET TROJAN W32/Alina.POS-Trojan Checkin"

• "ET CURRENT_EVENTS DRIVEBY SweetOrange - Java Exploit Downloaded"

• "ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"

• "ET MOBILE_MALWARE Android/Code4hk.A Checkin"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (ua-passport .space in TLS SNI)"

• "ET TROJAN RaccoonStealer Admin Console Inbound"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (APT-C-55/BabyShark Staging Domain)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible Pegasus Related DNS Lookup (icloudcacher .com)"

• "ET TROJAN Shamoon V3 CnC Checkin"

• "ET TROJAN WEBC2-AUSOV Checkin Response - Embedded CnC APT1 Related"

• "ET CURRENT_EVENTS Successful FreeMobile (FR) Phish M3 2016-10-06"

• "ET TROJAN Gamania Trojan Check-in"

• "ET TROJAN Brute Ratel CnC Activity (xml-c2) M1"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (contact-adnocae .com) 2022-12-05"

• "ET CURRENT_EVENTS Possible Metasploit Java Exploit"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET MOBILE_MALWARE Android APT-C-23 (lets-see .site in DNS Lookup)"

• "ET TROJAN Backdoor.Win32.Sykipot Get Config Request"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (AnubisStealer CnC)"

• "ET TROJAN Observed Upatre CnC Domain in TLS SNI"

• "ET TROJAN Observed DNS Query to TA444 Domain (ms .onlineshares .cloud)"

• "ET MALWARE Loadmoney.A Checkin 7"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (jobdescription .linkpc .net)"

• "ET MALWARE Win32/Farfli.BAL CnC Activity"

• "ET MALWARE Vaccineprogram.co.kr Related Spyware User Agent (pcsafe)"

• "ET TROJAN ELF/RapperBot CnC Checkin M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Cryptbotv2 CnC Activity (POST) M2"

• "ET TROJAN FatalRAT CnC Activity"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (ap1-port .net)"

• "ET CURRENT_EVENTS Likely Malicious Windows SCT Download MSXMLHTTP M2"

• "ET TROJAN Win32/Backdoor.Daxin CnC Activity"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor S5WRITE Command (Inbound)"

• "ET TROJAN Mystic Stealer C2 Client Hello Packet"

• "ET TROJAN Win32/Kryptik.HCZR Variant Initial Checkin"

• "ET TROJAN Hangover Campaign Keylogger 2 checkin"

• "ET USER_AGENTS Suspicious User-Agent (WinProxy)"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET TROJAN Recaptcha Magecart Skimmer Domain in DNS Lookup (trustdomains .net)"

• "ET TROJAN Tinba Server Response"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 6.3)"

• "ET MOBILE_MALWARE Android APT-C-23 (buymicrosft .com in TLS SNI)"

• "ET MOBILE_MALWARE Android Vultr Checkin"

• "ET TROJAN Glupteba CnC Observed in DNS Query"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Sakura Landing with Applet Aug 30 2013"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (areadozemode .space in DNS Lookup)"

• "ET TROJAN Win32/Sabsik.TE.B!ml CnC Checkin"

• "ET CURRENT_EVENTS Successful Office 365 Phish 2016-08-24"

• "ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 2"

• "ET TROJAN PWS Win32/Lmir.BMQ checkin"

• "ET USER_AGENTS Suspicious User-Agent (checkonline)"

• "ET TROJAN Win32.ClipBanker.uhn Exfil"

• "ET TROJAN ZeroAccess udp traffic detected"

• "ET TROJAN Kriptovor Retrieving RAR Payload"

• "ET TROJAN Banker Trojan (General) HTTP Checkin (vit)"

• "ET MOBILE_MALWARE Android APT-C-23 (hotimael .com in TLS SNI)"

• "ET TROJAN IMDDOS Botnet User-Agent kav"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.a CnC Beacon"

• "ET TROJAN Ursnif Variant CnC Beacon 3"

• "ET TROJAN NimPlant Task Activity (GET)"

• "ET TROJAN [DCSO] Andariel CnC Activity, Check String"

• "ET CURRENT_EVENTS Terror EK Payload Download"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET CURRENT_EVENTS Successful Netflix Credential Phish 2022-12-27"

• "ET TROJAN Win32/TrojanDownloader.AutoHK.MT CnC Checkin"

• "ET TROJAN FakeAV Install"

• "ET WEB_SERVER Tunna Variant Webshell Activity"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (printerjobs .xyz)"

• "ET TROJAN ELF/RapperBot CnC Checkin M1"

• "ET TROJAN CHAOS RAT/AlfaC2 Client Checkin"

• "ET TROJAN Win32/Onliner CnC Checkin"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M14"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (jokergame1 .com)"

• "ET TROJAN MACE C2 Framework Response M2"

• "ET MOBILE_MALWARE Android.Trojan.Rana.A (whoisdomainpc .com in DNS Lookup)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jul 13 2016"

• "ET MALWARE PUP Optimizer Pro Adware GET or POST to C2"

• "ET TROJAN Observed Cobalt Strike CnC Domain (windowsupdatesc .com in TLS SNI)"

• "ET TROJAN JavaRAT Keep-Alive (outbound)"

• "ET TROJAN Win32/ScarCruf Payload Inbound"

• "ET TROJAN Cobalt Strike Beacon (Bing Profile)"

• "ET CURRENT_EVENTS Successful Personalized Adobe Online PDF Phish 2016-11-28"

• "ET TROJAN OSX/Shlayer CnC Activity M3"

• "ET TROJAN Observed CobaltStrike/TEARDROP CnC Domain Domain in DNS Query"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2020-05-27)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Lazarus CnC Domain Observed in DNS Query"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(smaal)"

• "ET CURRENT_EVENTS Successful Credential Phish (Multiple Brands) 2016-12-22"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2019-11-04"

• "ET TROJAN Malicious Chrome Extension Click Fraud Activity via Websocket"

• "ET TROJAN APT28 SEDNIT Variant CnC Beacon 4"

• "ET TROJAN Possible Puzzlemaker Remote Shell Activity (GET)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 30"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (cspapop110 .com)"

• "ET TROJAN Redis-p2pinfect TLS Certificate Serial Number Observed in SSL Certificate"

• "ET TROJAN Base64 Encoded MZ In Image"

• "ET CURRENT_EVENTS Successful Webmail Validator Phish M2 2016-09-02"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (bigbricks .org)"

• "ET CURRENT_EVENTS Successful Generic Personalized Phish 2019-02-13"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Kelihos.F Checkin"

• "ET MALWARE AskSearch Spyware User-Agent (AskSearchAssistant)"

• "ET TROJAN Akira Stealer CnC Domain in DNS Lookup (akira .red)"

• "ET CURRENT_EVENTS Possible Magnitude IE EK Payload Nov 8 2013"

• "ET TROJAN Suspected Monero Miner CnC Channel Secondary Domain Lookup"

• "ET TROJAN Trojan/Win32.FraudPack User-Agent (Downloader MLR 1.0.0)"

• "ET TROJAN PingPull Related Activity (Outbound)"

• "ET TROJAN [PTsecurity] MZRevenge Ransomware Server Response"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (datadog-cloud .com)"

• "ET TROJAN FraudLoad.aww HTTP CnC Post"

• "ET TROJAN FastPOS RAM Scraper Sending Details"

• "ET TROJAN Observed Glupteba CnC Domain (thestatsfiles .ru in TLS SNI)"

• "ET TROJAN MSIL/BlackGuard Stealer Exfil Activity"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (saharabo .ru)"

• "ET TROJAN GratefulPOS Covert DNS CnC Initial Checkin"

• "ET TROJAN W32/Virus-Encoder Ransomware Checkin"

• "ET TROJAN MSIL/Agent.DNL Server Response Task (whoami)"

• "ET CURRENT_EVENTS Generic Multibrand NewInjection Phishing Landing Template"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Faebook Credential Phish Landing Page M1 2022-05-27"

• "ET TROJAN GobRAT CnC Domain in DNS Lookup (su .vealcat .com)"

• "ET TROJAN Backdoor Win32/Hupigon.CK Server Idle"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS PerSwaysion Landing Page M2"

• "ET MOBILE_MALWARE Android Fancy Bear Checkin 2"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (13fzyjcfqhnryc4dkxkykbaawkzwrmhcfc .com in TLS SNI)"

• "ET TROJAN Maldoc Retrieving Payload 2021-07-06"

• "ET CURRENT_EVENTS Successful Facebook Phish 2022-07-18"

• "ET TROJAN Win32/Ramnit Checkin"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (n5k .me)"

• "ET TROJAN PoisonIvy RAT/Backdoor follow on POST Data PUSH Packet"

• "ET WEB_CLIENT Malicious Chrome Extension Domain Request (lite-bookmarks .info in DNS Lookup)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (vpn-secure .co)"

• "ET TROJAN Request for utu.dat Likely Ponmocup checkin"

• "ET TROJAN W32/Emotet CnC Beacon 3"

• "ET TROJAN DNS Query to Raspberry Robin Domain (nwz .li)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0i .wf)"

• "ET TROJAN W32/Kegotip CnC Beacon"

• "ET MALWARE Observed Win32/Foniad Domain (suggedin .info in DNS Lookup)"

• "ET TROJAN Linux/B1txor20 Backdoor DNS Tunnel Activity M3"

• "ET TROJAN NimPlant Sending Task (Inbound)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (drilledgas .org)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (officeaddons .com)"

• "ET TROJAN MedusaHTTP Variant CnC Checkin"

• "ET CURRENT_EVENTS Possible Spartan/Nuclear EK Payload"

• "ET TROJAN Observed DNS Query to TA444 Domain (cloud .tptf .ltd)"

• "ET CURRENT_EVENTS myGov Credential Phish 2023-02-15"

• "ET TROJAN Konni APT Related Activity (GET)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed TraderTraitor Domain (primerosauxiliosperu .com in TLS SNI)"

• "ET TROJAN Observed IcedID Domain (pireltotus .com in TLS SNI)"

• "ET TROJAN Possible CopyKittens DNS Lookup (u.mywindows24.in)"

• "ET TROJAN Possible Malicious PowerSploit PowerShell Script Observed over HTTP"

• "ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup"

• "ET TROJAN W32/ServStart.Variant CnC Beacon"

• "ET TROJAN FSB Snake CnC Activity Inbound via TCP (AA23-129A) M2"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 5.1)"

• "ET TROJAN Pyramid Framework Payload Request (base-LaZagne.py)"

• "ET USER_AGENTS Suspicious User-Agent (=Mozilla)"

• "ET TROJAN Possible Sharik/Smoke Loader Microsoft Connectivity check M3"

• "ET TROJAN OSX/WireLurker DNS Query Domain www.comeinbaby.com"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (alfujairah-ae .com) 2022-12-05"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework Landing"

• "ET TROJAN Possible CopyKitten DNS Lookup (chromeupdates .online)"

• "ET TROJAN Latrodectus Alive Response M6"

• "ET TROJAN Kraken C2 Domain Observed (kraken656kn6wyyx in DNS Lookup)"

• "ET TROJAN ENV Variable Data Exfiltration Attempt (HTTP POST)"

• "ET CURRENT_EVENTS Keitaro Set-Cookie Inbound to RogueRaticate (212bb)"

• "ET TROJAN Observed Mallox Ransomware Domain (whyers .io) in TLS SNI"

• "ET WEB_CLIENT Tech Support Phone Scam Landing 2018-01-10"

• "ET CURRENT_EVENTS Obfuscated Phishing Landing 2016-12-19"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-12-08"

• "ET TROJAN DarkGate Domain in DNS Lookup (awsamazon.cc)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (implacavelvideos .com)"

• "ET CURRENT_EVENTS Possible CryptoLocker TorComponent DL"

• "ET TROJAN MargulasRAT Checkin M2"

• "ET CURRENT_EVENTS Generic Phishing Landing Hosted via Weebly"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (stillprunnert .com)"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup"

• "ET TROJAN ActionLoader CnC Domain in DNS Lookup (kc-3 .ru)"

• "ET CURRENT_EVENTS Capital One Phishing Landing"

• "ET TROJAN Sidecopy APT Related Backdoor Activity"

• "ET TROJAN Observed Remcos Domain (retghrtgwtrgtg .bounceme .net in TLS SNI)"

• "ET TROJAN Bladabindi/njrat CnC Command (Registry)"

• "ET CURRENT_EVENTS RIG encrypted payload M1 Feb 02 2016"

• "ET TROJAN Maldoc CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Agent.RDE Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win64/Agent.NL Variant CnC Activity"

• "ET TROJAN Win32/Delf.TJJ Variant CnC Activity"

• "ET ATTACK_RESPONSE python shell spawn attempt"

• "ET TROJAN W32/Woai.Dropper Config Request"

• "ET CURRENT_EVENTS CritXPack - No Java URI - Dot.class"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (fessionalwork .com)"

• "ET TROJAN Observed Malicious SSL Cert (ELF/Rekoobe CnC)"

• "ET TROJAN Possible CopyKittens DNS Lookup (gmailtagmanager.com)"

• "ET INFO Common Form POST - Possible Generic Phishing Landing 2020-06-11"

• "ET CURRENT_EVENTS SUSPICIOUS winhosts.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN Observed TraderTraitor Domain (nomadpkgs .com in TLS SNI)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (joekairbos .com)"

• "ET TROJAN APT41 CnC Domain (c .ymvh8w5 .xyz) in DNS Lookup"

• "ET TROJAN Win32/Spy.Banker.AAQD Checkin"

• "ET TROJAN Possible CopyKitten DNS Lookup (sharepoint-microsoft .co)"

• "ET TROJAN Win32/StormKitty CnC Telegram Notification M2"

• "ET TROJAN ELF/Mirai Variant UA Outbound (muhstik)"

• "ET TROJAN APT28/Sofacy Zebrocy Go Variant Downloader Error POST"

• "ET CURRENT_EVENTS Watering Hole Redirect Inject Jun 28 2017"

• "ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup"

• "ET TROJAN Deathstalker/Evilnum Delivery Domain in DNS Lookup (bukjut11 .com)"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2020-07-29)"

• "ET TROJAN [PTsecurity] Bladabindi/njRAT (Dd19271927)"

• "ET MOBILE_MALWARE Android APT-C-23 (apkapps .site in TLS SNI)"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M1 2016-08-12"

• "ET MOBILE_MALWARE Android APT-C-23 (donna-paulsen .info in DNS Lookup)"

• "ET TROJAN Observed Malicious SSL Cert (Various CnC)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed TA444 Domain (privacysign .org in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (arthursaito .club in DNS Lookup)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32.Androm.gnlb Checkin"

• "ET TROJAN Arkei/Vidar/Mars Stealer Variant DLL GET Request"

• "ET EXPLOIT Possible Microsoft Edge Chakra.dll Type Confusion (CVE-2016-7200 CVE-2016-7201) Observed in SunDown EK 3"

• "ET TROJAN Shade Ransomware Payment Domain in DNS Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (dodgesteelbuildings .com)"

• "ET TROJAN Observed DNS Query to Stitch C2 Domain"

• "ET TROJAN Win32/Covagent Checkin"

• "ET CURRENT_EVENTS Successful Apple Store Transaction Cancellation Phish 2016-08-30"

• "ET TROJAN Win32/Remcos RAT Checkin 62"

• "ET TROJAN Trojan.PSW.Autoit Data Exfiltration Attempt"

• "ET CURRENT_EVENTS Common Form POST - Facebook Phishing Landing 2020-06-11"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (csmmmsp099q .com)"

• "ET CURRENT_EVENTS Outlook WebApp Phish Landing 2015-11-05"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 7"

• "ET TROJAN Scarlet Mimic DNS Lookup 16"

• "ET EXPLOIT Possible ETERNALBLUE Exploit M3 MS17-010"

• "ET CURRENT_EVENTS DHL Phish Landing 2015-11-14"

• "ET TROJAN SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Activity (Beacon)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Legion Loader Activity Observed (carlos_castaneda)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MintStealer CnC Activity (GET)"

• "ET TROJAN Observed Malicious SSL Cert (DeadlyKiss APT)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.t (DNS Lookup)"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M4"

• "ET MALWARE iDownloadAgent Spyware User-Agent (iDownloadAgent)"

• "ET TROJAN SysJoker User-Agent Observed"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to freescanonline .com"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M5"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 41"

• "ET TROJAN Win32/Spy.Pavica.FH Variant CnC Activity"

• "ET TROJAN Kimsuky Related Activity (GET)"

• "ET TROJAN Common Downloader Install Report URL (pid - mac)"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Fake Browser Update Domain in TLS SNI (bingbuy .com)"

• "ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-16"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET CURRENT_EVENTS LinkedIn Phishing Landing 2017-07-20"

• "ET CURRENT_EVENTS Successful Outlook Phish 2016-10-18"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M10"

• "ET TROJAN DNS Query to KEKW Variant Domain (kekwltd .ru)"

• "ET TROJAN Fbot Blockchain Based CnC DNS Lookup (musl .lib)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (weryfikacja-konta .space)"

• "ET TROJAN KL-Remote / Cryp_Banker14 RAT connection"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k1n .club)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (knemuso .ru)"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET MOBILE_MALWARE NSO Related Domain 38"

• "ET TROJAN HTran/SensLiceld.A response to infected host"

• "ET MALWARE Win32/TrojanDownloader.Adload.NSD Variant Checkin"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN PunkeyPOS HTTP CnC Beacon 3"

• "ET TROJAN Uroburos/Turla CnC (OUTBOUND) 2"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M1"

• "ET CURRENT_EVENTS Successful OWA Phish 2022-08-17"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 1"

• "ET TROJAN Win32/TrojanDownloader.Wauchos.A CnC Activity"

• "ET MOBILE_MALWARE Android APT-C-23 (max-mayfield .com in TLS SNI)"

• "ET TROJAN Win32/Sabsik.EN.D!ml CnC Checkin"

• "ET CURRENT_EVENTS Successful Webmail Phish 2015-08-27"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (sharemanage .elwoodasset .xyz)"

• "ET TROJAN TA457 Related Activity (POST)"

• "ET TROJAN Possible Pegasus/Trident Related HTTP Beacon 4"

• "ET TROJAN PseudoManuscrypt Activity (POST)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 4"

• "ET TROJAN Win32/Dostre CnC Activity"

• "ET TROJAN PeepingTitle Backdoor Related Activity"

• "ET MALWARE OSX/MapperState CnC Activity"

• "ET CURRENT_EVENTS Possible Veil Powershell Encoder B643"

• "ET TROJAN Observed Win32/SVCReady Loader User-Agent"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-05-27"

• "ET MALWARE Win32/Onescan FraudWare User-Agent"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sofacy DNS Lookup secnetcontrol.com"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (exportball .servegame.org)"

• "ET TROJAN Win32.Lager Trojan Initial Checkin"

• "ET WEB_CLIENT Netsolhost SSL Proxying - Possible Phishing Nov 24 2015"

• "ET TROJAN Shuckworm CnC Domain (leonardis .ru) in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN MAGICHOUND-related DNS Lookup (briefl .ink)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to Raspberry Robin Domain (q0 .pm)"

• "ET TROJAN Win32/RA-based.NCX CnC Checkin"

• "ET TROJAN Possible Darkhotel Higasia Downloader Checkin"

• "ET TROJAN MWI Maldoc Posting Host Data"

• "ET TROJAN Wintervivern Activity M2 (GET)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (draggedline .org)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN BandarChor/CryptON Ransomware Checkin"

• "ET CURRENT_EVENTS Successful Facebook Phish 2020-01-10"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI"

• "ET TROJAN FTCode Stealer CnC Activity"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (bitscrunch .myvnc .com)"

• "ET TROJAN Win32/S1deload Stealer CnC Domain (neukoo .top) in DNS Lookup"

• "ET TROJAN Stellar Stealer Data Exfiltration Attempt M4"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2kbq .com)"

• "ET TROJAN Syrutrk/Gibon/Bredolab Checkin"

• "ET TROJAN FakeAV checkin"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN TA444 Domain in DNS Lookup (jaicvc .com)"

• "ET TROJAN System Information Being Sent in User-Agent"

• "ET TROJAN Win32.Sluegot.A Checkin WEBC2-YAHOO APT1 Related"

• "ET TROJAN Win32/Plurox Backdoor CnC Checkin"

• "ET TROJAN Trojan.NSIS.Comame.A Checkin"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN ATTACKER IRCBot - netsh - PRIVMSG Command"

• "ET TROJAN Linux/dtool IRC Command (CHSERVER)"

• "ET TROJAN vSkimmer.PoS Checkin"

• "ET TROJAN Storm C&C with typo'd User-Agent (Windoss)"

• "ET TROJAN W32/Emotet CnC Checkin"

• "ET WEB_CLIENT Tech Support Phone Scam Landing 2017-07-26"

• "ET TROJAN Banload User-Agent Detected (ExampleDL)"

• "ET TROJAN Win32/Autophyte.F C2 Domain (www .anlway .com in TLS SNI)"

• "ET TROJAN DNS Query to SysJoker Domain (filestorage-short .org)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Observed Malicious SSL Cert (FIN8 CnC)"

• "ET TROJAN Iron Tiger DNSTunnel DNS Lookup (xssok.blogspot.com)"

• "ET TROJAN Observed Teal Kurma Domain (eth0 .secrsys .net in TLS SNI)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (mirrohost .space)"

• "ET TROJAN MirrorBlast KiXtart Downloader Client Request M2"

• "ET TROJAN FakeM SSL DNS Lookup (islamhood .net)"

• "ET TROJAN Observed DNS Query to RisePro Domain (best24-files .com)"

• "ET TROJAN Win32.Troj.Cidox Checkin"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (wordpress .securityplugins .org)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-endpoint .com)"

• "ET TROJAN OSX/Proton.C/D Domain (handbrake .cc) in TLS SNI"

• "ET MOBILE_MALWARE Android/Geost CnC Checkin"

• "ET TROJAN Observed DNS Query to TA444 Domain (perseus .bond)"

• "ET TROJAN Banker.Delf User-Agent (MzApp)"

• "ET TROJAN Lemon_Duck Linux Shell Script CnC Activity"

• "ET TROJAN Observed Malicious SSL Cert (Quasar CnC)"

• "ET WEB_CLIENT Suspicious LastPass URI Structure - Possible Phishing"

• "ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) (Outbound) M1"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (meta-ua .space in TLS SNI)"

• "ET MALWARE ABX Toolbar ActiveX Install"

• "ET TROJAN Winsoft.E Checkin 1"

• "ET TROJAN Observed Malicious SSL Cert (Win32/Gadwats Banker CnC Domain)"

• "ET TROJAN Sidewinder Stage 2 VBS Downloader Reporting Successful Infection"

• "ET TROJAN DarkHotel CnC Domain in DNS Lookup"

• "ET TROJAN AZORult v3.2 Server Response M2"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .info in DNS Lookup)"

• "ET TROJAN W32/HelloBridge.Backdoor Login CnC Beacon"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (sd1-bin .net)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-11-22"

• "ET TROJAN APT28/Sednit DNS Lookup (militaryadviser .org)"

• "ET TROJAN RouteX CnC Domain (73780fbd309561e201a4aee9914d882d .org) in DNS Lookup"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN TA401 Domain in DNS Lookup (jayyburrows .icu)"

• "ET TROJAN KL-Remote / Cryp_Banker14 RAT response"

• "ET WEB_SERVER WebShell ASPXShell - Title"

• "ET TROJAN Phorpiex Botnet Downloader Activity (GET)"

• "ET TROJAN Unknown Rootkit Download Activity (GET)"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-10-25"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (proposal-ae-enoc .com) 2022-12-05"

• "ET TROJAN Qbot Payload Request (2023-03-21) M2"

• "ET TROJAN Bitter APT Related Activity (GET)"

• "ET TROJAN US-CERT TA14-353A Proxy Tool 1"

• "ET TROJAN APT DNSpionage/Karkoff CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS SunDown EK RIP Landing M1 B641"

• "ET TROJAN Observed DNS Query to RisePro Domain (testitsoft .com)"

• "ET TROJAN Win32.Runner/Bublik Checkin"

• "ET TROJAN Win32/Milum CnC"

• "ET TROJAN Arechclient2 Backdoor CnC Keep-Alive"

• "ET TROJAN Win32/Agartha Stealer Activity via Telegram (Response)"

• "ET MOBILE_MALWARE Android APT-C-23 (mofa-help .site in DNS Lookup)"

• "ET CURRENT_EVENTS Possible Apple Phishing Domain 2016-06-14"

• "ET TROJAN POWERTON CnC Domain in DNS Lookup"

• "ET TROJAN ELF/Emptiness v1 DNS Flood Command Inbound"

• "ET CURRENT_EVENTS TA569 Keitaro TDS in TLS SNI (surelytheme .org)"

• "ET MOBILE_MALWARE NSO Related Domain 32"

• "ET CURRENT_EVENTS Capesand EK Landing"

• "ET CURRENT_EVENTS Successful Apple Phishing 2016-03-03"

• "ET CURRENT_EVENTS W3LL STORE Credential Phish Landing Page (Index) 2023-05-05"

• "ET TROJAN Operation EvilTraffic Initial Redirect M1"

• "ET TROJAN SpyEye C&C Check-in URI"

• "ET TROJAN Possible Kaseya VSA Exploit Activity Inbound M1"

• "ET MOBILE_MALWARE Android Flubot / LIKEACHARM Stealer Exfil (POST)"

• "ET TROJAN Observed Chinese APT Related Domain (ramblercloud .com in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (ososezo .site in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Possible Successful Phish - Other Credentials Nov 25 2013"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Win32/SiMay RAT Activity (GET)"

• "ET TROJAN Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 Unicode"

• "ET TROJAN Jasmin Ransomware C2 Checkin"

• "ET TROJAN PlayMP3z.biz Related Spyware/Trojan Install Report"

• "ET TROJAN HTTP Request for Possible ELF/LiLocked Ransomware Note"

• "ET TROJAN ChamelGang Related CnC Domain in DNS Lookup (mcafee-upgrade .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Cobalt Strike Malleable C2 (Wordpress Profile)"

• "ET TROJAN Havoc Framework Header in HTTP Response"

• "ET TROJAN Observed BatLoader Domain (updateclientssoftware .com) in TLS SNI"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zk5 .co)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN nspps Backdoor - Sending SOCKS Details"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (heyapp .website in DNS Lookup)"

• "ET INFO MacOS Process List in HTTP POST Request (/sbin/launchd) M2"

• "ET TROJAN Win32/Remcos RAT Checkin 60"

• "ET TROJAN DNS Query to Raspberry Robin Domain (tiua .uk)"

• "ET TROJAN BunnyLoader - Initial CnC Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (9r .re)"

• "ET TROJAN [ANY.RUN] DarkGate Check-In HTTP Header (POST)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET TROJAN Win32/RiskWare.YouXun.AD CnC Activity"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 10.0)"

• "ET TROJAN Gamaredon MalDoc CnC Exfil"

• "ET MOBILE_MALWARE NSO Related Domain 25"

• "ET TROJAN Bladabindi/njrat CnC Command (Get Passwords)"

• "ET TROJAN APT32 Komprogo DNS Lookup"

• "ET TROJAN Suspected APT37 Related Activity (GET)"

• "ET MALWARE DNS Query to Neoreklami Domain (testupdate .info)"

• "ET TROJAN FIN8 SARDONIC CnC Domain in DNS Lookup (api-cdnw5 .net)"

• "ET TROJAN FIN7 JSSLoader Variant Activity (GET)"

• "ET CURRENT_EVENTS SUSPICIOUS PSHELL Downloader Primitives B643 Oct 19 2017"

• "ET TROJAN PS/Unk.EB.Spreader CnC Checkin"

• "ET TROJAN W32/Taidoor.Backdoor CnC Checkin With Default Substitute MAC Address Field"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Capture)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (w0 .pm)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Netwire RAT Check-in 2"

• "ET MOBILE_MALWARE NSO Related Domain 8"

• "ET MOBILE_MALWARE Android APT-C-23 (parrotchat .co in DNS Lookup)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN iebar Spyware User Agent (iebar)"

• "ET TROJAN Win32/TA402 CnC Response M1"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M23"

• "ET TROJAN Cryptolocker Payment Page (krfdnhfnsai3d)"

• "ET TROJAN IP2B Trojan Communication Protocol detected"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (lindarealtytulum .com)"

• "ET WEB_SERVER IIS ISN BackDoor Command Delete Log"

• "ET CURRENT_EVENTS Generic Mailer Accessed on Internal Compromised Server"

• "ET TROJAN Observed Malicious SSL Cert (Zepakab CnC)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Scarlet Mimic DNS Lookup 41"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (trinazhkoma .club)"

• "ET CURRENT_EVENTS Generic Credential Phish Redirection 2022-03-14"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (nelubelei .com)"

• "ET TROJAN W32/SpeedingUpMyPC.Rootkit Install CnC Beacon"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-05-26"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (sabihpo .ru)"

• "ET TROJAN Observed DNS Query to Ursnif SAIGON Variant CnC Domain"

• "ET CURRENT_EVENTS Observed LordEK HTTP POST Request"

• "ET TROJAN Terse Upload to Free Image Hosting Provider (uploads .im) - Likely Malware"

• "ET MALWARE DNS Query to Neoreklami (vadimmqz .beget .tech)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Win32/Sarwent Initial Checkin"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-10-12"

• "ET CURRENT_EVENTS Successful Excel Phish 2016-09-26"

• "ET MALWARE NewWeb/Sudui.com Spyware User-Agent (updatesodui)"

• "ET CURRENT_EVENTS ING Credential Phish Landing Page 2022-05-27"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M2 2016-11-18"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible OceanLotus Time Check to Microsoft.com"

• "ET TROJAN Red Wolf/RedCurl Domain in DNS Lookup (amscloudhost .com)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cdn-edu .net)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish Nov 09 2017 (set)"

• "ET TROJAN ReverseRAT Activity (POST) M5"

• "ET TROJAN Observed Targeted Attack Malicious SSL Cert (angeldonationblog .com)"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-10-18"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (privymeet .com)"

• "ET CURRENT_EVENTS [eSentire] DHL Phish Landing July 24 2018"

• "ET TROJAN Kraken Ransomware End Activity"

• "ET TROJAN Win32/Protux.B POST checkin"

• "ET TROJAN Observed Glupteba CnC Domain (cdneurop .cloud in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (newageiscoming .top in TLS SNI)"

• "ET TROJAN Pupy DNS Request without SPI M2"

• "ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup"

• "ET TROJAN Observed BazarLoader Domain (vighik .xyz in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Khaosz.A!MTB Checkin - Command Retrieval"

• "ET POLICY W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Work Server Response"

• "ET MALWARE Outerinfo.com Spyware Advertising Campaign Download"

• "ET TROJAN Shady RAT Relay Command"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (paknavy .comsats .xyz)"

• "ET CURRENT_EVENTS IRS Payment Credential Phish Debit Card or Check Data Exfil"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .corkagenexus .com)"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor S5READ Command (Inbound)"

• "ET CURRENT_EVENTS Watering Hole applet name AppletHigh.jar"

• "ET TROJAN NanoCore RAT Keepalive Response 2"

• "ET TROJAN Agent Tesla Keylogger Report SMTP"

• "ET TROJAN Chinotto CnC Activity (hello)"

• "ET TROJAN METALJACK APT32 DNS Lookup (vitlescaux.com)"

• "ET TROJAN Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 4"

• "ET TROJAN DNS Query to IcedID Domain (brojizuza .com)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (i2care .us)"

• "ET TROJAN Possible Kimsuky APT Connectivity Check via Document"

• "ET TROJAN MalDoc Retrieving Payload 2021-06-15"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET CURRENT_EVENTS Possible Java Applet JNLP applet_ssv_validated in Base64 3 (Reversed)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (alljazeera .co)"

• "ET TROJAN Observed DNS Query to RisePro Domain (hero-files .com)"

• "ET TROJAN Trojan.Kwampirs Outbound GET request"

• "ET CURRENT_EVENTS Successful AU myGov Credential Phish 2023-01-30"

• "ET CURRENT_EVENTS Bank of America Phishing Landing"

• "ET TROJAN Possible Tunna Proxy Activity (Response)"

• "ET CURRENT_EVENTS SUSPICIOUS DNS Request for Grey Advertising Often Leading to EK"

• "ET WEB_SERVER DNS Query for Suspicious 33db9538.com Domain - Anuna Checkin - Compromised PHP Site"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (onewayskateboard .com)"

• "ET TROJAN Likely Linux/Xorddos DDoS Attack Participation (xxxatat456.com)"

• "ET TROJAN [401TRG] Observed Backdoor.SUNBURST CnC Domain (infinitysoftwares .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-20"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Alibaba Phish 2016-10-18"

• "ET TROJAN SocGholish Domain in DNS Lookup (smiles .cahl4u .org)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (msedgepackageinfo .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (h6 .re)"

• "ET TROJAN Win32/Spy.Obator .onion Proxy Domain"

• "ET TROJAN CrownAdPro CnC Activity M5"

• "ET CURRENT_EVENTS HTTP POST Contains Only Password (ga) 2021-04-05"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-10-28 3"

• "ET TROJAN SideCopy Related Domain in DNS Lookup (securedesk .one)"

• "ET WEB_CLIENT Fake Virus Phone Scam Landing Oct 19 M3"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zf0 .ro)"

• "ET TROJAN Arid Viper APT Transmitting Serial"

• "ET CURRENT_EVENTS Possible Successful Apple Phish 2015-07-30"

• "ET TROJAN RegSubsDat Checkin"

• "ET TROJAN Win32/Pterodo.NG Checkin 2"

• "ET TROJAN Observed DNS Query to Hyperion Obfuscator Domain (plague .fun)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (adio-gov .com) 2022-12-05"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (metahelpservice .net)"

• "ET TROJAN Wapack Labs Sinkhole DNS Reply"

• "ET TROJAN DDoS.XOR Checkin via HTTP"

• "ET MALWARE Matanbuchus Loader CnC M4"

• "ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access postToSocial"

• "ET TROJAN Android/MMRAT CnC Checkin M1"

• "ET WEB_CLIENT c0896 Hacked Site Response Hex (Inbound)"

• "ET TROJAN Send-Safe Bulk Mailer SSL Cert - Observed in Spam Campaigns"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (dfhelp .live)"

• "ET TROJAN LokiBot Checkin"

• "ET INFO PhishMe.com Phishing Landing Exercise"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Yowai)"

• "ET CURRENT_EVENTS Successful Adobe Shared PDF Phish 2016-12-13"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Pingback Exec Command Issued"

• "ET TROJAN Windows route Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Known Sinkhole Response Header"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 8"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (lump .semara .ru)"

• "ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement"

• "ET TROJAN TA450 GRAMDOOR Telegram CnC Activity (POST)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (d0 .wf)"

• "ET TROJAN Cobalt Strike Malleable C2 (WooCommerce Profile)"

• "ET TROJAN Win32/Agent.WMN CnC Beacon"

• "ET TROJAN Dialer-715 Install Checkin"

• "ET TROJAN APT32/OceanLotus Associated Domain in DNS Lookup (tocaoonline .com)"

• "ET TROJAN Observed Malicious SSL Cert (TA577)"

• "ET TROJAN SharpExec EXE Lateral Movement Tool Downloaded"

• "ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)"

• "ET TROJAN APT29 CnC Domain in DNS Lookup (edenparkweddings .com)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (belcherjacky .info)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (bitscrunch .pd .linkpc .net)"

• "ET TROJAN Backdoor.Win32.Sykipot Put"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 60"

• "ET TROJAN FerociousKitten CnC Domain in DNS Lookup (microsoft .com-view .space)"

• "ET CURRENT_EVENTS Successful Ziraat Bankasi (TK) Phish M2 Oct 12 2017"

• "ET MALWARE BInet Information Install Report"

• "ET TROJAN APT28/FancyBear Related Activity (POST)"

• "ET CURRENT_EVENTS Successful Generic AES Phish M1 Oct 24 2017"

• "ET MALWARE Win32/Adware.Adposhel.A Checkin 5"

• "ET CURRENT_EVENTS Successful Yahoo Password Strength Phish M2 2016-08-24"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 15"

• "ET TROJAN Suspected Monero Miner CnC Channel TXT Lookup"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (diligencefinconsultants .com) 2022-12-05"

• "ET TROJAN Win32/RecordBreaker CnC Checkin M1"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (cubicalwave .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Joker CnC Configuration Retrieval"

• "ET TROJAN OSX/WireLurker User-agent (globalupdate)"

• "ET TROJAN MSUpdater alt checkin to CnC"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (team-meet .online)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (univision .click)"

• "ET CURRENT_EVENTS Successful Phish Outlook Credentials Oct 01 2015"

• "ET TROJAN EXE Download When Server Claims To Send Audio File - Must Be Win32"

• "ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe"

• "ET MALWARE TryMedia Spyware User-Agent (TryMedia_DM_2.0.0)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0w .pm)"

• "ET CURRENT_EVENTS Possible Red Dot Exploit Kit Single Character JAR Request"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (linda-callaghan .icu)"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1qc230lt32ey73qlaj9rkujm0ujtv090 .com)"

• "ET TROJAN Ursnif Payload Request (cook32.rar)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (avoymratax .com)"

• "ET CURRENT_EVENTS Inbound JasperLoader Using Array Push Obfuscation"

• "ET TROJAN Win32/RecordBreaker - Observed UA M6 (01785252112)"

• "ET TROJAN Gazer DNS query observed (soligro . com)"

• "ET TROJAN FF-RAT Stage 1 CnC Checkin"

• "ET TROJAN Poweliks Clickfraud CnC M3"

• "ET TROJAN Win32/RisePro CnC Server Response M1"

• "ET TROJAN Possible Red October proxy CnC 2"

• "ET TROJAN Observed DNS Query to RisePro Domain (my-rise .pro)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup"

• "ET POLICY My2022/Beijing2022 App (DNS Lookup) 1"

• "ET TROJAN Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (ASCII)"

• "ET TROJAN APT28/Sednit DNS Lookup (timezoneutc .com)"

• "ET TROJAN DDoS.Win32.Agent.bay Covert Channel (VERSONEX and Mr.Black)"

• "ET CURRENT_EVENTS TA398/Sidewinder Credential Phish Landing Page M2 2022-11-18"

• "ET MOBILE_MALWARE DNS Query for gongfu-android.com DroidKungFu CnC Server"

• "ET TROJAN Ixeshe/Mecklow Checkin"

• "ET TROJAN Enfal CnC POST"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (tapewormorchestra .top in TLS SNI)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (llhhospitals .com) 2022-12-05"

• "ET TROJAN ELF/Mirai Variant UA Outbound (ph0ne)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M2"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 13"

• "ET CURRENT_EVENTS Successful Microsoft Account Phish 2019-11-06"

• "ET USER_AGENTS Suspicious User-Agent String (AskPartnerCobranding)"

• "ET TROJAN ProjectSauron Remsec DNS Lookup (flowershop22.110mb.com)"

• "ET TROJAN Win32/Sinresby.B Checkin"

• "ET TROJAN Win32/Spyder CnC Checkin"

• "ET MALWARE Suspicious User-Agent (downloader)"

• "ET TROJAN ELF/Kinsing Payload Request M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN W32/Witch.3FA0!tr CnC Activity M3"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET TROJAN TinyLoader.B1 Checkin x64"

• "ET TROJAN Win32/RisePro CnC Command Outbound (get_loaders)"

• "ET MALWARE LNKR CnC Activity M3"

• "ET TROJAN Suspicious User-Agent MyAgrent"

• "ET MOBILE_MALWARE Android/Spy.Agent.AON / Glancelove DNS Lookup 1 (goldncup .com)"

• "ET CURRENT_EVENTS SUSPICIOUS Request for Grey Advertising Often Leading to EK"

• "ET TROJAN Banker.Delf User-Agent (Mz)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4k1 .xyz)"

• "ET TROJAN Athena DDoS Bot Checkin"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (qsertopinajil .com)"

• "ET TROJAN APT32 Win32/Ratsnif Requesting Command from CnC"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Generic Obfuscated Sign In Landing Page 2023-06-22"

• "ET TROJAN SuperFish CnC Beacon 1"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (nebibizi .ru)"

• "ET CURRENT_EVENTS Shipping Document Phishing Landing 2016-06-23"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1qr0kxc4gcqt2lcpkdnz8ehs02u9n2xkgz89rwpr .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (windriversupport .com)"

• "ET CURRENT_EVENTS SUSPICIOUS Grey Advertising Often Leading to EK"

• "ET TROJAN Linux.Ngioweb Stage 1 CnC Activity Client Request (set)"

• "ET TROJAN Observed Glupteba CnC Domain (duniadekho .bar in TLS SNI)"

• "ET MALWARE Win32/Toolbar.Conduit.AG Checkin"

• "ET CURRENT_EVENTS Successful BT GROUP Credential Phish 2022-11-23"

• "ET CURRENT_EVENTS Successful Wells Fargo/CIBC Bank Phish M1 2015-08-25"

• "ET CURRENT_EVENTS [eSentire] Successful Personalized Phish 2018-06-15"

• "ET TROJAN GravityRAT CnC Domain (click2chat .org in DNS Lookup)"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M4 2022-04-13"

• "ET TROJAN WEBC2-UGX User-Agent (Windows+NT+5.x) APT1"

• "ET TROJAN MAGICHOUND.RETRIEVER CnC Beacon"

• "ET TROJAN [PTsecurity] Win32/SpyAgent.Raptor (realtime-spy) CnC activity 1"

• "ET MALWARE Observed PC Optimizer Software Domain (fortect .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Generic Checkin - MSCommonInfoEx"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (deftsecurity .com)"

• "ET TROJAN Glupteba CnC Observed in DNS Query"

• "ET TROJAN W32/VBS.SLoad.Backdoor Initial Base64 Encoded OK Server Response"

• "ET TROJAN Windows net start Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .club in DNS Lookup)"

• "ET TROJAN Observed DNS Query to Impersoni-fake-ator (cloud .microsoftshop .org)"

• "ET CURRENT_EVENTS PHOEN!X Apple Phish Landing Page 2015-12-29"

• "ET TROJAN Fortigate THINCRUST Backdoor Activity M1"

• "ET CURRENT_EVENTS Observed Phishing Domain in DNS Lookup (mcrsfts-passwdupdate .com)"

• "ET TROJAN Stealbit Variant Data Exfil M1"

• "ET TROJAN Pushdo.S CnC response"

• "ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain"

• "ET TROJAN Tsyrval Panda CnC Beacon"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .spv88 .online)"

• "ET TROJAN GravityRAT CnC Domain (dailybuild .mozillaupdates .com in DNS Lookup)"

• "ET TROJAN DNSBin Demo - Data Exfil"

• "ET TROJAN Tandem Espionage CnC Domain (rhjebiuujydv .ru) in DNS Lookup"

• "ET TROJAN Ransomware/Cerber Checkin M3 (4)"

• "ET TROJAN Win32/SVCReady Loader CnC Activity"

• "ET ATTACK_RESPONSE Hostile FTP Server Banner (StnyFtpd)"

• "ET TROJAN Kimsuky KGH Backdoor Secondary Payload Download Request"

• "ET TROJAN Malicious SSL Cert (Magecart)"

• "ET TROJAN Fake/Short Google Search Appliance UA Win32/Ranbyus and Others"

• "ET TROJAN RocketKitten APT Checkin"

• "ET TROJAN Win32/RisePro CnC Server Response M4"

• "ET MOBILE_MALWARE Android APT-C-23 (hoopoechat .com in TLS SNI)"

• "ET TROJAN APT DarkHydrus DNS Lookup 9"

• "ET TROJAN Suspected Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN Possible Zbot Activity Common Download Struct"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful AOL Phish M1 2016-07-14"

• "ET CURRENT_EVENTS Successful Adobe Phish 2015-08-31"

• "ET CURRENT_EVENTS Successful Chase Phish 2015-11-03"

• "ET TROJAN Arid Gopher Related Domain in DNS Lookup (mozelllittel .com)"

• "ET CURRENT_EVENTS Successful US Government Bid Credential Phish 2022-12-28"

• "ET CURRENT_EVENTS Probable Sakura exploit kit landing page with obfuscated URLs"

• "ET TROJAN Brazilian Banker SSL Cert"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h .com in TLS SNI)"

• "ET TROJAN [401TRG] Backdoor.BEACON SSL Cert Inbound (bigtopweb .com)"

• "ET TROJAN Observed DNS Query to TA444 Domain (mufg .tokyo)"

• "ET MOBILE_MALWARE NSO Related Domain 31"

• "ET CURRENT_EVENTS Redirect to DotkaChef EK Landing"

• "ET MOBILE_MALWARE Android APT-C-23 (kate-austen .info in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (lgf .pw)"

• "ET TROJAN APT Cheshire Cat CnC Beacon"

• "ET TROJAN Possible Pegasus Related DNS Lookup (smser .net)"

• "ET USER_AGENTS Suspicious User-Agent (IE/1.0)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (stockme .top in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (trzx .eu)"

• "ET TROJAN Suspected Bitter APT Related Activity"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Plead TSCookie CnC Checkin M2"

• "ET TROJAN Bladabindi/njrat CnC Command Response (Get Passwords)"

• "ET TROJAN [ANY.RUN] Win32/Gh0stRat Keep-Alive"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (galaxy-s .com)"

• "ET TROJAN IRC potential bot commands"

• "ET TROJAN Earth Lusca/SprySOCKS CnC Checkin"

• "ET TROJAN Potential Dridex.Maldoc Minimal Executable Request"

• "ET MALWARE W32/InstallRex.Adware Initial CnC Beacon"

• "ET TROJAN Cinobi Banking Trojan Domain in DNS Lookup (www .magicalgirlonlive .com)"

• "ET TROJAN WikilLoader Activity M1 (Response)"

• "ET TROJAN Generic Credential Phish Landing Page 2023-03-21"

• "ET TROJAN DNS Query to TA444 Domain (acuitykp .co)"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (share .devprocloud .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (uz3 .me)"

• "ET CURRENT_EVENTS Silicon Valley Bank Credential Phish Landing Page (2023-03-30)"

• "ET TROJAN Windows netsh advfirewall show allprofiles Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M2"

• "ET TROJAN Skeleton Key Filename in SMB Traffic (ASCII)"

• "ET TROJAN Observed IcedID Domain (magiketchinn .com in TLS SNI)"

• "ET CURRENT_EVENTS Observed Possible Phishing Landing Page 2021-06-25"

• "ET TROJAN Lethic Spambot CnC Initial Connect"

• "ET TROJAN Qbot Payload Request (2023-03-21) M8"

• "ET WEB_CLIENT Observed DNS Query to Malicious Cookie Monster Roulette JS Cookie Stealer Exfil Domain"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j68 .info)"

• "ET MALWARE AlphabetSoup Adware Extension CnC Checkin"

• "ET TROJAN PowerSploit/PowerView SMTP Data Exfil"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET TROJAN TickGroup Datper CnC Checkin M1"

• "ET TROJAN SockRacket/KANDYKORN CnC Response"

• "ET TROJAN Observed DNS Query to TA444 Domain"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.SSL.BEACON.[CSBundle Ajax]"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (skyboxdrive .cloud)"

• "ET TROJAN Observed BatLoader Domain (updatecloudservice1 .com) in TLS SNI"

• "ET TROJAN DNS Query to TA444 Domain (antifirmware .site)"

• "ET TROJAN MSIL/CrimsonRAT Activity (POST)"

• "ET TROJAN Ursnif Variant Retrieving Payload (x64)"

• "ET TROJAN Observed Malicious SSL Cert (TA577)"

• "ET TROJAN Suspected Glupteba Download"

• "ET MOBILE_MALWARE Android APT-C-23 (accaunts-googlc .com in TLS SNI)"

• "ET TROJAN DNSpionage Commands Embedded in Webpage Inbound"

• "ET TROJAN Phorpiex CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Facebook Phishing Domain in DNS Lookup"

• "ET TROJAN ELF/Mirai Variant CnC Activity"

• "ET CURRENT_EVENTS JDB Exploit Kit JAR Download"

• "ET MOBILE_MALWARE Arid Viper (kentporter .site in DNS Lookup)"

• "ET CURRENT_EVENTS Weebly Phishing Landing Observed 2015-11-10"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Gamaredon Domain in DNS Lookup (iraty .ru)"

• "ET TROJAN Win32/RaaLoader CnC Activity"

• "ET CURRENT_EVENTS Successful Square Phish Nov 16 2015"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-12-07"

• "ET TROJAN SparklingGoblin/Winnti Group SideWalk Domain in DNS Lookup"

• "ET TROJAN [ANY.RUN] Gh0stBins Checkin"

• "ET TROJAN Evil JS Ransomware"

• "ET TROJAN Observed DNS Query to Win32/TrojanDropper.Agent.SLC Domain"

• "ET TROJAN Observed DNS Query to TA444 Domain (tptf .cloud)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN W32/KeyLogger.ACQH!tr Checkin"

• "ET TROJAN PlugX/Destory HTTP traffic"

• "ET CURRENT_EVENTS Possible JDB Exploit Kit Class Request"

• "ET TROJAN DNS Query to IcedID Domain (curabiebarristie .com)"

• "ET TROJAN Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN Cobalt Strike Activity (POST)"

• "ET TROJAN Sandman APT LuaDream Backdoor Domain in DNS Lookup (ssl .explorecell .com)"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (admin .nikanps .top)"

• "ET TROJAN Inception Group CnC Observed in DNS Query (ms-check-new-update .com)"

• "ET CURRENT_EVENTS Terse POST to Wordpress Folder - Probable Successful Phishing M7"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M11"

• "ET CURRENT_EVENTS Successful Microsoft Credential Phish 2022-06-28"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (rtofmethough .top)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (raloco .com)"

• "ET TROJAN Donot Group Pult Downloader Activity (POST) M6"

• "ET TROJAN Possible Dragonfly APT Activity HTTP URI OPTIONS"

• "ET TROJAN Win32/Spy.Delf.QTL Data Exfiltration Attempt"

• "ET CURRENT_EVENTS Generic Paypal Phish Kit Landing"

• "ET CURRENT_EVENTS Successful Generic Phish Observed"

• "ET TROJAN Possible Infection Report Mail - Indy Mail lib and Nome do Computador in Body"

• "ET TROJAN Win32/Emotet CnC Activity M12 (POST)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Chanitor Variant .onion Proxy Domain"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(MBESCVDFRT)"

• "ET TROJAN OceanLotus Stage 2 Domain in DNS Lookup (cdn-ampproject .com)"

• "ET TROJAN Win32/Valak <v9 - Stage 2 - Request"

• "ET TROJAN KLog Nick Keylogger Checkin"

• "ET TROJAN Pyramid Framework Payload Request (base-tunnel-inj.py)"

• "ET TROJAN Observed BazarLoader Domain (cntrhum .xyz in TLS SNI)"

• "ET TROJAN Zbot .onion Proxy Domain"

• "ET TROJAN Suspected TeamTNT Linux Miner Activity"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cdn-src .net)"

• "ET TROJAN TA406 Win32/Updog CnC Checkin"

• "ET TROJAN Windows driverquery -v Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS Successful Phish OWA Credentials 2016-08-16"

• "ET TROJAN SideCopy Group Activity (GET)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (kafiripa .ru)"

• "ET TROJAN Red Wolf/RedCurl Implant Checkin"

• "ET MOBILE_MALWARE SslCrypt Server Communication"

• "ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Histories Firefox.txt) M1"

• "ET TROJAN Koobface Trojan HTTP Post Checkin"

• "ET CURRENT_EVENTS Possible Phishing Landing Page 2021-05-18"

• "ET TROJAN Win32/PSW.QQPass.OZV Variant Checkin"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET POLICY Random Hash Pascalcoin Miner Checkin"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (toyourownbeat .com)"

• "ET TROJAN Win32/Webdor.NAC Variant CnC Activity"

• "ET TROJAN Possible Covenant Framework Grunt Stager HTTP Download (Grunt.GruntStager)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Loli Stealer CnC Domain in DNS Lookup (webstealer .ru)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2017-12-04"

• "ET TROJAN CryptoShield Ransomware Checkin"

• "ET TROJAN Zlob User Agent - updating (internetsecurity)"

• "ET TROJAN ViperSoftX CnC Activity M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32\Cryptbot CnC Domain (okwydg05 .top) in DNS Lookup"

• "ET TROJAN Win32/Logger RAT CnC Checkin"

• "ET MALWARE Observed Win32/Foniad Domain (aclassigned .info in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (alain .ps in DNS Lookup)"

• "ET TROJAN Win32/Small.NO Checkin"

• "ET TROJAN OilRig APT PowDesk Powershell Check"

• "ET TROJAN Haxdoor Reporting User Activity 2"

• "ET MOBILE_MALWARE Android APT-C-23 (help-live .club in TLS SNI)"

• "ET TROJAN Amadey CnC Check-In"

• "ET TROJAN W32/Badur.Spy User Agent lawl"

• "ET TROJAN W32/Jiwerks.A Checkin"

• "ET TROJAN Asylum Ambuscade Related CnC Activity (install)"

• "ET TROJAN Smokeloader getproxy Command"

• "ET TROJAN Andromeda Downloading Module"

• "ET MALWARE Searchmeup Spyware Install (mstask)"

• "ET TROJAN Backdoor.Elise CnC Beacon 1 M1"

• "ET CURRENT_EVENTS Successful Generic Phish 2022-03-28"

• "ET CURRENT_EVENTS Successful iTunes Connect Phish M1 2016-12-13"

• "ET TROJAN Malicious Browser Installer Checkin (POST)"

• "ET MALWARE Win32/Adware.Bang5mai.BB CnC Activity M2"

• "ET TROJAN Win32/DarkCloud Exfil Over SMTP (Body)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 17"

• "ET TROJAN FRAT Downloader Activity"

• "ET TROJAN Chthonic CnC Beacon 6"

• "ET TROJAN Observed CoinMiner CnC Domain (en24zuggh3ywlj .x .pipedream .net in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN FastPOS Version Checkin"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET TROJAN Common Upatre Header Structure 3"

• "ET CURRENT_EVENTS SUSPICIOUS pony.exe in URI"

• "ET TROJAN Tordal/Hancitor/Chanitor Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j5n .xyz)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android/Spy.Banker.BTO CnC Domain in DNS Lookup"

• "ET TROJAN ELF/Kinsing Payload Request M1"

• "ET TROJAN DNS Query Possible Zbot Infection Query for networksecurityx.hopto.org"

• "ET TROJAN Possible Pegasus Related DNS Lookup (iusacell-movil .com.mx)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 10"

• "ET TROJAN Win32/Trojan.Nymeria CnC Activity (GET) M6"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN US-CERT TA14-353A Proxy Tool 2"

• "ET TROJAN CoinVault POST M2"

• "ET TROJAN TA402/Molerats Related Malware Domain in DNS Lookup"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET TROJAN Gamaredon Domain in DNS Lookup (idogbpa .ru)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (e0 .wf)"

• "ET WEB_CLIENT pshell dl/execute primitives in wideb64 1"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky C2)"

• "ET TROJAN Py/MechaFlounder CnC Activity - Reporting Download Command Success"

• "ET TROJAN Volatile Cedar DNS Lookup (xploreredotnet.info)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 7"

• "ET CURRENT_EVENTS Successful Bank of America Phish M3 2016-10-27"

• "ET MOBILE_MALWARE iOS/Xsser checking library version"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (qatarenergys .com) 2022-12-05"

• "ET TROJAN Iron Tiger HTTPBrowser DNS Lookup (trendmicro-update.org)"

• "ET TROJAN Observed Malicious DNS Query (Reyptson Ransomware CnC)"

• "ET TROJAN Kimsuky Related Malicious VBScript Inbound M4"

• "ET TROJAN Suspected Tunna Proxy M3 (Outbound)"

• "ET TROJAN Qarallax RAT Downloading Modules"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Tsunami)"

• "ET INFO DERO Crypto Mining Related Domain in DNS Lookup"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (mestorycallin .com)"

• "ET TROJAN Win32/Unk.BrowserStealer Data Exfil M3"

• "ET TROJAN Possible Deep Panda User-Agent"

• "ET CURRENT_EVENTS DRIVEBY Styx - TDS - Redirect To Landing Page"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (doc .global-link .run .place)"

• "ET TROJAN Likely PadCrypt Locker PKG DL"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (APT29)"

• "ET TROJAN VNCStartServer BOT Variant CnC Beacon"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET TROJAN Win32.Tdss User Agent Detected (Mozzila)"

• "ET TROJAN Win32/HMR RAT Sending System Information M3"

• "ET TROJAN Likely Geodo/Emotet Downloading PE - Fake UA"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 26"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET TROJAN FerociousKitten CnC Domain in DNS Lookup (microsoft .microcaft .xyz)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M32"

• "ET CURRENT_EVENTS Coinbase Credential Phish Landing Page 2022-12-02"

• "ET TROJAN Cobalt Strike Malleable C2 Webbug Profile"

• "ET TROJAN Win32/Zegost!ml CnC Checkin"

• "ET TROJAN Backdoor.TurlaCarbon.A C2 HTTP Request"

• "ET CURRENT_EVENTS Successful Dubai Islamic Internet Bank Phish 2016-12-20"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN Observed DNS Query to TA455 Domain (alharbitelecom .co)"

• "ET TROJAN FakeM RAT CnC Beacon"

• "ET TROJAN DNS Query to Scattered Spider Domain (victimname-sso .com"

• "ET TROJAN Observed Karen Ransomware Powershell Loader"

• "ET TROJAN Observed GandCrab Payment Domain (gandcrab in DNS Lookup)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (medicinebuckerrysa .pw)"

• "ET TROJAN Winter Vivern Retrieving Commands"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET TROJAN Win32/DanaBot Harvesting Email Addresses 2"

• "ET TROJAN PowerTrick download ver1 bot"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN OSX/GMERA.B CnC Checkin"

• "ET TROJAN MalDoc/Konni APT CnC Activity (GET) M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN BigLock Ransomware CnC Activity (ext)"

• "ET TROJAN Observed DNS Query to Blackrota Domain"

• "ET TROJAN Lazarus CnC Domain Observed in DNS Query"

• "ET TROJAN Linux/LuaBot CnC Beacon Response"

• "ET TROJAN Atomic macOS (AMOS) Stealer Payload Delivery Domain in DNS Lookup (xn--tradgsvews-0ubd3y .com)"

• "ET CURRENT_EVENTS GitHub/CicleCI Themed Phishing Domain in DNS Lookup (circle-cl .com)"

• "ET TROJAN MSIL/SkidRat User-Agent Observed"

• "ET MALWARE OptimizerPro Checkin"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 69"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (j-ic .co .intneral-document-he-gr-me .run .place)"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (bitscrunnch .linkpc .net)"

• "ET TROJAN Observed MassLogger Domain in TLS SNI (ecigroup-tw .com)"

• "ET TROJAN Trojan.Win32.Buzus Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN LAME SSL Cert APT1"

• "ET TROJAN ArrobarLoader CnC Checkin M1"

• "ET CURRENT_EVENTS Successful Apple Phish M2 2016-11-15"

• "ET CURRENT_EVENTS Possible BulletProofLink Phishkit Activity - Retrieving Resources"

• "ET CURRENT_EVENTS Successful Alibaba Phish 2016-09-28"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-10-07"

• "ET CURRENT_EVENTS PUBG Credential Phish Landing Page 2022-08-22"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-08-19"

• "ET TROJAN Pony Downloader check-in response STATUS-IMPORT-OK"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 27"

• "ET CURRENT_EVENTS Successful Survey Credential Phish M7 2022-04-04"

• "ET USER_AGENTS Suspicious UA Observed (IEhook)"

• "ET TROJAN Probable OneLouder downloader (Zeus P2P) exe download"

• "ET TROJAN Observed Malicious SSL Cert (Turla CnC)"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M8"

• "ET TROJAN Win32/MillionLoader CnC Activity (Outbound)"

• "ET CURRENT_EVENTS Styx Exploit Kit Jerk.cgi TDS"

• "ET CURRENT_EVENTS Successful Bank of America Phish 2015-10-02"

• "ET TROJAN Gamaredon Domain in DNS Lookup (for30 .procellarumbi .ru)"

• "ET TROJAN Potential Juniper Reflected XSS Attempt (CVE-2022-22242)"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Craigslist Phish 2016-04-25"

• "ET TROJAN Py/MechaFlounder CnC Activity - Reporting Upload Command Success"

• "ET CURRENT_EVENTS Successful Survey Credential Phish M2 2022-04-04"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (Knotweed/SubZero)"

• "ET MALWARE Gamehouse.com Related Spyware User-Agent (Sprout Game)"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebcck .com in TLS SNI)"

• "ET TROJAN Arbitrium-RAT CnC Activity"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN Matrix Max Stealer Exfiltration Observed"

• "ET TROJAN TA444 Domain in DNS Lookup (on-global .xyz)"

• "ET TROJAN APT39/Chafer Payload - CnC Checkin M2"

• "ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin"

• "ET TROJAN Likely FakeAV/Fakeinit/FraudLoad Checkin"

• "ET TROJAN Win32/TyphonReborn Telegram CnC Checkin"

• "ET TROJAN Observed ExecPS/Cobolt Domain (getfreshnews .com in DNS Lookup)"

• "ET TROJAN Overtoolbar.net Backdoor ICMP Checkin Response"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (3aqulcx8xkg6qxrhxgmisecrt98kxlenzj .com in TLS SNI)"

• "ET TROJAN Lazarus CnC Domain in DNS Lookup (team-meet .online)"

• "ET USER_AGENTS Downloader User-Agent (AutoDL\/1.0)"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (ukgames .tech)"

• "ET TROJAN MalDoc/TA427 Payload Request (GET)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Win32/Orchard Botnet Activity M2"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (throatpills .org)"

• "ET TROJAN MyKings Bootloader Variant Requesting Payload M1"

• "ET TROJAN [ANY.RUN] PureLogs Stealer C2 Connection M2"

• "ET TROJAN Blackmoon/Banbra Configuration Request"

• "ET TROJAN Gamaredon Related Domain in DNS Lookup (gayado .ru)"

• "ET TROJAN Zenlod System Information Retrieval"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M1"

• "ET TROJAN Backdoor.Win32.VB.brg C&C Checkin"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (bahariafoundation .org)"

• "ET TROJAN DNS Query to SupremeBot Domain (silentlegion .duckdns .org)"

• "ET TROJAN RedGuard Framework Related Request Activity"

• "ET TROJAN Gozi/Ursnif/Papras Connectivity Check"

• "ET TROJAN Observed Gamaredon APT Related Domain (butoza .ru in TLS SNI)"

• "ET TROJAN Observed MSIL/n2019cov (COVID-19) Ransomware CnC Domain in TLS SNI"

• "ET TROJAN Win32/Wacapew.C!ml CnC Checkin"

• "ET TROJAN Generic Dropper Installing PUP 1"

• "ET TROJAN Maldoc CnC Checkin"

• "ET TROJAN Stuxnet index.php"

• "ET TROJAN Win32/Trojan.Nymeria CnC Activity (GET) M4"

• "ET TROJAN FrameworkPOS Covert DNS CnC Initial Check In"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2020-09-29"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious Domain (jscloud .ink in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (amanda-hart .website in DNS Lookup)"

• "ET MOBILE_MALWARE Android Marcher Trojan Download - BankAustria Targeting (set)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .zapto .org)"

• "ET TROJAN MirrorBlast CnC Activity M2"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M2 Jul 29 2016"

• "ET TROJAN FrameworkPOS CnC Server Reporting IP Address To Agent"

• "ET TROJAN Observed GobRAT Domain (wpksi .mefound .com) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (mitchvandenborn .com)"

• "ET MALWARE Outerinfo.com Spyware Activity"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (navert0p.com)"

• "ET WEB_CLIENT Possible Phishing Redirect Feb 09 2016"

• "ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)"

• "ET TROJAN CopperStealer - Remote Desktop - Initial Checkin"

• "ET TROJAN Possible OceanLotus CnC Heartbeat"

• "ET CURRENT_EVENTS Successful Adobe Credential Phish 2022-06-21"

• "ET CURRENT_EVENTS Suspicious GitHack DNS Request - Possible PurpleFox EK"

• "ET TROJAN W32/StealRat.SpamBot Email Template Request"

• "ET TROJAN APT/FamousSparrow Activity (POST)"

• "ET TROJAN BunnyLoader CnC Checkin - Retrieve Tasking"

• "ET TROJAN Observed Malicious SSL Cert (Win32/SandCat CnC)"

• "ET TROJAN Suspected Solarwinds Serv-U Backdoor (Incoming)"

• "ET TROJAN Win32/StormKitty CnC Telegram Notification M1"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (addisonlynch .com)"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .serveirc .com)"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST Struct M3"

• "ET CURRENT_EVENTS WinHttpRequest Downloading EXE Non-Port 80 (Likely Exploit Kit)"

• "ET TROJAN [TGI] Py.Machete HTTP CnC Exfil"

• "ET TROJAN Observed Malicious SSL Cert (Sidewinder APT CnC)"

• "ET TROJAN Linux.Mirai Login Attempt (xc3511)"

• "ET TROJAN Observed Scattered Spider Domain (victimname-okta .com in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (hotmailme .website in DNS Lookup)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-endpoint .com)"

• "ET TROJAN S400 RAT Client Checkin via Discord"

• "ET CURRENT_EVENTS Successful Squirrelmail Phishing 2015-11-20"

• "ET MALWARE Fake AV User-Agent (N1)"

• "ET TROJAN Uroburos/Turla CnC (OUTBOUND) 1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (alepscoking .com)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN DNS Query to Raspberry Robin Domain (m0 .nu)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (id .bigmir .space)"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (xn--metaspport-v43e .com)"

• "ET TROJAN TA406 Related Activity (GET)"

• "ET TROJAN SockRacket/KANDYKORN Client Challenge"

• "ET TROJAN Worm.VBS.ayr CnC command (is-enum-driver)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (wak .rocks)"

• "ET TROJAN Possible ICMP Backdoor Tunnel Command - whoami"

• "ET MALWARE Miva Spyware User-Agent (Travel Update)"

• "ET TROJAN GoLang Popping Eagle Trojan Related Activity (POST)"

• "ET TROJAN MageCart CnC Domain Observed in DNS Query"

• "ET TROJAN SocGholish Domain in DNS Lookup (ghost .blueecho88 .com)"

• "ET INFO Possible Phishing Landing via Moonfruit M2 2016-10-03"

• "ET TROJAN Ousaban Banker Checkin M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Gootloader Domain in DNS Lookup (junk-bros .com)"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (wordpress .secureplatform .org)"

• "ET TROJAN US-CERT TA14-353A Proxy Tool 3"

• "ET TROJAN Possible DEEP PANDA C2 Activity"

• "ET TROJAN W32/Coced.PasswordStealer User-Agent 5.0"

• "ET WEB_CLIENT Fake AV Phone Scam Landing July 20 2015 M4"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6gcr .com)"

• "ET TROJAN APT SuperhardCorp DNS Lookup (ns8.ddns1.com)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (akademia-mil .space)"

• "ET MOBILE_MALWARE Apple iPhone Implant - Upload Files"

• "ET TROJAN MSIL/Hidden-Tear Variant Ransomware CnC Checkin"

• "ET CURRENT_EVENTS Successful iCloud Phish 2016-09-02"

• "ET CURRENT_EVENTS Apple Credential Phish Landing Page M1 2022-06-21"

• "ET INFO Suspicious Yahoo Page - Possible Phishing Landing"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (mirohost .online)"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M4"

• "ET TROJAN AllcomeClipper CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (hz .nikanpsx .top)"

• "ET CURRENT_EVENTS Possible Generic Microsoft Hosted Phishing Landing M2"

• "ET TROJAN Fileless infection dropped by EK CnC Beacon"

• "ET CURRENT_EVENTS Terror EK Payload RC4 Key M1 Mar 14 2017"

• "ET TROJAN OSX/WireLurker DNS Query Domain manhuaba.com.cn"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (highdatabase .com in TLS SNI)"

• "ET CURRENT_EVENTS Obfuscated MrxC0DER Credential Phish Landing Page"

• "ET CURRENT_EVENTS Possible Successful Phish - Generic Credential POST to Ngrok.io"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-10-06"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 26"

• "ET CURRENT_EVENTS Observed TOAD Domain (q2care .us in TLS SNI)"

• "ET WEB_CLIENT Likely MS12-004 midiOutPlayNextPolyEvent Heap Overflow Midi Filename Requested baby.mid"

• "ET TROJAN DNSChanger CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 18"

• "ET CURRENT_EVENTS Emirates NBD Bank Credential Phish Landing Page 2022-06-23"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (farmexpressmachine .com)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (tender-adnoc .com) 2022-12-05"

• "ET CURRENT_EVENTS Successful Credit Agricole Bank (FR) Phish M3 2016-10-19"

• "ET TROJAN CosmicStrand Rootkit Related Domain in DNS Lookup (update .bokts .com)"

• "ET TROJAN Cknife Shell Command Struct Inbound (aspx)"

• "ET MALWARE RubyFortune Spyware Capabilities User-Agent (Microgaming Install Program) - GET"

• "ET MALWARE ErrorNuker FakeAV User-Agent (ERRN2004 (Windows XP))"

• "ET TROJAN Possible CryptoPHP Leaking Credentials May 8 2015 M1"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (firstdoxed .space in DNS Lookup)"

• "ET TROJAN Observed Teal Kurma Domain (upt .mcsoft .org in TLS SNI)"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (ywbgrcrupasdiqxknwgceatlnbvmezti .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (christopher .fun in TLS SNI)"

• "ET TROJAN Observed GoBotKR Domain in TLS SNI"

• "ET TROJAN Downloader.Win32.Small CnC Beacon"

• "ET TROJAN Win32/Atomsilo Ransomware Activity (POST)"

• "ET TROJAN Lu0bot CnC Domain in DNS Lookup (hsh .juz09 .cfd)"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Win64/Agent.BP Checkin"

• "ET TROJAN Win32/Throwback Server Response (Incoming)"

• "ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access makeCall"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 9"

• "ET MALWARE User-Agent (webcount)"

• "ET TROJAN Known Malicious Redirector in DNS Lookup (by007 .cn)"

• "ET TROJAN Win32/DanijBot CnC Task Status"

• "ET TROJAN APT.Fwits CnC Beacon M2"

• "ET TROJAN Observed Targeted Attack Malicious Domain in TLS SNI (krakenfolio .com)"

• "ET TROJAN Win32.HLLW.Autoruner USA_Load UA"

• "ET TROJAN Observed CobaltStrike CnC Domain (defendersecyrity .com in TLS SNI)"

• "ET TROJAN IIS-Raid Module Backdoor Ping in HTTP Request"

• "ET TROJAN Suspected Lockscreen Ransomware Activity"

• "ET EXPLOIT Metasploit Plugin-Detect Posting Data 2"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (gameoolines .com)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET TROJAN Kimsuky Related Host Data Exfil M3"

• "ET TROJAN Observed Evrial Domain (cryptoclipper .ru in TLS SNI)"

• "ET CURRENT_EVENTS Covid19 Stimulus Payment Phish Inbound M4 (2021-10-21)"

• "ET TROJAN Zeus Bot Connectivity Check"

• "ET TROJAN Observed TA430/Andariel APT Related Domain (tech .micrsofts .tech in TLS SNI)"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET CURRENT_EVENTS Possible AMSI Powershell Bypass Attempt B643"

• "ET TROJAN Win32/Filecoder.STOP Variant Request for Public Key"

• "ET TROJAN Malicious SockRacket/KANDYKORN SSL Certificate Detected"

• "ET CURRENT_EVENTS SUSPICIOUS winhost(32|64).exe in URI"

• "ET TROJAN APT28/SkinnyBoy Payload Request"

• "ET TROJAN Suspected Polonium CnC Checkin (get_cmd)"

• "ET CURRENT_EVENTS Successful Canada Revenue Agency Phish 2015-08-18"

• "ET TROJAN APT DarkHydrus DNS Lookup 25"

• "ET TROJAN Windows Executable Downloaded With Image Content-Type Header"

• "ET TROJAN Theoreon.com Related Trojan Checkin"

• "ET WORM W32/Rimecud wg.txt Checkin"

• "ET TROJAN Win32/Teslacrypt Ransomware HTTP CnC Beacon M1"

• "ET TROJAN Observed Godlua Backdoor Domain (d .heheda .tk in TLS SNI)"

• "ET TROJAN Win32/Enchanim Check-in Response"

• "ET TROJAN DNS Query to Raspberry Robin Domain (glnj .nl)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET MALWARE Nerbian RAT Data Exfiltration"

• "ET TROJAN Ponmocup Post Infection DNS Lookup messagewild"

• "ET MALWARE Reborn Stealer 2021 Exfil attempt via Telegram"

• "ET TROJAN Gamaredon Domain in DNS Lookup (varials .ru)"

• "ET TROJAN Observed DNS Query to Impersoni-fake-ator (cloud .crmdev .org)"

• "ET TROJAN Hangover related campaign Checkin"

• "ET TROJAN TeslaCrypt/AlphaCrypt Variant .onion Payment Domain(k7tlx3ghr3m4n2tu)"

• "ET TROJAN Zlob User Agent - updating (Winlogon)"

• "ET TROJAN APT32/OceanLotus Associated Domain in DNS Lookup (tinmoivietnam .com)"

• "ET TROJAN Win32/Spyder Sending Info to CnC"

• "ET TROJAN GET to Google with specific HTTP lib likely Cycbot/Bifrose/Kryptic checking Internet connection"

• "ET POLICY Observed External IP Lookup SSL Cert"

• "ET CURRENT_EVENTS Successful Paypal Phish Mar 14 2017"

• "ET CURRENT_EVENTS Netscaler Gateway Credential Theft (POST)"

• "ET CURRENT_EVENTS Possible Phishing Landing - Data URI Inline Javascript Mar 07 2016"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (meeting-online .site)"

• "ET TROJAN Possible Maldoc Downloading EXE Jul 26 2016"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 49"

• "ET TROJAN APT DarkHydrus DNS Lookup 2"

• "ET MOBILE_MALWARE PJobRat System Exfil to CnC"

• "ET TROJAN MAGICHOUND-related DNS Lookup (com-adm .in)"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Observed TOAD Domain (bgcare .live in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET TROJAN Observed Emotet Maldoc Retrieving Payload (2023-03-07) M1"

• "ET TROJAN Gamaredon CnC Domain (kuckuduk .ru) in DNS Lookup"

• "ET TROJAN Gamaredon Domain in DNS Lookup (mensaso .ru)"

• "ET TROJAN WasabiSeed Backdoor Payload Request (GET)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 96"

• "ET TROJAN Downloader Win32.Small.agoy Checkin"

• "ET TROJAN CerberTear Ransomware CnC Checkin"

• "ET TROJAN Red October/Win32.Digitalia Checkin cgi-bin/nt/sk"

• "ET TROJAN Unknown Chinese Threat Actor CnC Domain in DNS Lookup"

• "ET TROJAN Observed Glupteba CnC Domain (statsexplorer .org in TLS SNI)"

• "ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1"

• "ET CURRENT_EVENTS RIG EK Landing Feb 26 2016"

• "ET MOBILE_MALWARE Android APT-C-23 (lexi-branson .website in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (3lzj .com)"

• "ET CURRENT_EVENTS Observed OWA Phishing Landing Page 2021-08-20"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS PerSwaysion Phishkit Javascript - Observed Repetitive Custom JS Components"

• "ET TROJAN Win32/Aurora Stealer Thanks Command"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 9"

• "ET CURRENT_EVENTS Successful Fake Webmail Quota Phish 2015-09-10"

• "ET CURRENT_EVENTS Nuclear EK PDF URI Struct"

• "ET TROJAN [eSentire] Remcos RAT Checkin 24"

• "ET WEB_CLIENT Office Discovery HTA file Likely CVE-2017-0199 Request M2"

• "ET TROJAN Nexus Stealer CnC Data Exfil"

• "ET CURRENT_EVENTS Successful Hinet Phish 2015-11-19"

• "ET TROJAN Scarlet Mimic DNS Lookup 15"

• "ET CURRENT_EVENTS Possible Successful Tripod.com Phish 2016-03-31"

• "ET TROJAN Win32/Spy.Banker.AAXV Retrieving key from Pinterest"

• "ET CURRENT_EVENTS Successful DrSpam Phish 2016-06-08 M2"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (isteros .com)"

• "ET TROJAN Observed Malicious SSL Cert (MassLogger)"

• "ET TROJAN TraderTraitor CnC Domain (dafom .dev) in DNS Lookup"

• "ET TROJAN Shuckworm/Gamaredon CnC Domain (pasamart .ru) in DNS Lookup"

• "ET CURRENT_EVENTS Possible FortDisco Wordpress Brute-force Site list download 10+ wp-login.php"

• "ET USER_AGENTS Suspicious User-Agent Im Luo"

• "ET CURRENT_EVENTS Successful Canada Revenue Agency Phish 2015-08-18"

• "ET TROJAN MSIL.Zapchast Checkin"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (number1g .top in TLS SNI)"

• "ET TROJAN Konni Group CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Tesco Phish (set) M4 Jul 18 2017"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS CritXPack PDF Request"

• "ET TROJAN Successful Cobalt Strike Shellcode Download (x32)"

• "ET TROJAN APT37 M2RAT CnC Server Command - UNI"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (virtualdataserver .com)"

• "ET TROJAN DarkHotel Payload Uploading to CnC"

• "ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendSMS"

• "ET TROJAN Sofacy DNS Lookup securitypractic.com"

• "ET TROJAN Dark Halo/SUNBURST SSL Cert Inbound (seobundlekit .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (addisonlynch .com)"

• "ET MALWARE [FIREEYE] SLIGHTPULSE Webshell Activity M2"

• "ET CURRENT_EVENTS Successful TA398/Sidewinder APT Related Phish 2022-09-28"

• "ET TROJAN DNSTrojan FakeAV Dropper Activity Observed (2)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Observed IcedID Domain (vrondafarih .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Teslacrypt Ransomware .onion domain (2kjb7.net)"

• "ET CURRENT_EVENTS Successful Commonwealth Bank Phish 2015-08-20"

• "ET MOBILE_MALWARE Android APT-C-23 (eleanorguthrie .site in DNS Lookup)"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (zupertech .com in TLS SNI)"

• "ET TROJAN Ursnif Payload Request (cook64.rar)"

• "ET CURRENT_EVENTS SUSPICIOUS PSHELL Downloader Primitives B645W Oct 19 2017"

• "ET TROJAN BlackEnergy v2.x HTTP Request with Encrypted Variables"

• "ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M2"

• "ET TROJAN Win32/Rage Stealer CnC Exfil via Telegram (POST)"

• "ET TROJAN Stellar Stealer Data Exfiltration Attempt M2"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Sep 19 2017"

• "ET CURRENT_EVENTS Chase Phish Landing 2020-10-13"

• "ET TROJAN Zeus Bot GET to Google checking Internet connectivity"

• "ET MOBILE_MALWARE Android APT-C-23 (mauricefischer .club in DNS Lookup)"

• "ET TROJAN Possible Malicious Macro DL EXE Feb 2016"

• "ET POLICY External IP Lookup Request"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper RAT CnC)"

• "ET TROJAN OSX/Flashback.K/I reporting successful infection 2"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (qwepoi123098 .com)"

• "ET MOBILE_MALWARE Unknown Redirector Nov 17 2016"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN WSHRAT CnC Checkin"

• "ET TROJAN TA452 Related Backdoor Activity (GET)"

• "ET CURRENT_EVENTS PawnStorm Java Class Stage 2 M1 Aug 28 2015"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (plivetrakoy .com)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (internal .group .link-net .publicvm .com)"

• "ET TROJAN Win32/Avaddon Ransomware Style External IP Address Check"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN Cryptolocker Checkin"

• "ET TROJAN Woody RAT CnC Domain (microsoft-telemetry .ru) in DNS Lookup"

• "ET TROJAN Spoofed MSIE 8 User-Agent Likely Ponmocup"

• "ET TROJAN NCSC XAgent Beacon"

• "ET TROJAN Win32/Boaxxe.BR CnC Beacon"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (h2care .cc)"

• "ET TROJAN SharpPanda APT Activity (GET)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Possible PurpleFox EK Framework URI Struct Payload Request M1"

• "ET TROJAN MSIL/Crimson Receiving Command (files list)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET TROJAN eCh0raix/QNAPCrypt Successful Server Response"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN Linux Backdoor Linux/Cdorked.A Redirect 3"

• "ET TROJAN Bitter APT CHM Activity (GET) M3"

• "ET TROJAN Possible APT17 CnC Content in Public Website"

• "ET TROJAN KPOT Stealer Initial CnC Activity M4"

• "ET CURRENT_EVENTS Successful HMRC Phish Oct 18 2017"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-05-27"

• "ET TROJAN PunkeyPOS HTTP CnC Beacon 4"

• "ET TROJAN AgentTesla Exfil via FTP"

• "ET TROJAN APT28/Sednit DNS Lookup (diplomatnews .org)"

• "ET TROJAN Win32/80mb3rm4n Grabber CnC Exfil via Discord (POST)"

• "ET TROJAN W32/Witch.3FA0!tr CnC Activity"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jan 17 2017"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (informativosatelital .com)"

• "ET TROJAN SocGholish Domain in DNS Lookup (trademark .iglesiaelarca .com)"

• "ET TROJAN DCRat Initial Checkin Server Response M5"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (m2care .us)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Download file with Powershell via LNK file (observed in Sundown EK)"

• "ET TROJAN CommentCrew Possible APT crabdance backdoor base64 head 2"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (snoc-projectae .com) 2022-12-05"

• "ET CURRENT_EVENTS FlimKit hex.zip Java Downloading Jar"

• "ET TROJAN ELF.STD.ddos Checkin"

• "ET TROJAN [PTsecurity] Trickbot Data Exfiltration"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Tofsee Covid19 Spam Template 1 Active - Outbound Email Spam"

• "ET TROJAN Revoyem Ransomware Activity"

• "ET TROJAN Sandman APT LuaDream Backdoor Domain in DNS Lookup (mode .encagil .com)"

• "ET TROJAN APT SuperhardCorp DNS Lookup (np3.Jkub.com)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (group-meeting .online)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Obfuscated Phishing Landing 2015-11-05"

• "ET MOBILE_MALWARE Android APT-C-23 (karenwheeler .club in DNS Lookup)"

• "ET MALWARE User-Agent (AgavaDwnl) - Possibly Xema"

• "ET POLICY Powershell Activity Over SMB - Likely Lateral Movement"

• "ET CURRENT_EVENTS Successful Yahoo Phish 2016-10-25"

• "ET MALWARE pdfspeedup Initial CnC Checkin"

• "ET CURRENT_EVENTS Generic Xbalti Phishing Landing 2018-11-26"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k5m .co)"

• "ET TROJAN Domen SocEng CnC Observed in DNS Query"

• "ET TROJAN Win32.Beaugrit.gen.AAAA"

• "ET TROJAN Likely FakeAV/Fakeinit/FraudLoad Checkin"

• "ET TROJAN Red October/Win32.Digitalia Checkin cgi-bin/win/wcx"

• "ET TROJAN Win32/Tiggre!rfn Zipped Exfil"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (cfg .jipinwan .com)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (jinowera .com)"

• "ET MOBILE_MALWARE Android.Backdoor.866.origin CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lazarus Domain (videomeethub .online in TLS SNI)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (galofad .ru)"

• "ET TROJAN Trojan.Win32.VBKrypt.cugq/Umbra Checkin"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN lu0bot Loader HTTP Request"

• "ET TROJAN Observed AZORult CnC Domain (miscrosoftworrd .000webhostapp .com in TLS SNI)"

• "ET TROJAN Win32/Borr Stealer Variant Sending System Information"

• "ET TROJAN Observed Lazarus Domain (team-meet .online in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Redline Stealer/MetaStealer Family TCP CnC Activity - MSValue (Outbound)"

• "ET TROJAN Kimsuky Related Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Ionos Credential Phish 2023-02-28"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN VectorStealer Data Exfil via Telegram"

• "ET MALWARE Win32/VrBrothers Checkin"

• "ET TROJAN Possible OwlProxy activity M2"

• "ET TROJAN Win32/Phorpiex Template 7 Active - Outbound Malicious Email Spam"

• "ET MOBILE_MALWARE Android APT-C-23 (olivia-hartman .info in DNS Lookup)"

• "ET TROJAN Observed PyPI Malicious Library Payload Delivery Domain (h4ck .cfd) Domain in DNS Lookup"

• "ET TROJAN APT28/Sednit DNS Lookup (worldmilitarynews .org)"

• "ET TROJAN Antinum HTTP Checkin"

• "ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC No Open Ports Message"

• "ET INFO Possible Kimsuky Related Malicious VBScript Inbound"

• "ET TROJAN Suspicious user-agent (f**king)"

• "ET TROJAN Possible NK APT SLICKSHOES Host Checkin"

• "ET TROJAN Bookworm CnC Beacon"

• "ET TROJAN DarkGate AutoIt Downloader"

• "ET TROJAN SolarBot Plugin Download Server Response"

• "ET TROJAN WinPwn PenTesting Activity"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Google Drive Phish 2015-07-28"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (biddings-enoc .com) 2022-12-05"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN Linux/dtool IRC Command (HTTPFLOOD)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish 2016-05-26"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k5x .xyz)"

• "ET TROJAN BUILDINGCAN CnC Activity"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (baruta .ru)"

• "ET TROJAN TA402/Molerats Payload Downloaded"

• "ET TROJAN ABUSE.CH Cerber Ransomware Domain Detected"

• "ET TROJAN Cobalt Strike CnC Domain (r2 .57thandnormal .com) in DNS Lookup"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (cupata .ru)"

• "ET TROJAN NEWPASS CnC Client Checkin"

• "ET TROJAN Bamital Checkin Response 2"

• "ET TROJAN W32/FloatingCloud.Banker CnC Beacon"

• "ET TROJAN TransparentTribe APT Maldoc CnC Checkin"

• "ET TROJAN Bitter APT Related Domain in DNS Lookup (diyefosterfeeds .com)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Oct 25 2016"

• "ET TROJAN WikiLoader Activity M3 (GET)"

• "ET TROJAN Smokeloader getgrab Command"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5g7 .at)"

• "ET TROJAN Urlzone/Bebloh/Bublik Checkin /was/uid.php"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (jokergame1 .com)"

• "ET TROJAN Observed Malicious Domain (jscloud .live in TLS SNI)"

• "ET INFO Microsoft Powershell Banner Output - Decimal Encoded"

• "ET TROJAN Observed Glupteba CnC Domain (spolaect .info in TLS SNI)"

• "ET TROJAN BAZAR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Unknown Stealer CnC Exfil (POST)"

• "ET CURRENT_EVENTS Successful Adobe Phish M1 2016-07-11"

• "ET TROJAN Mermaid Ransomware Variant CnC Activity M1"

• "ET CURRENT_EVENTS Successful Google Drive/Dropbox Phish Nov 20 2016"

• "ET WEB_CLIENT Suspicious Credential POST to FormBuddy.com - Possible Phishing Aug 10 2016"

• "ET TROJAN Qadars CnC DNS Lookup (zkdef09i7ola.net)"

• "ET TROJAN Transparent Tribe APT Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS [eSentire] Fake Flash Update 2018-07-09"

• "ET USER_AGENTS WaterDropX PRISM UA Observed"

• "ET TROJAN Win32/MOOZ.THCCABO CoinMiner CnC Checkin"

• "ET TROJAN Cuba Ransomware Related Domain in DNS Lookup (chatgpt4beta .com)"

• "ET MALWARE Casino Related Spyware User-Agent Detected (Viper 4.0)"

• "ET TROJAN Win32/Neutrino Bot Fake 404 Checkin Response"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET USER_AGENTS Suspicious User-Agent (NateFinder)"

• "ET TROJAN MintStealer CnC Activity (POST)"

• "ET TROJAN Midhos/Medfos downloader"

• "ET TROJAN Py/MechaFlounder CnC Activity - Reporting Sleep Command Success"

• "ET TROJAN Loki Locker Ransomware CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (iredugov .wiki)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (gz3 .nl)"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M6"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2018-06-11"

• "ET TROJAN MalDoc Retrieving Qbot Payload 2022-06-14"

• "ET P2P p2p Related User-Agent (eChanblard)"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 26"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M2 Oct 16 2016"

• "ET TROJAN Observed DNS Query to Ursnif Domain (damnater .com)"

• "ET TROJAN Golang Easy Stealer Activiy (POST)"

• "ET CURRENT_EVENTS Successful DenizBank Phish 2018-04-16"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M2"

• "ET MALWARE Clickspring.net Spyware Reporting Successful Install"

• "ET MOBILE_MALWARE Android APT-C-23 (kate-austen .info in DNS Lookup)"

• "ET TROJAN Sharik/Smoke Loader Adobe Connectivity Check 3"

• "ET TROJAN DNS Query to Raspberry Robin Domain (aij .hk)"

• "ET TROJAN Android/FakeKakao checkin"

• "ET MALWARE BInet Information Upload"

• "ET WEB_CLIENT Fake AV Phone Scam Landing June 26 2015 M5"

• "ET CURRENT_EVENTS Successful Bank of America Phish (set) M3 2016-10-14"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN FIN8 SARDONIC CnC Domain in DNS Lookup (git-api .com)"

• "ET CURRENT_EVENTS Successful Chase Phish 2015-09-24"

• "ET TROJAN APT/TransparentTribe CnC Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Parallax CnC Response Activity M14"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET MALWARE Searchspy.co.kr Spyware User-Agent (HTTP_FILEDOWN)"

• "ET TROJAN Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)"

• "ET WEB_SERVER ATTACKER WebShell - 1337w0rm - cPanel Cracker"

• "ET TROJAN Mevade Checkin"

• "ET MOBILE_MALWARE Android/Spy.Agent.AOX Checkin"

• "ET TROJAN IoT_reaper DNS Lookup M5 (bbk80 .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN BunnyLoader Initial CnC Checkin Response"

• "ET MALWARE Gator Agent Traffic"

• "ET TROJAN Potao CnC POST Response"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (scannermcscanface-edgescan .com)"

• "ET TROJAN LuminosityLink - Data Channel Client Request"

• "ET TROJAN Blue Bot DDoS Proxy Request"

• "ET TROJAN MICROPSIA CnC Checkin"

• "ET TROJAN Suspected Tunna Proxy M3"

• "ET TROJAN Possible Charming Kitten Backdoor CnC Activity"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 27"

• "ET TROJAN MontysThree HTTPTransport Module Activity"

• "ET TROJAN Possible Win32/Get2 Downloader Activity"

• "ET TROJAN TA410 APT LookBack Client HTTP Activity (POST)"

• "ET CURRENT_EVENTS Successful PlayerUnknown's Battlegrounds Credential Phish 2022-07-05"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Lazarus Decafett DNS Lookup 2"

• "ET TROJAN DNSChanger CnC Domain in DNS Lookup"

• "ET TROJAN MS_D0wnl0ad3r Checkin"

• "ET TROJAN MalDoc Retrieving Possible Ostap Payload"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (srv .fazlollah .net)"

• "ET MALWARE SweetIM Install in Progress"

• "ET CURRENT_EVENTS Underminer EK Plugin Check"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET WEB_SERVER WebShell - GODSpy - Cookie"

• "ET TROJAN MoonBounce Backdoor Related Domain in DNS Lookup (kinopoisksu .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (jack-wagner .website in TLS SNI)"

• "ET TROJAN AlinaPOS Exfiltration via DNS"

• "ET CURRENT_EVENTS Successful OWA Account Phish 2015-08-21"

• "ET TROJAN DNS query for known Anunak APT Domain (update-java.net)"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-10-06"

• "ET TROJAN MSIL/Monitor.PCTattletale.A Checkin (POST)"

• "ET TROJAN APT Mustang Panda CnC Activity"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5qy .ro)"

• "ET TROJAN AppleJeus - Ants2Whale CnC Domain in DNS Lookup (qnalytica .com)"

• "ET MOBILE_MALWARE Android/Spy.Agent.AON / Glancelove DNS Lookup 3 (autoandroidup .website)"

• "ET MOBILE_MALWARE Android Gymdrop Dropper (onlinefitnessanalysis .com in TLS SNI)"

• "ET TROJAN Red Wolf/RedCurl Domain (amscloudhost .com) in TLS SNI"

• "ET TROJAN DonBot Checkin"

• "ET TROJAN PlugX Related Domain in DNS Lookup (wps .daj8 .me)"

• "ET TROJAN CryptoWall .onion Proxy Domain (7oqnsnzwwnm6zb7y)"

• "ET MALWARE OSX/Adware.Pirrit Web Injects"

• "ET TROJAN FruityArmor DNS Lookup (shelves-design .com)"

• "ET TROJAN BlackCat Ransomware Related Domain in TLS SNI (updatedaemon .com)"

• "ET TROJAN Observed DNS Query to Known Gelsemium CnC"

• "ET TROJAN Win32/TrojanDownloader.VB.RUI Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6wr9 .com)"

• "ET USER_AGENTS Suspicious User-Agent (opera)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS CVE-2014-6332 Sep 01 2016 (HFS Actor) M1"

• "ET MOBILE_MALWARE NSO Related Domain 3"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (android-settings .info in TLS SNI)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (gigimas .xyz)"

• "ET TROJAN DNS Query Sykipot Domain rusview.net"

• "ET CURRENT_EVENTS Successful Facebook Phish 2018-04-16"

• "ET TROJAN Donot Group Pult Downloader Activity (POST) M4"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 1"

• "ET TROJAN sysrv.ELF Exploit Success Payload Request"

• "ET TROJAN IXWARE Stealer CnC Activity"

• "ET TROJAN APT Lazarus Nukesped Downloader"

• "ET TROJAN Latrodectus Alive Response M1"

• "ET CURRENT_EVENTS DRIVEBY [PwC CTD] -- MultiGroup - ScanBox Watering Hole function return value"

• "ET WEB_SERVER ATTACKER WebShell - Weevely - POSTed"

• "ET MOBILE_MALWARE Android APT-C-23 (katie .party in TLS SNI)"

• "ET USER_AGENTS Observed Donot Group UA (Mozilla FireFox)"

• "ET TROJAN Win32/Fosniw CnC Checkin Style 2"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST]"

• "ET CURRENT_EVENTS KaiXin Landing M3"

• "ET WEB_SPECIFIC_APPS Request to Wordpress W3TC Plug-in dbcache Directory"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2019-05-21"

• "ET TROJAN Ransomware/Cerber Onion Domain Lookup"

• "ET MALWARE Errclean.com Related Spyware User-Agent (Locus NetInstaller)"

• "ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 3"

• "ET TROJAN BotLoader Retrieving Additional Payloads"

• "ET TROJAN Linkup Ransomware check-in"

• "ET TROJAN W32/TrojanSpy.MSIL Fetch Time CnC Beacon"

• "ET CURRENT_EVENTS Successful Excel Online Phish 2015-12-08"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (SilentLibrarian)"

• "ET TROJAN Sekhmet Ransomware CnC Activity"

• "ET TROJAN Possible CopyKitten DNS Lookup (dnsserv .host)"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-11-29"

• "ET MALWARE Shopathomeselect .com Spyware User-Agent (WebDownloader)"

• "ET CURRENT_EVENTS Possible Successful Banking Phish (BR) 2016-09-29"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (abigelofraj .com)"

• "ET CURRENT_EVENTS KaiXin Landing Page Nov 25 2014"

• "ET CURRENT_EVENTS Successful Santander Phish M2 Oct 04 2017"

• "ET MALWARE HTTP Connection to go2000.cn - Common Malware Checkin Server"

• "ET TROJAN Win32/Unknown RAT CnC Checkin"

• "ET TROJAN Cobalt Strike Exfiltration"

• "ET TROJAN MalDoc/Konni APT CnC Activity (GET) M2"

• "ET TROJAN TA444 Related JS Activity Sending Windows System Process Information (POST)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (bgreenglobus .com)"

• "ET TROJAN Zeus GameOver Checkin"

• "ET TROJAN Xbash CnC DNS Lookup (censys .xyz)"

• "ET CURRENT_EVENTS Successful USAA Phish 2016-11-22"

• "ET TROJAN Win32/Agent.WVW CnC Beacon 2"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET MALWARE Lavasoft PUA/Adware Client Install"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Hentai)"

• "ET MALWARE User-Agent Mozilla/3.0"

• "ET TROJAN PHPStudy CnC Domain in DNS Lookup"

• "ET MALWARE Win32/Adware.Neoreklami.MI Activity M2"

• "ET TROJAN W32/CoinMiner.ESJ!tr CnC Domain (rp .oiwcvbnc2e .stream) in DNS Lookup"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 4"

• "ET TROJAN Razy Variant Checkin"

• "ET TROJAN Observed Glupteba CnC Domain (mastiakele .icu in TLS SNI)"

• "ET USER_AGENTS Suspicious User-Agent Fragment (WORKED)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-08-31"

• "ET MOBILE_MALWARE Android APT-C-23 (daario-naharis .info in TLS SNI)"

• "ET TROJAN Gamaredon Related VBS Activity (GET)"

• "ET TROJAN SysJoker User-Agent Observed"

• "ET TROJAN Win32/MultiPasswordRecovery.A cs-crash PWS"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Banbra.aa CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Apple Phish (FR) M2 2016-10-07"

• "ET TROJAN Win32/Eris Ransomware CnC Checkin"

• "ET CURRENT_EVENTS Successful Microsoft Live Email Account Phish 2016-11-29"

• "ET CURRENT_EVENTS DRIVEBY Nuclear EK Landing May 05 2014"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (pdf .cisco-webex .online)"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1qm34lsc65zpw79lxes69zkqmk6ee3ew .com)"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET INFO Terse Unencrypted Request for Google - Likely Connectivity Check"

• "ET MOBILE_MALWARE Trojan-Ransom.AndroidOS.Agent.bi CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Keitaro Set-Cookie Inbound to RogueRaticate (4cdcb)"

• "ET MALWARE Kuwo Music Installer Log"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (helpzonecisco .com)"

• "ET TROJAN Databack CnC"

• "ET TROJAN TA471/UNC2589 Related Activity (GET)"

• "ET TROJAN Observed Malicious SSL Cert (PHPs Labyrinth Stage1 CnC)"

• "ET CURRENT_EVENTS SunDown EK RIP Landing M3 B642"

• "ET MALWARE Win32/Adware.Kraddare.FJ Checkin"

• "ET TROJAN SocGholish Domain in DNS Lookup (pluralism .themancav .com)"

• "ET CURRENT_EVENTS Successful Banco do Brasil Phish M2 Sep 29 2017"

• "ET TROJAN ProjectSauron Remsec DNS Lookup (bikessport.com)"

• "ET MALWARE PUA Boxore User-Agent"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Outlook Phish 2016-07-14"

• "ET MOBILE_MALWARE Android APT-C-23 (meet-me .chat in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (heyapp .website in TLS SNI)"

• "ET TROJAN [ANY.RUN] Lu0bot-Style DNS Query in DNS Lookup M5"

• "ET TROJAN Linux.Mumblehard Initial Checkin"

• "ET TROJAN Win32.Banload.BTQP Checkin 1"

• "ET TROJAN XDR33 CnC Server SSL Certificate Observed"

• "ET CURRENT_EVENTS USPS Phish Landing Page 2023-12-05"

• "ET TROJAN TA444 Domain in DNS Lookup (internal .group .link-net .publicvm .com)"

• "ET TROJAN TA453 BellaCiao CnC Domain in DNS Lookup (mail-updateservice .info)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (perfectscenario .top)"

• "ET TROJAN W32.Blackshades/Shadesrat Backdoor CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN JS/RAA Ransomware check-in"

• "ET MALWARE DownloadAssistant Activity"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Dropbox Phishing Landing Feb 27 2017"

• "ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M5"

• "ET CURRENT_EVENTS Excel/Adobe Online Phishing Landing Nov 25 2015"

• "ET CURRENT_EVENTS Common Form POST - SunTrust Phishing Landing 2020-06-11"

• "ET TROJAN Win32/Ispen BADNEWS Fake User-Agent"

• "ET TROJAN [ANY.RUN] Win32/Gh0stRat Activity"

• "ET TROJAN TAG28 Associated CnC Domain in DNS Lookup (samuelblog .info)"

• "ET CURRENT_EVENTS [TW] Robin Banks HTTP HOST M1"

• "ET TROJAN Win32/Travnet.A Checkin"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M8"

• "ET INFO Suspected Phishing Simulation Service Activity"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DonotGroup CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (d2care .cc)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (taiprotectsq .xyz in DNS Lookup)"

• "ET TROJAN Ghostwriter/UNC1151 Related Domain in DNS Lookup (tvasahi .online)"

• "ET TROJAN Possible GoBruteforcer Payload Retrieval Attempt"

• "ET TROJAN Observed DNS Query to TA455 Domain (getadobe .net)"

• "ET TROJAN Subterranean Crimson Rat - FileManager pwd Command"

• "ET TROJAN W32/NetShare User-Agent"

• "ET TROJAN Orca RAT URI Struct 2"

• "ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.so)"

• "ET TROJAN Win32/Farfli.CUY CnC Server Response"

• "ET TROJAN Gulpix/PlugX Client Request"

• "ET MALWARE Win32/Adware.VrBrothers.AI Variant CnC Activity"

• "ET TROJAN Possible CopyKittens DNS Lookup (mswordupdate16.com)"

• "ET MOBILE_MALWARE NSO Related Domain 16"

• "ET TROJAN pswshopro_bot Stealer CnC Checkin"

• "ET CURRENT_EVENTS Keitaro Set-Cookie Inbound to ClearFake (71eb8)"

• "ET TROJAN H1N1 Loader CnC Beacon M1"

• "ET MALWARE AppControls.com User-Agent"

• "ET TROJAN eCh0raix/QNAPCrypt Requesting Key/Wallet/Note"

• "ET TROJAN StealerNeko CnC Checkin"

• "ET TROJAN DNS Query for a known malware domain (sektori.org)"

• "ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce]"

• "ET POLICY My2022/Beijing2022 App (TLS SNI) 3"

• "ET TROJAN Observed DNS Query to Reborn/Ovidiy Stealer CnC Domain"

• "ET MOBILE_MALWARE Android APT-C-23 (mygift .site in TLS SNI)"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (thedoccloud .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (defeatdiseasewithdata .com)"

• "ET TROJAN Win32/PurpleWave Stealer CnC Exfil M2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (3h .wf)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET POLICY W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Connection"

• "ET TROJAN Observed Targeted Attack Malicious Domain in TLS SNI (transferwiser .io)"

• "ET TROJAN Sednit/AZZY Checkin"

• "ET MALWARE MultiPlug.J Checkin"

• "ET TROJAN APT/Donot Group CnC Domain in DNS Lookup (request .soundedge .live)"

• "ET TROJAN TA402/Molerats Related Domain in DNS Lookup"

• "ET TROJAN DDoS.XOR Checkin 3"

• "ET TROJAN Observed ProtonBot User-Agent"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to MINEBRIDGE CnC Domain (creatorz123 .top)"

• "ET CURRENT_EVENTS Successful Alibaba Phish 2016-09-29"

• "ET TROJAN Observed Win32/Wacapew.A!ml Domain in TLS SNI (zytrox .tk)"

• "ET MALWARE Suspicious User-Agent (update)"

• "ET TROJAN TA444 Domain in DNS Lookup (doc .global-link .run .place)"

• "ET CURRENT_EVENTS Terror EK Landing T1 Jun 02 2017 M2"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Ouija_x.86)"

• "ET TROJAN Woody RAT Payload Delivery Domain (garmandesar .duckdns .org) in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4j .pm)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (snocprojectae .com) 2022-12-05"

• "ET TROJAN Mirai/OMG Proxy Variant CnC in DNS Lookup (ccnew.mm .my)"

• "ET CURRENT_EVENTS Cloned Instagram Page - Possible Phishing Landing M3"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Security Scanner Domain (log4j .binaryedge .io)"

• "ET TROJAN W32/Pterodo.CL CnC Checkin"

• "ET CURRENT_EVENTS Possible Phishing Landing - Data URI Inline Javascript 2016-02-09"

• "ET TROJAN Likely Geodo/Emotet CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Playful Taurus Observe malicious SSL Cert (self-signed www .netgate .com)"

• "ET POLICY Suspicious SSN Parameter in HTTP POST - Possible Phishing"

• "ET TROJAN ReverseRAT Activity (POST) M4"

• "ET TROJAN Win32/Sinresby.B Downloader CnC Activity M2"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2019-08-23"

• "ET TROJAN Win32/Bumblebee Loader Checkin Activity"

• "ET TROJAN [Fireeye] Backdoor.BEACON M1"

• "ET MALWARE ZenoSearch Spyware User-Agent"

• "ET TROJAN Remote Utility Access Tool Key SMTP Exfil"

• "ET TROJAN Win32/QakBot CnC Payload Request (GET)"

• "ET TROJAN Observed Malicious SSL Cert (SmokeLoader CnC)"

• "ET TROJAN Possible CopyKitten DNS Lookup (1m100 .tech)"

• "ET TROJAN APT Lurker GET CnC Beacon"

• "ET TROJAN Executable contained in DICOM Medical Image Received from PACS DICOM Device"

• "ET POLICY External IP Address Lookup via dawhois.com"

• "ET MOBILE_MALWARE CoolReaper CnC Beacon 2"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement"

• "ET TROJAN Observed Glupteba CnC Domain (ggjump .ru in TLS SNI)"

• "ET MALWARE BoostBeast Task Request M2"

• "ET TROJAN Sofacy DNS Lookup microsofi.org"

• "ET MALWARE OSX/Fake Flash Player Download Oct 20"

• "ET TROJAN Win32/Swrort.A Checkin 3"

• "ET CURRENT_EVENTS Successful Wallet Connect Private Key Phish 2023-02-03"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2"

• "ET TROJAN DNS Query to TA444 Domain (tp-globa .xyz)"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.2 Domain (letsmakeparty3 .ga) in TLS SNI"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN WEBC2-ADSPACE Server Response"

• "ET TROJAN TA444 Domain in TLS SNI (on-global .xyz)"

• "ET TROJAN Malicious Domain in DNS Lookup (jscloud .ink)"

• "ET TROJAN Kinsing Botnet Related Domain in DNS Lookup (blacknurse .lib)"

• "ET CURRENT_EVENTS Successful Banco de la Repblica Oriental del Uruguay Phish 2022-11-30"

• "ET TROJAN Win32/Common RAT Host Checkin (GET)"

• "ET CURRENT_EVENTS Possible Bank of America Phishing Domain Aug 15 2016"

• "ET TROJAN VBS/Dojos Downloader Activity M2"

• "ET TROJAN Win32/LeftHook Stealer CnC Command - save_cookies (POST)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 79"

• "ET TROJAN W32/Iyus.H Initial CnC Beacon"

• "ET CURRENT_EVENTS Disdain EK Flash Exploit M3 Aug 23 2017"

• "ET TROJAN W32.Virut.A joining an IRC Channel"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Process Listing)"

• "ET TROJAN [ANY.RUN] Echida Botnet Check-In M2"

• "ET TROJAN NOBELIUM (TA421) CEELOADER CnC Domain in DNS Lookup"

• "ET TROJAN OpenSSH in ICMP Payload - Possible Covert Channel"

• "ET MALWARE 180solutions Spyware (tracked event 2 reporting)"

• "ET CURRENT_EVENTS IRS COVID-19 Landing Page"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Generic Social Media Credential Phish 2022-03-31"

• "ET CURRENT_EVENTS Observed TOAD Domain (bshelp .live in TLS SNI)"

• "ET TROJAN RedLine - GetArguments Request"

• "ET TROJAN Win32/Valyria Maldoc Payload Request M1"

• "ET TROJAN Observed BlackGuard_v2 Domain (greenblguard .shop) in TLS SNI"

• "ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config"

• "ET TROJAN KeyBoy DNS Lookup (www .about.jkub.com)"

• "ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families)"

• "ET TROJAN Click Fraud Checkin"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .im .linkpc .net)"

• "ET TROJAN FSB Snake CnC Activity Inbound via TCP (AA23-129A) M3"

• "ET TROJAN Observed MAZE Ransomware CnC Domain (thesawmeinrew .net in TLS SNI)"

• "ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M5"

• "ET TROJAN Mirai/OMG Proxy Variant CnC in DNS Lookup (rpnew.mm .my)"

• "ET TROJAN CIA Ransomware - wallpaper/readme retrieval attempt"

• "ET TROJAN contacy.info Trojan Checkin (User agent clk_jdfhid)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Kratos Silent Miner Checkin via Discord"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Powershell commands sent B64 1"

• "ET TROJAN CozyCar CnC Beacon"

• "ET TROJAN DNS Query to IcedID Domain (stayersa .art)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (pafwa .info)"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .settings .oysterfloats .org)"

• "ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M3"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Wintervivern Related CnC Domain in DNS Lookup (securemanag .com)"

• "ET MALWARE Outerinfo.com Spyware Checkin"

• "ET TROJAN Kimsuky Related CnC Activity"

• "ET TROJAN FatDuke Domain Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Mystic Stealer Admin Panel Inbound"

• "ET TROJAN Observed Magecart Exfil Domain (imags .pw in TLS SNI)"

• "ET CURRENT_EVENTS Possible Fedex Phishing Landing 2015-07-28"

• "ET TROJAN Observed DNS Query to AppleJeus Domain (telloo .io)"

• "ET TROJAN Confucious APT CnC Checkin"

• "ET TROJAN Suspected Muggle Stealer Activity M1"

• "ET MALWARE ISearchTech.com XXXPornToolbar Activity (2)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 21"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET MALWARE Win32/Speedbit Variant Checkin"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET USER_AGENTS Suspicious User-Agent (msIE 7.0)"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (datadog-graph .com)"

• "ET TROJAN Observed GandCrab Ransomware Domain (chlenaverasiskihe .sex in DNS Lookup)"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (ccdata.txt) M2"

• "ET MOBILE_MALWARE Arid Viper (margarita-smith .host in DNS Lookup)"

• "ET TROJAN Observed DNS Query to Certishell Domain (freetips .php5 .sk)"

• "ET TROJAN BlackMatter CnC Domain in DNS Lookup (mojobiden .com)"

• "ET USER_AGENTS Eldorado.BHO User-Agent Detected (MSIE 5.5)"

• "ET MALWARE Likely Hostile User-Agent (Forthgoer)"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Vawtrak CnC)"

• "ET CURRENT_EVENTS CoolEK Payload Download (5)"

• "ET TROJAN Observed Cobalt Stike CnC Domain (nirsoft .me in TLS SNI)"

• "ET TROJAN Win32/LODEINFO CnC Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (freya .miranda-barlow .website in TLS SNI)"

• "ET TROJAN Win32/Nubjub.A HTTP Check-in"

• "ET TROJAN APT28 SEDNIT Variant CnC Beacon 1"

• "ET TROJAN W32/Hyteod.Downloader CnC Beacon"

• "ET TROJAN ChromeLoader Activity (GET)"

• "ET TROJAN W32/Sality Executable Pack Digital Signature ASCII Marker"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 1/2 CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (q0 .wf)"

• "ET TROJAN Win32/RM3Loader Activity (set)"

• "ET CURRENT_EVENTS Office 365 Phishing Landing"

• "ET CURRENT_EVENTS [TW] Robin Banks Redirect M2"

• "ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (callbinary .xyz in TLS SNI)"

• "ET TROJAN Win32/Urausy.C Checkin 4"

• "ET TROJAN Malicious Base64 Encoded Payload In Image"

• "ET TROJAN Win32/Bancos URL Structure"

• "ET TROJAN MewsSpy.AE Onion Domain (cxkefbwo7qcmlelb in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (aryastark .info in TLS SNI)"

• "ET CURRENT_EVENTS KaiXin Secondary Landing Page"

• "ET TROJAN BlackEnergy v2 POST Request"

• "ET TROJAN Win32/Radonskra.B C2 Check-in"

• "ET TROJAN Kimsuky Related Activity (GET)"

• "ET TROJAN Possible APT Sarhurst/Husar/Hussarini/Hassar CnC Command Response"

• "ET MALWARE Win32/ReImageRepair.T CnC Checkin"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M10"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Possible Zeus .ru CnC Domain Generation Algorithm (DGA) Lookup Detected"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN Filename svchost.exe Download - Common Hostile Filename"

• "ET TROJAN Bitter APT Backdoor Related Activity"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[SID1]"

• "ET CURRENT_EVENTS Axie Infinity Credential Phish Landing Page M1 2022-05-18"

• "ET TROJAN Skeleton Key Filename in SMB2 Traffic"

• "ET CURRENT_EVENTS Fake Browser Update Domain in TLS SNI (christopherchabannes .com)"

• "ET TROJAN Gamaredon APT Backdoor Related Activity"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (page .googledocpage .com)"

• "ET MALWARE UCMore Spyware Reporting"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Observed Ttint CnC Domain in DNS Query"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Possible WannaCry DNS Lookup 3"

• "ET CURRENT_EVENTS ClearFake Fingerprinting Domain in DNS Lookup (stats-best .site)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 33"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET USER_AGENTS Suspicious User-Agent (ErrCode)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-cdn .com)"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (koolstoredeluxe .com)"

• "ET TROJAN Trojan.BlackRev Download Executable"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (gogowormdealer .top)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed BatLoader Domain (externalchecksso .com) in TLS SNI"

• "ET TROJAN Win32/Hikit Server Authentication Response"

• "ET TROJAN HiveRAT CnC Activity M1"

• "ET TROJAN FrameworkPOS Covert DNS CnC Beacon 1"

• "ET TROJAN CyberGate RAT Checkin"

• "ET TROJAN WhiteSnake Stealer Sending Data to Telegram (POST)"

• "ET TROJAN MSIL.BackNet Checkin"

• "ET TROJAN [TGI] Cobalt Strike Malleable C2 Response (O365 Profile) M2"

• "ET TROJAN Ransomware CrypMIC Payment Onion Domain"

• "ET TROJAN Dark Halo/SUNBURST CnC Domain (kubecloud .com in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2yd .eu)"

• "ET TROJAN ViperSoftX HTTP CnC Activity"

• "ET TROJAN Libyan Scorpions Adwind DNS Lookup (collge .myq-see.com)"

• "ET WEB_CLIENT Observed DNS Query to Malicious Cookie Monster Roulette JS Cookie Stealer Exfil Domain"

• "ET TROJAN Possible APT Sarhurst/Husar/Hussarini/Hassar CnC Check Response"

• "ET CURRENT_EVENTS Successful National Australia Bank 2016-09-28"

• "ET MALWARE Qcbar/Adultlinks Spyware User-Agent (IBSBand)"

• "ET TROJAN Backdoor.Win32.Sykipot Checkin"

• "ET TROJAN W32/Alina.POS-Trojan Checkin"

• "ET TROJAN WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related"

• "ET TROJAN Win32/RCAP CnC Checkin"

• "ET WEB_SERVER ATTACKER WebShell - Weevely - Downloaded"

• "ET TROJAN SideCopy APT MargulasRAT Related Activity"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (adiantumso .ru)"

• "ET TROJAN Shuckworm Backdoor Screenshot Upload Attempt"

• "ET TROJAN WooSIP Downloader CnC DeleteFileOnServer"

• "ET TROJAN Dark Halo/SUNBURST SSL Cert Inbound (kubecloud .com)"

• "ET TROJAN DistTrack/Shamoon CnC Beacon M2"

• "ET CURRENT_EVENTS Successful Tesco Bank Phish M1 Phish 2016-12-15"

• "ET TROJAN Observed DangerousPassword APT Related Domain (shopapppro .com in TLS SNI)"

• "ET MALWARE User-Agent (Fast Browser Search)"

• "ET TROJAN TA430/Andariel APT Related DLRAT Activity (POST)"

• "ET TROJAN LegionLoader CnC Domain (legions .win) in DNS Lookup"

• "ET CURRENT_EVENTS Microsoft Account Login Hosted on Firebasestorage"

• "ET TROJAN Observed Malicious SSL Cert (Silver Implant)"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Conficker.b Shellcode"

• "ET CURRENT_EVENTS Successful Chase Phish M2 2015-12-01"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN Possible Zendran ELF IRCBot Joining Channel"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (nightchat .live in DNS Lookup)"

• "ET TROJAN rat-test CnC Response"

• "ET TROJAN MSIL/InfoStealer Variant Activity (POST)"

• "ET TROJAN APT28 SEDNIT Variant CnC Beacon 2"

• "ET TROJAN JAR/Qealler Stealer HTTP Headers Observed"

• "ET TROJAN APT28/Sednit DNS Lookup (symantecsupport .org)"

• "ET TROJAN Suspected USBFERRY CnC"

• "ET TROJAN DNS Query to UNK_BisonBooster Domain (speedup-pc .online)"

• "ET TROJAN Observed DNS Query to TA444 Domain (1drvmicrosoft .com)"

• "ET CURRENT_EVENTS Common Form POST - Webmail Mini Phishing Landing 2020-06-11"

• "ET TROJAN Trojan-PSW.Win32.Stealer.sb CnC"

• "ET TROJAN JavaScriptBackdoor HTTP GET CnC Beacon"

• "ET CURRENT_EVENTS ghayt_Zone Phishing Kit"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phishing Oct 06 2016"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN Win32/RisePro CnC Command Outbound (pingmap)"

• "ET TROJAN NightfallGT Mercurial Grabber"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (gov-pok .net)"

• "ET CURRENT_EVENTS Successful Citibank Phish 2021-11-10"

• "ET TROJAN Possible CVE-2015-2424 RTF Dropping Sofacy"

• "ET TROJAN Win32/Neutrino CC dump"

• "ET CURRENT_EVENTS Observed TOAD Domain (a2care .cc in TLS SNI)"

• "ET TROJAN ElectroRAT Command from Server (Get folder content)"

• "ET TROJAN Earth Lusca/SprySOCKS CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS - Possible Redkit 1-4 char JNLP request"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hshelp .live)"

• "ET TROJAN TAG28 Associated CnC Domain in DNS Lookup (samuelblog .me)"

• "ET TROJAN Predator Pain Keylogger FTP"

• "ET TROJAN FIN6 StealerOne CnC DNS Query"

• "ET TROJAN Win32/RisePro CnC Command Outbound (get_grabbers)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (aptekoagraliy .com)"

• "ET WEB_CLIENT DRIVEBY Social Engineering Toolkit JAR Download"

• "ET TROJAN AHK/BKDR_HTV.ZKGD-A CnC Checkin"

• "ET TROJAN [TGI] Py.Machete FTP Exfil 2"

• "ET WEB_SERVER WebShell - GODSpy - GOD Hacker"

• "ET TROJAN Win32/Valak <v20 Checkin - Server Response"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (lionnik .xyz)"

• "ET TROJAN Observed Turla Domain (vision2030 .tk in TLS SNI)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-26"

• "ET MALWARE CoolWebSearch Spyware User-Agent (iefeatsl)"

• "ET TROJAN DNS Query for IcedID Domain (flarkonafaero .com)"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (j2care .us)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (mclearoptical .com)"

• "ET TROJAN Taurus Stealer CnC Exfil"

• "ET TROJAN Backdoor.Win32.Agent.bjjv Checkin"

• "ET TROJAN Win32/TrojanDownloader.Chekafe.D User-Agent my_check_data On Off HTTP Port"

• "ET TROJAN SSL/TLS Certificate Observed (Various Crimeware)"

• "ET TROJAN General Win32 Backdoor Checkin POST Packet 1"

• "ET TROJAN Malicious Chrome Extension Requesting Websocket"

• "ET TROJAN Observed MageCart CnC Domain (mcdnn .me in TLS SNI)"

• "ET TROJAN Observed VikroStealer CnC Domain in TLS SNI"

• "ET TROJAN MegalodonHTTP/LuciferHTTP/Gomorrah Client Action M2"

• "ET CURRENT_EVENTS Successful Barclays Phish M2 2016-10-06"

• "ET TROJAN Nemours/Proyecto RAT CnC Checkin"

• "ET MOBILE_MALWARE GravityRAT CnC Domain (chat2hire .net in DNS Lookup)"

• "ET TROJAN TA444 Related CnC Payload Request"

• "ET CURRENT_EVENTS Successful DHL Credential Phish 2023-04-24"

• "ET TROJAN Cobalt Strike Malleable C2 Amazon Profile"

• "ET MALWARE Jasmin Ransomware Panel Activity (Response)"

• "ET TROJAN Linux/BillGates Checkin Response"

• "ET CURRENT_EVENTS Possible Successful Phish to Hostinger Domains M1 2016-04-04"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (mynetenergy .com)"

• "ET CURRENT_EVENTS Successful Paypal Phish M3 2016-10-05"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Bitter APT Related Domain in DNS Lookup (signal-premium-app .org)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN TA453 Related Activity (POST)"

• "ET TROJAN Zbot UA"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1q6crq62w2sclm0cwwk6m2wugr6jkh .com in TLS SNI)"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Information.html) M1"

• "ET TROJAN APT28/Sednit DNS Lookup (natoint .com)"

• "ET TROJAN Possible DarkHotel Landing M2"

• "ET TROJAN Generic AsyncRAT Style SSL Cert"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN ASPXSPY - Manic Menagerie Variant Activity M1"

• "ET TROJAN [TGI] BlackRAT Checkin Response"

• "ET TROJAN APT DarkHydrus DNS Lookup 28"

• "ET CURRENT_EVENTS Successful DHL Phish 2015-09-30"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Hisoka CnC Domain Observed in DNS Query"

• "ET MOBILE_MALWARE Android APT-C-23 (maria-bouchard .website in DNS Lookup)"

• "ET TROJAN VirRansom/VirLock Checkin"

• "ET TROJAN SLUB Domain in DNS Lookup"

• "ET DNS Reply Sinkhole FBI Zeus P2P 1 - 142.0.36.234"

• "ET TROJAN Possible Tunna Proxy Activity (Response)"

• "ET TROJAN Python.Ragua Checkin"

• "ET TROJAN VikroStealer CnC Exfil"

• "ET MALWARE Morpheus Spyware Install User-Agent (SmartInstaller)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Mailbox Upgrade Phish 2016-06-27 M2"

• "ET TROJAN Probable OneLouder downloader (Zeus P2P)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (risenpeaches .org)"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI)"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 4"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Bladabindi/njrat CnC Checkin"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (designautocad .org)"

• "ET TROJAN Observed GoBotKR Domain in TLS SNI"

• "ET TROJAN OilRig QUADAGENT DNS Tunneling"

• "ET TROJAN GCleaner Downloader IP Address Retrieval Attempt M2"

• "ET TROJAN TeamBot CnC Activity"

• "ET CURRENT_EVENTS Fiesta Flash Exploit URI Struct"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (nikanpsx .hopto .org)"

• "ET CURRENT_EVENTS Safe/CritX/FlashPack URI Struct .php?id=Hex"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Observed DNS Query to RisePro Domain (neo-files .com)"

• "ET TROJAN ABUSE.CH Locky Payment Domain Detected"

• "ET TROJAN DNS Query to Jaff Domain (fkksjobnn43 . org)"

• "ET TROJAN Possible Mask C2 Traffic"

• "ET TROJAN Generic Stealer Config from Server"

• "ET CURRENT_EVENTS Phishing Landing via Webeden.net 2016-10-13"

• "ET MOBILE_MALWARE Android APT-C-23 (accountforusers .website in DNS Lookup)"

• "ET TROJAN Cobalt Strike Malleable C2 (Unknown Profile)"

• "ET TROJAN Possible CopyKittens DNS Lookup (haaretz-news.com)"

• "ET MALWARE User-Agent (Download Master) - Possible Malware Downloader"

• "ET TROJAN Murlo Trojan Checkin"

• "ET TROJAN Observed Malicious SSL Cert (CobInt CnC)"

• "ET TROJAN [ANY.RUN] Hydrochasma Fast Reverse Proxy M3"

• "ET CURRENT_EVENTS Terse POST to Wordpress Folder - Probable Successful Phishing M4"

• "ET TROJAN Reptile Rootkit Default TCP Magic Packet Trigger"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN DNS Query to Raspberry Robin Domain (li1iv .com)"

• "ET TROJAN Possible CopyKitten DNS Lookup (cloudmicrosoft .net)"

• "ET TROJAN Pegasus Domain in DNS Lookup"

• "ET TROJAN MoonBounce Backdoor Related Domain in DNS Lookup (glbaitech .com)"

• "ET TROJAN Possible Upatre or Dyre SSL Cert Jan 22 2015"

• "ET MOBILE_MALWARE Arid Viper (hannah-parsons .info in DNS Lookup)"

• "ET TROJAN TA430/Andariel APT HazyLoad Proxy Related Activity (POST)"

• "ET TROJAN Asylum Ambuscade Related CnC Activity (GET) M3"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN Win32/BlackLotus CnC Activity (POST)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET MALWARE CoinSurf Proxy CnC Response (Refesh Token)"

• "ET TROJAN Remcos 3.x Unencrypted Checkin"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Generic Email Login Phishing Landing 2016-06-02"

• "ET TROJAN AlinaPOS Exfiltration via DNS"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-10-04"

• "ET CURRENT_EVENTS Successful IRS Phish 2018-05-07"

• "ET CURRENT_EVENTS Common Form POST - Chase Phishing Landing 2020-06-11"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to digitalcollege .org"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (mitchvandenborn .com)"

• "ET TROJAN QuickBooks Pop-Up Scam - Pop-Up Details Request"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (skigimeetroc .com)"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2019-05-14"

• "ET TROJAN Nazar Implant - Sending Basic System Info to CnC"

• "ET TROJAN Banker Boleto Fraud JS_BROBAN.SM Checkin 3"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Gamaredon APT Related Domain (achilleaso .ru in TLS SNI)"

• "ET TROJAN Observed DNS Query to PC Optimizer Software Domain (fortect .com)"

• "ET MALWARE Snoopstick.net Related Spyware User-Agent (SnoopStick Updater)"

• "ET MOBILE_MALWARE Android/Spy.Agent.AON / Glancelove DNS Lookup 4 (mobilestoreupdate .website)"

• "ET TROJAN Dark Halo/SUNBURST CnC Domain (seobundlekit .com in TLS SNI)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (anguisbi .ru)"

• "ET TROJAN W32/Tobfy.Ransomware Invalid URI CnC Request"

• "ET MALWARE Win32/ReImageRepair.T CnC Activity"

• "ET TROJAN Observed DNS Query to RisePro Domain (get-files24 .com)"

• "ET CURRENT_EVENTS MageCart 404 COOKIE_ANNOT"

• "ET TROJAN Win32/Dorv InfoStealer CnC DNS Query"

• "ET CURRENT_EVENTS RIG EK - Unexpected Victim Location Server Response"

• "ET TROJAN Blue Bot DDoS Logger Request"

• "ET MALWARE Matcash Trojan Related Spyware Code Download"

• "ET MOBILE_MALWARE Android APT-C-23 (harper-monty .site in DNS Lookup)"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET TROJAN Kazy/Kryptor/Cycbot Trojan Checkin"

• "ET TROJAN J-Spy JSP webshell response"

• "ET CURRENT_EVENTS Possible Successful Phish - Generic Status Messages Sept 11 2015"

• "ET TROJAN RedLine Stealer - CheckConnect Response"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Injected iframe leading to Redkit Jan 02 2013"

• "ET CURRENT_EVENTS Successful Google Drive Phish June 17 2015"

• "ET CURRENT_EVENTS Sakura exploit kit exploit download request /nano.php"

• "ET TROJAN Linux/Agent.HX CnC Activity (set)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (machinetext .org)"

• "ET WEB_CLIENT Chrome Extension Phishing HTTP Request"

• "ET EXPLOIT Pulse Secure SSL VPN - Arbitrary File Read (CVE-2019-11510)"

• "ET TROJAN LURK Trojan Communication Protocol detected"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (animamagaznaf .com)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing Nov 6 2015 M1"

• "ET TROJAN Backdoor.Win32/Dervec.gen Connectivity Check to Google"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 11"

• "ET CURRENT_EVENTS Generic Credential Phishing Landing Aug 11 2015"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (paknvay-pk .net)"

• "ET TROJAN Netwire RAT Check-in (set)"

• "ET CURRENT_EVENTS PawnStorm Sednit DL Aug 28 2015"

• "ET CURRENT_EVENTS Successful Mailbox Update Credential Phish 2015-10-02"

• "ET MOBILE_MALWARE Android APT-C-23 (lexi-branson .website in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN H1N1 Loader CnC Beacon M2"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (beetelson .xyz)"

• "ET TROJAN BotLoader CnC Checkin"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 5"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android/Spy.SmsSpy.XC CnC Domain in DNS Lookup"

• "ET TROJAN Observed Glupteba CnC Domain (rentalhousezz .net in TLS SNI)"

• "ET TROJAN SugarGh0st RAT Domain in DNS Lookup (login .drive-google-com .tk)"

• "ET TROJAN Win32/IceXLoader Sending System Information (POST)"

• "ET TROJAN ShellBot.C retrieval"

• "ET TROJAN FROZENLAKE (APT 28) Related Domain in DNS Lookup (ukrprivatesite .frge .io)"

• "ET TROJAN APT 41 LOWKEY Backdoor - Initalisation Bytes Received from CnC"

• "ET TROJAN W32/Adrom.Backdoor CnC Beacon"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (d01fa .net)"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M1 2016-11-18"

• "ET TROJAN PoshC2 - Observed Default URI Structure M29"

• "ET TROJAN DNS Query to Teal Kurma Domain (ud .ybcd .tech)"

• "ET TROJAN Symbiote CnC Domain in DNS Lookup (caixa .cx)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M2"

• "ET TROJAN Win32/Wacatac.B Loader CnC Checkin"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Observed JS/Skimmer (likely Magecart) Domain in TLS SNI (imprintcenter .com)"

• "ET TROJAN IOS.Oneclickfraud HTTP Host"

• "ET TROJAN Observed Malicious SSL Cert (Various CnC)"

• "ET CURRENT_EVENTS Successful Axie Infinity Credential Phish M2 2022-05-18"

• "ET MALWARE Internet Optimizer Activity User-Agent (IOKernel)"

• "ET TROJAN Win32.FakeAV.chhq Checkin"

• "ET TROJAN Ursnif Payload Request (grab64.rar)"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M5"

• "ET TROJAN Win32/Neutrino Checkin 2"

• "ET TROJAN Win32/CollectorStealer - Returning Client GeoIP Information"

• "ET TROJAN DNSChanger CnC Domain in DNS Lookup"

• "ET TROJAN Possible OwlProxy activity M6"

• "ET MALWARE Query to Seetrol RAT Domain (seetrol .co .kr)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (msix .pm)"

• "ET TROJAN Observed BLINDINGCAN Domain (www .automercado .co .cr in TLS SNI)"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish 2016-11-15"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET CURRENT_EVENTS Successful Tesco Bank Phish (set) Jul 17 2017"

• "ET TROJAN DNS Reply Sinkhole Microsoft NO-IP Domain"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT28 CnC Domain DNS Lookup"

• "ET TROJAN Possible Andromeda download with fake Zip header (1)"

• "ET TROJAN APT28/Sednit DNS Lookup (biocpl .org)"

• "ET TROJAN MirrorBlast KiXtart Downloader Client Request"

• "ET TROJAN DNS Query to Raspberry Robin Domain (as3 .biz)"

• "ET CURRENT_EVENTS Unknown EK Secondary Landing Page May 01 2015 M1"

• "ET TROJAN Win32/Oliga Fake User Agent"

• "ET TROJAN W32/Citadel.Arx Variant CnC Beacon 1"

• "ET MALWARE Suspicious User-Agent (gettingAnswer)"

• "ET TROJAN Observed Python CTX Library Backdoor Domain (anti-theft-web .herokuapp .com) in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN SockRacket/KANDYKORN Client Connect (Random Number)"

• "ET CURRENT_EVENTS Successful Amazon Phish M2 2016-10-05"

• "ET USER_AGENTS Suspicious User-Agent (Version 1.23)"

• "ET CURRENT_EVENTS Observed TOAD Domain (hscare .info in TLS SNI)"

• "ET TROJAN WhiteSnake Stealer Response (Inbound)"

• "ET TROJAN Soraya C2 User-Agent (slayer)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (ellechina .online)"

• "ET TROJAN Scieron DNS Lookup (autocar.ServeUser.com)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bscare .cc)"

• "ET TROJAN TURLA APT CnC Activity"

• "ET TROJAN Observed Malicious Debugging Application Related Domain (blgbeach .com in TLS SNI)"

• "ET TROJAN Dridex CnC Request - Spam/Worm Component"

• "ET CURRENT_EVENTS SUSPICIOUS PSHELL Downloader Primitives B642 Oct 19 2017"

• "ET MOBILE_MALWARE Android/KungFu Package Delete Command"

• "ET CURRENT_EVENTS Successful Commonwealth Bank Phish Fake Error Page 2015-08-20"

• "ET CURRENT_EVENTS iCloud Credential Phish Landing Page 2022-12-06"

• "ET TROJAN DNS Query to Raspberry Robin Domain (r0 .pm)"

• "ET TROJAN WEBC2-UGX Embedded CnC Response APT1"

• "ET TROJAN W32/Citadel.Arx Varient CnC Beacon 2"

• "ET MALWARE LNKR landing page (possible compromised site) M3"

• "ET TROJAN LDPinch SMTP Password Report with mail client The Bat!"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Magnitude/Hunter EK IE Exploit Aug 23 2015"

• "ET TROJAN APT 41 CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-10-17"

• "ET MALWARE Nivesro Cheat CnC Activity M1"

• "ET TROJAN PoshC2 - Observed Default URI Structure M15"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (rotter2 .publicvm.com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Anuna PHP Backdoor Attempt"

• "ET CURRENT_EVENTS Mailbox Deactivation Phishing Landing 2016-12-15"

• "ET MOBILE_MALWARE Android/MMRAT Data Exfiltration Attempt"

• "ET TROJAN Mozart Loader CnC Checkin (getid)"

• "ET MOBILE_MALWARE Android APT-C-23 (face-book-support .email in DNS Lookup)"

• "ET TROJAN Buer Loader Update Request"

• "ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET CURRENT_EVENTS TA398/Sidewinder Credential Phish Landing Page M1 2022-11-18"

• "ET TROJAN Linux/Torte Downloading Binary"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST Struct M2"

• "ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)"

• "ET CURRENT_EVENTS CoinMiner Malicious Authline Seen After CVE-2017-10271 Exploit"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (singamofing .com)"

• "ET WEB_CLIENT Microsoft Edge SmartScreen Page Spoof Attempt Dec 16 2016"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (SilentLibrarian)"

• "ET TROJAN Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 3"

• "ET TROJAN Possible CopyKittens DNS Lookup (windowkernel.com)"

• "ET TROJAN Ousaban Banker KeepAlive Response"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET CURRENT_EVENTS Possible Evil Redirector Leading to EK Nov 09 2015 M1"

• "ET TROJAN Shylock Module Data POST"

• "ET TROJAN Windows nbtstat -s Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET MOBILE_MALWARE Android Marcher Trojan Download - Austrian Bank Targeting"

• "ET WEB_CLIENT Tech Support Scam Landing M2 2019-04-15"

• "ET CURRENT_EVENTS Adobe Shared Document Phishing Landing Common CSS 2016-08-10"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN APT28/Sednit DNS Lookup (driversupdate .info)"

• "ET TROJAN Possible Maldoc Downloader Aug 18 2017"

• "ET TROJAN Possible OwlProxy activity M5"

• "ET TROJAN Possible Winnti-related DNS Lookup (vps2java .securitytactics .com)"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (13fzyjcfqhnryc4dkxkykbaawkzwrmhcfc .com)"

• "ET TROJAN Win32/frebniis IIS Backdoor Trigger Attempt M1"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET MOBILE_MALWARE Arid Viper (fasebcoki .com in DNS Lookup)"

• "ET CURRENT_EVENTS Successful OWA Phish 2022-07-15"

• "ET CURRENT_EVENTS Successful Banco Itau (BR) Phish M1 2016-12-08"

• "ET TROJAN Observed DNS Query to Ursnif Domain (gigeram .com)"

• "ET MOBILE_MALWARE Android/Kemoge Checkin"

• "ET TROJAN Observed Cobalt Strike CnC Domain (gojihu .com in TLS SNI)"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 13"

• "ET TROJAN W32.DarkVNC Variant Checkin"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (snocprojectuae .com) 2022-12-05"

• "ET TROJAN Win32/MagicRAT Additional Payload URI M3"

• "ET TROJAN Swizzor Checkin (kgen_up)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET MOBILE_MALWARE Android APT-C-23 (accountusers .website in TLS SNI)"

• "ET WEB_CLIENT Evil Keitaro Set-Cookie Inbound (9487d)"

• "ET CURRENT_EVENTS Successful Greatness Credential Phish M2 (2023-11-07)"

• "ET TROJAN ASNAROK Domain in TLS SNI"

• "ET TROJAN Win32.FakeAV POST datan.php"

• "ET TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2015-11-14"

• "ET TROJAN FIN7/Carbanak CnC Domain in DNS Lookup (besaintegration .com)"

• "ET INFO Possible Bot CnC Checkin (GET)"

• "ET TROJAN Win32/Neutrino Checkin 3"

• "ET TROJAN MSIL/PSW.Agent.STP Data Exfiltration Attempt"

• "ET USER_AGENTS Suspicious User-Agent (Presto)"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .scheme .corycabana .net)"

• "ET TROJAN MSIL/EasyLocker Ransomware CnC Activity"

• "ET TROJAN ZenRAT Status Response"

• "ET TROJAN Gamaredon Domain in DNS Lookup (stereotyped .ru)"

• "ET TROJAN MRCR1 Ransomware Checkin M2"

• "ET TROJAN Remcos 3.x Unencrypted Server Response"

• "ET TROJAN IRC Potential bot update/download via ftp command"

• "ET CURRENT_EVENTS L33bo Phishing Kit - Successful Credential Phish M3 2016-03-29"

• "ET TROJAN Win32/Fareit Variant Activity (POST)"

• "ET MOBILE_MALWARE Android APT-C-23 (flirtymania .fun in TLS SNI)"

• "ET TROJAN Win32/keyzetsu Stealer exfil via Telegram (Response)"

• "ET TROJAN Win32/Remcos RAT Checkin 56"

• "ET CURRENT_EVENTS EITest Evil Redirect Leading to EK Feb 01 2016"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed BatLoader Domain (24xpixeladvertising .com) in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 5 Staging Domain)"

• "ET TROJAN SunSeed Downloader Retrieving Binary (set)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Win32/TradingView CnC Exfil (POST)"

• "ET TROJAN Common RAT Connectivity Check Observed"

• "ET TROJAN Win32/Banbra Banking Trojan Communication"

• "ET TROJAN VBS/TrojanDownloader.Agent.SEB Keep-Alive"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Win32/ASPC Bot CnC Checkin M1"

• "ET TROJAN Unk.DPRK MalDoc SysInfo CnC Exfil"

• "ET TROJAN Suspected Gamaredon Related Maldoc Activity M1"

• "ET TROJAN ELF/muBoT IRC Activity 6 (SOCKS)"

• "ET TROJAN Win32/LeftHook Stealer CnC Command - get_socket (POST)"

• "ET TROJAN Win32/RootTeam Stealer CnC Response"

• "ET TROJAN NanoLocker Check-in (ICMP) M1"

• "ET TROJAN BatLoader CnC Domain (t1pixel .com) in DNS Lookup"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 4"

• "ET CURRENT_EVENTS Fiesta EK Landing Nov 05 2014"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Lazarus CnC Domain Observed in DNS Query"

• "ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst"

• "ET WEB_SPECIFIC_APPS Possible Ivanti Endpoint Manager Mobile CVE-2023-35082 Check/Exploitation Attempt"

• "ET TROJAN ELF/TooEasy Miner CnC Checkin"

• "ET TROJAN Suspicious User-Agent - Matcash related Trojan Downloader (Ismazo Advanced Loader)"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M20"

• "ET MOBILE_MALWARE Android/Koler.C Checkin"

• "ET TROJAN TinyLoader.B2 Checkin x64"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Suspicious User Agent EXE2"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET CURRENT_EVENTS Possible Phishing Landing Page 2021-05-24"

• "ET CURRENT_EVENTS Successful CenturyLink Phish 2016-10-12"

• "ET MOBILE_MALWARE Android APT-C-23 (matthew-stevens .club in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Adobe Phish 2016-04-29"

• "ET TROJAN Sofacy DNS Lookup adobeincorp.com"

• "ET TROJAN CASHY200 CnC Domain in DNS Lookup"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (azureonlinestorage .com)"

• "ET CURRENT_EVENTS Successful Outlook Webmail Account Phish 2015-09-02"

• "ET TROJAN Win32/BlackNET CnC Checkin"

• "ET TROJAN Observed DarkGate Domain (zochao .com in TLS SNI)"

• "ET USER_AGENTS Suspicious User-Agent (Fire-Cloud)"

• "ET TROJAN SQUIRRELWAFFLE Server Response"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (forumsecrets .com)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN XCodeGhost DNS Lookup"

• "ET TROJAN Secure-Soft.Stealer Checkin"

• "ET MOBILE_MALWARE Android/Locker.B Checkin 1"

• "ET TROJAN x0Proto Client Info"

• "ET TROJAN Trojan.Verblecon Related Domain in DNS Lookup (jonathanhardwick .me)"

• "ET CURRENT_EVENTS Common Form POST - Chase Phishing Landing 2020-06-11"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/TrickBot Anchor Variant Style External IP Check"

• "ET CURRENT_EVENTS Successful Bank of America Phish 2015-11-06"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-endpoint .xyz)"

• "ET CURRENT_EVENTS Terror EK Payload Download M1 Mar 14 2017"

• "ET TROJAN Likely MAGICHOUND.FETCH Receiving PowerSploit PowerShell over HTTP"

• "ET TROJAN Cobalt Strike Malleable C2 (jquery Profile)"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Spy.Mekotio.EY Payload Request"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (circuspride .org)"

• "ET POLICY W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Initial Connection Server Response"

• "ET TROJAN Win32/Neutrino ping"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN APT 41 CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Bank of Scotland Phish M1 2015-11-05"

• "ET TROJAN ELF/Emptiness v1 HTTP Flood Command Inbound"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor PUTFILE Command (Inbound)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 77"

• "ET TROJAN Win32/DarkWatchman Activity (POST)"

• "ET TROJAN Gamarue/Andromeda Downloading Payload"

• "ET TROJAN Win32/PSW.LdPinch CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (CopperStealer CnC)"

• "ET MOBILE_MALWARE Android APT-C-23 (android-settings .info in DNS Lookup)"

• "ET TROJAN Win32/CryptInject.BE!MTB Stealer CnC Checkin"

• "ET CURRENT_EVENTS Outlook Web App Phishing Landing on Appspot Hosting"

• "ET TROJAN Fareit/Pony Downloader Checkin 3"

• "ET TROJAN Spora Ransomware DNS Query"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 11 CnC)"

• "ET WEB_SERVER SUSPICIOUS Possible WebShell Login Form (Outbound)"

• "ET INFO Possible Phishing Landing via MoonFruit.com M1 2016-01-22"

• "ET TROJAN Win32/RootTeam Stealer CnC Exfil M2"

• "ET MOBILE_MALWARE Android.Stealthgenie Checkin"

• "ET MALWARE WiseCleaner Installed (PUA)"

• "ET MOBILE_MALWARE Android APT-C-23 (caroline-nina .com in TLS SNI)"

• "ET TROJAN W32/StartPage.eba Dropper Checkin"

• "ET TROJAN Win32/Jackpot Ransomware CnC Checkin"

• "ET TROJAN Possible DarkFinger Payload Retrieval Attempt - nc10"

• "ET USER_AGENTS Suspicious User-Agent (InfoBot)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M8"

• "ET CURRENT_EVENTS Nourblog1 Phish Kit"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Evil Eye Android Malware Beacon"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Rootkit TDSS/Alureon Checkin 2"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor.Win32.RShot Checkin"

• "ET CURRENT_EVENTS Ankarex Smishing as a Service Domain in DNS Lookup (ankarex .net)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (checkauj .com)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-chat .com)"

• "ET TROJAN AppleJeus - JMT Trading CnC Activity (OSX Variant)"

• "ET INFO Phishing Landing via Weebly.com M3 2016-02-02"

• "ET TROJAN DNS Query to Raspberry Robin Domain (vqdn .net)"

• "ET TROJAN W32/Numnet.Downloader CnC Checkin 1"

• "ET MOBILE_MALWARE Android APT-C-23 (accountforuser .website in TLS SNI)"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (1kmtet1wyig94bxbcke45nivfx1w3m3hth .com)"

• "ET TROJAN Andromeda Check-in Response"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (thebestthings1337 .online)"

• "ET CURRENT_EVENTS Possible Pony DLL Download"

• "ET CURRENT_EVENTS HiYu - Request for Victim Enrichment"

• "ET TROJAN Ponmocup Post Infection DNS Lookup intohave"

• "ET CURRENT_EVENTS Ferest Smuggler Request M2"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (downloadtesting .com)"

• "ET TROJAN GoBrut/StealthWorker Requesting Brute Force List (flowbit set)"

• "ET MOBILE_MALWARE Android APT-C-23 (kaniel-outis .info in TLS SNI)"

• "ET USER_AGENTS suspicious user agent string (changhuatong)"

• "ET CURRENT_EVENTS Email Account Exceeded Quota Phishing Landing 2016-07-11"

• "ET MALWARE Observed Seetrol RAT Domain (seetrol .com in TLS SNI)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (project2anub .xyz in DNS Lookup)"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Email System Manager Phishing Landing 2016-04-12"

• "ET TROJAN W32.FakeEzQ.kr Checkin"

• "ET MALWARE Optimum Installer User-Agent IE6 on Windows XP"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (n2care .cc)"

• "ET MALWARE Grandstreet Interactive Spyware User-Agent (IEP)"

• "ET TROJAN RCtrl Backdoor CnC Checkin M1"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit MITM)"

• "ET TROJAN Win32/Vermilion Stager Activity (GET)"

• "ET CURRENT_EVENTS Windows Settings Phishing Landing Jul 22 2016"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS T-Mobile Phishing Landing"

• "ET TROJAN Win32/Unknown Stealer CnC Exfil via Telegram M1"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET TROJAN ProxyBox - ProxyBotCommand - I_AM"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (mohregov-ae .com) 2022-12-05"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2015-11-17"

• "ET TROJAN PowerTrick Task Checkin M2"

• "ET TROJAN Observed Buran Ransomware UA"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Gh0st RAT Backdoor Checkin"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Stager]"

• "ET MALWARE Win32/InstallCore.GF CnC Activity"

• "ET TROJAN Predator Logger Sending Data over SMTP"

• "ET TROJAN TA444 Related Domain in DNS Lookup (documentworkspace .io)"

• "ET TROJAN Win32/ProtonBot Stealer Activity"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hscare .cc)"

• "ET WEB_CLIENT BottleEK Landing"

• "ET TROJAN Dirt Jumper/Russkill3 Checkin"

• "ET CURRENT_EVENTS KaiXin Exploit Kit Landing Page parseInt Javascript Replace"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Solar)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET MALWARE 180solutions (Zango) Spyware Local Stats Post"

• "ET MALWARE RogueAntiSpyware.AntiVirusPro Checkin"

• "ET TROJAN Observed TA471/UNC2589 Go Downloader User-Agent (-hobot-)"

• "ET TROJAN eCh0raix/QNAPCrypt CnC Activity - Done"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Volatile Cedar Win32.Explosive HTTP CnC Beacon 1"

• "ET TROJAN Arid Viper APT DNS Lookup (pstcmedia.com)"

• "ET TROJAN Observed DNS Query to Ursnif Domain (pinki .cyou)"

• "ET MOBILE_MALWARE Android APT-C-23 (nightchat .live in TLS SNI)"

• "ET MOBILE_MALWARE Android/Spy.Agent.ANA (secandroid .com in DNS Lookup)"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M5"

• "ET TROJAN Win32/Htbot.B Checkin"

• "ET TROJAN APT28/Sednit DNS Lookup (dailypoliticsnews .com)"

• "ET CURRENT_EVENTS W3LL STORE Phish Kit Landing Page 2023-05-02"

• "ET TROJAN BackSwap Trojan C2 Domain Observed (debasuin .nl in TLS SNI)"

• "ET TROJAN APT/Sidewinder CnC Domain in DNS Lookup (afcat .xyz)"

• "ET TROJAN PowerTrick download bot known key"

• "ET TROJAN Arid Viper APT Checkin 1"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M1"

• "ET USER_AGENTS Suspicious User-Agent (HttpDownload)"

• "ET TROJAN Trojan.Nurjax Checkin"

• "ET TROJAN W32/HelloBridge.Backdoor Register CnC Beacon"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (newwildtuna .top)"

• "ET USER_AGENTS Suspicious User-Agent (Installer)"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebookvideo .com in DNS Lookup)"

• "ET TROJAN Win32/a310Logger Clipboard Exfil via SMTP"

• "ET TROJAN PlugX variant"

• "ET MOBILE_MALWARE Android APT-C-23 (face-book-support .email in TLS SNI)"

• "ET TROJAN ActionLoader CnC Domain in DNS Lookup (xlssmooth .xyz)"

• "ET TROJAN ZStealer Admin Panel Inbound"

• "ET TROJAN Observed Karen Ransomware Domain (karen .h07 .wlh .io in TLS SNI)"

• "ET TROJAN SNIcat - Detected C2 Commands (SIZE)"

• "ET TROJAN Suspected Gamaredon Related Maldoc Activity M2"

• "ET TROJAN RevProxy Java Settings"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h .com)"

• "ET TROJAN Win32/Rodecap CnC Checkin"

• "ET TROJAN APT28/Sednit DNS Lookup (virusdefender .org)"

• "ET TROJAN Wintervivern Activity M5 (GET)"

• "ET TROJAN APT28/Sednit DNS Lookup (mscoresvw .com)"

• "ET TROJAN UAC-0114/Winter Vivern Redirect"

• "ET TROJAN CozyCar V2 CnC Beacon"

• "ET TROJAN CobianRAT Receiving Commands From CnC"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (en-za-wordpress .org)"

• "ET TROJAN BandarChor Ransomware Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (nt3 .xyz)"

• "ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M2"

• "ET TROJAN MSIL/Agent.BIC Variant CnC Checkin"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 1"

• "ET TROJAN Fake ChatGPT Domain in DNS Lookup (chat-gpt-online-pc .com)"

• "ET TROJAN Tibs/Harnig Downloader Activity"

• "ET TROJAN PingPull Related Activity (POST)"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-11-15"

• "ET TROJAN Possible Heliconia Noise Landing Page Response"

• "ET TROJAN Dridex CnC Request - Spam/Worm Component"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity Domain)"

• "ET TROJAN IMDDOS Botnet User-Agent i am ddos"

• "ET TROJAN Ransomware/Cerber Checkin M3 (8)"

• "ET TROJAN Possible UNC1878/FIN12 Cobalt Strike CnC SSL Cert Inbound (office)"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN Win32/SaintStealer CnC Response"

• "ET TROJAN Enigma Locker Checkin"

• "ET USER_AGENTS Observed Malicious VBS Related UA"

• "ET CURRENT_EVENTS CritXPack Landing Page"

• "ET TROJAN Observed FIN12 Related Domain (hdhuge .com in TLS SNI)"

• "ET CURRENT_EVENTS SunDown EK CVE-2016-0189 Sep 22 2016 (b643)"

• "ET TROJAN Win32/Emotet.C Checkin"

• "ET TROJAN RouteX CnC Domain (322ffbbc7c1b312c2f9d942f20422f8d .com) in DNS Lookup"

• "ET TROJAN Win32/Farfli.CUY KeepAlive M1"

• "ET CURRENT_EVENTS Successful SFR Account Phish 2015-09-01"

• "ET TROJAN US-CERT TA14-353A Wiper 2"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cdn-top .net)"

• "ET MALWARE MyGlobalSearch Spyware bar update"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Unkown exploit kit pdf download"

• "ET TROJAN Observed Awad Bot CnC Domain (hawad .000webhostapp .com in TLS SNI)"

• "ET TROJAN Cnzz.cn Related Dropper Checkin"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (lovers .semara .ru)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (followmeasap13 .top)"

• "ET CURRENT_EVENTS e-Orico Credential Phish Landing Page 2022-12-12"

• "ET TROJAN Win32/Agent.USB Variant CnC Activity"

• "ET MOBILE_MALWARE Android APT-C-23 (help-sec .club in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET TROJAN TickGroup Datper CnC Checkin M2"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (protect4juls .space in DNS Lookup)"

• "ET TROJAN Enfal CnC GET"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 7"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-blog .xyz)"

• "ET TROJAN MintStealer Discord Activity (GET)"

• "ET TROJAN WooSIP Downloader CnC WriteMetadataOnServer"

• "ET CURRENT_EVENTS Successful Survey Credential Phish M5 2022-04-04"

• "ET TROJAN W32.Berbew Check-in"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 19"

• "ET TROJAN Observed DNS Query to Ursnif Domain (tornton .xyz)"

• "ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v2"

• "ET CURRENT_EVENTS Successful Facebook Phish 2015-08-27"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (akademia-mil .space in TLS SNI)"

• "ET TROJAN Win32/Sisron/BackDoor.Cybergate.1 Checkin"

• "ET MALWARE DNS Query to Seetrol RAT Domain (seetrol .kr)"

• "ET TROJAN PowerTrick Known Key 1"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN VBS/Kimsuky.O Host Fingerprint Exfil"

• "ET EXPLOIT Possible Successful ETERNALROMANCE MS17-010 - Windows Executable Observed"

• "ET TROJAN Upatre External IP Check"

• "ET TROJAN NanoCore RAT CnC 23"

• "ET TROJAN APT Mustang Panda Payload - CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Phorpiex Botnet Downloader Activity (GET)"

• "ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 3"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (simsimsalabim .top)"

• "ET TROJAN Unknown DPRK Threat Actor Activity (GET)"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2020-02-21)"

• "ET CURRENT_EVENTS TA398 Phishing Kit URI Pattern M2"

• "ET CURRENT_EVENTS Successful Yahoo Password Strength Phish M1 2016-08-24"

• "ET TROJAN Ironhalo CnC Beacon"

• "ET MALWARE BetterInstaller"

• "ET CURRENT_EVENTS Outlook Phishing Landing 2020-10-23"

• "ET TROJAN TA455 CnC Domain in DNS Lookup"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET TROJAN Kimsuky KGH Backdoor CnC Activity"

• "ET CURRENT_EVENTS Possible Successful Ebay Phishing Domain Feb 02 2017"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful US Bank Phish 2016-06-09 M2"

• "ET TROJAN Unknown CN Related APT Activity (GET)"

• "ET MOBILE_MALWARE Android.YzhcSms CnC Keepalive Message"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-schnellvpn .xyz)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (printerupdates .online)"

• "ET TROJAN Pegasus Domain in DNS Lookup"

• "ET TROJAN TA505 P2P CnC Checkin"

• "ET TROJAN Observed Pegasus Domain (api1r3f4 .redirectweburl .com in TLS SNI)"

• "ET TROJAN BPFDoor V2 UDP Magic Packet Inbound"

• "ET POLICY My2022/Beijing2022 App (TLS SNI) 2"

• "ET TROJAN P2P Zeus or ZeroAccess Request To CnC"

• "ET USER_AGENTS Win32.OnLineGames User-Agent (BigFoot)"

• "ET TROJAN Observed Malicious SSL Cert (OceanLotus APT CnC)"

• "ET TROJAN Sn0wsLogger CnC Exfil M1"

• "ET TROJAN APT.Fwits CnC Beacon M1"

• "ET TROJAN Known Hostile Domain citi-bank.ru Lookup"

• "ET MALWARE Win32/LoadMoney Adware Activity"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2022-06-08"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (yourblogcenter .com)"

• "ET TROJAN Win32.Nitol.K Variant CnC"

• "ET TROJAN Cobalt Strike Infrastructure CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 8"

• "ET TROJAN CN Based APT Related Domain in DNS Lookup (sign .sanaqsign .org)"

• "ET MALWARE Lowercase mozilla/2.0 User-Agent Likely Malware"

• "ET POLICY W32/BitCoinMiner.MultiThreat Subscribe/Authorize Stratum Protocol Message"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (fxb .tw)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (cwgmanagementllc .com)"

• "ET CURRENT_EVENTS Generic Phish Landing Page (2023-10-26)"

• "ET TROJAN ZenRAT Request Module CnC Response"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to freescanonline .com"

• "ET CURRENT_EVENTS Successful Generic Phish 2018-06-27 (set)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (i49 .xyz)"

• "ET TROJAN [PTsecurity] Possible Cobalt Strike payload"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1qp2we64k79237y0npqehprfgynlz02fwpktlwte .com in TLS SNI)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M6"

• "ET TROJAN Observed DNS Query to TA444 Domain (mizuhogroup .us)"

• "ET TROJAN Maldoc Sending Registration Information (GET)"

• "ET TROJAN IIS-Raid Module Backdoor - INJ Command in HTTP Request"

• "ET TROJAN Win32/Farfli.CUY KeepAlive M2"

• "ET TROJAN DNSBin Demo - Data Inbound"

• "ET TROJAN ChromeLoader CnC Checkin M2"

• "ET WEB_CLIENT Fake AV Phone Scam Landing Feb 12"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (minutozhart .online)"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity Domain)"

• "ET TROJAN PS/SunCrypt Ransomware CnC Activity"

• "ET TROJAN Win32/TrickBot CnC Initial Checkin M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Google Drive Phish M1 2016-09-01"

• "ET TROJAN Observed Operation Silent Watch Domain in DNS Lookup (filecloudservices .xyz)"

• "ET TROJAN Gamaredon/Armageddon CnC Activity (Sending Windows System Information)"

• "ET TROJAN Win32/PSW.Papras.CK file upload"

• "ET TROJAN Arid Viper APT Related Domain in DNS Lookup (cooperron .me)"

• "ET TROJAN CozyDuke APT Possible SSL Cert 5"

• "ET CURRENT_EVENTS Dropbox Phishing Landing May 31 2017"

• "ET TROJAN Fodcha Bot CnC Heartbeat Response"

• "ET TROJAN Sidecopy APT Backdoor Related Domain in DNS Lookup (kokotech .xyz)"

• "ET TROJAN Observed Malicious Domain (drive-google-com .tk in TLS SNI)"

• "ET TROJAN Glupteba CnC Observed in DNS Query"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M2"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .serveirc .com)"

• "ET TROJAN Possible CopyKitten DNS Lookup (owa-microsoft .online)"

• "ET TROJAN OSX/OceanLotus.D Requesting Commands from CnC"

• "ET MALWARE CommonName.com Spyware/Adware User-Agent (CommonName Agent)"

• "ET TROJAN APT32 Komprogo DNS Lookup"

• "ET TROJAN Observed TA444 Domain (team .msteam .biz in TLS SNI)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (youcanfindmeonthe .top)"

• "ET MOBILE_MALWARE Android APT-C-23 (lindamullins .info in TLS SNI)"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET MALWARE User-Agent (Save)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-06-14"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server)"

• "ET TROJAN OSX/AlienSpy RAT Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Elysium Stealer Domain (phonefix .bar in TLS SNI)"

• "ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound"

• "ET TROJAN DCRAT Checkin via Telegram"

• "ET TROJAN Win32/Necurs"

• "ET TROJAN FastPOS Reporting Error Code"

• "ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2"

• "ET MOBILE_MALWARE Android APT-C-23 (italk-chat .com in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (margaery-tyrell .info in TLS SNI)"

• "ET MOBILE_MALWARE Android PHONEMONITOR RAT CnC (getsettings)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (weryfikacja-konta .space in TLS SNI)"

• "ET TROJAN x0Proto Init"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (oob .li)"

• "ET TROJAN Phorpiex Botnet Downloader Activity (GET)"

• "ET TROJAN CommentCrew Possible APT c2 communications sleep2"

• "ET TROJAN Win32/SaintStealer Data Exfiltration Attempt M1"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET CURRENT_EVENTS Successful Office 365 Phish 2016-11-18"

• "ET TROJAN Win32/TrojanDownloader.Small.AWO CnC Activity"

• "ET TROJAN Win32.ServStart.D Checkin"

• "ET CURRENT_EVENTS Successful Metamask Pass Phrase Phish 2023-02-01"

• "ET TROJAN Win32/nstealer CnC Exfiltration (POST) M2"

• "ET TROJAN TA444 Domain in DNS Lookup (document .shared-link .line .pm)"

• "ET TROJAN SideCopy APT Related CnC Response"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M4"

• "ET TROJAN Win32/RecordBreaker - Observed UA M4 (20112211)"

• "ET TROJAN MSIL/Agent.TRM Checkin Response"

• "ET CURRENT_EVENTS Observed TOAD Domain (bshelp .info in TLS SNI)"

• "ET TROJAN MICROPSIA CnC Domain Observed in SNI (samwinchester .club)"

• "ET TROJAN Win32/Stealerium Stealer Checkin via Discord"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bghelp .online)"

• "ET TROJAN Parite Setup Connection (tqzn.com related)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2018-05-31"

• "ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)"

• "ET TROJAN Backdoor.Win32.Xtrat Checkin 2"

• "ET TROJAN Mini/Cosmic Duke variant FTP upload"

• "ET TROJAN Sofacy DNS Lookup symanttec.org"

• "ET TROJAN BePush/Kilim payload retrieval"

• "ET USER_AGENTS Suspicious User-Agent (HELLO)"

• "ET TROJAN Ursnif Payload Request (grab32.rar)"

• "ET TROJAN Trojan.Dirtjump Checkin"

• "ET CURRENT_EVENTS Interac (CA) Account Credential Phish Landing Page 2022-09-30"

• "ET TROJAN Win32/TrojanProxy.JpiProx.B CnC Beacon 1"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (skrgerona .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DNS Reply Sinkhole - Microsoft - 199.2.137.0/24"

• "ET TROJAN Arid Viper APT Possible User-Agent (SK)"

• "ET MOBILE_MALWARE Android APT-C-23 (miwakosato .club in TLS SNI)"

• "ET POLICY My2022/Beijing2022 App (TLS SNI) 1"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (genericalphabet .top in TLS SNI)"

• "ET TROJAN DNS Possible User trying to visit POSHCODER.A .onion link outside of torbrowser"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed CobaltStrike/TEARDROP CnC Domain Domain in TLS SNI (mobilnweb .com)"

• "ET TROJAN Python/PBot Browser Hijacker Activity"

• "ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup"

• "ET MALWARE CWS Trafcool.biz Related Installer"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M1"

• "ET TROJAN Generic Request to gate.php Dotted-Quad"

• "ET TROJAN Possible Win32/Travnet.A Internet Connection Check (microsoft.com)"

• "ET TROJAN SNIcat - Detected C2 Commands (ALIVE)"

• "ET TROJAN Unknown Powershell Profiler Exfiltrating System Data"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Orange Credential Phish 2022-07-07"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (metasupport .com)"

• "ET TROJAN Netbounce User-Agent (Netbounce)"

• "ET TROJAN SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Activity (Upload)"

• "ET CURRENT_EVENTS Base64 http argument in applet (Neutrino/Angler)"

• "ET TROJAN APT10 Related Domain in DNS Lookup (7cnbo .com)"

• "ET TROJAN Smoke Loader Checkin r=gate"

• "ET USER_AGENTS Aria2 User-Agent"

• "ET TROJAN KeyLogger related to FindPOS CnC Beacon"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET TROJAN NewsPenguin Domain in DNS Lookup (windowsupdates .shop)"

• "ET CURRENT_EVENTS Successful Credit Agricole Bank (FR) Phish M1 2016-10-19"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (SilentLibrarian)"

• "ET TROJAN MICROPSIA Screenshot Upload M2"

• "ET TROJAN Observed Glupteba CnC Domain (biggames .online in TLS SNI)"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M3"

• "ET TROJAN DNS Query to Raspberry Robin Domain (r6 .nz)"

• "ET TROJAN Observed DNS Query to LIGHTSHOW Domain (doug .org)"

• "ET TROJAN OLDBAIT Checkin sptr"

• "ET TROJAN DNS Query to MINEBRIDGE CnC Domain (fatoftheland .top)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .lushespets .com)"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (coupang-networks .pics)"

• "ET TROJAN Observed Glupteba CnC Domain in TLS SNI"

• "ET TROJAN DeathStalker/PowerPepper CnC Domain in DNS Lookup (allmedicalpro .com)"

• "ET TROJAN APT32 CnC in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (ShadowHammer CnC)"

• "ET TROJAN Ddex Loader Check-in"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN Crashedtech Loader CnC Checkin"

• "ET TROJAN Observed DNS Query to Ursnif SAIGON Variant CnC Domain"

• "ET TROJAN NgrBot IRC CnC Channel Join"

• "ET TROJAN BlackTech/PLEAD TSCookie CnC Checkin M2"

• "ET MOBILE_MALWARE NSO Group Domain in DNS Lookup (urlpush .net)"

• "ET TROJAN GCleaner CnC Checkin M2"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (scott-chapin .com in TLS SNI)"

• "ET TROJAN Troxen Downloader Checkin"

• "ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS PerlBot Version Message"

• "ET MOBILE_MALWARE Android APT-C-23 (leslie-barnes .website in TLS SNI)"

• "ET TROJAN [PTsecurity] Kuriyama Loader Checkin"

• "ET TROJAN Lost Door Checkin"

• "ET MALWARE Win32/OutBrowse.G Variant Checkin"

• "ET TROJAN ChaseBot CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bscare .help)"

• "ET TROJAN Grandoreiro Banking Trojan DGA Domain in DNS Lookup (freedynamicdns. org)"

• "ET TROJAN Win32/Remcos RAT Checkin 57"

• "ET TROJAN IoT_reaper DNS Lookup M6 (bbk86 .com)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (longlakeweb .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (daydayvin .xyz)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bgcare .info)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 5"

• "ET TROJAN [ANY.RUN] Win32/RootTeam Stealer Related User-Agent"

• "ET CURRENT_EVENTS Successful Adobe Phish 2016-07-21"

• "ET TROJAN TA444 Related Domain in DNS Lookup (googlesheet .info)"

• "ET TROJAN NORTHSTAR Interactive Client CnC"

• "ET EXPLOIT Remote Command Execution via Android Debug Bridge 2"

• "ET CURRENT_EVENTS Successful Impots.gouv.fr Phish 2016-10-31"

• "ET CURRENT_EVENTS Successful WhatsApp Phish M1 2016-12-07"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 15"

• "ET TROJAN Win32.Shiz.fxm/Agent-TBT Checkin"

• "ET TROJAN Deathstalker/Evilnum Delivery Domain (storangefilecloud .vip) in TLS SNI"

• "ET TROJAN Win32/Unk HeavensGate Loader CnC in DNS Lookup"

• "ET CURRENT_EVENTS Generic Phishing Landing 2018-01-12"

• "ET TROJAN W32.Daws/Sanny CnC Initial Beacon"

• "ET USER_AGENTS Suspicious User-Agent - Possible Trojan Downloader (https)"

• "ET CURRENT_EVENTS Successful Telstra Phish M2 2015-09-05"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (annafraudy .top in TLS SNI)"

• "ET INFO Possible Successful Hostinger Generic Phish Jun 09 2017"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (oceansurvey .club)"

• "ET TROJAN SocGholish Domain in DNS Lookup (artwork .siddavisart .com)"

• "ET WEB_CLIENT Common Paypal Phishing URI Feb 24 2017"

• "ET CURRENT_EVENTS RIG Exploit URI Struct March 20 2015"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-endpoint .xyz)"

• "ET TROJAN Papras Banking Trojan Checkin"

• "ET TROJAN MS Office Macro Dridex Download URI Jan 7 2015"

• "ET TROJAN Buer Loader Successful Payload Download"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN MSIL/MosaiqueRAT CnC Checkin"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server]"

• "ET TROJAN WRAT Dropper (TLS SNI)"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (protectionguardapp .club in DNS Lookup)"

• "ET TROJAN MSIL/G1 Stealer/GravityRAT Uploading File"

• "ET MOBILE_MALWARE Android APT-C-23 (ezofiezo .website in DNS Lookup)"

• "ET TROJAN DNS Query to IcedID Domain (simipimi .com)"

• "ET CURRENT_EVENTS RIG EK encrypted payload Sept 11 (1)"

• "ET CURRENT_EVENTS Crypto Credential Phish Landing Page 2023-04-17"

• "ET TROJAN Andromeda Checkin Dec 29 2014"

• "ET MOBILE_MALWARE Android/Gigabud CnC Domain (cmnb9 .cc) in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Win32/Adware.Winggo.AB Checkin"

• "ET CURRENT_EVENTS Successful Generic Credential OTP Phish 2022-11-22"

• "ET TROJAN W32/Citadel Conf.bin Download From CnC Server"

• "ET TROJAN APT/Bitter Related Checkin Activity (GET)"

• "ET TROJAN SteamStealer DNS Lookup (steamdesktopauthenticator)"

• "ET TROJAN Kraken Stealer SMTP Data Exfiltration Attempt"

• "ET TROJAN ProjectSauron Remsec/HTTPBrowser/Pisloader Covert DNS CnC Channel TXT Lookup"

• "ET TROJAN DNS Query to TA444 Domain (systemupdate .site)"

• "ET MALWARE VilnyNet VPN Install Started"

• "ET TROJAN Andariel Backdoor Actvity (Response)"

• "ET CURRENT_EVENTS DRIVEBY SPL - Java Exploit Requested - /spl_data/"

• "ET TROJAN TA444 Domain in TLS SNI (doc .global-link .run .place)"

• "ET TROJAN Dalexis Downloading EXE"

• "ET WEB_CLIENT Tech Support Scam 2019-11-14"

• "ET MOBILE_MALWARE Android APT-C-23 (juana .fun in DNS Lookup)"

• "ET CURRENT_EVENTS Unknown EK Landing (Payload Downloaded Via Dropbox)"

• "ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 1"

• "ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 30 M2"

• "ET CURRENT_EVENTS Observed TOAD Domain (b2care .us in TLS SNI)"

• "ET TROJAN Possible Asprox Pizza"

• "ET TROJAN Win32/SystemBC CnC Checkin (null key) M2"

• "ET MALWARE MacOS/OnlineAppNotice Activity"

• "ET TROJAN ServHelper CnC Domain"

• "ET TROJAN Glupteba CnC Observed in DNS Query"

• "ET CURRENT_EVENTS Fiesta EK SilverLight Exploit Apr 23 2015"

• "ET TROJAN Ransomware/Cerber Checkin M3 (9)"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (bandtester .com)"

• "ET TROJAN Observed Certificate Base64 Encoded Executable Inbound"

• "ET TROJAN NanoCore RAT CnC 24"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0j .wf)"

• "ET TROJAN Arid Viper APT Transmitting Date"

• "ET TROJAN Observed BatLoader Domain (t1pixel .com) in TLS SNI"

• "ET TROJAN Possible malicious Office doc hidden in XML file"

• "ET TROJAN ASNAROK CnC Domain in DNS Lookup"

• "ET MALWARE PUP W32/DownloadGuide.D"

• "ET TROJAN MSIL/NxRansomware C2 Domain Detected (0cf5ff34 .ngrok .io in DNS Lookup)"

• "ET TROJAN Win32/Emotet HTML Template Response"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)"

• "ET TROJAN Vawtrak/NeverQuest Posting Data"

• "ET TROJAN Suspected Tick Group APT Related Activity (GET)"

• "ET CURRENT_EVENTS AlaskaUSA FCU Phish 2022-07-24"

• "ET CURRENT_EVENTS Canada Revenue Agency COVID-19 Assistance Eligibility Phishing Landing 2020-04-01"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-06-29"

• "ET TROJAN Cyborg Ransomware - Downloading Desktop Background"

• "ET CURRENT_EVENTS UK GOV Identity Verification Phishing Landing"

• "ET TROJAN Avzhan DDOS Bot Outbound Hardcoded Malformed GET Request Denial Of Service Attack Detected"

• "ET TROJAN Turkojan C&C Initial Checkin (ams)"

• "ET CURRENT_EVENTS Observed Malicious SSL Cert (Office365 Phish Landing Page 2020-01-09)"

• "ET TROJAN Stealth Soldier Backdoor Related Activity M1 (POST)"

• "ET CURRENT_EVENTS American Express Phishing Landing"

• "ET TROJAN APT28/Sednit DNS Lookup (politicsinform .com)"

• "ET TROJAN W32/Hupigon.B User Agent TSDownload"

• "ET TROJAN Dropper.Win32.Agent.ahju Checkin"

• "ET TROJAN JST Perl IrcBot download"

• "ET TROJAN Hades APT Domain in DNS Lookup (findupdatems .com)"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET EXPLOIT Possible Microsoft Edge Chakra.dll Type Confusion (CVE-2016-7200 CVE-2016-7201) B641"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1k4 .xyz)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to thedoccloud .com"

• "ET TROJAN ReverseRAT Activity (POST) M2"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (nikanpsx .hopto .org)"

• "ET CURRENT_EVENTS Successful Chase Phish M2 2016-12-07"

• "ET TROJAN MirrorBlast KiXtart Downloader Server Response"

• "ET TROJAN FIN7/Carbanak CnC Domain in DNS Lookup (sephardimension .com)"

• "ET TROJAN AlinaPOS Exfiltration via DNS"

• "ET TROJAN StrongPity APT Related Domain in DNS Lookup (sessionprotocol .com)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M22"

• "ET CURRENT_EVENTS Apple Phishing Landing M3 Sep 14 2017"

• "ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain"

• "ET CURRENT_EVENTS Successful Yahoo Phish M1 2016-09-08"

• "ET TROJAN Possible CopyKitten DNS Lookup (alkamaihd .net)"

• "ET TROJAN DNS Query to Fake Chrome Landing Page (chromiumlink .site)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (ahaliahospitalae .com) 2022-12-05"

• "ET TELNET Teslarvng Ransomware CnC Activity M2"

• "ET TROJAN DATA-BROKER BOT Activity"

• "ET TROJAN CenterPOS Delete Plugins"

• "ET TROJAN Aurora Stealer Admin Console In HTTP Response"

• "ET TROJAN Diavol Communicating with CnC - Ignore Request"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (8t .wf)"

• "ET TROJAN Cobalt Strike Domain (fepopeguc .com) in TLS SNI"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-01-27"

• "ET TROJAN Observed Teal Kurma Domain (ybcd .tech in TLS SNI)"

• "ET TROJAN Emotet CnC Beacon"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (300005 .ru)"

• "ET MOBILE_MALWARE Android.Trojan.SMSSend.Y"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET TROJAN Win32/Steallerium Stealer Data Exfil via Telegram (POST)"

• "ET TROJAN DeimosC2 TCP Agent Heartbeat"

• "ET CURRENT_EVENTS SUSPICIOUS Crystalize Filter in Uncompressed Flash"

• "ET WEB_SERVER HTTP POST Generic eval of base64_decode"

• "ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010"

• "ET TROJAN Banload HTTP Checkin"

• "ET TROJAN Observed sLoad Related Domain (angedionisu .eu in TLS SNI)"

• "ET TROJAN GoLang Discord Token Grabber Exfil"

• "ET TROJAN CryptoWall Check-in"

• "ET CURRENT_EVENTS Fake Update/Installer ForceDL Template Nov 03 2017"

• "ET TROJAN Win32/Tobfy.S"

• "ET CURRENT_EVENTS Successful Bank of America Phish M1 2016-11-23"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (avroralikhaem .com)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (meetcentralhub .online)"

• "ET MOBILE_MALWARE Android APT-C-23 (miranda-barlow .website in TLS SNI)"

• "ET TROJAN Observed Gamaredon Domain (opela .ru in TLS SNI)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.DNS.BEACON.[CSBundle DNS]"

• "ET P2P zzima_loader"

• "ET MOBILE_MALWARE NSO Pegasus iOS Megalodon Activity (GET)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (gz .qa)"

• "ET TROJAN Godlua Backdoor Stage-3 Client Heartbeat (Dec 2019- Jul 2020) (set)"

• "ET MOBILE_MALWARE Android APT-C-23 (accountforusers .website in TLS SNI)"

• "ET TROJAN Observed Malicious Domain Targeting Minority Groups Domain (unohcr .org in TLS SNI)"

• "ET CURRENT_EVENTS Successful IRS Phish 2016-01-23"

• "ET MOBILE_MALWARE Android Malvertising Communication"

• "ET TROJAN Suspected TA430/Andariel CollectionRAT Related Activity (GET)"

• "ET CURRENT_EVENTS Successful Amazon Account Phish 2015-08-21"

• "ET MALWARE Suspicious User-Agent (lineguide)"

• "ET TROJAN Observed DNS Query to RisePro Domain (greatsofteasy .com)"

• "ET TROJAN Possible CopyKitten DNS Lookup (azurewebsites .tech)"

• "ET MOBILE_MALWARE ANDROIDOS_LEAKERLOCKER.HRX DNS Lookup"

• "ET TROJAN Possible PrivateLoader Payload Request (GET)"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET TROJAN MAGICHOUND.MPK Activity via IRC"

• "ET TROJAN CMDEmber Backdoor Style Request"

• "ET CURRENT_EVENTS Sibhost/FlimKit/Glazunov Jar with lowercase class names"

• "ET TROJAN Hakbit/Thanos Ransomware BMP Download"

• "ET WEB_SERVER WebShell Generic eval of convert_uudecode"

• "ET TROJAN OSX/OceanLotus.D CnC DNS Lookup (widget .shoreoa .com)"

• "ET TROJAN Pult Downloader Activity"

• "ET TROJAN Various Malicious AlphaNum DL Feb 10 2016"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE NSO Related Domain 19"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (paf-gov .net)"

• "ET TROJAN Limitless Logger Sending Data over SMTP"

• "ET CURRENT_EVENTS INTERAC Payment Multibank Phishing Landing Mar 14 2017"

• "ET MOBILE_MALWARE Android APT-C-23 (oriential .website in DNS Lookup)"

• "ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC Open Ports Message"

• "ET TROJAN Observed Malicious FIN12 Related SSL Cert (serviceswork .net)"

• "ET MALWARE User-Agent (Mozilla/4.0 (SP3 WINLD))"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET TROJAN Windows WMIC NETLOGIN get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN SuperCMD CnC Beacon"

• "ET TROJAN Observed DNS Query to RisePro Domain (vip-space .com)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Generic Phish (set) Aug 21 2017"

• "ET TROJAN Parallax CnC Response Activity M15"

• "ET TROJAN Observed DNS Query to RisePro Domain (pin-files .com)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Malicious SSL Cert (Magecart)"

• "ET MALWARE User-Agent (Internet)"

• "ET MALWARE Casino on Net Reporting Data"

• "ET TROJAN Manjusaka C2 Heartbeat Response"

• "ET EXPLOIT [ConnectWise CRU] Java ECDSA (Psychic) TLS Signature (CVE-2022-21449)"

• "ET TROJAN [GIGAMON_ATR] FIN8 BADHATCH CnC Checkin"

• "ET CURRENT_EVENTS Observed TOAD Domain (r2care .us in TLS SNI)"

• "ET TROJAN Unk.VBSLoader Retrieving Payload"

• "ET TROJAN ErbiumStealer CnC Domain (mamamiya137 .ru) in DNS Lookup"

• "ET CURRENT_EVENTS Email Settings Error Phishing Landing Nov 16 2016"

• "ET TROJAN Observed DNS Query to UNC3890 Domain (office365update .live)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected"

• "ET TROJAN Grandoreiro CnC Activity (vbs)"

• "ET TROJAN Observed IcedID Domain (ultrafoks .com in TLS SNI)"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (1kmtet1wyig94bxbcke45nivfx1w3m3hth .com in TLS SNI)"

• "ET TROJAN DNS Query to Teal Kurma Domain (alhurra .online)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (s0 .pm)"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Plead TSCookie CnC Checkin M3"

• "ET TROJAN MSSQL maggie backdoor sp_addextendedproc Command Observed"

• "ET USER_AGENTS Suspicious User-Agent (winlogon)"

• "ET TROJAN Arid Viper APT Advtravel Campaign DNS Lookup (linksis.info)"

• "ET TROJAN DNS Query to IcedID Domain (manjuskploman .com)"

• "ET TROJAN Prometei Botnet CnC DGA - xinchao Pattern"

• "ET TROJAN Win32/Agent.TWI CnC Checkin"

• "ET TROJAN Suspected ToddyCat APT Curlu Related Activity M1"

• "ET TROJAN Possible Covenant Framework Grunt Stager HTTP Download (DynamicInvoke)"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (ysl .jxwan .com)"

• "ET CURRENT_EVENTS Successful Phish Fake Document Loading Error 2015-07-27"

• "ET TROJAN W32/CoinMiner.ESJ!tr CnC Domain (aj .0x0x0x0x0 .best) in DNS Lookup"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-chat .xyz)"

• "ET TROJAN Kronos Checkin"

• "ET MOBILE_MALWARE Arid Viper (calculator-1e016 .firebaseio .com in DNS Lookup)"

• "ET CURRENT_EVENTS W3LL STORE Credential Phish Landing Page 2023-04-25"

• "ET TROJAN Win32/MataDoor CnC Beacon Over UDP"

• "ET CURRENT_EVENTS Successful Generic Phish - JS Redirect to PDF 2016-08-24"

• "ET WEB_SERVER WebShell Generic eval of gzinflate"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (mamount .cyou)"

• "ET WEB_CLIENT Tech Support Phone Scam Landing 2016-07-21 M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Malicious Dropper Activity (GET)"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M11"

• "ET TROJAN Win32/RecordBreaker - Observed UA M5 (23591)"

• "ET TROJAN Possible CopyKitten DNS Lookup (microsoft-security .host)"

• "ET TROJAN Red Wolf/RedCurl Domain in DNS Lookup (servicehost .click)"

• "ET TROJAN MSIL/Crimson Receiving Command (dirs list)"

• "ET TROJAN DNS Query to TA444 Domain (cryptyk .cloud)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (walidacja-poczty .space)"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Py/Beapy CnC Checkin"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M17"

• "ET TROJAN Antinum WebSockets Start"

• "ET TROJAN Pyramid Framework Payload Request (base-tunnel-socks5.py)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (kontrola-poczty .space)"

• "ET TROJAN Covenant Framework HTTP Hello World Server Response"

• "ET TROJAN Jasper URI Path Observed M1"

• "ET EXPLOIT D-Link Remote Code Execution Attempt (CVE-2022-28958)"

• "ET TROJAN Koobface C&C availability check"

• "ET TROJAN TrochilusRAT DNS Lookup (security-centers.com)"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET TROJAN Observed JS/Skimmer (likely Magecart) CnC Domain in DNS Lookup"

• "ET TROJAN Book of Eli CnC Checkin"

• "ET TROJAN Sidecopy APT Related CnC Domain in DNS Lookup (afrepublic .xyz)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-12-24 M1"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (manchestercity .work .gd)"

• "ET MALWARE Bypass Ticket Monitoring Domain in DNS Lookup (www .bypass .cn)"

• "ET CURRENT_EVENTS Possible Successful Chase Phish Feb 02 2017"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN DOC/TrojanDownloader.Agent.ARJ Payload Request"

• "ET TROJAN WARP Win32/Barkiofork.A"

• "ET TROJAN Observed Malicious SSL Cert (PhantomNet/Smanager CnC)"

• "ET TROJAN Backdoor.Elise CnC Beacon 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M11"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC ConfigSyncProc RCE Attempt"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/FunnyDream Backdoor Related Domain in DNS Lookup (www .weekendorg .com)"

• "ET CURRENT_EVENTS Successful Yahoo Credential Phish 2015-10-03"

• "ET TROJAN TA444 Related Activity (POST)"

• "ET CURRENT_EVENTS Successful Earthlink Phish 2016-10-21"

• "ET MALWARE Bestoffersnetwork.com Related Spyware User-Agent (TBONAS)"

• "ET TROJAN Trickbot/Anchor ICMP Request"

• "ET MOBILE_MALWARE Android/Ozotshielder.A Checkin"

• "ET TROJAN W32/GameThief Initial CnC Beacon"

• "ET CURRENT_EVENTS Possible Successful Google Drive Phishing Domain Feb 02 2017"

• "ET CURRENT_EVENTS Observed TOAD Domain (c2care .cc in TLS SNI)"

• "ET TROJAN Win32/NetDooka Framework RAT Sending Session ID"

• "ET TROJAN TA402/Molerats Pierogi CnC Response (Download)"

• "ET TROJAN Observed Malicious Domain Targeting Minority Groups (tcahf .org in TLS SNI)"

• "ET TROJAN Legion Loader Activity Observed (satan)"

• "ET TROJAN SideCopy APT Related Backdoor Command Inbound (getinfo)"

• "ET TROJAN Wintervivern Activity (GET)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN BKDR_BTMINE.MNR BitCoin Miner Retrieving Server IP Addresses"

• "ET TROJAN WORM_VOBFUS Checkin Generic"

• "ET TROJAN Possible Emotet DGA NXDOMAIN Responses"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup"

• "ET TROJAN LokiBot Screenshot Exfiltration Detected"

• "ET TROJAN Win32/Poweliks.A Checkin 2"

• "ET MALWARE Observed OSX/PremierOpinionD Collection Domain in TLS SNI"

• "ET TROJAN PoshC2 - Observed Default URI Structure M26"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (iugur .live)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN J-Spy JSP webshell request"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M7"

• "ET TROJAN DNS query for known Anunak APT Domain (adguard.name)"

• "ET TROJAN Observed Malicious SSL Cert (BitRAT CnC)"

• "ET TROJAN DNS Query to IcedID Domain (asleytomafa .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (lagertha-lothbrok .info in TLS SNI)"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Services Listing)"

• "ET MOBILE_MALWARE SMSSend Fake flappy bird APK"

• "ET CURRENT_EVENTS Chase Mobile Phishing Landing M2"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-06-13"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-blog .com)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (Jasper CnC)"

• "ET TROJAN EvilNum APT Related Domain in DNS Lookup (imageztun .com)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (mohsengo .shop)"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-08"

• "ET TROJAN W32/Ferret DDOS Bot CnC Beacon 2"

• "ET TROJAN JavaRAT Sending Screenshot"

• "ET TROJAN Mimikatz x86 Mimidrv.sys Download Over HTTP"

• "ET TROJAN r0 CnC Architecture GET 3"

• "ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M3 2023-02-22"

• "ET TROJAN Possible PlugX DNS Lookup (googlemanage.com)"

• "ET TROJAN Shamoon v3 32bit Propagating Internally via SMB"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (docsenddata .linkpc .net in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (david-moris .website in TLS SNI)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-schnellvpn .xyz)"

• "ET CURRENT_EVENTS USPS Phishing Landing 2016-02-10"

• "ET TROJAN DoS.Linux/Elknot.G Checkin"

• "ET TROJAN Cuba Ransomware Related Domain in DNS Lookup (masterofdigital .org)"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET TROJAN FIN7/Carbanak CnC Domain in DNS Lookup (sendbits .m2stor4ge .xyz)"

• "ET CURRENT_EVENTS NHS Gov UK COVID-19 Landing Page"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (fingerpin .cyou)"

• "ET TROJAN Fake Browser Update via Error Page Web Inject"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server]"

• "ET MOBILE_MALWARE Android APT-C-23 (ososezo .club in DNS Lookup)"

• "ET TROJAN Win32/MagicRAT Additional Payload URI M1"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN Sofacy DNS Lookup windows-updater.com"

• "ET TROJAN Shuckworm/Gamaredon CnC Domain (motoristo .ru) in DNS Lookup"

• "ET TROJAN Cobalt Strike CnC Domain in DNS Lookup (a .pwn-t .tk)"

• "ET TROJAN Galock Ransomware Check-in"

• "ET TROJAN W32/SchwSonne CnC Beacon M2"

• "ET TROJAN DNS Query to TA444 Domain (auditprovidre .site)"

• "ET CURRENT_EVENTS Microsoft Credential Phish 2022-03-14"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Stager 2]"

• "ET MOBILE_MALWARE Android/HippoSms Method Request to CnC"

• "ET TROJAN PowerShell Script Downloading Emotet DLL"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN Trojan-Dropper.Win32.StartPage.dvm or Mebromi Bios Rootkit CnC Count Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET MOBILE_MALWARE Android ERMAC Banker (PL) Related Domain in DNS Lookup (bolt-food .site)"

• "ET CURRENT_EVENTS Successful Generic Phish - Observed in Apple/Bank of America/Amazon 2016-10-26"

• "ET MALWARE Windows Explorer Tab Add-on Post Install Checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 95"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Keylogging)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (paradoxmarine .com)"

• "ET TROJAN Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern"

• "ET TROJAN Observed OSX/Silver Sparrow Download Domain in TLS SNI"

• "ET TROJAN NSO Group Pegasus CnC Domain Observed in DNS Query"

• "ET TROJAN r0 CnC Report POST"

• "ET TROJAN Possible CopyKittens DNS Lookup (patchthiswindows.com)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-04-17"

• "ET CURRENT_EVENTS Successful Facebook Phish M1 2016-09-30"

• "ET TROJAN Observed OSX/GMERA.A CnC Domain (appstockfolio .com in TLS SNI)"

• "ET TROJAN Windows quser Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5s .pm)"

• "ET TROJAN Delf Checkin via HTTP (5)"

• "ET TROJAN TA455 Related CnC Domain in DNS Lookup"

• "ET TROJAN Win32/TrojanDropper.Agent.RLO CnC Acitivty"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (surelytheme .org)"

• "ET TROJAN Possible Windows executable sent when remote host claims to send HTML/CSS Content"

• "ET CURRENT_EVENTS Successful Apple ID Phish M2 2016-10-04"

• "ET TROJAN Observed DangerousPassword APT Related Domain (cop .osonlines .co in TLS SNI)"

• "ET CURRENT_EVENTS Spelevo Download Payload Landing"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (dsk .5636 .com)"

• "ET CURRENT_EVENTS SunDown EK NOP Sled Sep 22 2016 (b643)"

• "ET TROJAN Observed StrongPity Domain (autoconfirmations .com in TLS SNI)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (disagreeable .ru)"

• "ET TROJAN Observed Cryptor Ransomware CnC Domain (e3kok4ekzalzapsf .onion .ws in TLS SNI)"

• "ET MALWARE W32/GameplayLabs.Adware Installer Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MiniDuke CnC Beacon (string2_slide_3_2)"

• "ET WEB_CLIENT Suspicious Byethost Phishing Redirect 2016-10-04"

• "ET TROJAN PureCrypter Requesting Injector - Known Campaign ID M4"

• "ET MALWARE Crackswin Downloader Activity"

• "ET TROJAN PoshC2 - Observed Default URI Structure M30"

• "ET TROJAN Downloader General Bot Checking In - Possible Win32.Small.htz related"

• "ET TROJAN Bebloh connectivity check"

• "ET TROJAN Possible Stitur Secondary Download"

• "ET CURRENT_EVENTS Generic Phishing Landing Hosted via Weebly"

• "ET TROJAN Shady RAT Send Status Result"

• "ET TROJAN Observed Malicious SSL Cert (Gozi CnC)"

• "ET TROJAN Sharik/Smoke Loader Receiving Payload"

• "ET MOBILE_MALWARE iOS/Xsser sending GPS info"

• "ET TROJAN TinyNuke VNC Checkin M3"

• "ET TROJAN Win32/SDBbot CnC Checkin"

• "ET TROJAN Amadey Bot Activity (POST) M1"

• "ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01 2016 (userdir dotted quad)"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET TROJAN Win32/SilentBreak Related Domain in DNS Lookup (eleed .online)"

• "ET TROJAN Cobalt Strike Malleable C2 (Unknown Profile)"

• "ET CURRENT_EVENTS Successful XBOOMBER Paypal Phish Nov 28 2016"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (tadernost .com)"

• "ET TROJAN DNS Query to Ursnif Domain (mifrutty .com)"

• "ET CURRENT_EVENTS Terror EK CVE-2016-0189 Exploit"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Steam_htmlcache.txt)"

• "ET CURRENT_EVENTS Bingo Exploit Kit Landing May 08 2017"

• "ET MALWARE Win32/GameHack.COG Variant CnC Activity"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M2"

• "ET CURRENT_EVENTS Possible Successful Linkedin Phishing Domain Feb 02 2017"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"

• "ET TROJAN Observed TA430/Andariel APT Related Domain (tech .micrsofts .com in TLS SNI)"

• "ET TROJAN Win32/Cutwail.BE Checkin 2"

• "ET TROJAN Win32/TrojanDownloader.Agent.GEM Maldoc Remote Template Request M1"

• "ET MALWARE Loadmoney.A Checkin 2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (z19 .ro)"

• "ET TROJAN FIN8 ShellTea CnC in DNS Lookup"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - Guest Account Creation - CVE-2023-34362 Stage 1a"

• "ET TROJAN W32/Ke3chang.Snake.APT Campaign CnC Beacon"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 Aug 14 2017"

• "ET TROJAN TA444 Domain in DNS Lookup (sharedrive .ink)"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET TROJAN Win32/Scarsi Variant CnC Activity"

• "ET TROJAN Torpig Reporting User Activity (wur8)"

• "ET TROJAN NimPlant Register Activity (GET)"

• "ET TROJAN TinyLoader.B1 Checkin x86"

• "ET EXPLOIT Fortra MFT Deserialization Remote Code Execution Attempt (CVE-2023-0669) M2"

• "ET MOBILE_MALWARE Android APT-C-23 (leonard-kim .website in TLS SNI)"

• "ET WEB_CLIENT Generic HeapSpray Construct"

• "ET TROJAN ISMAgent DNS Tunneling (microsoft-publisher . com)"

• "ET TROJAN Storm/Waledac 3.0 Checkin 2"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (registrations-adnoc .com) 2022-12-05"

• "ET TROJAN Win32/Unknown Grabber Base64 Data Exfiltration Attempt"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (rfq-taziz .com) 2022-12-05"

• "ET TROJAN SugarGh0st RAT CnC Checkin"

• "ET TROJAN OSX/Proton.C/D Domain (eltima .in) in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Cool Java Exploit Recent Jar (1)"

• "ET EXPLOIT LastPass RCE Attempt"

• "ET CURRENT_EVENTS Magnitude EK Landing M1 Aug 05 2017"

• "ET TROJAN Parallax CnC Response Activity M9"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework Payload"

• "ET TROJAN ELF/Mirai.shiina v3 CnC Checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 5"

• "ET TROJAN Tortoiseshell/SysKit CnC Activity"

• "ET TROJAN Trojan-Downloader Win32.Genome.AV"

• "ET CURRENT_EVENTS Successful AOL Phish M1 2016-07-14"

• "ET TROJAN Restylink Domain in DNS Lookup (sseekk .xyz)"

• "ET CURRENT_EVENTS Successful Chase Phish M1 2016-10-17"

• "ET MALWARE OSX/Adware.Pirrit CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Malicious Browser Ext CnC)"

• "ET TROJAN Spora Ransomware Checkin"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (pgp .eu .com) in DNS Lookup"

• "ET MALWARE Suspicious User Agent (FTP)"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-02-21"

• "ET TROJAN Hupigon URL Infection Checkin Detected"

• "ET TROJAN Magecart Exfil Domain in DNS Lookup (convert-server .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (pmi-pna .com in TLS SNI)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Candiru Related Domain in DNS Lookup (bitly .tel)"

• "ET TROJAN Observed DNS Query to RisePro Domain (upxlead .com)"

• "ET TROJAN Linux/dtool IRC Command (UDPFLOOD)"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (gulfcoastoilngas-ae .com) 2022-12-05"

• "ET CURRENT_EVENTS Possible Compromised Wordpress - Generic Phishing Landing 2018-01-22"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN xCaon Embedded Encrypted Command in Webpage"

• "ET TROJAN NCSC XAgent itwm beacon v1"

• "ET TROJAN [PTsecurity] Win32/Spy.Agent.PMJ (MICROPSIA)"

• "ET TROJAN Linux/dtool IRC Command (RAW)"

• "ET TROJAN Arkei/Vidar/Mars Stealer Variant CnC checkin commands"

• "ET TROJAN Lyceum Backdoor CnC Activity M1"

• "ET TROJAN ELF/Muhstik Attempting to Download Payload"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN BigLock Ransomware CnC Activity (name)"

• "ET INFO PNG in HTTP POST (Outbound)"

• "ET TROJAN Observed IcedID Domain (magizanqomo .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful Office365 Credential Phish 2023-03-31"

• "ET TROJAN Win32.YordanyanActiveAgent Generic CnC Pattern"

• "ET CURRENT_EVENTS Observed TOAD Domain (bshelp .us in TLS SNI)"

• "ET TROJAN Observed DarkSide Ransomware Domain (rumahsia .com in TLS SNI)"

• "ET TROJAN Arid Gopher Related Domain in DNS Lookup (pam-beesly .site)"

• "ET MALWARE Known Malicious User-Agent (x) Win32/Tracur.A or OneStep Adware Related"

• "ET TROJAN Hitpop.AG/Pophot.az HTTP Checkin"

• "ET TROJAN Win32/MSIL.Heracles Checkin"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (en-au-wordpress .org)"

• "ET CURRENT_EVENTS KaiXin Landing M5 1 Oct 05 2015"

• "ET CURRENT_EVENTS Successful Alibaba Credential Phish 2022-11-30"

• "ET CURRENT_EVENTS Possible WhiteLotus EK 2013-2551 Exploit 3"

• "ET TROJAN Virusremover2008.com Checkin"

• "ET WEB_SERVER WebShell - ASPyder -File Upload - POST Structure"

• "ET TROJAN TA452 Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Impots.gouv.fr Phish M2 2015-08-21"

• "ET MALWARE Mycomclean.com Spyware User-Agent (HTTP_GET_COMM)"

• "ET MOBILE_MALWARE Arid Viper (marty-colvard .top in DNS Lookup)"

• "ET POLICY W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Coinbasetxn Begin Mining Response"

• "ET TROJAN APT28 Uploader Variant Fake Request to Google"

• "ET TROJAN JS/GootLoader CnC Exfil"

• "ET TROJAN Aurora Stealer Domain in DNS Lookup (nvidia-graphics .top)"

• "ET TROJAN Suspected Praying Mantis Threat Actor Activity"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (linda-gaytan .website in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (jqueryns .com)"

• "ET TROJAN SNIcat - Detected C2 Commands (CD)"

• "ET ATTACK_RESPONSE Nemesis Admin Panel Inbound"

• "ET TROJAN AppleJeus - JMT Trading CnC Activity (Windows Variant)"

• "ET TROJAN Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)"

• "ET TROJAN Injected WP Keylogger/Coinminer Domain Detected (cloudflare .solutions in DNS Lookup)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (pakgov .net)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (mod-mil .site)"

• "ET TROJAN Win32/TrojanDownloader.Agent.FC CnC Activity"

• "ET CURRENT_EVENTS Successful Orderlink (IN) Phish Feb 24 2017"

• "ET TROJAN Parallax CnC Response Activity M7"

• "ET TROJAN XCodeGhost DNS Lookup"

• "ET CURRENT_EVENTS Possible RedDotv2 applet with 32hex value Landing Page"

• "ET TROJAN TAIDOOR CnC Domain in DNS Lookup (www.cnaweb.mrslove .com)"

• "ET TROJAN [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity"

• "ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 2"

• "ET TROJAN Win32/CryptFile2 Ransomware Checkin"

• "ET TROJAN Gh0st Variant CnC Domain in DNS Lookup (dexercisep .com)"

• "ET TROJAN UNC2628 BEACON Activity (GET)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (midatlanticlabel .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4j5 .xyz)"

• "ET TROJAN Observed MAZE Ransomware CnC Domain (checksoffice .me in TLS SNI)"

• "ET TROJAN Truebot/Silence.Downloader No Tasking Response from Server"

• "ET TROJAN WEBC2-RAVE UA"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT CnC)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (QakBot)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup FireStarter CnC)"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Information.html) M2"

• "ET CURRENT_EVENTS Successful Banco G&T Continental Credential Phish 2023-01-25"

• "ET TROJAN Kimsuky Related Maldoc Activity (GET)"

• "ET TROJAN MirrorThief CnC in DNS Lookup"

• "ET WEB_SERVER China Chopper WebShell Observed Outbound"

• "ET TROJAN Lurk Click fraud Template Request"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET CURRENT_EVENTS Shared Document Base64 Phishing Landing 2016-01-20"

• "ET TROJAN TA453 Modified IIS-Raid Backdoor Module Headers in HTTP Request"

• "ET TROJAN Observed Gamaredon Domain (loop71 .procellarumbi .ru in TLS SNI)"

• "ET TROJAN Yandexbot Request Outbound"

• "ET MALWARE AdVantage Malware URL Infection Report"

• "ET TROJAN Golang Easy Stealer CnC Response"

• "ET TROJAN Possible CopyKittens DNS Lookup (fbstatic-a.xyz)"

• "ET TROJAN Win32/Sarwent Variant CnC Activity"

• "ET TROJAN Malicious Domain in DNS Lookup (jscloud .live)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 9"

• "ET WEB_SERVER WebShell - ASPyder - Auth Creds"

• "ET TROJAN W32/Asprox.FakeAV Affiliate Second Stage Download Location Request"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed DNS Query to TA455 Domain (googleupdate .co)"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2017-12-20"

• "ET MALWARE PUP.Win32.BoBrowser User-Agent (BoBrowser)"

• "ET TROJAN Observed DNS Query to TA444 Domain (bankofamerica .nyc)"

• "ET TROJAN DNS Query to Teal Kurma Domain (nmcbcd .live)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M7"

• "ET TROJAN Observed DNS Query to Known Fenrir Ransomware CnC Domain"

• "ET TROJAN [Fireeye] Backdoor.BEACON SSL Cert Inbound (databasegalore .com)"

• "ET CURRENT_EVENTS BulletProofLink Phishkit Activity (GET)"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET TROJAN Win32.Hyteod.acox Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"

• "ET TROJAN ComRAT CnC Domain in DNS Lookup"

• "ET TROJAN Generic - POST To .php w/Extended ASCII Characters"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in TLS SNI"

• "ET TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Malware C2)"

• "ET INFO Self-Signed Cert O=XX Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Colibri Loader Activity"

• "ET TROJAN Observed Malicious SSL Cert (Fake Gmail Self Signed - Possible Cobalt Stirke)"

• "ET TROJAN Trojan.MyDNS DNSChanger - HTTP POST"

• "ET TROJAN Scarlet Mimic DNS Lookup 1"

• "ET TROJAN Kimsuky Related Host Data Exfil"

• "ET TROJAN Maldoc CnC Domain in DNS Lookup (r .significantbyte .com)"

• "ET EXPLOIT [FIREEYE] Suspicious Pulse Secure HTTP Request (CVE-2021-22893) M3"

• "ET TROJAN Generic Dropper/Clicker Checkin"

• "ET TROJAN Linux/BillGates Checkin"

• "ET CURRENT_EVENTS HT SWF Exploit RIP"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (marwapetersson .info)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (updateadobeflash .com)"

• "ET MOBILE_MALWARE Android/Xnore Fake Facebook Login Credentials Collected"

• "ET TROJAN Gamaredon C2 Domain (a0728173 .xsph .ru) in DNS Lookup"

• "ET TROJAN Observed Operation Silent Watch Domain in DNS Lookup (filesindrive .info)"

• "ET TROJAN DNS Query to Fake TeamViewer Domain (coldcreekranch .com)"

• "ET ATTACK_RESPONSE JS/Spy.Banker.LD Credit Card Skimmer Inbound"

• "ET CURRENT_EVENTS Successful Stripe Phish 2016-12-09"

• "ET TROJAN Win32/Comrerop Checkin to FTP server"

• "ET TROJAN TDSServ or Tidserv variant Checkin"

• "ET TROJAN Upatre Downloader 2p (Zeus) May 07 2014"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (blogsolutions .top in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed CoinMiner CnC Domain (endpsbn1u6m8f .x .pipedream .net in TLS SNI)"

• "ET TROJAN r0 CnC Architecture POST 3"

• "ET TROJAN Hoax.Win32.BadJoke/DownLoader1.57593 Checkin"

• "ET TROJAN Subterranean Security Domain in DNS Lookup"

• "ET CURRENT_EVENTS Lucy Security Time Tracking POST"

• "ET TROJAN Suspected Tunna Proxy M1 (Outbound)"

• "ET TROJAN Observed Malicious SSL Cert (BazaLoader CnC)"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN APT32/OceanLotus CnC Domain in DNS Lookup (idtpl .org)"

• "ET CURRENT_EVENTS Suspicious Generic Login - Possible Successful Phish 2019-01-02"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 3"

• "ET TROJAN Spytector Domain (mail .spytector .com) in TLS SNI"

• "ET CURRENT_EVENTS Tech Support Phone Scam Landing 2023-04-17"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 92"

• "ET MOBILE_MALWARE Trojan.AndroidOS.TimpDoor Module Download Request"

• "ET TROJAN Observed MongoLock Variant CnC Domain (s .rapid7 .xyz in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (camilleoconnell .website in TLS SNI)"

• "ET TROJAN W32/Symmi.46846 CnC Beacon"

• "ET TROJAN Kimsuky Related Activity (GET)"

• "ET TROJAN Observed TA444 Domain (azure-protection .cloud in TLS SNI)"

• "ET TROJAN Observed DNS Query to Ursnif CnC Domain (vorulenuke. us)"

• "ET TROJAN APT-C-27 CnC Domain Observed in DNS Query"

• "ET DNS Reply Sinkhole - Dr. Web"

• "ET P2P Phatbot Control Connection"

• "ET TROJAN Win32/Zemot Config Download"

• "ET TROJAN DNSChanger CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 62"

• "ET TROJAN Observed Nemty Ransomware Payment Page"

• "ET TROJAN LokiBot Request for C2 Commands Detected M2"

• "ET TROJAN Inter Skimmer CnC Domain in DNS Lookup"

• "ET TROJAN Charming Kitten APT Related DNS Activity"

• "ET TROJAN Unruy Downloader Checkin"

• "ET CURRENT_EVENTS TMOBILE Credential Phish Landing Page 2022-11-01"

• "ET CURRENT_EVENTS Successful Impots.gouv.fr Phish 2016-10-24"

• "ET TROJAN Chaos Botnet CnC Domain (tomca1 .com) in DNS Lookup"

• "ET TROJAN Amadey Bot Activity (POST)"

• "ET TROJAN Symbiote CnC Domain in DNS Lookup (caixa .wf)"

• "ET TROJAN Turla DNS Lookup (vision2030 .cf)"

• "ET TROJAN Observed DNS Query to RisePro Domain (pu-file .com)"

• "ET CURRENT_EVENTS Generic Phish Landing Page (2023-10-30)"

• "ET TROJAN Potential Juniper PHP Local File Inclusion Attempt (CVE-2022-22246)"

• "ET CURRENT_EVENTS Generic Korean Bank Credential Theft 2023-01-09"

• "ET TROJAN Win32/Swrort.A Checkin 2"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (javan-demsky .website in TLS SNI)"

• "ET TROJAN Suspicious UA (^IE[\d\s])"

• "ET TROJAN Observed Jupyter Stealer CnC Domain (blackl1vesmatter .org in TLS SNI)"

• "ET TROJAN Win32/SilentBreak Related Domain in DNS Lookup"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (circuspride .org)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6id .xyz)"

• "ET EXPLOIT Possible Microsoft Edge Chakra.dll Type Confusion (CVE-2016-7200 CVE-2016-7201) B643"

• "ET WEB_CLIENT Tech Support Scam Landing Jul 19 2017"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-06-21"

• "ET TROJAN Win32/Tesch.B CnC Beacon"

• "ET MOBILE_MALWARE NSO Pegasus iOS Activity (GET)"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (wordpress .secureplatform .org)"

• "ET CURRENT_EVENTS HoeflerText Chrome Popup DriveBy Download Attempt 2"

• "ET TROJAN Kimsuky HTA Payload Retrieval Attempt"

• "ET TROJAN Yayih.A Checkin 3"

• "ET TROJAN Windows WMIC SERVICE get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (weryfikacja-poczty .space in TLS SNI)"

• "ET CURRENT_EVENTS Likely Trojan Multi-part Macro Download M1"

• "ET MOBILE_MALWARE APT33/Charming Kitten Android/LittleLooter Activity (POST) M2"

• "ET TROJAN Malicious lnk Downloader Activity (GET)"

• "ET MOBILE_MALWARE Android.Trojan.Marcher.U DNS Lookup"

• "ET TROJAN PS/PowerRatankba CnC DNS Lookup"

• "ET TROJAN Observed StrongPity CnC Domain (pulmonyarea .com in TLS SNI)"

• "ET MALWARE Suspicious User-Agent (Huai_Huai)"

• "ET TROJAN PurpleFox Backdoor/Rootkit Download Request M2"

• "ET CURRENT_EVENTS Successful Apple Phish M1 2016-09-29"

• "ET TROJAN Possible Office Doc with Embedded VBA containing Reverse Meterpreter Shell"

• "ET CURRENT_EVENTS Successful Apple Store Phish M4 2016-12-29"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN Smokeloader getload Command"

• "ET TROJAN Possible Kelihos Infection Executable Download With Malformed Header"

• "ET TROJAN Observed Glupteba CnC Domain (mastiakele .ae .org in TLS SNI)"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET MALWARE NewWeb/Sudui.com Spyware User-Agent (B Register)"

• "ET CURRENT_EVENTS GCash Credential Phish 2022-06-17"

• "ET CURRENT_EVENTS USPS Credential Phish Landing Page M2 2023-04-28"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 7"

• "ET MOBILE_MALWARE Android Gymdrop Dropper (onlinefitnessanalysis .com in DNS Lookup)"

• "ET TROJAN Observed IcedID Domain (deactivate .pw in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (lwxa .eu)"

• "ET TROJAN Cobalt Strike Malleable C2 Profile (__session__id Cookie)"

• "ET TROJAN Pupy DNS Request without SPI M1"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (gulfmarineoilservices .com) 2022-12-05"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (tobaccosafe .xyz)"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (kalpoipolpmi .net)"

• "ET TROJAN Win32/Koubbeh Sending Windows System Info"

• "ET TROJAN Shuckworm/Gamaredon CnC Domain (heato .ru) in DNS Lookup"

• "ET TROJAN SoulSearcher Malware Domain in DNS Lookup (gmy .cimadlicks .net)"

• "ET EXPLOIT Possible 2012-1533 altjvm RCE via JNLP command injection"

• "ET TROJAN Volt Typhoon User-Agent"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET TROJAN Possible CopyKittens DNS Lookup (walla.link)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Observed Fake Chrome Landing Domain (chromiumlink .site in TLS SNI)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 61"

• "ET TROJAN Win32/Bisonal DNS Lookup 3"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN YAHOOYLO Stealer CnC Exfil"

• "ET TROJAN Observed Cobalt Strike CnC Domain (dimentos .com in TLS SNI)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN ELF/Roboto - Communicating with Hardcoded Peer 5"

• "ET TROJAN DNS Query to Raspberry Robin Domain (w4 .nz)"

• "ET USER_AGENTS Suspicious User-Agent (MyAgent)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (nebtoizi .ru)"

• "ET TROJAN DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram"

• "ET MOBILE_MALWARE Android APT-C-23 (bitgames .world in DNS Lookup)"

• "ET TROJAN GravityRAT CnC Domain (orangevault .net in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-08-23"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (neferzi .ru)"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (pickuchu .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (u0 .rs)"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (en-nz-wordpress .org)"

• "ET TROJAN DNS Query to Teal Kurma Domain (al-marsad .co)"

• "ET TROJAN Supercharge Component Download (exe)"

• "ET TROJAN Shuckworm CnC Domain (destroy .asierdo .ru) in DNS Lookup"

• "ET TROJAN TA444 Related Domain (thecloudnet .org) in DNS Lookup"

• "ET TROJAN BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)"

• "ET TROJAN Trojan.Win32.Jorik.Totem.vg HTTP request"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (prises .cyou)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [Mandiant] UNC4841 SEASPY Backdoor Activity M2"

• "ET TROJAN Suspected Lazarus APT Related Activity (GET)"

• "ET TROJAN Magecart/Skimmer Domain in DNS Lookup (cddn .site)"

• "ET TROJAN W32/Echmark/MarkiRAT CnC Response"

• "ET TROJAN Possibly Malicious Double Base64 Unicode Net.ServicePointManager M1"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN UAC-0114/Winter Vivern CnC Activity"

• "ET TROJAN SmugX Domain (newsmailnet .com) in TLS SNI"

• "ET TROJAN Monsoon Tinytyphon CnC Beacon GET"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike)"

• "ET TROJAN Regin Hopscotch Module Accessing SMB Named Pipe (Unicode) 2"

• "ET TROJAN Win32/CollectorStealer - Uploading System Information"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2022-10-11"

• "ET TROJAN Mimikatz x86 Mimidrv.sys File Transfer Over SMB"

• "ET CURRENT_EVENTS Tech Support/Refund Scam Landing Inbound 2022/04/25"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Yowai)"

• "ET TROJAN Observed BazarLoader Domain (numklo .xyz in TLS SNI)"

• "ET TROJAN Egspy Infection Report Email"

• "ET CURRENT_EVENTS Successful Windows Live Account Phish 2016-10-26"

• "ET TROJAN Observed Malicious SSL Cert (TA577)"

• "ET TROJAN Cryptowall .onion Proxy Domain"

• "ET MALWARE Observed Win32/Foniad Domain (acinster .info in TLS SNI)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 100"

• "ET TROJAN TA455 Related CnC Domain in DNS Lookup"

• "ET TROJAN [Fireeye] Observed SUNBURST DGA Request"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (kontrola-poczty .space in TLS SNI)"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish M2 2016-12-02"

• "ET TROJAN DNS Query to TA444 Domain (doc .linkpc .net)"

• "ET MOBILE_MALWARE Android APT-C-23 (lord-varys .info in DNS Lookup)"

• "ET TROJAN Lazarus CnC Domain Observed in DNS Query"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (graceygretchen .info in TLS SNI)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Observed Reverse Shell Payload Delivery Domain (opentunnel .quest) in TLS SNI"

• "ET TROJAN Bladabindi/njrat CnC Checkin"

• "ET TROJAN Maldoc Sending Windows System Information (POST)"

• "ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (corporatelover .top)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Facebook Phish 2016-10-12"

• "ET WEB_SERVER Compromised WordPress Server pulling Malicious JS"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Drive Receiving POST1 DDoS instructions"

• "ET MALWARE User-Agent (microsoft) - Possible Trojan Downloader"

• "ET WEB_CLIENT Microsoft Tech Support Scam M1 2016-09-15"

• "ET CURRENT_EVENTS Successful Airbnb COVID-19 Phish 2020-03-25"

• "ET TROJAN Sourtoff Receiving Simda Payload"

• "ET TROJAN ElectroRAT Command from Server (Screenshot)"

• "ET TROJAN MSIL/Autorun.AD Checkin"

• "ET TROJAN Latrodectus 404 Response"

• "ET TROJAN BePush/Kilim CnC Beacon"

• "ET TROJAN TA444 Domain in TLS SNI (nor-health .xyz)"

• "ET TROJAN DonotGroup CnC Observed in DNS Query"

• "ET MALWARE Searchspy.co.kr Spyware User-Agent (HTTPGETDATA)"

• "ET TROJAN Remcos RAT Checkin 23"

• "ET TROJAN Observed TA406 Related Domain in TLS SNI"

• "ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 4"

• "ET TROJAN Win32.Razy.azv Downloading Content"

• "ET TROJAN W32/PointOfSales.Misc CnC Beacon"

• "ET CURRENT_EVENTS [TW] Trex Phishkit POST"

• "ET MOBILE_MALWARE Android APT-C-23 (lagertha-lothbrok .info in DNS Lookup)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6qo .at)"

• "ET MOBILE_MALWARE Android APT-C-23 (caroline-nina .com in DNS Lookup)"

• "ET TROJAN Win32/Unk HeavensGate Loader CnC in DNS Lookup"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Joker Checkin"

• "ET MALWARE X-Files Stealer CnC Exfil Activity M1"

• "ET CURRENT_EVENTS Twitter Phishing Landing 2018-07-19"

• "ET TROJAN Probable OneLouder downloader (Zeus P2P)"

• "ET TROJAN Arid Viper APT Related Domain in DNS Lookup (juliansturgill .info)"

• "ET CURRENT_EVENTS OWA Phishing Landing 2016-04-04 M2"

• "ET TROJAN Maldoc Downloading from Dropbox via API"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (havan .qhigh.com)"

• "ET TROJAN Observed Malicious SSL Cert (Klingon RAT)"

• "ET TROJAN Fake AV GET"

• "ET TROJAN Win32/Spy.Agent.OHT - AnunakAPT TCP Checkin 1"

• "ET TROJAN Smart Fortress FakeAV/Kryptik.ABNC Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (mygift .site in DNS Lookup)"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Username Checkin"

• "ET CURRENT_EVENTS Successful Generic Phish 2020-01-29 (set)"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN Win32/DolphinCape Activity (POST)"

• "ET CURRENT_EVENTS Fake Google Chrome Error Landing Page, Control Access with Cookie"

• "ET CURRENT_EVENTS Possible Successful Phish - Saved Website Comment Observed"

• "ET TROJAN Trojan Generic - POST To gate.php with no referer"

• "ET CURRENT_EVENTS Am3Refh Obfuscated Phishing Landing 2016-02-23"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (avira .ltd) in DNS Lookup"

• "ET TROJAN ASNAROK Related Domain in DNS Lookup"

• "ET TROJAN Desert Falcon APT DNS Lookup (linkedim.in)"

• "ET TROJAN Kimsuky CnC Domain Observed in DNS Query"

• "ET INFO Possible Fake 404 Credential Phish Landing Page"

• "ET TROJAN Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing Jul 24 2015"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET TROJAN Win32/Bisonal DNS Lookup 5"

• "ET TROJAN Win32/DarkWatchman Checkin Activity (POST)"

• "ET TROJAN Banker.Delf Infection - Sending Initial Email to Owner"

• "ET CURRENT_EVENTS Zbot Generic URI/Header Struct .bin"

• "ET TROJAN Fake Chrome Landing Domain Activity (chromiumtxt .space)"

• "ET TROJAN AlinaPOS Exfiltration via DNS"

• "ET TROJAN Tandem Espionage CnC Domain (aztkiryhetxx .ru) in DNS Lookup"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET CURRENT_EVENTS Qtloader encrypted check-in Oct 19 M1"

• "ET TROJAN Observed DNS Query to UNC3890 Domain (fileupload .shop)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 9"

• "ET TROJAN PureCrypter Requesting Injector - Known Campaign ID M3"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M1 Jan 20 2017"

• "ET TROJAN RouteX CnC Domain (c13a856f4a879a89e9a638207efd6c94 .biz) in DNS Lookup"

• "ET CURRENT_EVENTS Successful FR Gmail Phish M2 2016-03-15"

• "ET TROJAN Playful Taurus CnC Domain (update .delldrivers .in) in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (ColdRiver APT DNSpionage MITM)"

• "ET TROJAN Latrodectus Alive Response M8"

• "ET TROJAN Sofacy DNS Lookup testservice24.net"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 6"

• "ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 70"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (emspgenerahospae .com) 2022-12-05"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) in SNI 2019-09-27"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (ftpserverit .otzo.com)"

• "ET TROJAN Possible Hiloti DNS Checkin Message explorer_exe"

• "ET TROJAN Patchwork Backdoor - Requesting Task"

• "ET TROJAN Win32/Zemot Requesting PE"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (ns2.hostasa.org)"

• "ET TROJAN Win32/RecordBreaker - Observed UA M1"

• "ET TROJAN Observed DCRat CnC Domain (dud-shotline .000webhostapp .com in TLS SNI)"

• "ET TROJAN DNS Query to TA444 Domain (cryptyk .webredirect .org)"

• "ET TROJAN Lunar Builder Exfil via Discord M1"

• "ET TROJAN Win32/SaintStealer Data Exfiltration Attempt M2"

• "ET TROJAN W32/Asprox CnC Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (aslaug-sigurd .info in TLS SNI)"

• "ET CURRENT_EVENTS Successful Citibank Phish Landing Page"

• "ET TROJAN Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 58"

• "ET TROJAN GCleaner Downloader Activity M8"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (bloggersglobbers .top)"

• "ET TROJAN Win32/WarHawk Checkin Activity"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (pireltotus .com)"

• "ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle canada)"

• "ET TROJAN Jaff Ransomware Checkin M1"

• "ET TROJAN Possible Dyre SSL Cert M2 (L CN)"

• "ET TROJAN Havex RAT CnC Server Response HTML Tag"

• "ET TROJAN Win32/Wacatac Ransomware Variant Retrieving File (GET)"

• "ET CURRENT_EVENTS Successful Yahoo Phish 2016-10-14"

• "ET TROJAN Win32/Xtrat.A Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Parallax CnC Response Activity M16"

• "ET TROJAN Observed Gamaredon APT Related Domain (humorumbi .ru in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN JunkMiner Downloader Communicating with CnC"

• "ET MOBILE_MALWARE Android JadeRAT CnC Beacon"

• "ET TROJAN DarkGate Domain in DNS Lookup (hardwarenet .cc)"

• "ET TROJAN TyphonStealer Exfil via AnonFiles (POST)"

• "ET MOBILE_MALWARE Android/FakeAhnAV.A CnC Beacon"

• "ET CURRENT_EVENTS Obfuscated Javascript from Generic Phishkit"

• "ET TROJAN Mustang Panda APT Related Activity M2 (Response)"

• "ET TROJAN lu0bot CnC Domain in DNS Lookup"

• "ET TROJAN Trojan-Downloader.Win32.AutoIt.mj Checkin"

• "ET CURRENT_EVENTS Sliver Related Domain in DNS Lookup"

• "ET TROJAN Win32/Cryptbot CnC Activity (POST)"

• "ET CURRENT_EVENTS Possible Successful Gmail Phish Nov 25 2013"

• "ET TROJAN Iron Tiger Gh0ST/PlugX/Various Backdoors DNS Lookup (gameofthrones.ddns.net)"

• "ET TROJAN Win32/ChromeBack Browser Hijacker Home Beacon"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (dofixifa .co)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (t0 .wf)"

• "ET CURRENT_EVENTS Successful Generic Webmail Phish 2016-12-02"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2016-09-02"

• "ET CURRENT_EVENTS [TW] NOTG Redirect URL Struct"

• "ET MOBILE_MALWARE NSO Related Domain 39"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2015-10-03"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-cdn .com)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (csd-pk .co)"

• "ET MOBILE_MALWARE Trojan-Ransom.AndroidOS.Agent.bi CnC Domain in DNS Lookup"

• "ET TROJAN L0rdix Stealer CnC Data Exfil"

• "ET TROJAN Observed DNS Query to Ursnif Domain (fishenddog .xyz)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (selectnew25mode .space in DNS Lookup)"

• "ET TROJAN Suspicious user agent (V32)"

• "ET TROJAN MSIL/G1 Stealer/GravityRAT Requesting Payload"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (nebiltech .shop)"

• "ET TROJAN Possible Astaroth User-Agent Observed"

• "ET TROJAN General Trojan Downloader"

• "ET TROJAN Possible Malicious Macro DL BIN May 2016 (No UA)"

• "ET TROJAN Windows net statistics server Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS Generic Landing Page 2022-02-04"

• "ET TROJAN Andariel Backdoor Activity (Checkin)"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN DazzleSpy Related Domain in DNS Lookup"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (likasertik .shop)"

• "ET TROJAN Soraya C2 User-Agent (Vulture)"

• "ET TROJAN Observed VikroStealer CnC Domain in TLS SNI"

• "ET TROJAN [ANY.RUN] RCRU64 Ransomware Variant CnC Activity"

• "ET CURRENT_EVENTS Possible Astrum EK URI Struct"

• "ET ATTACK_RESPONSE Unusual FTP Server Banner (freeFTPd)"

• "ET TROJAN TURLA NETFLASH CnC"

• "ET TROJAN Observed PowerShell/CustomRAT Domain (kleinm .de) in TLS SNI"

• "ET TROJAN Win32/Matanbuchus Loader Related Domain in DNS Lookup (collectiontelemetrysystem .com)"

• "ET TROJAN Candiru Related Domain in DNS Lookup (instagrarn .co)"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET TROJAN Backdoor.Elise CnC Beacon 3 M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4w .rs)"

• "ET TROJAN Possible Windows executable sent when remote host claims to send a Text File"

• "ET TROJAN KeyBase Keylogger Uploading Screenshots"

• "ET MOBILE_MALWARE Android APT-C-23 (meet-me .chat in TLS SNI)"

• "ET TROJAN MSIL.L4L Stealer Screenshot Exfiltration"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-01-12"

• "ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Oracle America)"

• "ET TROJAN MiniDuke CnC Beacon (string1_slide_3_2)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page from Text Scam M2 2023-05-01"

• "ET TROJAN Mermaid Ransomware Variant CnC Activity M2"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (kazaboldu .net)"

• "ET TROJAN APT32 Win32/Ratsnif CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed DNS Query to IcedID Domain (acehphonnajaya .com)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-09-24"

• "ET CURRENT_EVENTS Successful BBVA Compass Account Phish 2015-08-21"

• "ET TROJAN MalDoc/Konni APT CnC Activity (GET) M3"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 17"

• "ET TROJAN Win32/Qbot CnC Activity M3 (POST)"

• "ET WEB_SERVER WebShell - Pouya - Pouya_Server Shell"

• "ET CURRENT_EVENTS Observed TOAD Domain (axhelp .us in TLS SNI)"

• "ET EXPLOIT Fortra MFT Deserialization Remote Code Execution Attempt (CVE-2023-0669) M3"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (mod-pk .com)"

• "ET TROJAN Win32/Dofoil.L Checkin"

• "ET TROJAN TAG28 Associated CnC Domain in DNS Lookup (samuelblog .site)"

• "ET MALWARE Bypass Ticket Monitoring Activity (POST)"

• "ET TROJAN Observed MSIL/Heracles Variant CnC Domain (stainless .fun in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Buer Loader Download Request"

• "ET TROJAN Possible Lockbit CnC Checkin"

• "ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access getGalleryImage"

• "ET CURRENT_EVENTS RIG EK URI struct Oct 24 2016 (RIG-v)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (bitscrunch .deck .linkpc .net)"

• "ET MOBILE_MALWARE Android/IRATA CnC Domain (rimotgozaran .tk) in DNS Lookup"

• "ET TROJAN Lyceum Backdoor CnC Activity M3"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cloud-apt .net)"

• "ET TROJAN DDoS.Win32.Agent.bay Variant Covert Channel (VERSONEX)"

• "ET TROJAN Shafttt MySQL Bruteforce Bot CnC Beacon"

• "ET CURRENT_EVENTS Adobe PDF Online Phishing Landing"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN Observed Magecart Skimmer Domain (googie-analytics .website in TLS SNI)"

• "ET TROJAN ELF/BASHLITE vbot Variant CnC"

• "ET CURRENT_EVENTS Successful Paypal Phish M3 2016-10-06"

• "ET TROJAN Win32/Sephora Related Domain in DNS Lookup (sephus .me)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (internal .bounceme .net)"

• "ET TROJAN Shiz/Rohimafo Checkin"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab1c403220c27 .com) Jun 2017"

• "ET TROJAN W32/NSIS.TrojanDownloader Second Stage Download Instructions from Server"

• "ET CURRENT_EVENTS Successful Apple Phish M1 2016-10-07"

• "ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1"

• "ET MOBILE_MALWARE Android APT-C-23 (assets-acc .club in DNS Lookup)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (whitedrill .org)"

• "ET TROJAN W32/118GotYourNo Reporting to CnC"

• "ET TROJAN Asprox Form Submission to C&C"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-09-29"

• "ET MALWARE Win32/SWInformer.B Checkin"

• "ET TROJAN Laplas Clipper - Regex CnC Request"

• "ET CURRENT_EVENTS Successful Generic Credential Phish Landing Page 2022-07-26"

• "ET TROJAN Shamoon v3 64bit Propagating Internally via SMB"

• "ET CURRENT_EVENTS Fake Chrome Update Landing Page Redirect to Payload (2023-10-26)"

• "ET TROJAN MASSLOGGER Client Data Exfil (POST)"

• "ET TROJAN Linux/Agent.HX CnC Activity M2"

• "ET TROJAN DarkComet-RAT Client Keepalive"

• "ET TROJAN Observed DNS Query to Ursnif Domain (reaso .xyz)"

• "ET CURRENT_EVENTS Successful Protected PDF (Excel Template) Phish 2016-12-28"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-09-02"

• "ET WEB_CLIENT Suspicious Redirect - Possible Phishing May 25 2016"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M7"

• "ET TROJAN Socks666 Connect Command Packet"

• "ET TROJAN Win32/InnaputRAT CnC DNS Lookup (ajdhsfhiudsfhsi .top)"

• "ET TROJAN OSX/WireLurker checkin"

• "ET TROJAN Ares Loader Observed User-Agent M2"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (downloadlog .linkpc.net)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (syriahr .eu)"

• "ET TROJAN CopyKittens Matryoshka DNS Lookup 1 (winupdate64 . com)"

• "ET TROJAN MalDoc/Konni APT CnC Activity (GET)"

• "ET TROJAN W32/Kbot.Backdoor Variant CnC Beacon"

• "ET TROJAN Observed FinSpy Domain (browserupdate .download in TLS SNI)"

• "ET TROJAN DCRAT CnC Domain in DNS Lookup (akamaitechcdns .com)"

• "ET TROJAN JynxLoaderV2 CnC Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (m5n .biz)"

• "ET WEB_CLIENT Microsoft Tech Support Scam Landing M1 Oct 13 2017"

• "ET TROJAN GravityRAT CnC Domain (melodymate .co .in in DNS Lookup)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN IIS Backdoor CnC Command Inbound"

• "ET TROJAN Win32/Krypton Stealer CnC Checkin"

• "ET CURRENT_EVENTS Successful SFR Mail Credential Phish 2023-07-07"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 2"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Security Scanner Domain (log4j. leakix .net)"

• "ET TROJAN FIN7 JSSLoader Variant Activity (POST)"

• "ET TROJAN PSRansom File Exfiltration (POST)"

• "ET TROJAN Unk.PSAttack Activity"

• "ET MOBILE_MALWARE Android.Bgserv POST of Data to CnC Server"

• "ET TROJAN ELF/Emptiness v1.1 DNS Flood Command Inbound"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (verify-mail .space in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (dachfunny .club in TLS SNI)"

• "ET CURRENT_EVENTS Generic Phishing Kit Landing"

• "ET TROJAN DNS Query to TA444 Domain (pre .alwayswait .site)"

• "ET TROJAN Common Downloader Install Count Tracking URL (partner)"

• "ET TROJAN Foudre Checkin M4"

• "ET USER_AGENTS Suspicious User-Agent Detected (WINS_HTTP_SEND Program/1.0)"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN CryptoDefense DNS Domain Lookup"

• "ET TROJAN OSX/Shlayer Malicious Download Request"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M6"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected"

• "ET TROJAN Observed Glupteba CnC Domain (cdneurops .buzz in TLS SNI)"

• "ET TROJAN SocGholish Domain in DNS Lookup (creativity .kinchcorp .com)"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 5"

• "ET CURRENT_EVENTS ScanBox Jun 06 2015 M1 T1"

• "ET TROJAN Xbash CnC DNS Lookup (scanaan .tk)"

• "ET TROJAN Hong Kong SWC Attack DNS Lookup (aoemvp.com)"

• "ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M2 2023-02-22"

• "ET TROJAN Linux/LuaBot CnC Beacon"

• "ET CURRENT_EVENTS Evil Redirect Leading to EK Jul 28 2016"

• "ET TROJAN OLDBAIT Checkin 2 brvc"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (configuratorpro .com)"

• "ET TROJAN NIGHTSCOUT Malware CnC Domain in DNS Lookup (update .boshiamys .com)"

• "ET USER_AGENTS Suspicious User-Agent (hacker)"

• "ET TROJAN Lethic - Client Alive"

• "ET CURRENT_EVENTS Malicious JS.Nemucod to PS Dropping PE Nov 14 M2"

• "ET TROJAN Alina User-Agent(Alina)"

• "ET TROJAN Win32/DuckLogs Malware Activity (GET)"

• "ET TROJAN Stabuniq Checkin"

• "ET CURRENT_EVENTS Google Maps Phishing Landing 2016-02-17"

• "ET TROJAN CommentCrew Possible APT backdoor download logo.png"

• "ET EXPLOIT Possible ETERNALROMANCE MS17-010 Heap Spray"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (residencialcasabrasileira .com)"

• "ET CURRENT_EVENTS Microsoft Excel Credential Phish Landing Page 2022-10-03"

• "ET TROJAN Observed Gamaredon APT Related Domain (alceaso .ru in TLS SNI)"

• "ET CURRENT_EVENTS Redkit Landing Page URL March 03 2013"

• "ET TROJAN PowerTrick download ver2 bot"

• "ET MALWARE W32/OnlineGames Checkin"

• "ET TROJAN Observed OSX/WizardUpdate Domain in TLS SNI ( .dlvplayer .com)"

• "ET ATTACK_RESPONSE VBA/Subdoc.B Obfuscated Payload Inbound"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-12-13"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (nrots .net)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (horsespeedtravel .com) 2022-12-05"

• "ET TROJAN Sarwent CnC Command (update)"

• "ET TROJAN Sarwent CnC Command (powershell)"

• "ET TROJAN RedditC2 Related Activity (POST)"

• "ET TROJAN Chafer CnC DNS Query"

• "ET CURRENT_EVENTS Successful Webmail Mailbox Quota Phish 2016-09-02"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (daddygarages .org)"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1qjywr9cpsm5u7e4yrmnx2jsahgzzmm7 .com in TLS SNI)"

• "ET TROJAN Sofacy DNS Lookup checkmalware.org"

• "ET WEB_SERVER WebShell Generic - ASP File Uploaded"

• "ET TROJAN QRat.Java.RAT Checkin Response"

• "ET TROJAN Linux/SSHDoor.A Reporting Backdoor CnC Beacon"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Apple Phish M3 Feb 06 2016"

• "ET TROJAN Observed Malicious SSL Cert (GRIFFON CnC)"

• "ET TROJAN TrueBot/Silence.Downlaoder Screenshot Post M2"

• "ET TROJAN FIN6 StealerOne CnC Domain in SNI"

• "ET TROJAN Fortigate TABLEFLIP Backdoor Trigger - Magic Number Sequence"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (extic .icu)"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M3"

• "ET TROJAN [Fireeye] Backdoor.BEACON SSL Cert Inbound (panhardware .com)"

• "ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 2"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-01-19"

• "ET TROJAN CommentCrew Possible APT c2 communications sleep5"

• "ET TROJAN Win32/POWERPLANT CnC Exfil (Query)"

• "ET CURRENT_EVENTS Successful Raiffeisen Phish Nov 03 2017"

• "ET TROJAN Possible Backdoor.Linux.Tsunami Outbound HTTP request"

• "ET TROJAN Bladabindi/njrat CnC Command Response (Process listing)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (i0up .com)"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (muasaashshaj .com)"

• "ET CURRENT_EVENTS Successful Generic Personalized Phish 2019-03-11"

• "ET TROJAN Observed Arid Viper APT Related Domain (zakaria-chotzen .info in TLS SNI)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 43"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET P2P Bittorrent P2P Client HTTP Request"

• "ET TROJAN Possible Raspberry Robin Activity (GET) M3"

• "ET TROJAN SugarGh0st RAT Domain in DNS Lookup (account .drive-google-com .tk)"

• "ET TROJAN VBulletin Backdoor CMD inbound"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .presentations .life)"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful DHL Credential Phish M1 2022-06-09"

• "ET TROJAN DNS Query to Gamaredon Domain (kahotepa .ru)"

• "ET CURRENT_EVENTS Successful Outlook Phish 2015-08-18"

• "ET CURRENT_EVENTS Observed TOAD Domain (hshelp .info in TLS SNI)"

• "ET TROJAN APT29 HTA Dropper Checkin Observed"

• "ET TROJAN RisePro TCP Heartbeat Packet"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (azuredeploystore .com)"

• "ET TROJAN Win32/Amadey Bot Activity (POST) M2"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET CURRENT_EVENTS Successful Etisalat Phish 2016-12-20"

• "ET TROJAN PoshC2 - Observed Default URI Structure M8"

• "ET TROJAN Linux/Venom CnC Beacon"

• "ET TROJAN SOMNIRECORD Backdoor PROBE Command in DNS Query"

• "ET TROJAN [ANY.RUN] Konni.APT Keep-Alive"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b DNS Lookup"

• "ET CURRENT_EVENTS Successful Poloniex Cryptocurrency Exchange Phish Aug 28 2017"

• "ET MOBILE_MALWARE Observed Android ERMAC Banker (PL) Domain (bolt-food .site in TLS SNI)"

• "ET EXPLOIT Possible ETERNALROMANCE MS17-010"

• "ET CURRENT_EVENTS Successful Anonisma Paypal Phish 2015-12-29"

• "ET MALWARE Adload.Generic Spyware User-Agent (91castInstallKernel)"

• "ET CURRENT_EVENTS DRIVEBY Generic CollectGarbage in JJEncode (Observed in Sednit)"

• "ET INFO Powershell Get-ComputerInfo Output (WindowsBuildLabEx) - Decimal Encoded"

• "ET TROJAN NewPosThings Data Exfiltration"

• "ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)"

• "ET TROJAN Ares Loader Checkin"

• "ET CURRENT_EVENTS Webmail Account Upgrade Phishing Landing 2016-07-15"

• "ET CURRENT_EVENTS Successful Generic Phish - Phone Number 2015-09-02"

• "ET CURRENT_EVENTS Successful Bradesco Bank Phish M1 Jan 05 2017"

• "ET TROJAN APT28/Sednit DNS Lookup (dailyforeignnews .com)"

• "ET TROJAN MrRobot LYON Phish Kit Exfil (POST) M2"

• "ET CURRENT_EVENTS Observed TOAD Domain (hshelp .cc in TLS SNI)"

• "ET TROJAN linux.backdoor.wordpressexploit.2 JS backdoor retrieval"

• "ET MALWARE Win32/Swjoy.A Telemetry Checkin"

• "ET TROJAN Win32/Orion Logger SMTP Base64 Exfil"

• "ET CURRENT_EVENTS Possible Sweet Orange redirection 21 July 2014"

• "ET TROJAN NewsPenguin Domain in DNS Lookup (updates .win32 .live)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (whatsthescore .top in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (u0 .pm)"

• "ET TROJAN Ransomware/Cerber Checkin M3 (1)"

• "ET TROJAN Win32/Matanbuchus Loader Activity (POST)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 80"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) May 24 2017"

• "ET TROJAN RedDelta Poison Ivy Domain in DNS Lookup"

• "ET TROJAN MSIL/Agent.PYO Possible net.tcp CnC Beacon (control)"

• "ET TROJAN MSIL/SkidRat CnC Checkin M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (h0 .pm)"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (flowdivison .club in DNS Lookup)"

• "ET TROJAN Observed Unk.PowerShell Loader CnC Domain in TLS SNI"

• "ET TROJAN APT29 Domain in DNS Lookup (pandorasong .com)"

• "ET TROJAN Observed Malicious SSL Cert (Brushaloader CnC) 2023-12-4"

• "ET MOBILE_MALWARE Android APT-C-23 (hitmesanjjoy .pro in TLS SNI)"

• "ET TROJAN Windows dir Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS Successful Wildblue Phishing M2 2015-11-24"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Mustang Panda APT PlugX Related Domain in DNS Lookup (myanmarnewsonline .org)"

• "ET TROJAN Win32/7ev3n Ransomware Initial Checkin"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (team-meet .xyz)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (naverk .myvnc .com)"

• "ET MALWARE Zenosearch Malware Checkin HTTP POST (2)"

• "ET TROJAN Villain C2 Framework CnC Exfil (POST)"

• "ET TROJAN Nitro Stealer Exfil Activity (Response)"

• "ET TROJAN Win32/Teslacrypt Ransomware HTTP CnC Beacon M2"

• "ET WEB_SERVER JSP.SJavaWebManage WebShell Access"

• "ET SCAN WebHack Control Center User-Agent Inbound (WHCC/)"

• "ET TROJAN abubasbanditbot CnC Checkin"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (creditals-mirohost .space in TLS SNI)"

• "ET MOBILE_MALWARE APT-C-23 Related CnC Domain in DNS Lookup (javan-demsky .website)"

• "ET MOBILE_MALWARE Phenakite Image Upload CnC activity"

• "ET TROJAN Windows WMIC PROCESS get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN NSO Group Pegasus CnC Domain Observed in DNS Query"

• "ET TROJAN Ponmocup HTTP Request (generic) M4"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET TROJAN Linux/DDoS.M Admin console status"

• "ET TROJAN Impersoni-fake-ator backdoor CnC Checkin"

• "ET TROJAN W32/Qakbot.Bot Version 8 CnC Beacon"

• "ET TROJAN TA444 Domain in DNS Lookup (cisco-webex .online)"

• "ET TROJAN NDSW/NDSX Javascript Inject"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET TROJAN Win32/ModernLoader Activity (POST)"

• "ET MALWARE SurfAccuracy.com Spyware Updating"

• "ET CURRENT_EVENTS RIG EK Payload Jun 26 2016"

• "ET MALWARE Adware pricepeep Adware.Shopper.297"

• "ET TROJAN Agent Tesla Reverse Base64 Encoded MZ In Image"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6y .re)"

• "ET CURRENT_EVENTS Successful Generic Phish 2022-08-01"

• "ET TROJAN W32/Ke3chang.MovieStar.APT Campaign CnC Beacon"

• "ET CURRENT_EVENTS Phishing Landing via Webeden.co.uk M1 2016-01-22"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (en-nz-wordpress .org)"

• "ET TROJAN AlienSpy RAT Checkin Set"

• "ET TROJAN DNS Query to Raspberry Robin Domain (c0 .wf)"

• "ET TROJAN ISMAgent CnC Checkin 1"

• "ET TROJAN Observed DeltaStealer Domain (deltastealer .xyz) in TLS SNI"

• "ET TROJAN Kimsuky ReconShark Payload Retrieval Request M1"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (account-gocgle .com in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Restylink Domain in DNS Lookup (spffusa .org)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET USER_AGENTS Suspicious User-Agent (Windows Explorer)"

• "ET TROJAN BLINDEAGLE CnC Domain (upxsystems .com) in DNS Lookup"

• "ET TROJAN FIN8 ShellTea CnC in DNS Lookup"

• "ET TROJAN Observed Gootloader Domain in DNS Lookup (jonathanbartz .com)"

• "ET TROJAN TAIDOOR CnC Domain in DNS Lookup (www.infonew.dubya .net)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET CURRENT_EVENTS Successful SeniorPeopleMeet Phish M1 2016-09-14"

• "ET WEB_CLIENT Tech Support Phone Scam Landing (warning.mp3) Jan 24 2017"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (sdilok .com)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Stealbit Variant Data Exfil M2"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Account Update Phish 2015-09-01"

• "ET MALWARE Win32/2144FlashPlayer.E Checkin"

• "ET TROJAN DNS Query to Teal Kurma Domain (systemctl .network)"

• "ET MALWARE GreatArcadeHits CnC Activity"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"

• "ET TROJAN Infostealer.Bancos ProxyChanger Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (gmailservice .us in TLS SNI)"

• "ET CURRENT_EVENTS Paypal Phishing Landing Feb 24 2017"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (dawnpk .org)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (j2care .cc)"

• "ET TROJAN Win32/Napolar.A Getting URL"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (uwannaplaygame .space in DNS Lookup)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (acorusso .ru)"

• "ET TROJAN Trojan-Dropper.Win32.Sysn.cdjy CnC Activity"

• "ET TROJAN W32/Zbot.InfoStealer WindowsUpdate Connectivity Check With Opera UA"

• "ET TROJAN Umbra/MultiBot Plugin access"

• "ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI"

• "ET TROJAN Observed Jupyter Stealer CnC Domain (gogohid .com in TLS SNI)"

• "ET CURRENT_EVENTS USAA Phishing Landing 2016-02-26"

• "ET TROJAN WikiLoader Activity M3 (Response)"

• "ET TROJAN ProxyBot Phone Home Traffic"

• "ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M2"

• "ET TROJAN KPOT Stealer Initial CnC Activity M5"

• "ET TROJAN Observed DNS Query to Impersoni-fake-ator (cloud .fastpaymentser-vice .com)"

• "ET TROJAN NOBELIUM - Cobalt Strike Malleable Profile M1"

• "ET MALWARE W32/Linkular.Adware Successful Install Beacon (2)"

• "ET CURRENT_EVENTS Successful Webmail Account Upgrade Phish 2016-12-27"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (netstreamag .publicvm.com)"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (primecisco .com)"

• "ET TROJAN W32/Liftoh.Downloader Images CnC Beacon"

• "ET TROJAN MacOS/UpdateAgent.A CnC Activity M1"

• "ET TROJAN BalkanDoor CnC Checkin"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN Observed TraderTraitor Domain (launchruse .com in TLS SNI)"

• "ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU Checkin"

• "ET TROJAN AZORult v3.2 Server Response M3"

• "ET CURRENT_EVENTS Successful Apple Store Phish M3 2016-12-29"

• "ET TROJAN Win32/Spy.Banker.ACUT CnC Checkin"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k5j .one)"

• "ET TROJAN MassLogger Client Exfil (POST) M3"

• "ET CURRENT_EVENTS Domen SocEng Redirect - Landing Page Observed"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 3"

• "ET CURRENT_EVENTS Mailbox Upgrade Phishing Landing 2016-06-27"

• "ET TROJAN Win32/Loli Stealer CnC Activity"

• "ET TROJAN Observed DNS Query to Certishell Domain (vavave .xf .cz)"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET TROJAN Fareit/Pony Downloader Checkin 2"

• "ET TROJAN System Progressive Detection FakeAV (AMD)"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN Win32/BLUELIGHT OAuth Login Attempt"

• "ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M1"

• "ET TROJAN Win32/NitroStealer CnC Exfil M2"

• "ET TROJAN DangerousPassword APT Related Domain in DNS Lookup (www .datacentre .center)"

• "ET MALWARE Adware.Gen5 Reporting"

• "ET TROJAN Lyceum Golang HTTP Backdoor Submitting Data to CnC"

• "ET CURRENT_EVENTS Successful Telstra Credential Phish 2022-08-26"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Possible APT29 Compressed Payload Download Request"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (snocuae .com) 2022-12-05"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Pirate Stealer Domain in DNS Lookup (wearenotbbystealer .nl)"

• "ET TROJAN Win32.Stealer.alwu Data Exfiltration Attempt"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 6.0)"

• "ET MALWARE Win32.AdWare.iBryte.C Install"

• "ET CURRENT_EVENTS Possible Encoded Wide PowerShell (IEX) in Certificate Inbound"

• "ET TROJAN Evrial Stealer CnC Activity M2"

• "ET CURRENT_EVENTS SUSPICIOUS msctcd.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup"

• "ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 1"

• "ET TROJAN Python Monero Miner CnC DNS Query"

• "ET TROJAN Downloader.Win32.Geral Checkin"

• "ET TROJAN Observed DNS Query to CnC Domain (StrongPity)"

• "ET CURRENT_EVENTS Successful Gmail Phish M2 2016-10-12"

• "ET TROJAN Mazilla Suspicious User-Agent Jan 15 2015"

• "ET TROJAN GravityRAT CnC Domain (titaniumx .co .in in DNS Lookup)"

• "ET TROJAN DCRat Initial CnC Activity"

• "ET TROJAN Downadup/Conficker A or B Worm reporting"

• "ET TROJAN Observed GobRAT Domain (ktlvz .dnsfailover .net) in TLS SNI"

• "ET TROJAN Gamaredon Domain in DNS Lookup (dzhibeydpa .ru)"

• "ET TROJAN APT10 Related Domain in DNS Lookup (microsofts .cc)"

• "ET MALWARE Win32/SocksTroy Session Initiation Attempt M2"

• "ET CURRENT_EVENTS Successful Maersk Phishing 2016-02-25"

• "ET TROJAN Parallax CnC Response Activity M17"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (kolabdown .sytes.net)"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (billionaireshore .top)"

• "ET TROJAN Observed GandCrab Ransomware CnC/IP Check Domain (gdcb .bit in DNS Lookup)"

• "ET MOBILE_MALWARE Android Syria-Twitter Checkin"

• "ET TROJAN Foudre Checkin M3"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-09-06"

• "ET TROJAN StrongPity CnC Domain Observed in DNS Query"

• "ET TROJAN Downloader (P2P Zeus dropper UA)"

• "ET TROJAN Observed DNS Query to TA444 Domain (finxiio .com)"

• "ET TROJAN IRC potential reptile commands"

• "ET TROJAN Spy/Infostealer.Win32.Embed.A Client Traffic"

• "ET CURRENT_EVENTS Successful Monzo Credential Phish M1 2022-02-17"

• "ET TROJAN APT-C-27 CnC Domain Observed in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ejk .li)"

• "ET MALWARE IE Toolbar User-Agent (IEToolbar)"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Win32/Amadey Payload Request (GET) M2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET USER_AGENTS Peppy/KeeOIL User-Agent (ekeoil)"

• "ET TROJAN Possible OceanLotus C2 Checkin"

• "ET CURRENT_EVENTS Successful US Bank Phish 2016-06-09 M1"

• "ET TROJAN Win32/Scieron-A Checkin via HTTP POST"

• "ET TROJAN PoshC2 - Observed Default URI Structure M17"

• "ET TROJAN LuminosityLink - CnC Password Exfil"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Generic Wembail Phish M2 2016-11-18"

• "ET TROJAN Ursa Loader CnC Checkin"

• "ET TROJAN Win32/XFILES Stealer Data Exfiltration Attempt"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (pipap .xyz)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bgcare .online)"

• "ET TROJAN Observed Magecart/Skimmer - _try_action CnC Domain (cdn-frontend .com in TLS SNI)"

• "ET TROJAN Teslarvng Ransomware CnC Activity M3"

• "ET TROJAN BlackTech ELF/TSCookie CnC Observed in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (pjz .one)"

• "ET TROJAN Win32/VB.AAF Checkin"

• "ET WEB_CLIENT JS Browser Based Ransomware"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bshelp .us)"

• "ET TROJAN MSIL/BISKVIT DNS Lookup (bigboss .x24hr .com)"

• "ET TROJAN Linux DarkRadiation Ransomware Telegram Activity M2"

• "ET TROJAN Observed Glupteba CnC Domain (revouninstaller .homes in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (david-gardiner .website in TLS SNI)"

• "ET CURRENT_EVENTS Dropbox Phishing Landing - Title over non SSL"

• "ET TROJAN Possible JKDDOS download ddos.exe"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Remcos Builder License Check"

• "ET TROJAN Observed Glupteba CnC Domain (checkpos .net in TLS SNI)"

• "ET TROJAN DiamondFox HTTP Post CnC Checkin M3"

• "ET TROJAN MSIL/Small.FU Variant CnC Activity M3"

• "ET MALWARE Ask.com Toolbar/Spyware User-Agent (AskPBar)"

• "ET CURRENT_EVENTS Successful Bank of America Phish M2 2016-10-21"

• "ET CURRENT_EVENTS NuclearPack - Landing Page Received - applet archive=32CharHex"

• "ET TROJAN Observed GoBotKR Domain in TLS SNI"

• "ET CURRENT_EVENTS Common Form POST - Instagram Phishing Landing 2020-06-11"

• "ET TROJAN Kimsuky Maldoc Activity (GET)"

• "ET TROJAN APT28 CnC Domain DNS Lookup"

• "ET WEB_CLIENT Fake AV Phone Scam Landing July 20 2015 M2"

• "ET TROJAN QwixxRAT - Telegram CnC Checkin"

• "ET CURRENT_EVENTS Successful Dropbox Business Phish 2016-11-17"

• "ET TROJAN IcedID CnC Domain in SNI"

• "ET TROJAN Gozi/Ursnif/Papras Grabftp Module Download"

• "ET TROJAN Skeleton Key Filename in SMB Traffic (Unicode)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-11-06"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Miniduke Variant CnC Beacon via WebDAV"

• "ET MALWARE W32/PicColor Adware CnC Beacon"

• "ET TROJAN Hades APT Downloader Attempting to Retrieve Stage 2 Payload"

• "ET CURRENT_EVENTS Bleeding Life 2 GPLed Exploit Pack payload download"

• "ET TROJAN Observed Malicious SSL Cert (Baka Skimmer Staging CnC)"

• "ET TROJAN TA402/Molerats Pierogi CnC Response (Screenshot)"

• "ET CURRENT_EVENTS Successful Craigslist (RO) Phish M2 Feb 24 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/BISKVIT DNS Lookup (secured-links .org)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (bitscrunch .deck .linkpc .net)"

• "ET TROJAN W32.Netwire Connectivity Check"

• "ET MALWARE Platinumreward.co.kr Spyware User-Agent (WT_GET_COMM)"

• "ET TROJAN Pyramid Framework Payload Request (base-pythonmemorymodule.py)"

• "ET CURRENT_EVENTS Successful EDU Phish 2017-12-04"

• "ET TROJAN Legion Loader Activity Observed (lilith)"

• "ET MALWARE SecureDriverUpdater Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Win32/Atshz.A Checkin"

• "ET TROJAN SmugX Domain in DNS Lookup (newsmailnet .com)"

• "ET TROJAN Sidecopy APT Backdoor Related Activity (POST)"

• "ET CURRENT_EVENTS Successful US Bank Phish M1 2015-12-22"

• "ET TROJAN Backdoor.Win32.Svlk Client Checkin"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET TROJAN Soraya Credit Card Exfiltration"

• "ET CURRENT_EVENTS Unknown VBScript Loader with Encoded PowerShell Execution Inbound"

• "ET TROJAN Bitter APT CHM CnC Activity (GET) M4"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(DEMO)"

• "ET TROJAN APT33/CharmingKitten Encrypted Payload Inbound"

• "ET TROJAN Linux DarkRadiation Ransomware Activity (wget)"

• "ET TROJAN Observed Lazarus Related Domain (share .bloomcloud .org in TLS SNI)"

• "ET TROJAN W32/Bravix.Dropper CnC Beacon"

• "ET TROJAN BatLoader CnC Domain (externalchecksso .com) in DNS Lookup"

• "ET TROJAN Win32/StreamFlaw.A Checkin"

• "ET TROJAN Win32/LockScreen CnC HTTP Pattern"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Nov 15 2016"

• "ET CURRENT_EVENTS Possible Linkedin Phishing Domain Dec 09 2016"

• "ET CURRENT_EVENTS DNSChanger EK Secondary Landing May 12 2015 M2"

• "ET TROJAN EvilNum CnC Checkin Response"

• "ET MOBILE_MALWARE Android APT-C-23 (debra-morgan .com in TLS SNI)"

• "ET TROJAN Win32/CHIP Ransomware CnC Checkin"

• "ET TROJAN ZINC APT Related Backdoor Activity (POST)"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 11"

• "ET USER_AGENTS Suspicious user agent (Google page)"

• "ET TROJAN ProjectSauron Remsec DNS Lookup (we .q.tcow.eu)"

• "ET TROJAN Win32/Autophyte.F C2 Domain (www .ap8898 .com in DNS Lookup)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (louisianaworkingdogs .com)"

• "ET TROJAN Golang/Webbfustator Related Domain in DNS Lookup (xmlschemeformat .com)"

• "ET TROJAN PLATINUM Dipsind CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed IcedID Domain (deactivate .best in TLS SNI)"

• "ET MALWARE Observed Win32/Foniad Domain (maraukog .info in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Donot Group Downloader Activity (GET)"

• "ET TROJAN Alloy Taurus Reshell Backdoor URI pattern Observed M2"

• "ET TROJAN Observed DNS Query to TA444 Domain (careers .bankofamerica .nyc)"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (singnode .com)"

• "ET TROJAN Parallax CnC Activity M9 (set)"

• "ET TROJAN BAZAR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android/Spy.Agent.ANA (mediamobilereg .com in DNS Lookup)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 20"

• "ET TROJAN Red October/Win32.Digitalia Checkin cgi-bin/dllhost/ac"

• "ET TROJAN WebDAV Retrieving .zip from .url M2 (CVE-2023-36025)"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Poweliks Clickfraud CnC M4"

• "ET TROJAN [eSentire] Win32/Spy.Banker.ADIO CnC Checkin"

• "ET CURRENT_EVENTS ScanBox Framework used in WateringHole Attacks Initial (POST)"

• "ET TROJAN W32/Threebyte.APT Checkin"

• "ET TROJAN HVNC BOT Detected"

• "ET TROJAN DonotGroup CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Upatre CnC)"

• "ET TROJAN Win32/Autophyte.F C2 Domain (www .anlway .com in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Three Step Gmail Phish (3 of 3) 2016-12-02"

• "ET MALWARE LoadMoney Checkin 5"

• "ET TROJAN Suspicious User-Agent (Mozilla/3.0 (compatible))"

• "ET TROJAN Generic Stealer Config Download Request"

• "ET TROJAN TA444 Domain in DNS Lookup (dnx .capital)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Tandem Espionage CnC Domain (wzqyuwtdxyee .ru) in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN BadPatch CnC Activity"

• "ET TROJAN W32/Nymaim Checkin M2"

• "ET TROJAN Observed Koadic Header Structure"

• "ET USER_AGENTS User-agent DownloadNetFile Win32.small.hsh downloader"

• "ET MALWARE OSX/Adware.Pirrit CnC Activity 2"

• "ET TROJAN TA444 Related Domain in DNS Lookup (inst .shconstmarket .com)"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-09-29"

• "ET TROJAN Win32/IcedID WebSocket Request M2"

• "ET TROJAN Possible DACLS RAT CnC (Log Check)"

• "ET TROJAN APT29/CloakedUrsa Google Drive Authentication (POST)"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET TROJAN Cobalt Strike Malleable C2 (Adobe RTMP)"

• "ET TROJAN Possibly Malicious Double Base64 Unicode Net.ServicePointManager M2"

• "ET TROJAN MageCart CnC Domain in SNI"

• "ET TROJAN Win32/H0lyGh0st CnC Activity"

• "ET CURRENT_EVENTS Common Form POST - Instagram Phishing Landing 2020-06-11"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (salacomimmigration .com) 2022-12-05"

• "ET USER_AGENTS Win32/OnLineGames User-Agent (Revolution Win32)"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Gamaredon Domain (for71 .procellarumbi .ru in TLS SNI)"

• "ET TROJAN NanoCore RAT CnC 28"

• "ET CURRENT_EVENTS Successful Tesco Phish (set) M1 Jul 18 2017"

• "ET CURRENT_EVENTS Sweet Orange Landing with Applet Sep 30 2013"

• "ET TROJAN ConnectWise ScreenConnect Payload Delivery Domain (win03 .xyz) in DNS Lookup"

• "ET USER_AGENTS Suspicious User-Agent (ItIsMe)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (a2help .us)"

• "ET CURRENT_EVENTS United Parcel Service Landing Page 2023-03-10"

• "ET CURRENT_EVENTS RIG EK Payload Jul 05 2016"

• "ET TROJAN ELF/Roboto - Communicating with Hardcoded Peer 4"

• "ET CURRENT_EVENTS PurpleFox EK Landing Page Domain in SNI"

• "ET TROJAN Kimsuky Related Host Data Exfil"

• "ET CURRENT_EVENTS Successful IRS Credential Phish 2022-04-25"

• "ET TROJAN Win32/LeftHook Stealer CnC Activity (GET) M1"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 86"

• "ET CURRENT_EVENTS Successful Banco do Brasil Phish M1 Sep 29 2017"

• "ET TROJAN W32.Qakbot Webpage Infection Routine POST"

• "ET TROJAN Win32/Retadup CnC Checkin M2"

• "ET CURRENT_EVENTS JDB Exploit Kit Landing Page"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6j2 .xyz)"

• "ET TROJAN W32/BlackEnergy Dirconf CnC Beacon"

• "ET CURRENT_EVENTS Terse POST to Wordpress Folder - Probable Successful Phishing M6"

• "ET MALWARE Loadmoney User Agent"

• "ET CURRENT_EVENTS Possible Base64 Obfuscated Phishing Landing 2015-11-30"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish M3 2016-11-22"

• "ET MALWARE User-Agent (Example)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (ebothlips .com)"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET CURRENT_EVENTS Instagram Fake Copyright Infringement Hosted on 000webhostapp"

• "ET TROJAN Possible W32/Citadel Download From CnC Server Self Referenced /files/ attachment"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (scorerabbate .site)"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M12"

• "ET TROJAN Anuna PHP Backdoor Sucessful Exploit"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 5"

• "ET MOBILE_MALWARE Android APT-C-23 (lyanna-stark .info in TLS SNI)"

• "ET TROJAN Possible DACLS RAT CnC (Log Server Reporting)"

• "ET TROJAN Georgian Targeted Attack - Trojan Checkin"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET TROJAN Win32/Darkme Trojan Checkin M1"

• "ET TROJAN Win32/Vibem.C CnC Activity"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN DonotGroup Related Domain in DNS Lookup (officeframework .online)"

• "ET TROJAN Win32/GenCBL.XS CnC Activity"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MALWARE Trojan.FakeAV.SystemDefender Checkin"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (forumsecrets .com)"

• "ET TROJAN CN Based APT Related Domain in DNS Lookup (open .zerdeopen .top)"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK Jul 08"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 20"

• "ET TROJAN DonotGroup Staging Domain in DNS Query"

• "ET MOBILE_MALWARE Android APT-C-23 (katie .party in DNS Lookup)"

• "ET TROJAN Win32/Dipverdle.A Activity"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (encrypted-message .cloud)"

• "ET TROJAN Possible DeadlyKiss APT CnC Domain Observed in DNS Query"

• "ET TROJAN Successful Win32/TrojanDownloader.VB.RUI Exfil Activity M1"

• "ET TROJAN Chaos Botnet CnC Domain (ai .nqb001 .com) in DNS Lookup"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M1"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .result .garrettcountygranfondo .org)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (MagnitudeEK Associated)"

• "ET TROJAN Shiz or Rohimafo Reporting Listening Socket to CnC Server"

• "ET TROJAN Win32.Riberow.A (mkdir)"

• "ET TROJAN PureCrypter Requesting Injector - Known Campaign ID M2"

• "ET TROJAN Bifrose Response from Controller"

• "ET TROJAN Vidar/Arkei/Megumin/Oski Stealer Data Exfil"

• "ET TROJAN HTTPCore CnC Task Request"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN Linux/MayhemBruter Checkin"

• "ET TROJAN Win32/Kryptik.FVVZ Variant CnC Checkin 2"

• "ET TROJAN Observed Malicious DNS Query (BazarLoader/Team9 Backdoor CnC Domain)"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (syncmeet .online)"

• "ET TROJAN Sality Variant Downloader Activity (2)"

• "ET MALWARE Ezula Related User-Agent (mez)"

• "ET CURRENT_EVENTS DarkX Phish Landing Page 2022-01-22"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (consultant-enoc .com) 2022-12-05"

• "ET TROJAN Cobalt Strike Malleable C2 Amazon Profile Variant (GET)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Sakula/Mivast RAT CnC Beacon 2"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (anscowerbrut .com)"

• "ET CURRENT_EVENTS ClearFake Fingerprinting Domain in TLS SNI (stats-tracked .com)"

• "ET TROJAN Suspicious X-mailer Synapse"

• "ET TROJAN Worm.VBS.ayr CnC command (is-cmd-shell)"

• "ET CURRENT_EVENTS DNS Query to Generic 107 Phishing Domain"

• "ET CURRENT_EVENTS Successful Survey Credential Phish M1 2022-04-04"

• "ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.tk)"

• "ET TROJAN Skeleton Key Filename in SMB2 Traffic"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ALFA Shell APT33 DNS Lookup (solevisible .com)"

• "ET MALWARE Win32/DownloadAssistant.Q Variant Checkin"

• "ET MOBILE_MALWARE NSO Group Domain in DNS Lookup (free247downloads .com)"

• "ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Exploited Message"

• "ET CURRENT_EVENTS Generic Credential Phish 2022-10-12"

• "ET TROJAN Win32/Loader Variant Activity (POST)"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(nento)"

• "ET MALWARE Suspicious User-Agent (My Session)"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .tech .linkpc .net)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M23"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (j-ic .co .intneral-document-he-gr-me .run .place)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (aplikacje .ron-mil .space)"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish 2016-10-26"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Donot (APT-C-35) Stage 1 Requesting Persistence Setup File"

• "ET TROJAN 000Stealer Data Exfiltration M1"

• "ET CURRENT_EVENTS SUSPICIOUS wimhost.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN Observed Glupteba Domain (dazhiruoyu .org in TLS SNI)"

• "ET TROJAN BatLoader CnC Domain (cloudupdatesss .com) in DNS Lookup"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (reaso .xyz)"

• "ET TROJAN Zbot download config"

• "ET TROJAN Linux/dtool IRC Command (RESTART)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b Apps List Exfil"

• "ET TROJAN Shady RAT Retrieve and Execute Command"

• "ET TROJAN Piptea.a Related Trojan Checkin (1)"

• "ET TROJAN Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 2"

• "ET CURRENT_EVENTS Successful Free.fr Phish 2016-03-10"

• "ET CURRENT_EVENTS Fedex Phishing Landing on Appspot Hosting"

• "ET TROJAN [ANY.RUN] PovertyStealer Check-In via TCP"

• "ET TROJAN AppleJeus - CoinGoTrade CnC Domain in DNS Lookup (coingotrade .com)"

• "ET TROJAN Locky CnC Checkin"

• "ET EXPLOIT Zollard PHP Exploit UA Outbound"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (nicsan .ru)"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (hamraoilgroup .com) 2022-12-05"

• "ET TROJAN Observed CoinMiner Domain (pool .supportxmr .com in TLS SNI)"

• "ET TROJAN OSX/Mami CnC Checkin"

• "ET TROJAN Observed BlackDolphin Ransomware Builder Cookie"

• "ET TROJAN Kelihos.K Executable Download DGA"

• "ET USER_AGENTS Win32/FakeAV InternetSecurityGuard User-Agent"

• "ET TROJAN APT28/Sednit DNS Lookup (kenlynton .com)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-03"

• "ET TROJAN Observed DNS Query to Ursnif Domain (rorfog .com)"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab8cee60c2d .com) Aug 2017"

• "ET TROJAN Diavol CnC Checkin"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup"

• "ET TROJAN OSX/Flashback.K first execution checkin"

• "ET MALWARE W32/InstallMonetizer.Adware Beacon 1"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (thereisnoscheme .top)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (uoej .net)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish from W3LL STORE Phishkit 2023-04-25"

• "ET TROJAN W32 Bamital or Backdoor.Win32.Shiz CnC Communication"

• "ET TROJAN ELF/lizkebab CnC Activity (Server Banner)"

• "ET MALWARE ASKTOOLBAR.DLL Reporting"

• "ET TROJAN Neverquest Request URI Struct"

• "ET MALWARE Win32/Zonebac Traffic Redirect"

• "ET MOBILE_MALWARE Android.YzhcSms URL for Possible File Download"

• "ET TROJAN Echelon/DarkStealer Variant CnC Exfil M2"

• "ET TROJAN Win32/FakeSysdef Rogue AV Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (nissour-beton .com in TLS SNI)"

• "ET TROJAN Lockbit Ransomware Related Domain in DNS Lookup (lockbitapt)"

• "ET TROJAN Turkojan C&C Logs Parse Command (LOGS1)"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(TCBFRVDEMS)"

• "ET TROJAN Trojan.JS.Agent.dwz Checkin"

• "ET TROJAN Bravix Checkin"

• "ET CURRENT_EVENTS Successful iTunes Connect Phish M3 2016-12-13"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Aug 31 2017"

• "ET CURRENT_EVENTS Possible Successful *.myjino. ru Phish 2016-12-16"

• "ET ATTACK_RESPONSE Backdoor reDuh http initiate"

• "ET TROJAN DNS Query for DNSpionage CnC Domain"

• "ET MOBILE_MALWARE Android APT-C-23 (hareyupnow .club in TLS SNI)"

• "ET MALWARE Spyware User-Agent (install_s)"

• "ET TROJAN Powershell commands sent when remote host claims to send an image"

• "ET TROJAN Bancos/Banker Info Stealer Post"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bshelp .info)"

• "ET TROJAN MyKings Bootloader Variant Requesting Payload M3"

• "ET TROJAN Legion Loader Activity Observed (neva-project)"

• "ET TROJAN BlackEnergy v2.x Plugin Download Request"

• "ET TROJAN APT DarkHydrus DNS Lookup 14"

• "ET TROJAN MSIL/Diezen CnC Checkin M2"

• "ET TROJAN Phonk Trojan CnC Checkin (POST)"

• "ET TROJAN Bazaloader Variant Activity"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.1 Domain (tommyforgreendream .icu) in TLS SNI"

• "ET CURRENT_EVENTS Possible Successful COVID-19 Related Phish M1"

• "ET TROJAN Win32/Unk.HRESQ! MultiDownloader Checkin M2"

• "ET TROJAN MSIL/Crimson Receiving Command (ping) M1"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (onelao .line .pm)"

• "ET TROJAN Win32/Cinoshi Stealer Payload Request (GET)"

• "ET CURRENT_EVENTS Successful Blackboard Account Phish 2015-10-08"

• "ET TROJAN Perfect Keylogger FTP Initial Install Log Upload"

• "ET CURRENT_EVENTS Successful Webmail Phish M2 2016-06-22"

• "ET TROJAN DNS Query to TA444 Domain (cryptyk .online)"

• "ET TROJAN ELF/Emptiness v1 CnC Checkin"

• "ET CURRENT_EVENTS Successful DrSpam Phish 2016-06-08 M1"

• "ET TROJAN PyPI Malicious Library Payload Delivery Domain (python-release .com) in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (a0 .pm)"

• "ET CURRENT_EVENTS Successful WZ-REKLAMA Phish 2016-01-08"

• "ET TROJAN ProjectSauron Remsec DNS Lookup (rapidcomments.com)"

• "ET TROJAN EvilNominatus Ransomware Related Domain in DNS Lookup"

• "ET MALWARE [eSentire] Win32/Adware.Adposhel.lgvk CnC Checkin"

• "ET CURRENT_EVENTS Successful Generic Phish M2 2016-10-27"

• "ET MALWARE Win32/BrowseFox.H Checkin 2"

• "ET TROJAN Win32/Spy.Banker.AAGB Checkin"

• "ET TROJAN IcedID WebSocket Request"

• "ET TROJAN Malicious Debugging Application Related Domain in DNS Lookup (dbgsymbol .com)"

• "ET CURRENT_EVENTS Successful Canada Revenue Agency COVID-19 Assistance Eligability Phish 2020-04-01"

• "ET CURRENT_EVENTS OneDrive Phishing Landing 2020-04-10"

• "ET MALWARE DealPly Adware CnC Beacon 4"

• "ET TROJAN Win32/Phorpiex CnC Checkin"

• "ET TROJAN Backdoor.Win32.Trup.CX Checkin 1"

• "ET TROJAN Golang/Kaos/YamaBot CnC Activity"

• "ET TROJAN MSSQL maggie backdoor Query Observed (other functions)"

• "ET TROJAN SNIcat - Detected C2 Commands (finito)"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (leprotestant .com)"

• "ET MALWARE User-Agent (Mozilla) - Possible Spyware Related"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Cakle)"

• "ET CURRENT_EVENTS OneDrive Phishing Landing on Appspot Hosting"

• "ET TROJAN DNS Query to Raspberry Robin Domain (g4 .nu)"

• "ET TROJAN W32/Antifulai.APT CnC Beacon 2"

• "ET TROJAN StartPage jsp checkin"

• "ET TROJAN Possible CopyKitten DNS Lookup (elasticbeanstalk .tech)"

• "ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response"

• "ET TROJAN Win32/Sality.NBA CnC Checkin"

• "ET TROJAN Win32.Raccoon Stealer Checkin M6"

• "ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (climedballon .org)"

• "ET TROJAN Unknown Actor Targeting Minority Groups CnC Activity"

• "ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)"

• "ET TROJAN Zalupko/Koceg/Mandaph HTTP Checkin (2)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-14"

• "ET TROJAN Observed DangerousPassword APT Related Domain (datacentre .center in TLS SNI)"

• "ET TROJAN Observed Cobalt Strike Stager Domain in DNS Query"

• "ET TROJAN DNS Query to TA444 Domain (hyperchaincapital .online)"

• "ET CURRENT_EVENTS Successful Generic Cryptowallet Credential Phish 2022-05-12"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1qm34lmk6eesc65zpw79lxes69zkq3ew .com in TLS SNI)"

• "ET TROJAN Taidoor Checkin"

• "ET TROJAN Observed DNS Query to LIGHTSHOW Domain (ajayjangid .in)"

• "ET CURRENT_EVENTS Successful Onedrive Credential Phish 2022-06-22"

• "ET MOBILE_MALWARE Android/SOVA Banking Trojan Activity (session cookie delete)"

• "ET TROJAN Void Rabisu Related Loader Activity (GET)"

• "ET CURRENT_EVENTS RIG EK URI Struct Feb 26 2017"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M1"

• "ET TROJAN Mera Keylogger POSTing keystrokes"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (residencialcasabrasileira .com)"

• "ET TROJAN Observed DNS Query to RisePro Domain (fvp-files .com)"

• "ET TROJAN StrongPity Host Checkin"

• "ET WEB_SERVER WebShell - GODSpy - GODSpy title"

• "ET CURRENT_EVENTS Possible Successful Generic Phish to .icu Domain 2019-02-06"

• "ET TROJAN W32/Asprox php.dll.crp POST CnC Beacon"

• "ET TROJAN TorrentLocker DNS Lookup (worldnews247.net)"

• "ET TROJAN Mac Trojan HTTP Checkin (accept-language violation)"

• "ET TROJAN Observed DNS Query to Certishell Domain (hotel-boss .eu)"

• "ET CURRENT_EVENTS Incognito Exploit Kit Java request to images.php?t="

• "ET TROJAN DNS Query to Gamaredon Domain (zuberipa .ru)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (fanlumpactiras .pw)"

• "ET TROJAN DDG Botnet Miner Download"

• "ET MOBILE_MALWARE Observed Android ExobotCompact.D/Octo Domain (ifn1h8ag1g .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Possible Successful Generic Paypal Phish Jan 23 2016"

• "ET TROJAN ProxyBox - HTTP CnC - .com.tw/check_version.php"

• "ET MOBILE_MALWARE Android.KorBanker Fake Banking App Install CnC Beacon"

• "ET CURRENT_EVENTS Possible Crypto Drainer Enumerate"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (greedyfines .org)"

• "ET TROJAN Mozi Botnet DHT Config Sent"

• "ET TROJAN DNS Query to Raspberry Robin Domain (krrz .pm)"

• "ET TROJAN Possible Regin Init CnC Beacon TCP"

• "ET TROJAN Dark Halo/SUNBURST SSL Cert Inbound (globalnetworkissues .com)"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 12"

• "ET TROJAN WEBC2-CLOVER Download UA"

• "ET MOBILE_MALWARE Android.Zitmo Forwarding SMS Message to CnC Server"

• "ET TROJAN Gazer DNS query observed (mydreamhoroscope . com)"

• "ET TROJAN Linux.Ngioweb Stage 1 CnC Activity Server Response (CERT)"

• "ET TROJAN TA422 Related Activity M5"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (esr .suppservices .xyz)"

• "ET TROJAN W32/Mentory CnC Server Providing Update Details"

• "ET CURRENT_EVENTS Successful Netflix Phish 2016-11-15"

• "ET USER_AGENTS Suspicious User-Agent (Download App)"

• "ET TROJAN Evrial Stealer CnC Activity"

• "ET CURRENT_EVENTS Microsoft Office Phishing Landing 2016-12-18"

• "ET TROJAN Observed DNS Query to TA444 Domain (cooporatestock .com)"

• "ET TROJAN Arid Viper APT Checkin 2"

• "ET TROJAN Win32/Pift DNS TXT CnC Lookup ppift.net"

• "ET TROJAN ZeroAccess P2P Module v6 Reporting"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN MrRobot LYON Phish Kit Exfil (POST) M1"

• "ET TROJAN Observed Glupteba CnC Domain (cdneurops .pics in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (MonetizUs/LNKR)"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Shell)"

• "ET MOBILE_MALWARE NSO Related Domain 10"

• "ET CURRENT_EVENTS Successful mail .ru Credential Phish"

• "ET MALWARE W32/Eorezo.Adware CnC Beacon"

• "ET TROJAN BYOB - Python Backdoor Loader Download"

• "ET TROJAN DNS Query to Raspberry Robin Domain (r4e .pl)"

• "ET TROJAN Possible OwlProxy activity M4"

• "ET TROJAN [PTsecurity] Win32/Spy.RTM/Redaman IP Check"

• "ET USER_AGENTS Suspicious User-Agent (angel)"

• "ET CURRENT_EVENTS Successful Citizens Bank Credential Phish 2022-10-24"

• "ET CURRENT_EVENTS DRIVEBY GENERIC CollectGarbage in Hex String No Seps"

• "ET CURRENT_EVENTS Suspicious SWF filename movie(dot)swf in doc root"

• "ET TROJAN Jupyter Stealer Reporting System Information M2"

• "ET TROJAN DonotGroup CnC Domain in DNS Lookup"

• "ET TROJAN DazzleSpy Related Domain in DNS Lookup"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (dynamicipaddress .linkpc.net)"

• "ET TROJAN Observed TraderTraitor Domain (datadog-graph .com in TLS SNI)"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET WEB_CLIENT PirateBay Phish - Possibly PirateMatryoshka Related"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (hkxpqdtgsucylodaejmzmtnkpfvojabe .com)"

• "ET CURRENT_EVENTS Successful Apple Phish M2 2016-09-14"

• "ET TROJAN User-Agent (Xmaker)"

• "ET CURRENT_EVENTS Successful Halkbank Phish M1 2018-04-16"

• "ET MALWARE CoinSurf Proxy CnC Response"

• "ET CURRENT_EVENTS Team IPwned Phishing Landing 2016-08-24"

• "ET CURRENT_EVENTS Observed TOAD Domain (bshelp .support in TLS SNI)"

• "ET TROJAN Socks5SystemZ CnC Checkin Response M2"

• "ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 2"

• "ET TROJAN Mimikatz x64 Executable Download Over HTTP"

• "ET TROJAN Candiru Spyware CnC Domain in DNS Lookup (cdnmobile .io)"

• "ET TROJAN DeathStalker/PowerPepper CnC Domain in DNS Lookup (mediqhealthcare .com)"

• "ET TROJAN Houdini/Hworm CnC Checkin M1"

• "ET TROJAN Win32.Agent.kawe SMTP Stealer"

• "ET CURRENT_EVENTS Generic Phishing - Successful Landing Interaction"

• "ET TROJAN IRC Potential bot scan/exploit command"

• "ET TROJAN Observed Win32/CollectorStealer User-Agent M1"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M1"

• "ET CURRENT_EVENTS Common Form POST - SunTrust Phishing Landing 2020-06-11"

• "ET TROJAN Observed TA444 Domain (tptf .cloud in TLS SNI)"

• "ET TROJAN UsefulTyphon CnC Activity M1"

• "ET TROJAN APT28/Sednit SSL Cert"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Observed CobInt CnC Domain in TLS SNI"

• "ET MALWARE SUPERAntiSpyware Install Checkin"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN JS/Unk Downloader 0 Byte POST CnC Checkin"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-09-29"

• "ET MALWARE Java.Deathbot Requesting Proxies"

• "ET TROJAN TA402/Molerats Pierogi CnC Activity (Upload)"

• "ET MOBILE_MALWARE Android APT-C-23 (oriential .website in TLS SNI)"

• "ET CURRENT_EVENTS Observed TOAD Domain (helpset123 .site in TLS SNI)"

• "ET TROJAN MSIL/Injector.VVP Downloader Activity M1"

• "ET TROJAN FIN7/Carbanak CnC Domain in DNS Lookup (myrric-uses .singlejets .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (chat-often .com in TLS SNI)"

• "ET TROJAN APT28 Komplex DNS Lookup (itunes-helper .net)"

• "ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"

• "ET TROJAN Hiloti loader installed successfully request"

• "ET TROJAN Backdoor Win32/Hupigon.CK Client Checkin"

• "ET CURRENT_EVENTS Styx Landing Page Oct 25 2013"

• "ET MALWARE Win32/DealPly Reporting Details to CnC"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 7"

• "ET TROJAN APT DarkHydrus DNS Lookup 3"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (c2care .cc)"

• "ET MALWARE TA471 Malicious AutoIT File Upload"

• "ET TROJAN MSIL/Lordix Stealer Exfiltrating Data"

• "ET TROJAN SLIVER Framework SMB CreateService Default ServiceName"

• "ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendMail"

• "ET TROJAN Likely Bot Nick in IRC (USA +..)"

• "ET TROJAN OSX/OceanLotus / ELF/RotaJakario CnC Checkin"

• "ET TROJAN Unk/LNKR CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M1 2016-12-29"

• "ET TROJAN MageCart Exfil URI"

• "ET TROJAN Win32/Urausy.C Checkin 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Dropspam.com Spyware Install User-Agent (DSInstall)"

• "ET TROJAN W32/CoinMiner.ESJ!tr CnC Domain (xs .0x0x0x0x0 .club) in DNS Lookup"

• "ET TROJAN DNS Query to Teal Kurma Domain (aws .systemctl .network)"

• "ET CURRENT_EVENTS Chase Phish Landing 2020-11-26"

• "ET TROJAN MSIL/Modi RAT CnC Command Inbound (plugin)"

• "ET TROJAN Observed DNS Query to UNC3890 Domain (naturaldolls .store)"

• "ET CURRENT_EVENTS DRIVEBY Redirection - Wordpress Injection"

• "ET TROJAN W32/Coinminer.Backdoor CnC Beacon"

• "ET TROJAN Win32/Enchanim C2 Injection Download"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (nizanigrola .com)"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN Fake Google Chrome Error Domain in DNS Lookup (chrome-error .co)"

• "ET TROJAN SUR SSL Cert APT1"

• "ET MOBILE_MALWARE Android Flubot / LIKEACHARM Stealer Exfil (POST) 2"

• "ET TROJAN Observed Gamaredon APT Related Domain (rogac .ru in TLS SNI)"

• "ET TROJAN SocGholish Domain in DNS Lookup (names .expressyourselfesthetics .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET WEB_SERVER safe_mode PHP config option in uri"

• "ET TROJAN SSL/TLS Certificate Observed (Buer Loader)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (easternbaytravels .com) 2022-12-05"

• "ET CURRENT_EVENTS Successful Orange.fr Credential Phish 2023-02-27"

• "ET TROJAN Cobalt Strike CnC Domain (taoche .cn .wswebpic .com) in DNS Lookup"

• "ET TROJAN Bitter APT Related Domain in DNS Lookup (signalpremium .com)"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (izikatka0010 .com)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (wijariief .space in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Dropbox Phish M2 2015-12-10"

• "ET TROJAN APT DarkHydrus DNS Lookup 16"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (ertusaporf .com)"

• "ET TROJAN Possible Malicious Tor Module Download"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (etzndtcvqvyxajpcgwkzsoweaubilflh .com)"

• "ET TROJAN CobaltStrike DNS Beacon Response"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK Mon Dec 21 2015 5"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky Payment)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jun 8 2016"

• "ET TROJAN WSHRAT Keylogger Module Download Command Inbound"

• "ET TROJAN WikiLoader Activity M2 (GET)"

• "ET CURRENT_EVENTS Radobank Phishing Landing Page 2022-07-05"

• "ET TROJAN Donot Group Pult Downloader Activity (POST) M5"

• "ET TROJAN Luder.B User-Agent (Mozilla/4.0 (SPGK)) - GET"

• "ET TROJAN [Fireeye] Backdoor.BEACON M6"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish 2016-08-19"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (talgatgi .ru)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (docuserve .ltd)"

• "ET TROJAN DNS Query to Gamaredon Domain (71delay .dzhahipa .ru)"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL Certificate Detected (Sinkhole)"

• "ET TROJAN Observed Glupteba CnC Domain (parrotcare .net in TLS SNI)"

• "ET TROJAN Javascript Initiating Remote Server Search with Window's Search-MS URI Handler"

• "ET TROJAN Suspected APT43 BRAVEPRINCE Related Activity (GET)"

• "ET TROJAN TA453/CharmingKitten HYPERSCRAPE Tool Sending System Information (POST)"

• "ET TROJAN Atya Dropper Possible Rootkit - HTTP GET"

• "ET CURRENT_EVENTS Observed TOAD Domain (hshelp .live in TLS SNI)"

• "ET TROJAN Observed TA444 Domain (docuprivacy .com in TLS SNI)"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .tech .linkpc .net)"

• "ET CURRENT_EVENTS Successful Personalized DHL Phish 2016-10-20"

• "ET MOBILE_MALWARE Arid Viper (samehnew-10a7c .firebaseio .com in DNS Lookup)"

• "ET TROJAN Observed TA444 Domain (bankofamerica .tel in TLS SNI)"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (info .payamradio .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET CURRENT_EVENTS Successful Wallet Connect Pass Phrase Phish 2023-02-03"

• "ET MOBILE_MALWARE Android APT-C-23 (octavia-blake .world in DNS Lookup)"

• "ET TROJAN CargoBay User-Agent"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bscare .info)"

• "ET TROJAN Win32/Spy.Odlanor CnC Checkin"

• "ET TROJAN Outbound POST Request with ps PowerShell Command Output"

• "ET TROJAN Bedep HTTP POST CnC Beacon"

• "ET TROJAN NOBELIUM (TA421) CnC Domain in DNS Lookup"

• "ET TROJAN Thallium CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (seattlecarwash .fun)"

• "ET TROJAN Kaspersky Sinkhole DNS Reply"

• "ET TROJAN ELF/Emptiness v1 UDP Flood Command Inbound"

• "ET TROJAN Ransomware Locky .onion Payment Domain"

• "ET MALWARE Win32/DealPly CnC Checkin"

• "ET MOBILE_MALWARE Arid Viper (dash-chat-c02b3 .appspot .com in DNS Lookup)"

• "ET CURRENT_EVENTS Fiesta EK IE Exploit Apr 23 2015"

• "ET TROJAN Qadars CnC DNS Lookup (liveskansys.com)"

• "ET TROJAN PPI User-Agent (InstallCapital)"

• "ET CURRENT_EVENTS SUSPICIOUS EXE Download from specific file share site (used in recent maldoc campaign)"

• "ET TROJAN FIN8 SARDONIC CnC Domain in DNS Lookup (api-cdn .net)"

• "ET TROJAN ELF/Miner Loader Activity M1 (GET)"

• "ET TROJAN Generic Downloader checkin (3)"

• "ET TROJAN Kimsuky Related Maldoc Activity (HEAD)"

• "ET TROJAN LNK/Unknown Downloader CnC Checkin (POST)"

• "ET USER_AGENTS Suspicious User-Agent (runUpdater.html)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (investinadio .com) 2022-12-05"

• "ET TROJAN Panda Banker CnC"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2j4 .xyz)"

• "ET TROJAN Win32/MALWARECAT Exfil via SMTP"

• "ET TROJAN Fake Opera 8.11 UA related to Trojan Activity"

• "ET MALWARE Xpire.info Spyware Install Reporting"

• "ET CURRENT_EVENTS Observed DNS Query to OWA Phishing Domain"

• "ET CURRENT_EVENTS Successful Amazon Phish 2015-11-07"

• "ET CURRENT_EVENTS Observed Zimbra Phishing Landing Page 2021-08-09"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .growind .info)"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 18"

• "ET TROJAN W32/Asprox Passgrub POST CnC Beacon"

• "ET TROJAN Chthonic Check-in"

• "ET WEB_SERVER c99 Shell Backdoor Var Override Cookie"

• "ET TROJAN WEBC2-KT3 Intial Connection Beacon APT1 Related"

• "ET EXPLOIT Possible DOUBLEPULSAR Beacon Response"

• "ET TROJAN Danabot UA Observed"

• "ET TROJAN Poebot Related User Agent (SPM_ID=)"

• "ET TROJAN Suspected Bumblebee Loader Activity"

• "ET USER_AGENTS Suspicious User-Agent (c \windows)"

• "ET CURRENT_EVENTS Successful Ameli.fr Phish M2 Oct 26 2016-10-26"

• "ET TROJAN Qbot Payload Request (2023-03-13) M4"

• "ET TROJAN Netwire RAT Check-in"

• "ET MOBILE_MALWARE Android APT-C-23 (esofiezo .website in TLS SNI)"

• "ET TROJAN r0 CnC Check"

• "ET TROJAN Suspected Win32/HMR RAT/LOBSHOT Initial Handshake"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (registration-ae-enoc .com) 2022-12-05"

• "ET TROJAN EvilNum CnC Checkin"

• "ET TROJAN APT28/Sednit DNS Lookup (trend-news .org)"

• "ET CURRENT_EVENTS Apple Phishing Landing Jan 30 2014"

• "ET TROJAN Observed DNS Query to Ursnif Domain (dodsman .com)"

• "ET TROJAN IcedID Observed Domain (loadfreeman .casa in TLS SNI)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (abienceinvestments-fze .com) 2022-12-05"

• "ET CURRENT_EVENTS Observed Evil Keitaro TDS Redirection Domain (fiberswatch .com in TLS SNI)"

• "ET CURRENT_EVENTS Stripe Phishing Landing Dec 09 2016"

• "ET TROJAN ELF/Muhstik - IRC CnC Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (e9 .wf)"

• "ET TROJAN Fake Google Chrome Error Domain in DNS Lookup (chromedistcdn .cloud)"

• "ET TROJAN Nim Based Downloader Activity (GET)"

• "ET TROJAN W32.Razy Inject Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Phishing Landing Hosted on CodeSandbox.io M1"

• "ET TROJAN Possible MEME#4CHAN Exfil Activity"

• "ET CURRENT_EVENTS Covid19 Stimulus Payment Phish Inbound M2 (2021-10-21)"

• "ET TROJAN PS/PSRansom Client Checkin (GET)"

• "ET CURRENT_EVENTS GCash Credential Phish Landing Page 2022-06-17"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (Jasper CnC)"

• "ET TROJAN [FIREEYE] SLIGHTPULSE Webshell Activity M2 (set) M1"

• "ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)"

• "ET TROJAN Observed Malicious SSL Cert (Moist Stealer CnC)"

• "ET TROJAN NOBELIUM Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Fruspam polling for IP likely infected"

• "ET TROJAN Suspected Gamaredon APT Related Activity (GET)"

• "ET TROJAN Win32/RecordBreaker - Observed UA M2"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (help2014 .linkpc.net)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Orca RAT URI Struct 4"

• "ET MOBILE_MALWARE Android APT-C-23 (billy-bones .info in TLS SNI)"

• "ET TROJAN TeleBots BCS-server User-Agent"

• "ET CURRENT_EVENTS Observed TOAD Domain (eshopper .top in TLS SNI)"

• "ET TROJAN [AV] EarthWorm/Termite IoT Agent Reporting Infection"

• "ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M3"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN ProxyBox - HTTP CnC - getiplist.php"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/Modi RAT CnC Command Outbound (ds)"

• "ET USER_AGENTS Suspicious User-Agent (C slash)"

• "ET CURRENT_EVENTS Successful Liqui Cryptocurrency Exchange Phish 2017-12-28"

• "ET TROJAN Win32/WhiskerSpy - Key Material Upload"

• "ET TROJAN Possible W32/KanKan tools.ini Request"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET CURRENT_EVENTS Observed TOAD Domain (hscare .us in TLS SNI)"

• "ET CURRENT_EVENTS EDD Credential Phish Landing Page M2 2023-03-16"

• "ET TROJAN Win32/Remcos RAT Checkin 58"

• "ET TROJAN Lu0bot CnC Domain in DNS Lookup (apo .eus80 .fun)"

• "ET MOBILE_MALWARE Possible Trojan-Banker.AndroidOS.Sharkbot Activity (DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Suspected HARDPULSE Request"

• "ET TROJAN APT DNSpionage/Karkoff CnC Domain in DNS Lookup"

• "ET TROJAN Wintervivern Related CnC Domain in DNS Lookup (secure-daddy .com)"

• "ET CURRENT_EVENTS JDB Exploit Kit Fake Adobe Download"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Generic Trojan Checkin (UA VBTagEdit)"

• "ET TROJAN [ANY.RUN] TheBoxClipper CnC Activity (getkeys)"

• "ET TROJAN Win32/Delf.BLL Variant CnC Activity (Inbound)"

• "ET TROJAN Win32/Injector.BXEW Variant HTTP CnC Beacon 1"

• "ET TROJAN WinGo/YT Stealer CnC Checkin"

• "ET TROJAN Turkojan C&C Browse Drive Command (BROWSC)"

• "ET TROJAN APT28/Sednit DNS Lookup (politicalreview .eu)"

• "ET TROJAN Observed IcedID Domain (80frontluzkher .xyz in TLS SNI)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Observed Win32/Ymacco.AA36 User-Agent"

• "ET TROJAN Win32/Ducktail Exfil Via Telegram CnC Response"

• "ET TROJAN Win32/Ponmocup.A Checkin"

• "ET TROJAN SocGholish Domain in TLS SNI (sommelier .peppertreecanyon .com)"

• "ET CURRENT_EVENTS SUSPICIOUS PSHELL Downloader Primitives B641 Oct 19 2017"

• "ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup"

• "ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M1"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (jaxebiridi .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2"

• "ET CURRENT_EVENTS Successful EDF Account Phish 2015-09-01"

• "ET TROJAN Darkness DDoS Common Intial Check-in Response wtf"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (marmelokpa .com)"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET TROJAN Win32/Remcos RAT Checkin 65"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET CURRENT_EVENTS L33bo Phishing Kit - Successful Credential Phish M1 2016-03-29"

• "ET CURRENT_EVENTS Successful Outlook WebApp Phish 2016-09-02"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (ilokod .com)"

• "ET TROJAN Win32/RisePro CnC Command Outbound (get_settings)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT CozyCar SSL Cert 1"

• "ET CURRENT_EVENTS [TW] Robin Banks Redirect M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed TraderTraitor Domain (datadog-cloud .com in TLS SNI)"

• "ET CURRENT_EVENTS DHL Credential Phish Landing Page 2022-10-07"

• "ET EXPLOIT Possible ETERNALCHAMPION MS17-010 Sync Response"

• "ET TROJAN W32/Snojan.BNQKZQH User-Agent"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2018-05-02"

• "ET TROJAN Minirem"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN Observed TWISTEDPANDA Domain in TLS SNI (www .minzdravros .com)"

• "ET MALWARE DriverTurbo Domain (driverturbo .com) in DNS Lookup"

• "ET MALWARE User-Agent (MSIE7 na)"

• "ET TROJAN Win32/PurpleWave Stealer CnC Exfil"

• "ET MOBILE_MALWARE Android/SOVA Banking Trojan Activity (bot registration)"

• "ET TROJAN Downloader.Banload2.KZU Checkin 2"

• "ET TROJAN APT28/Sednit DNS Lookup (euronews24 .info)"

• "ET TROJAN Suspected Fancy Bear (APT28) Maldoc CnC"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (implacavelvideos .com)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (mod-mil .online)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (giantos .xyz)"

• "ET TROJAN Observed GandCrab Ransomware CnC/IP Check Domain (malwarehunterteam .bit in DNS Lookup)"

• "ET TROJAN Cobalt Strike Beacon (WooCommerce Profile)"

• "ET TROJAN UPDATE Protocol Trojan Communication detected on non-http ports 2"

• "ET TROJAN Galock Ransomware Command"

• "ET CURRENT_EVENTS America First CU Account Recovery 2022-10-27"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN Win32/WarHawk Activity (task)"

• "ET TROJAN RouteX CnC Domain (dcb5684707f6c66492aaa9f7d9bfb5a6 .biz) in DNS Lookup"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET CURRENT_EVENTS Successful Personalized Webmail Phish 2016-10-05"

• "ET TROJAN Win32/WarHawk Activity (cmd)"

• "ET TROJAN Sage Ransomware Checkin"

• "ET CURRENT_EVENTS SUSPICIOUS PSHELL Downloader Primitives B644W Oct 19 2017"

• "ET TROJAN IndigoZebra APT BoxCaon DropBox Activity (POST)"

• "ET TROJAN APT33/CharmingKitten JS/HTA Stage 1 CnC Checkin"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M9"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN W32/Briba CnC POST Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (dachfunny .us in DNS Lookup)"

• "ET TROJAN Reply Sinkhole - irc-sinkhole.cert.pl"

• "ET TROJAN Aurora/OneKeyLocker Ransomware CnC Checkin"

• "ET TROJAN Win32/Lilith Stealer getFile Command"

• "ET MALWARE Win-touch.com Spyware User-Agent (WTRecover)"

• "ET TROJAN Chafer Win32/TREKX Uploading to CnC (Modified CAB)"

• "ET TROJAN Observed DNS Query to Certishell Domain (profiit .fiit .stuba .sk)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (activedardash .club in DNS Lookup)"

• "ET TROJAN Win32/Blacktech Plead CnC Activity (GET)"

• "ET CURRENT_EVENTS Generic XBALTI Phishing Landing"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 7"

• "ET TROJAN HTTPRevShell Initial CnC Checkin"

• "ET TROJAN Possible CopyKittens DNS Lookup (windows24-kernel.in)"

• "ET TROJAN Qbot Payload Request (2023-03-13) M8"

• "ET CURRENT_EVENTS ID.me Credential Theft Landing Page 2023-06-21"

• "ET TROJAN DNS Query to Raspberry Robin Domain (m0 .wf)"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .qhsbobfv .top)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (musclefarelongea .pw)"

• "ET CURRENT_EVENTS Possible Successful Phish to Hostinger Domains M5 2016-04-04"

• "ET TROJAN MAGICHOUND-related DNS Lookup (com-ho .me)"

• "ET TROJAN ELF/muBoT IRC Activity 3"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2022-06-21"

• "ET TROJAN PNScan.2 Inbound Status Check Response"

• "ET MOBILE_MALWARE Android APT-C-23 (james-charles .club in DNS Lookup)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (skanfordiporka .com)"

• "ET TROJAN CozyDuke APT Possible SSL Cert 2"

• "ET TROJAN DNS Query to TA444 Domain (cyberwalletsecurity .online)"

• "ET TROJAN Observed Lazarus Domain (online-meeting .team in TLS SNI)"

• "ET CURRENT_EVENTS Successful Bank of America Phish (set) M1 2016-10-14"

• "ET WEB_CLIENT Paypal Phishing Redirect M1 Feb 24 2017"

• "ET MOBILE_MALWARE Adware.Adwo.A"

• "ET TROJAN W32/Ke3chang.Dream.APT Campaign CnC Beacon 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible SharpShooter Framework Generated VBS Script"

• "ET TROJAN JS/Cloud9 Clipboard Exfiltration Attempt"

• "ET TROJAN Linux/Agent.HX CnC Activity M1"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN Observed Malicious SSL Cert (OSX/AppleJeus Variant CnC)"

• "ET TROJAN Windows Executable Sent When Remote Host Claims to Send a RAR Archive"

• "ET CURRENT_EVENTS Powershell Download Command Observed within Flash File - Probable EK Activity"

• "ET ATTACK_RESPONSE reNgine Recon Panel Inbound"

• "ET WEB_CLIENT Tech Support Scam Landing 2020-08-19"

• "ET TROJAN ApolloLocker Ransomware CnC Checkin"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (projectpredator .space in DNS Lookup)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN GoBrut/StealthWorker Service Bruter CnC Checkin"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Observed Malicious SSL Cert (Darkme CnC)"

• "ET TROJAN W32/Neverquest.InfoStealer Configuration Request CnC Beacon"

• "ET USER_AGENTS Suspicious User-Agent (SERVER2_03)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Tandem Espionage CnC Domain (dwrfqitgvmqn .ru) in DNS Lookup"

• "ET TROJAN TWISTEDPANDA CnC Domain in DNS Lookup (www .minzdravros .com)"

• "ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce 2]"

• "ET TROJAN Vawtrak/NeverQuest Posting Data 2"

• "ET TROJAN Teslarvng Ransomware CnC Activity M1"

• "ET TROJAN Win32/Nemty Ransomware Style Geo IP Check M1"

• "ET TROJAN JavaRAT Sending Screen Size"

• "ET TROJAN DNS Query to TA444 Domain (swissborg .blog)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Cobalt Strike Beacon Activity (UNC2447)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Meterpreter or Other Reverse Shell SSL Cert"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (adbntogo .com) 2022-12-05"

• "ET TROJAN Predator Pain Sending Data over SMTP"

• "ET TROJAN Confucious APT Related Domain in DNS Lookup (viterwin .club)"

• "ET TROJAN Suspicious POST with Common Windows Process Names - Possible Process List Exfiltration"

• "ET TROJAN Hong Kong SWC Attack PcClient CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (metasupportmail .co)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 24"

• "ET TROJAN Shurl0ckr Ransomware CnC (kdvm5fd6tn6jsbwh .onion .to in DNS Lookup)"

• "ET MALWARE Best-targeted-traffic.com Spyware Install"

• "ET CURRENT_EVENTS Successful DHL Phish 2015-11-14"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2016-10-21"

• "ET TROJAN APT29/WellMess CnC Activity"

• "ET TROJAN Mimikatz x64 Mimidrv.sys Download Over HTTP"

• "ET TROJAN MSIL/Spy.Agent.DYS Exfil"

• "ET TROJAN Win32/Swizzor User-Agent (Swizz03r)"

• "ET CURRENT_EVENTS DRIVEBY Generic - Redirection to Kit - BrowserDetect with var stopit"

• "ET WEB_CLIENT Tech Support Phone Scam Landing Jun 29 M3"

• "ET MALWARE PCAcceleratePro PUA/Adware User-Agent"

• "ET TROJAN CozyDuke APT Possible SSL Cert 4"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (wallanews .sytes.net)"

• "ET TROJAN Observed Karen Ransomware CnC Checkin"

• "ET TROJAN Observed GoLang Dropper Domain (en7dftkjiipor .x .pipedream .net in TLS SNI)"

• "ET MALWARE DNS Query to Neoreklami (service-domain .xyz)"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .ddns .net)"

• "ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4kx .xyz)"

• "ET TROJAN Ransomware Locky .onion Payment Domain (mphtadhci5mrdlju)"

• "ET TROJAN Gh0st Remote Access Trojan Encrypted Session To CnC Server"

• "ET TROJAN Ares Loader Observed User-Agent M1"

• "ET TROJAN Chafer Win32/TREKX Uploading to CnC"

• "ET P2P Bittorrent P2P Client User-Agent (Bittorrent/5.x.x)"

• "ET TROJAN Possible Outbound WebShell GIF"

• "ET TROJAN Win32/SodaMaster domain observed in TLS SNI (www. rare-coisns. com)"

• "ET TROJAN Kimsuky APT Related Activity (GET)"

• "ET TROJAN ServHelper CnC Inital Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to MINEBRIDGE CnC Domain (compilator333 .top)"

• "ET TROJAN Kinsing Botnet Related Domain in DNS Lookup (tempest .lib)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (online-meeting .team)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Deathstalker/Evilnum Delivery Domain (puccino .altervista .org) in TLS SNI"

• "ET TROJAN Piptea.a Related Trojan Checkin (2)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (vrondafarih .com)"

• "ET TROJAN Observed Cobalt Strike CnC Domain (security-desk .com in TLS SNI)"

• "ET TROJAN DonotGroup Related Domain in DNS Lookup (mimeversion .top)"

• "ET CURRENT_EVENTS Successful Mailbox Renew Phish 2015-08-14"

• "ET TROJAN Trojan:Win32/WinLNK.APA!MTB Payload Request"

• "ET USER_AGENTS Suspicious User Agent (BlackSun)"

• "ET TROJAN [PTsecurity] Trojan.JS.Agent.dwz Checkin 2"

• "ET TROJAN BunnyLoader Heartbeat Acknowledgement"

• "ET CURRENT_EVENTS Successful DHL Credential Phish M2 2022-06-09"

• "ET ATTACK_RESPONSE Hostile FTP Server Banner (Bot Server)"

• "ET TROJAN Win32/ZaRaza Stealer Activity via Telegram (Response)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET MALWARE Win32.LoadMoney User Agent 2"

• "ET CURRENT_EVENTS Generic Credential Phish Activity GET"

• "ET TROJAN Ransomware Locky CnC Beacon 2"

• "ET TROJAN TA453 Related CnC Domain in DNS Lookup (0storageatools0 .xyz)"

• "ET CURRENT_EVENTS ScanBox Jun 06 2015 M3 T1"

• "ET MALWARE Conduit Trovi Adware/PUA"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 11"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bgcare .help)"

• "ET TROJAN Revoyem Ransomware Check-in"

• "ET TROJAN Win32/Teslacrypt Ransomware .onion domain (7tno4hib47vlep5o)"

• "ET TROJAN OSX/MapperState CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (barakal .ru)"

• "ET WEB_CLIENT Tech Support Scam 2020-04-10"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET TROJAN Downloader/Win.MalXll.R466354 Payload Request"

• "ET CURRENT_EVENTS Zuponcic Hostile JavaScript"

• "ET TROJAN Capfire4 Checkin (register machine)"

• "ET TROJAN TraderTraitor dafom CnC Checkin M1 (POST)"

• "ET CURRENT_EVENTS NeoSploit Jar with three-letter class names"

• "ET TROJAN SideCopy APT Related Backdoor Sending System Information (POST)"

• "ET MALWARE MuLauncher Telemetry Gathering Attempt"

• "ET TROJAN Octopus Malware CnC Server Request"

• "ET CURRENT_EVENTS Spelevo EK Flash Exploit Attempt"

• "ET TROJAN Win32/LockScreen.BW Payment Info 2"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (dubai .network .cloud .doc-shared .linkpc .net)"

• "ET CURRENT_EVENTS Generic Mailer Accessed on External Compromised Server"

• "ET CURRENT_EVENTS GET Request to Appspot Hosting (set)"

• "ET TROJAN Win32/Unk.Joia CnC Activity"

• "ET TROJAN Win32/Teslacrypt Ransomware .onion domain (wh47f2as19.com)"

• "ET CURRENT_EVENTS [Fireeye] POSSIBLE HackTool.TCP.Rubeus.[User32LogonProcesss]"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M5 Jun 3"

• "ET TROJAN SysJoker Dropper Related Domain in DNS Lookup (github .url-mini .com)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (whatsapp-app .com)"

• "ET TROJAN Corebot Checkin"

• "ET TROJAN Win32/Tibs Checkin"

• "ET CURRENT_EVENTS Successful Personalized DHL Phish 2016-10-12"

• "ET TROJAN Observed APT Actor Payload Domain (archive-downloader .com in TLS SNI)"

• "ET INFO Suspicious HTML Hex Obfuscated Title - Possible Phishing Landing Jun 28 2017"

• "ET CURRENT_EVENTS DrSpam Phishing Landing CSS 2016-06-08"

• "ET CURRENT_EVENTS Successful OWA Phish Apr 25 2017"

• "ET TROJAN Gamaredon Domain in DNS Lookup (karoanpa .ru)"

• "ET TROJAN Win32.Bicololo Response 1"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN APT DNSpionage/Karkoff CnC Domain in DNS Lookup"

• "ET TROJAN TeslaCrypt/AlphaCrypt Variant .onion Proxy Domain (iq3ahijcfeont3xx)"

• "ET MOBILE_MALWARE Android APT-C-23 (italk-chat .info in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (gmailservice .us in DNS Lookup)"

• "ET TROJAN DonotGroup APT CnC Domain in DNS Lookup"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (int-secure .org)"

• "ET TROJAN Socks666 Successful Connect Packet Packet"

• "ET WEB_SERVER auto_prepend_file PHP config option in uri"

• "ET CURRENT_EVENTS Successful Generic Phish (set) Oct 30 2017"

• "ET TROJAN Observed Gamaredon Domain (orientalebi .ru in TLS SNI)"

• "ET TROJAN Maldoc Retrieving Remote Template (GET)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j4z .co)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET USER_AGENTS Suspicious User-Agent (App4)"

• "ET CURRENT_EVENTS Successful Mailbox Deactivation Phish 2016-12-15"

• "ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon"

• "ET TROJAN TA430/Andariel ACRES Backdoor Activity (GET)"

• "ET MALWARE PUP Win32.SoftPulse Retrieving data"

• "ET TROJAN Win32/Ascrirac .onion proxy Domain (5sse6j4kdaeh3yus)"

• "ET TROJAN Bitter APT AlmondRAT CnC Checkin"

• "ET MALWARE 2020search/PowerSearch Toolbar Adware/Spyware - GET"

• "ET CURRENT_EVENTS Successful HM Revenue & Customs Phish M2 Apr 07 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DonotGroup CnC Domain in DNS Lookup (drivethrough .top)"

• "ET MOBILE_MALWARE Android APT-C-23 (mary-crawley .com in DNS Lookup)"

• "ET TROJAN Possible Kimsuky Related Exfil"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (nikanpsx .top)"

• "ET CURRENT_EVENTS Successful Wells Fargo Mobile Phish 2016-08-01 M2"

• "ET MALWARE Observed DNS Query to OSX/Bundalore Domain"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 3"

• "ET CURRENT_EVENTS Observed TOAD Domain (h2care .us in TLS SNI)"

• "ET USER_AGENTS SFML User-Agent (libsfml-network)"

• "ET MOBILE_MALWARE NSO Related Domain 7"

• "ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce]"

• "ET TROJAN Sasfis Botnet Client Reporting Back to Controller After Command Execution"

• "ET MALWARE my247eshop .com User-Agent"

• "ET INFO Terse Request for WordPress Site ending in all digits"

• "ET TROJAN Bladabindi/njrat CnC Keep-Alive (OUTBOUND)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Emotet CnC Beacon"

• "ET TROJAN Dridex/Bugat/Feodo GET Checkin"

• "ET CURRENT_EVENTS Possible Successful Apple Phish 2015-07-27"

• "ET TROJAN Ranscam Ransomware Contact Form"

• "ET CURRENT_EVENTS Successful Generic Webmail Phish 2016-10-21"

• "ET CURRENT_EVENTS Account Update Phishing Landing 2016-09-06"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (jagernaut .com)"

• "ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M4"

• "ET TROJAN W32/Hesperus.Banker Nlog.php Variant Sending Data To CnC"

• "ET TROJAN US-CERT TA14-353A Listening Implant 7"

• "ET TROJAN Fake Google Chrome Error Domain in DNS Lookup (yhdmb .xyz)"

• "ET TROJAN Win32/SupremeBot CnC Checkin (POST) M2"

• "ET TROJAN Win32.FakeAV.Rean Checkin"

• "ET TROJAN eCh0raix/QNAPCrypt CnC Activity - Started"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (snxn298y5brpxd67rbntynb6p4qupuuv .com in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (n5 .ms)"

• "ET TROJAN Sharik/Smoke Loader Adobe Connectivity check"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2022-09-28"

• "ET TROJAN Oficla Checkin (1)"

• "ET TROJAN Win32/SVCReady Loader Requesting Payload"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET MOBILE_MALWARE Observed NSO Group CnC Domain in TLS SNI (stilloak .net)"

• "ET MOBILE_MALWARE NSO Related Domain 33"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-chat .com)"

• "ET TROJAN Observed Malicious SSL Cert (MSIL/Agent.TRM CnC)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET MOBILE_MALWARE Android APT-C-23 (accounts-gocgle .com in TLS SNI)"

• "ET MOBILE_MALWARE Android Trojan Fake10086 checkin 2"

• "ET TROJAN VoidRay Downloader CnC Activity"

• "ET TROJAN OSX/NukeSped Variant CnC Domain in DNS Lookup (globalkeystroke .com)"

• "ET TROJAN MSIL/Spy.Banker.DH Checkin"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky C2)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Possible WannaCry DNS Lookup 1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (margaery-tyrell .info in DNS Lookup)"

• "ET TROJAN Win32/Onliner Receiving Commands from CnC"

• "ET TROJAN Observed DNS Query to NanoCore Domain (nanocore2023 .duckdns .org)"

• "ET TROJAN Observed Gamaredon APT Related Domain (anguisbi .ru in TLS SNI)"

• "ET USER_AGENTS Suspicious User-Agent (56)"

• "ET TROJAN W32/Kazy.325252 Variant CnC Beacon 1"

• "ET TROJAN Lazarus Decafett DNS Lookup 4"

• "ET TROJAN Possible Malicious Macro EXE DL AlphaNumL"

• "ET TROJAN Possible Evil Macro Downloading Trojan Dec 16 2015 Post to EXE"

• "ET MOBILE_MALWARE Windows Phone PUA.Redpher (myservicessapps .com in DNS Lookup)"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (ansonwhitmore .live)"

• "ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (quantumbots .xyz in TLS SNI)"

• "ET TROJAN Illusion Bot (Lussilon) Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (parrotchat .co in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .live in DNS Lookup)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (b3vv .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN Urlzone/Bebloh Trojan Check-in"

• "ET CURRENT_EVENTS Possible Phishing Landing Captcha Check"

• "ET WEB_CLIENT Common /mpp/ Phishing URI Structure 2016-02-08"

• "ET MALWARE Fake Software Download Redirect Leading to Malware M1"

• "ET MOBILE_MALWARE Android APT-C-23 (freya .miranda-barlow .website in DNS Lookup)"

• "ET TROJAN General Win32 Backdoor Checkin POST"

• "ET TROJAN Winsoft.E Checkin 3"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b DNS Lookup"

• "ET TROJAN Win32/Packed.Themida.AAL Checkin"

• "ET TROJAN Worm.VBS.ayr CnC command (is-enum-process)"

• "ET TROJAN [PTsecurity] Black Stealer Exfil FTP STOR"

• "ET CURRENT_EVENTS Successful Craigslist Phish 2016-07-11"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (google_chrome_default_) M2"

• "ET CURRENT_EVENTS Observed TOAD Domain (bgcare .online in TLS SNI)"

• "ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 1"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback Response (Get Passwords)"

• "ET TROJAN Win32/Spy.Socelars.S CnC Activity M4 (GET)"

• "ET CURRENT_EVENTS Successful View Invoice Phish M1 2016-10-05"

• "ET TROJAN DNS Query to Raspberry Robin Domain (f0 .tel)"

• "ET MALWARE W32/SoftonicDownloader.Adware User Agent"

• "ET TROJAN W32/Echmark/MarkiRAT CnC Host Checkin"

• "ET TROJAN Packed Perl with Eval Statement"

• "ET TROJAN PHP Skimmer CnC Domain in DNS Lookup (secure-authorize .net)"

• "ET CURRENT_EVENTS HT SWF Exploit RIP M2"

• "ET TROJAN MSIL/Small.FU Variant CnC Activity M1"

• "ET TROJAN Tinba Checkin"

• "ET CURRENT_EVENTS RIG Landing URI Struct March 20 2015"

• "ET TROJAN SocGholish Domain in TLS SNI (sermon .pastorbriantubbs .com)"

• "ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"

• "ET TROJAN Gamaredon Domain in DNS Lookup (orientalebi .ru)"

• "ET TROJAN Win32/VB.QPK CnC Checkin"

• "ET TROJAN TA444 Domain in DNS Lookup (voldemort .myvnc .com)"

• "ET CURRENT_EVENTS Successful Facebook Phish 2019-04-26"

• "ET TROJAN Volatile Cedar DNS Lookup (carima2012.site90.com)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Fodcha Bot CnC Checkin"

• "ET CURRENT_EVENTS Terse POST to Wordpress Folder - Probable Successful Phishing M3"

• "ET CURRENT_EVENTS Generic Redirector Phishing Landing 2021-03-10"

• "ET TROJAN DNS Query to Teal Kurma Domain (upt .mcsoft .org)"

• "ET TROJAN Possible FortDisco Reporting Hacked Accounts"

• "ET TROJAN DTLoader Binary Request M2"

• "ET TROJAN Possible Winnti TLS Certificate Observed"

• "ET MALWARE MALWARE W32/WinWrapper.Adware User-Agent"

• "ET TROJAN Possible Pegasus Related DNS Lookup (asrarrarabiya .com)"

• "ET TROJAN PUSHCHA Related Domain in DNS Lookup (passport-log .online)"

• "ET MALWARE User-Agent (Download Agent) Possibly Related to TrinityAcquisitions.com"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 22"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 15"

• "ET TROJAN W32/Koobface Variant Checkin Attempt"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Cashout Proxy Bot reg_DST"

• "ET TROJAN Carberp CnC request POST /set/task.html"

• "ET TROJAN Observed Suspected TA453 Related Domain (metahelpservice .net in TLS SNI)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (letsmakesome .fun)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (i2care .cc)"

• "ET TROJAN Win32/Eternity Stealer Activity (POST)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Excel Phish 2016-11-17"

• "ET MOBILE_MALWARE Arid Viper (fasbcaok .com in DNS Lookup)"

• "ET MALWARE Win32/Adware.InstallCommerce.A CnC Checkin"

• "ET TROJAN Win32/WhiskerSpy CnC Activity"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Activity (System Information)"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (jobintro .linkpc .net in TLS SNI)"

• "ET TROJAN Qbot Payload Request (2023-03-21) M5"

• "ET TROJAN GoldenSpy Domain Observed"

• "ET TROJAN TraderTraitor dafom CnC Checkin M2 (POST)"

• "ET TROJAN OSX/Flashback.K/I reporting successful infection"

• "ET TROJAN JavaRAT Keep-Alive (inbound)"

• "ET TROJAN Lazarus APT Related Maldoc Activity (GET)"

• "ET CURRENT_EVENTS PerSwaysion Phishkit Javascript - Observed Repetitive Custom CSS Components"

• "ET TROJAN Kriptovor External IP Lookup checkip.dyndns.org"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cdn-pak .net)"

• "ET EXPLOIT Metasploit Plugin-Detect Posting Data 6"

• "ET TROJAN Win32/Nivdort Posting Data 1"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 Sep 15 2017"

• "ET TROJAN FAKE YAHOO SSL Cert APT1"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (databasegalore .com in TLS SNI)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (visualstudiofactory .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Suspected Lazarus APT Related Backdoor Activity (POST) M2"

• "ET TROJAN Patchwork APT Related Domain in DNS Lookup (dayspringdesk .xyz)"

• "ET MALWARE GMUnpackerInstaller.A Checkin"

• "ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 11"

• "ET CURRENT_EVENTS Possible Sakura Exploit Kit Version 1.1 document.write Fake 404 - Landing Page"

• "ET WEB_SERVER c99 Shell Backdoor Var Override Client Body"

• "ET TROJAN Backdoor.Elise CnC Beacon 3 M2"

• "ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (font .backuplogs .xyz)"

• "ET CURRENT_EVENTS Suspicious Proxifier DL (non-browser observed in maldoc campaigns)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Mozilla_Firefox_Cookies) M1"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET MOBILE_MALWARE IOS_XAGENT UA"

• "ET TROJAN Jupyter Stealer Reporting System Information"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 2"

• "ET TROJAN linux.backdoor.wordpressexploit.1 JS backdoor retrieval"

• "ET TROJAN DNS Query to Raspberry Robin Domain (d4j .club)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Carribean International Bank Account Phish 2015-08-25"

• "ET TROJAN Downloader.Win32.Tesch.A Server CnC Checkin Reply"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-blog .xyz)"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 10"

• "ET CURRENT_EVENTS Successful Mailbox Shutdown Phish M1 2016-05-16"

• "ET TROJAN Mirai pTea Variant - Info Submission Outbound"

• "ET TROJAN MSIL/Runsome Ransomware CnC Checkin"

• "ET TROJAN MSIL/Heracles Variant CnC Activity"

• "ET TROJAN Observed BazarLoader Domain (moig .xyz in TLS SNI)"

• "ET CURRENT_EVENTS SunDown EK RIP Landing M4 B641"

• "ET TROJAN DNS Query to MINEBRIDGE CnC Domain (123faster .top)"

• "ET TROJAN Win32/Atraps Receiving Config via Image File (steganography)"

• "ET TROJAN Android/AhMyth RAT Command Inbound (SMS Manager)"

• "ET TROJAN Observed DNS Query to AppleJeus Domain (bloxholder .com)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (officestoragebox .com)"

• "ET CURRENT_EVENTS Generic Custom Logo Phishing Landing"

• "ET TROJAN Amadey Stealer CnC"

• "ET MOBILE_MALWARE Android Fancy Bear Checkin 3"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (onelao .line .pm)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (server-avira .com) in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (geny-wise .com in DNS Lookup)"

• "ET TROJAN Win32.Chroject.B Requesting ClickFraud Commands from CnC"

• "ET MOBILE_MALWARE Android APT-C-23 (hotmailme .website in TLS SNI)"

• "ET CURRENT_EVENTS Successful Mailbox Renewal Phish 2016-08-19"

• "ET TROJAN Win32/Sabsik.FL.B!ml Exfil"

• "ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"

• "ET CURRENT_EVENTS Successful Monzo Credential Phish M2 2022-02-17"

• "ET CURRENT_EVENTS Observed TOAD Domain (hshelp .us in TLS SNI)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (tenders-adio .com) 2022-12-05"

• "ET TROJAN Bitter APT Domain in DNS Lookup (huandocimama .com)"

• "ET MOBILE_MALWARE Arid Viper (stevensmalley .pro in DNS Lookup)"

• "ET CURRENT_EVENTS W3LL STORE Credential Phish Landing Page (Success) 2023-05-05"

• "ET TROJAN MalDoc Exfil (2019-12-12)"

• "ET TROJAN W32/BaneChant.APT Winword.pkg Redirect"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET TROJAN AppleJeus - Kupay Wallet CnC Activity"

• "ET WEB_CLIENT Fake Virus Phone Scam Landing Mar 09 2017"

• "ET MALWARE Realtimegaming.com Online Casino Spyware Gaming Checkin"

• "ET CURRENT_EVENTS Successful Universal Webmail Phish 2016-08-19"

• "ET TROJAN MageCart JS Retrieval"

• "ET TROJAN [TGI] Cobalt Strike Malleable C2 Request (YouTube Profile)"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Possible iOS WebView Auto Dialer 2"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 72"

• "ET MALWARE YourSiteBar User-Agent (istsvc)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET CURRENT_EVENTS Lucy Security - Successful Phish"

• "ET TROJAN Rouge Security Software Win32.BHO.egw"

• "ET TROJAN PoshC2 - Observed Default URI Structure M10"

• "ET TROJAN MAGICHOUND.FETCH Retrieving Malicious PowerShell"

• "ET TROJAN W32/Quasar 1.3/Venom RAT Connectivity Check 2"

• "ET TROJAN MuddyWater Payload CnC Checkin"

• "ET MOBILE_MALWARE Possible Phenakite User-Agent"

• "ET TROJAN Observed Gamaredon APT Related Domain (patrios .ru in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (vs .gy)"

• "ET CURRENT_EVENTS W32/Caphaw DriveBy Campaign Statistic.js"

• "ET TROJAN Putter Panda 3PARA RAT initial beacon"

• "ET TROJAN Win32/Voltron/Spectre Stealer Sending OS Information (POST)"

• "ET TROJAN Observed 3CX Supply Chain Attack Cookie"

• "ET TROJAN Maldoc Activity (GET)"

• "ET TROJAN Evil PDF Retrieving Emotet Payload"

• "ET TROJAN Parallax CnC Activity (set) M14"

• "ET MALWARE Win32/MobiGame Install Stats Checkin M1"

• "ET TROJAN Lazarus Related Maldoc Activity"

• "ET CURRENT_EVENTS Badoo Phishing Landing 2018-07-19"

• "ET TROJAN W32/Asprox.ClickFraudBot CnC Beacon Acknowledgement"

• "ET CURRENT_EVENTS Observed DNS Query to Phishing Domain (apiujpnkbrhsdn57oi0ns0qmbaj0wcdzjhblj6frlh1tr .eur .lc)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (zirvaenergy .com) 2022-12-05"

• "ET TROJAN Legion Loader Activity Observed"

• "ET TROJAN DNS Query to Raspberry Robin Domain (g4 .wf)"

• "ET CURRENT_EVENTS Possible Locky VB/JS Loader Download Sep 08 2017"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN RCtrl Backdoor CnC Checkin M2"

• "ET TROJAN Qbot Payload Request (2023-03-21) M1"

• "ET TROJAN Ragnarok Ransomware CnC Activity M1"

• "ET CURRENT_EVENTS HellSpawn EK Landing 1 May 24 2013"

• "ET TROJAN [ANY.RUN] Phemedrone Stealer Exfiltration via Telegram"

• "ET TROJAN Loxes/Mongall Related CnC Beacon M4 (GET)"

• "ET TROJAN Babax Stealer Exfil via Telegram"

• "ET CURRENT_EVENTS Possible Generic Phishing Landing Jul 12 2013"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET CURRENT_EVENTS Successful Banco do Brasil Phish May 25 2017"

• "ET MALWARE Tool.InstallToolbar.24 Reporting"

• "ET CURRENT_EVENTS Successful Apple Phish M2 2016-09-29"

• "ET TROJAN QuickBooks Pop-Up Scam - Download Locations Response"

• "ET TROJAN Possible Worm W32.Svich or Other Infection Request for setting.doc"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (bitscrunch .im .linkpc .net)"

• "ET TROJAN VBulletin Backdoor C2 URI Structure"

• "ET TROJAN Cobalt Strike Beacon Activity (Wordpress Profile)"

• "ET MALWARE Loadmoney.A Checkin 1"

• "ET MOBILE_MALWARE Android APT-C-23 (engin-altan .website in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET TROJAN NightfallGT Discord Token Grabber"

• "ET ATTACK_RESPONSE webr00t WebShell Access"

• "ET CURRENT_EVENTS Observed TOAD Domain (cshelp03 .us in TLS SNI)"

• "ET TROJAN Observed Suspected TA453 Related Domain (metasupport .com in TLS SNI)"

• "ET TROJAN [PTsecurity] Trojan.Downloader VBA Script obfuscation (binary_getter)"

• "ET TROJAN OSX/SHLAYER CnC Checkin"

• "ET TROJAN Parallax CnC Response Activity M10"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1qm34lmk6eesc65zpw79lxes69zkq3ew .com)"

• "ET CURRENT_EVENTS Probable Sakura exploit kit landing page obfuscated applet tag Mar 28 2013"

• "ET MOBILE_MALWARE Android APT-C-23 (miwakosato .club in DNS Lookup)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1h3 .me)"

• "ET TROJAN Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Cipher_Suite length greater than Client_Hello Length)"

• "ET TROJAN Observed ZLoader Related Domain (lkjhgfgsdshja .com in TLS SNI)"

• "ET CURRENT_EVENTS Likely Malicious Windows SCT Download MSXMLHTTP M1"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (perfilcovid .com)"

• "ET TROJAN FastPOS Successful Software Update Request"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN BatLoader CnC Domain (updatea1 .com) in DNS Lookup"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (ns3.hostasa.org)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET MOBILE_MALWARE Android Golden Rat Checkin"

• "ET TROJAN Possible Pegasus Related DNS Lookup (mymensaje-sms .com)"

• "ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response M2"

• "ET TROJAN Observed BOUNCEBEAM Backdoor CnC Domain (cloudflare .5156game .com in TLS SNI)"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (wx .go890 .com)"

• "ET TROJAN Win32/S1deload Stealer Data Exfiltration Attempt M2"

• "ET INFO Rejetto HTTP File Sever Response"

• "ET TROJAN Mermaid Ransomware Variant CnC Activity M3"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-08-30"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 50"

• "ET TROJAN IRC Private message on non-standard port"

• "ET MALWARE ISearchTech.com XXXPornToolbar Activity (IST)"

• "ET TROJAN MAGICHOUND.LEASH IRC CnC Beacon"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 1 M1"

• "ET TROJAN Valyria Downloader Activity"

• "ET CURRENT_EVENTS Santander Phishing Landing"

• "ET TROJAN Cobalt Strike Malleable C2 (Meterpreter)"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Kimsuky APT Related Host Data Exfil M4"

• "ET TROJAN Netbounce Related Activity (Program Wrapper)"

• "ET CURRENT_EVENTS Possible Spartan/Nuclear EK Payload"

• "ET TROJAN Observed TA444 Domain (cloud .tptf .ltd in TLS SNI)"

• "ET MALWARE User-Agent (User-Agent Mozilla/4.0 (compatible ))"

• "ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Generic Credential Phish 2020-07-27 (set)"

• "ET TROJAN Possible Winnti-related Destination"

• "ET CURRENT_EVENTS Successful Luno Credential Phish 2022-10-20"

• "ET CURRENT_EVENTS Terror EK CVE-2015-2419 Exploit"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (windmencherser .com)"

• "ET TROJAN Suspected CHAOS CnC Inbound (getos)"

• "ET TROJAN DangerousPassword APT Related Domain in DNS Lookup (shopapptech .com)"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2016-05-16"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (mirohost .site in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Sidewinder APT CnC)"

• "ET TROJAN DonotGroup Related Domain in DNS Lookup (ppadoaolnwod .xyz)"

• "ET CURRENT_EVENTS Successful Bank of America Phish 2015-10-29"

• "ET TROJAN Gamaredon Style MalDoc .dot Download on freedynamicdns .org"

• "ET ATTACK_RESPONSE Amadey CnC Panel Inbound"

• "ET TROJAN Lazarus APT Related Loader Activity (GET)"

• "ET CURRENT_EVENTS Successful Fedex/DHL Phish 2018-10-22"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (wcmbqxzeuopnvyfmhkstaretfciywdrl .name)"

• "ET TROJAN TeslaCrypt/AlphaCrypt Variant .onion Payment Domain(fwgrhsao3aoml7ej)"

• "ET TROJAN Arid Viper APT DNS Lookup (mixedwork.com)"

• "ET TROJAN Observed TA444 Domain (gdocshare .one in TLS SNI)"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET CURRENT_EVENTS Possible Metasploit Java Payload"

• "ET TROJAN ELF/Rekoobe CnC Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Ziraat Bankasi (TK) Phish M1 Oct 12 2017"

• "ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 1"

• "ET TROJAN Observed Malware Delivery Domain (analyticsnet .top in TLS SNI)"

• "ET TROJAN PoetRAT Upload via HTTP"

• "ET TROJAN Observed Atomic macOS (AMOS) Stealer Payload Deliver Domain (trabingviews .com) in TLS SNI"

• "ET TROJAN Win32.ChinaZ.DDoSClient Checkin"

• "ET CURRENT_EVENTS [PTsecurity] Possible Malicious (HTA-VBS-PowerShell) obfuscated command"

• "ET TROJAN Emotet Style Request Activity (GET)"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-12-13"

• "ET WEB_CLIENT Tech Support Scam Landing 2018-07-18"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 52"

• "ET TROJAN TA444 Domain in DNS Lookup (indaddy .xyz)"

• "ET TROJAN ActionLoader CnC Domain in DNS Lookup (ekb .tanzedrom .ru)"

• "ET MALWARE Look2me Spyware Activity (1)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (gulfins-ae .com) 2022-12-05"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (wipro365 .com)"

• "ET CURRENT_EVENTS Spox Phish Kit Landing Page 2022-07-05"

• "ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement"

• "ET TROJAN Observed Malicious SSL Cert (MINEBRIDGE/MINEDOOR CnC)"

• "ET MOBILE_MALWARE Android/SOVA Banking Trojan Activity (number update)"

• "ET TROJAN LokiBot User-Agent (Charon/Inferno)"

• "ET TROJAN Win32/SystemBC CnC Checkin (null key) M1"

• "ET TROJAN LDPinch SMTP Password Report"

• "ET WEB_CLIENT Possible Phishing Redirect Dec 13 2016"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (windowlight .org)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (needzolapa .com)"

• "ET TROJAN ProjectSauron Remsec DNS Lookup (sx4-ws42 .yi.org)"

• "ET TROJAN MAGICHOUND-related DNS Lookup (chrome-up .date)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 25"

• "ET TROJAN MSIL/SamMiner CnC Checkin M2"

• "ET CURRENT_EVENTS Chase Account Phish Landing Oct 22"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (treegreeny .org)"

• "ET TROJAN HTA.BabyShark Checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 74"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Observed AgentTesla Domain Request"

• "ET TROJAN Possible Dragonfly APT Activity - SMB credential harvesting"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.t (TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert IRS Credential Phish Domain (jbdelmarket .com)"

• "ET CURRENT_EVENTS Successful Zoom.us Phish 2021-10-25"

• "ET TROJAN Possible Tracur.Q HTTP Communication"

• "ET TROJAN Possible Pegasus Related DNS Lookup (mobile-analytics .netweb-cloud-services .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (l0 .wf)"

• "ET CURRENT_EVENTS Successful EC21 B2B Phish 2016-10-21"

• "ET TROJAN Zeus POST Request to CnC sk1 and bn1 post parameters"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2016-10-05"

• "ET TROJAN Observed Cobalt Strike CnC Domain (www .msfthelpdesk .com in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Group 21 CnC Domain Observed in DNS Query"

• "ET TROJAN Observed DNS Query to Ursnif Domain (prises .cyou)"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Observed SSV Agent CnC Domain (rsnet-devel .com in TLS SNI)"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN Reaper (APT37) DNS Lookup (kmbr1 .nitesbr1 .org)"

• "ET CURRENT_EVENTS Successful DarkX Credential Phish 2022-12-19"

• "ET TROJAN DNS Query to TA444 Domain (sabrpatners .com)"

• "ET TROJAN APT Backspace CnC Beacon"

• "ET TROJAN WebDAV Retrieving .vbs from .url M1 (CVE-2023-36025)"

• "ET MOBILE_MALWARE Android/Plankton.P Commands Request to CnC Server"

• "ET TROJAN ReverseRat 2.0 CnC Checkin M2"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (office360-expert .online)"

• "ET TROJAN TA402/Molerats External IP Lookup Activity"

• "ET MOBILE_MALWARE XML Style POST Of IMEI International Mobile Equipment Identity"

• "ET TROJAN Win32.Sality-GR Checkin 2"

• "ET TROJAN Observed DNS Query to ROMCOM RAT Domain (www .get .adobe .com .aspx .io)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (skafiparod .com)"

• "ET CURRENT_EVENTS Successful Ameli.fr Phish M1 2016-10-26"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (farmexpressmachine .com)"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (realityarchitector .top)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 55"

• "ET TROJAN ReVBShell Command Response"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN PoetRAT CnC Domain in DNS Lookup"

• "ET TROJAN SparklingGoblin/Winnti Group SideWalk Domain in DNS Lookup"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (goldenunder .com)"

• "ET CURRENT_EVENTS Lucy Security - Phishing Landing Page M2"

• "ET TROJAN W32/Asprox.FakeAV Affiliate Download Location Response - Likely Pay-Per-Install For W32/Papras.Spy or W32/ZeroAccess"

• "ET TROJAN Pteranodon Variant 3 Backdoor Checkin"

• "ET MALWARE User-Agent (double dashes)"

• "ET CURRENT_EVENTS [PTsecurity] Grandsoft EK Payload"

• "ET MALWARE MSIL/Adload.AT Beacon"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-02-27"

• "ET TROJAN FindPOS Checkin"

• "ET CURRENT_EVENTS Observed TOAD Domain (g2care .cc in TLS SNI)"

• "ET TROJAN Possible Linux/Cdorked.A CnC"

• "ET CURRENT_EVENTS Successful Office 365 Phish Oct 10 2017 (set)"

• "ET TROJAN ELF/Mirai Variant UA Inbound (b3astmode)"

• "ET TROJAN Win32/ArtraDownloader Checkin"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (srv .payamradio .com)"

• "ET CURRENT_EVENTS Successful Generic Webmail Account Phish 2016-07-15"

• "ET CURRENT_EVENTS Successful Apple Phish M2 2016-10-07"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET MALWARE clickspring.com Spyware Install User-Agent (CS Fingerprint Module)"

• "ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain"

• "ET TROJAN MSIL/CoinMiner Performing System Checkin"

• "ET TROJAN Golang Easy Stealer Exfil (POST)"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET CURRENT_EVENTS Magnitude EK (formerly Popads) Java Exploit 32-32 byte hex java payload request Oct 16 2013"

• "ET TROJAN ATTACKER IRCBot - ipconfig - PRIVMSG Command"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET TROJAN Sidewinder APT Maldoc Activity"

• "ET TROJAN Observed IcedID Domain (manderatapple .com in TLS SNI)"

• "ET TROJAN WORM_VOBFUS Checkin 1"

• "ET MOBILE_MALWARE Android APT-C-23 (bbc-learning .com in DNS Lookup)"

• "ET TROJAN W32/Badlib Connectivity Check To Department of Defense Intelligence Information Systems"

• "ET USER_AGENTS Suspicious User-Agent (Trojan.Hijack.IrcBot.457 related)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT CnC)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-20"

• "ET TROJAN Possible Win32.Bicololo Checkin"

• "ET CURRENT_EVENTS Observed TOAD Domain (300005 .ru in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (BazaLoader CnC)"

• "ET TROJAN DPRK APT Related Domain in DNS Lookup (tokenais .com)"

• "ET TROJAN Possible CopyKittens DNS Lookup (windowslayer.in)"

• "ET TROJAN Win32/Remcos RAT Checkin 810"

• "ET TROJAN MICROPSIA HTTP Failover Response M1"

• "ET MOBILE_MALWARE Arid Viper (chad-jessie .info in DNS Lookup)"

• "ET TROJAN Zeus.Downloader Campaign Second Stage Executable Request 10/4/2014"

• "ET TROJAN Win32/Neurevt.A/Betabot Check-in 4"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Message)"

• "ET CURRENT_EVENTS Ping Identity Landing Page 2022-03-14"

• "ET TROJAN Chinese Based APT Related Domain in DNS Lookup (ramblercloud .com)"

• "ET TROJAN Win32.Datamaikon Checkin myAgent"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Damien)"

• "ET CURRENT_EVENTS Upatre Common URI Struct Feb 12 2015"

• "ET TROJAN Brute Ratel CnC Activity (json-c2) M1"

• "ET CURRENT_EVENTS Successful Banco do Brasil Phish Mar 30 2017"

• "ET CURRENT_EVENTS Successful Australian Government Credential Phish 2022-07-06"

• "ET TROJAN Bitter Elephant APT Related Activity (GET)"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M5"

• "ET TROJAN Recaptcha Magecart Skimmer Domain in DNS Lookup (magento-plugin .com)"

• "ET CURRENT_EVENTS HiYu - Victim Enrichment Response M1"

• "ET TROJAN Trojan.Win32.Codenox.gyezu CnC Activity"

• "ET TROJAN Observed APT29 Domain (toyy .zulipchat .com) in TLS SNI"

• "ET CURRENT_EVENTS Generic Multibrand NewInjection Phishing Landing Template"

• "ET CURRENT_EVENTS Successful Fedex/DHL Phish (set) 2018-10-22"

• "ET MALWARE W32/MediaGet Checkin"

• "ET TROJAN Observed Darkgate Domain (saintelzearlava .com in TLS SNI)"

• "ET TROJAN GCleaner Downloader Activity M11"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN ZenRAT Update CnC Response (Already Actual)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 109"

• "ET TROJAN Possible Gamaredon HEAD Request for .dot file on ddns.net"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE NSO Related Domain 37"

• "ET TROJAN Cobalt Strike Malleable C2 (OneDrive)"

• "ET TROJAN Win32/Phorpiex Template 6 Active - Outbound Malicious Email Spam"

• "ET TROJAN Known Sinkhole Response abuse.ch"

• "ET TROJAN SocGholish Domain in DNS Lookup (content .garretttrails .org)"

• "ET MOBILE_MALWARE Android/Smsilence.A Successful Install Report"

• "ET TROJAN Win32.Trojan.Agent.U3D7V0 Checkin"

• "ET TROJAN Bladabindi/njrat CnC Command (File Manager)"

• "ET TROJAN Lazarus CnC Domain in DNS Lookup (online-meeting .team)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN DNS Query for known ShadowPad CnC 4"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN Win32/Toby.N Multilocker Checkin"

• "ET TROJAN Win32/Matsnu.L Checkin"

• "ET MOBILE_MALWARE NSO Related Domain 24"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2016-08-31"

• "ET TROJAN APT28/Sofacy Zebrocy Secondary Payload CnC Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (bestbitloly .website in TLS SNI)"

• "ET TROJAN MSIL/PSW.Agent.SUD Zipped Data Exfil (set)"

• "ET TROJAN CoinMiner Domain in DNS Lookup (pool .supportxmr .com)"

• "ET TROJAN Scieron DNS Lookup (logoff.ddns.info)"

• "ET TROJAN MUROFET/Licat Trojan"

• "ET CURRENT_EVENTS Successful Webmail Update Phish 2015-10-08"

• "ET TROJAN Volatile Cedar Win32.Explosive HTTP CnC Beacon 1"

• "ET TROJAN APT DarkHydrus DNS Lookup 17"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .novelty .akibacreative .com)"

• "ET TROJAN ELF/STDbot CnC Activity (STD attack)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET WEB_CLIENT Fake Adobe Software Update Landing"

• "ET TROJAN Gamaredon CnC Domain Observed in DNS Query"

• "ET INFO Observed Malicious Filename in Outbound POST Request (Information.txt)"

• "ET CURRENT_EVENTS Wide HTA with PowerShell Execution Inbound"

• "ET WEB_SERVER IIS ISN BackDoor Command GetLog"

• "ET TROJAN Win32/Nitrokod Domain (nitrokod .com) in TLS SNI"

• "ET CURRENT_EVENTS Fiesta EK Flash Exploit Apr 23 2015"

• "ET TROJAN DCRat Initial Checkin Server Response M6"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup"

• "ET TROJAN Dridex DL Pattern Feb 18 2016"

• "ET TROJAN Dropper Checkin 2 (often scripts.dlv4.com related)"

• "ET TROJAN ErbiumStealer Response From Panel"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (w0iq .com)"

• "ET MALWARE Suspicious Darkwave Popads Pop Under Redirect"

• "ET TROJAN Observed Malicious SSL Cert (CopperStealer CnC)"

• "ET TROJAN XLS.Unk DDE rar Drop Attempt (.online)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (vavilgo .xyz)"

• "ET TROJAN SnappyTCP Reverse Shell Client Checkin M2"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2023-09-01"

• "ET TROJAN DonotGroup Backdoor Activity (POST)"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET MALWARE qq.com related Spyware User-Agent (QQGame)"

• "ET CURRENT_EVENTS Vietnamese Govt Credential Phish M2 2023-07-18"

• "ET TROJAN Scarlet Mimic DNS Lookup 6"

• "ET TROJAN Zloader Related Download Activity (GET)"

• "ET TROJAN JS/Cryxos Stealer Variant Sending Data to Telegram (POST)"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebcck .com in DNS Lookup)"

• "ET TROJAN Golang/Webbfustator Related Domain in DNS Lookup (updatesagent .com)"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN UAC-0063 Domain in DNS Lookup (net-certificate .services)"

• "ET TROJAN Bredolab CnC URL Detected"

• "ET TROJAN Go/PSW.Agent_AGen.A Data Exfil"

• "ET TROJAN Request for Malicious .dat File"

• "ET TROJAN ELF/Muhstik Bot Reporting Vulnerable Server to CnC"

• "ET TROJAN APT LuckyMouse Polpo Malware CnC"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (wallet.dat) M2"

• "ET TROJAN TA453 IIS Credential Stealer Module/Backdoor Headers in HTTP Request"

• "ET TROJAN Win32.Blackbeard Downloader"

• "ET TROJAN Infostealer.Mysayad Checkin 1"

• "ET TROJAN Win32/Final1stspy CnC Checkin (Reaper/APT37 Stage 1 Payload)"

• "ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M4"

• "ET CURRENT_EVENTS Common Form POST - Multibrand Phishing Landing 2020-06-11"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky C2)"

• "ET TROJAN DNS Query to Teal Kurma Domain (ybcd .tech)"

• "ET TROJAN Lemon_Duck CnC Activity"

• "ET TROJAN Win32/IceXLoader Sending Command Acknowledgement (POST)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (manchestercity .work .gd)"

• "ET TROJAN Win32/GoPix Stealer Activity (POST)"

• "ET TROJAN Trojan.Nurjax Retrieving Domains via JS"

• "ET TROJAN Asylum Ambuscade Related CnC Activity (GET) M2"

• "ET CURRENT_EVENTS Unknown_gmf EK - pdfx.html"

• "ET TROJAN HermeticWizard - File Copy via SMB"

• "ET CURRENT_EVENTS Possible Successful Paypal Phishing Domain (IT) Oct 10 2017"

• "ET TROJAN Gamaredon Domain in DNS Lookup (statuesque .ru)"

• "ET TROJAN W2KM_BARTALEX Downloading Payload M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed BatLoader Domain (logmeincloudss .com) in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (MINEBRIDGE/MINEDOOR CnC)"

• "ET TROJAN Observed Malicious SSL Cert (ColdRiver APT DNSpionage MITM)"

• "ET MALWARE Observed DownloadAssistant User-Agent"

• "ET TROJAN OSX/NukeSped Variant CnC Domain in DNS Lookup (airbseeker .com)"

• "ET TROJAN DirectsX CnC Checkin"

• "ET TROJAN TA452 Related Backdoor Activity (POST)"

• "ET TROJAN Zingo/GinzoStealer Stealer Exfiltration Observed"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Sality - Fake Opera User-Agent (Opera/8.89)"

• "ET MOBILE_MALWARE NSO Related Domain 6"

• "ET MALWARE Malicious Adware Chrome Extension Detected (2)"

• "ET CURRENT_EVENTS DHL/Adobe/Excel Phishing Landing 2016-01-07"

• "ET TROJAN Ransomware Win32/WinPlock.A Successfully Installed CnC Beacon"

• "ET TROJAN APT-C-23 Activity (POST)"

• "ET TROJAN Hacking Team Implant Exfiltration"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [401TRG] SUNBURST Related DNS Lookup to bigtopweb .com"

• "ET TROJAN Vawtrak/NeverQuest Posting Data"

• "ET CURRENT_EVENTS Microsoft Live External Link Phishing Landing M2 Feb 14 2017"

• "ET MALWARE Win32/DomaIQ Checkin"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Observed Malicious SSL Cert (Panda Banker Injects)"

• "ET TROJAN AZORult v3.3 Server Response M1"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 86"

• "ET TROJAN W32/Ke3chang.MyWeb.APT Campaign CnC Beacon"

• "ET TROJAN Win32/DanijBot User-Agent"

• "ET MALWARE Fake Adobe Update Download"

• "ET TROJAN Observed Malicious SSL Cert (Panda Banker C2)"

• "ET TROJAN Mozart Loader Command Request (reporttask)"

• "ET TROJAN Win32/Comotor.A!dll Reporting 1"

• "ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru)"

• "ET MALWARE ChromeLoader CnC Error"

• "ET TROJAN PRISM Backdoor"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET MALWARE Mirage.ru Related Spyware User-Agent (szNotifyIdent)"

• "ET TROJAN PlugX CnC Beacon"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (mindsnatchers .com)"

• "ET TROJAN Observed Axile Stealer Domain (axile .su in TLS SNI)"

• "ET TROJAN Android/xDrop Ransomware CnC Checkin"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b DNS Lookup"

• "ET CURRENT_EVENTS Malicious SSL Certificate detected (Alibaba Phishing)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (tpcontact .co.uk)"

• "ET CURRENT_EVENTS Observed TOAD Domain (m2care .cc in TLS SNI)"

• "ET TROJAN Suspicious HTTP Request for gift.exe"

• "ET CURRENT_EVENTS Successful Chase Phish M2 2016-10-17"

• "ET CURRENT_EVENTS Successful Dropbox Phish June 17 2015"

• "ET TROJAN Backdoor.Perl.Shellbot.cd IRC Bot that have DoS/DDoS functions"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4w .pm)"

• "ET TROJAN [ANY.RUN] Gh0stBins Kernel Download Request"

• "ET TROJAN BlackTech ELF/TSCookie CnC Observed in DNS Query"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Possible Godlua CnC)"

• "ET TROJAN Phorpiex Botnet Downloader Activity (GET)"

• "ET TROJAN Cobalt Strike Domain in DNS Lookup"

• "ET MALWARE Win32/MobiGame Install Stats Checkin M2"

• "ET TROJAN Latrodectus Alive Response M4"

• "ET TROJAN Polonium CreepyDrive Download Request"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT28/Sednit DNS Lookup (natopress .com)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2022-10-11"

• "ET TROJAN Lookup of Algorithm Generated Zeus CnC Domain (DGA)"

• "ET MALWARE PUP.Win32.BoBrowser User-Agent (LogEvents)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Gmail Phish M1 2016-10-12"

• "ET TROJAN Observed Blackrota Domain (blackrato .ga in TLS SNI)"

• "ET CURRENT_EVENTS Successful Bank of America Phish (set) 2016-02-27"

• "ET TROJAN Deep Panda Domain in DNS Lookup (svn1 .smi1egate .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (n9fz .com)"

• "ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain M1 Feb 29"

• "ET TROJAN Lazarus CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Generic Mailbox Phish 2019-03-07"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-10-31"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN AtlasAgent Activity (POST)"

• "ET TROJAN Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (windowservicecentar .com)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN DonotGroup Maldoc Activity (GET)"

• "ET MALWARE DriverTurbo Domain (driverfinderpro .com) in DNS Lookup"

• "ET TROJAN Suspected Periscope Framework Agent Related Activity"

• "ET TROJAN Ransomware Locky CnC Beacon"

• "ET TROJAN JS/Comm100 Trojan Backdoor Inbound"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (ns1.hostasa.org)"

• "ET TROJAN lu0bot CnC Domain in DNS Lookup"

• "ET MALWARE Loki Locker Ransomware User-Agent"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET CURRENT_EVENTS IRS Phishing Landing 2016-01-15"

• "ET TROJAN SuperFish CnC Beacon 2"

• "ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M6"

• "ET MOBILE_MALWARE Suspected Android Youzicheng Proxy Activity"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original POST]"

• "ET TROJAN Observed Buran Ransomware UA"

• "ET CURRENT_EVENTS Observed TOAD Domain (cashapphelp2 .us in TLS SNI)"

• "ET TROJAN Observed DNS Query to APT10 Related CnC Domain"

• "ET TROJAN Observed Magecart Skimmer Domain (googie-analytics .online in TLS SNI)"

• "ET TROJAN DonotGroup Staging Domain Observed in DNS Query"

• "ET TROJAN Magniber Ransomware CnC Domain in DNS Lookup"

• "ET MALWARE User-Agent (http-get-demo) Possible Reverse Web Shell"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET TROJAN Pay2Key Ransomware - Sending RSA Key"

• "ET CURRENT_EVENTS Likely Malicious Windows SCT Download MSXMLHTTP M3"

• "ET CURRENT_EVENTS Possible Successful Ebay Phish Jan 30 2017"

• "ET TROJAN Observed Malicious SSL Cert (ACBackdoor CnC)"

• "ET CURRENT_EVENTS Successful Outlook Phish 2016-10-03"

• "ET TROJAN DeathStalker APT Related Maldoc Activity (GET)"

• "ET TROJAN Maldoc Domain in DNS Lookup (travelcrimea .info)"

• "ET TROJAN DPRK APT Related Domain in DNS Lookup (alticgo .com)"

• "ET TROJAN IIS-Raid Module Backdoor Default Headers in HTTP Request"

• "ET TROJAN Possible UNC1878/FIN12 Cobalt Strike CnC SSL Cert Inbound (lol)"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (en-us-wordpress .org)"

• "ET INFO Suspected Phishing Simulation Service Domain in DNS Lookup (employees-portal .com)"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (jobdescription .linkpc .net in TLS SNI)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (pakgov .org)"

• "ET TROJAN Spark RAT CnC Checkin (POST)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (nxhelp .live)"

• "ET TROJAN Win32/Chifrax.a CnC Exfil via TCP"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MOBILE_MALWARE Android APT-C-23 (aamir-khan .site in DNS Lookup)"

• "ET TROJAN Qbot Payload Request (2023-03-13) M1"

• "ET MALWARE Win32/SoftPulse.H Checkin"

• "ET MALWARE Adrevmedia Related Media Manager Spyware Checkin"

• "ET TROJAN ELF/Emptiness v1.1 CnC Checkin"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (emperorplan .org)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET CURRENT_EVENTS HTTP POST Contains Only Password (gq) 2021-04-05"

• "ET TROJAN Cobalt Strike Malleable C2 (Microsoft Update GET)"

• "ET TROJAN Sharp Panda Soul Framework CnC Checkin"

• "ET TROJAN FSB Snake CnC Activity Inbound via TCP (AA23-129A) M4"

• "ET TROJAN [ANY.RUN] Win32/Stealc Checkin (POST)"

• "ET TROJAN Red Wolf/RedCurl Domain in DNS Lookup (tdnmouse .atspace .eu)"

• "ET CURRENT_EVENTS Adobe Online Document Phishing Landing M1 2016-04-25"

• "ET MOBILE_MALWARE Android APT-C-23 (fatehmedia .site in TLS SNI)"

• "ET TROJAN Win32.Kazy Checkin"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page M1 2022-08-01"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET TROJAN UBoatRAT CnC Check-in"

• "ET MOBILE_MALWARE Android APT-C-23 (dachfunny .club in DNS Lookup)"

• "ET TROJAN Lazarus CnC Domain in DNS Lookup (safemeeting .online)"

• "ET TROJAN MSIL/BlackGuard Stealer Variant Exfil via Telegram"

• "ET TROJAN Win32/DanijBot CnC Checkin"

• "ET TROJAN DNS Query to IcedID Domain (qousahaff .com)"

• "ET CURRENT_EVENTS g01pack exploit pack /mix/ payload"

• "ET TROJAN Observed Buran Ransomware UA"

• "ET TROJAN SeaDuke CnC Beacon"

• "ET TROJAN Desert Falcon Related APT DNS Lookup (abuhmaid.net)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (fishofgloster .pw)"

• "ET TROJAN Java Archive sent when remote host claims to send an image"

• "ET TROJAN Suspected Sidewinder Activity (GET)"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2016-11-28"

• "ET TROJAN ToddyCat Ninja Backdoor CnC Domain in DNS Lookup (eohsdnsaaojrhnqo .windowshost .us)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Patchwork Domain (rannd .org in DNS Lookup)"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET MALWARE Adload.Generic Spyware User-Agent (ProxyDown)"

• "ET CURRENT_EVENTS Successful Caixa Credential Phish 2022-06-29"

• "ET TROJAN ZuoRAT send_http_msg_php Call to arp.php"

• "ET TROJAN Malicious SSL Certificate detected (BoratRat)"

• "ET TROJAN DNS Reply Sinkhole - Microsoft - 131.253.18.11-12"

• "ET TROJAN HTML/Xbash Hex Encoded PS WebClient Object Inbound - Stage 1"

• "ET TROJAN Golang/Kaos/YamaBot CnC Activity M2 (POST)"

• "ET TROJAN Observed Glupteba CnC Domain (cdneurops .shop in TLS SNI)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jan 12 2017"

• "ET TROJAN Steam Stealer"

• "ET TROJAN Cryptolocker .onion Proxy Domain"

• "ET TROJAN Possible CopyKitten DNS Lookup (primeminister-goverment-techcenter .tech)"

• "ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M1"

• "ET TROJAN Darkgate Stealer CnC Checkin (POST) M2"

• "ET CURRENT_EVENTS Generic Financial Phish Landing 2017-12-21"

• "ET WEB_CLIENT Suspicious Compound Refresh - Possible Phishing Redirect 2016-06-09"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1u .pm)"

• "ET MOBILE_MALWARE Android APT-C-23 (masuka .club in TLS SNI)"

• "ET TROJAN W32/Antifulai.APT CnC Beacon 4"

• "ET TROJAN Hoic.zip retrieval"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (r2care .cc)"

• "ET EXPLOIT Lexmark Malicious File Upload Detected"

• "ET TROJAN LNK/imageres CnC Payload Request (GET)"

• "ET TROJAN Karagany encrypted binary (3)"

• "ET TROJAN Observed Ttint CnC Domain in DNS Query"

• "ET TROJAN Win32/Gh0stRat C2 Response (X11 SelectionNotify)"

• "ET TROJAN Xbash CnC DNS Lookup (vfk2k5s5tfjr27tz .tk)"

• "ET CURRENT_EVENTS Successful Ourtime.com Phish 2016-11-28"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (en-ca-wordpress .org)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (redsnowynose .org)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .switchmerge .com)"

• "ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam"

• "ET MOBILE_MALWARE Android APT-C-23 (aslaug-sigurd .info in DNS Lookup)"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN W32/Hicrazyk.A Downloader Install CnC Beacon"

• "ET TROJAN Trojan/MSIL.DOTHETUK CnC Activity"

• "ET TROJAN [ANY.RUN] PureLogs Stealer Data Exfiltration Attempt M1"

• "ET MOBILE_MALWARE Android APT-C-23 (accounts-googlc .com in TLS SNI)"

• "ET CURRENT_EVENTS SNET EK Encoded VBS 2"

• "ET CURRENT_EVENTS Webmail Account Upgrade Phishing Landing 2016-07-20"

• "ET MOBILE_MALWARE Android Trojan MSO.PJApps checkin 2"

• "ET TROJAN ELF.SystemdMiner C2 Domain in DNS Lookup"

• "ET TROJAN Suspected Tick Group APT Related Activity (GET)"

• "ET TROJAN Win32/Ramsay CnC Checkin"

• "ET TROJAN Observed BatLoader Domain (grammarlycheck2 .com) in TLS SNI"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (hiduwu .com)"

• "ET TROJAN Win32/Unk.BrowserStealer Data Exfil M1"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2023-02-07"

• "ET TROJAN Clipsa Stealer - Exfiltration Activity"

• "ET MALWARE BoostBeast Checkin M1"

• "ET TROJAN Peppy/KeeOIL Google Connectivity Check"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (bahriafoundation .live)"

• "ET MALWARE UCMore Spyware User-Agent (UCmore)"

• "ET TROJAN VBKlip/ClipBanker.P Status Update"

• "ET CURRENT_EVENTS Successful WhatsApp Payment Phish 2016-09-01"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET MALWARE DNS Query to Seetrol RAT Domain (seetrol .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (dachfunny .us in TLS SNI)"

• "ET TROJAN ELF/Mirai Variant UA Outbound (b3astmode)"

• "ET MALWARE DNS Query to Neoreklami Domain (133455789 .xyz)"

• "ET TROJAN WindowsEnterpriseSuite FakeAV Reporting via POST"

• "ET TROJAN Ttint XORed CnC Checkin"

• "ET CURRENT_EVENTS Successful Webmail Phish M3 2016-06-22"

• "ET TROJAN HVNC USR Init Detected"

• "ET TROJAN Win32/MassLogger FTP Data Exfiltration"

• "ET TROJAN MedusaHTTP Variant CnC Checkin M2"

• "ET TROJAN RAMNIT.A M1"

• "ET TROJAN Legion Loader Activity Observed (the devil)"

• "ET TROJAN Possible SKyWIper/Win32.Flame POST"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (greedyclowns .org)"

• "ET TROJAN Suspicious User-Agent (API-Guide test program) Used by Several trojans"

• "ET TROJAN ELF/AbcBot Requesting Commands from CnC"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2020-02-21 2)"

• "ET TROJAN Observed DNS Query to Ursnif Domain (minotos .xyz)"

• "ET TROJAN Observed Malicious SSL Cert (BitRAT CnC)"

• "ET TROJAN Win32/Spy.Agent.OHT - AnunakAPT HTTP Checkin 1"

• "ET TROJAN TA457 Related Activity M3 (POST)"

• "ET TROJAN Observed Fake Chrome Landing Domain (chromiumbase .site in TLS SNI)"

• "ET TROJAN Ransomware Locky Possible Payment Page"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (aka7newmalp23 .com)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 87"

• "ET CURRENT_EVENTS RedKit/Sakura/CritX/SafePack/FlashPack applet + obfuscated URL Apr 10 2013"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2i .wf)"

• "ET TROJAN Windows Microsoft Windows DOS prompt command Error Invalid Argument"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET TROJAN Rogue.Win32/Winwebsec Checkin"

• "ET TROJAN Drive Receiving IP2 DDoS instructions"

• "ET TROJAN Virtumonde Variant Reporting to Controller via HTTP (3)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (ideolot .ru)"

• "ET USER_AGENTS MSIL/Peppy User-Agent"

• "ET TROJAN Possible Pegasus Related DNS Lookup (icrcworld .com)"

• "ET TROJAN Possible WannaCry DNS Lookup 2"

• "ET TROJAN TA444 Domain in DNS Lookup"

• "ET INFO Possible Phish - Mirrored Website Comment Observed"

• "ET CURRENT_EVENTS Successful Wildblue/CenturyLink Phish 2015-12-08"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-cdn .xyz)"

• "ET MOBILE_MALWARE Android/Locker.B Checkin 2"

• "ET CURRENT_EVENTS Adobe PDF Zero Day Trojan.666 Payload libarext32.dll Second Stage Download POST"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-09-16"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (jagernaut .com)"

• "ET TROJAN Hiloti/Mufanom CnC Response"

• "ET CURRENT_EVENTS Successful Microsoft Live Email Account Phish 2016-09-08"

• "ET TROJAN AtlasAgent Activity (GET)"

• "ET TROJAN MWI Maldoc Load Payload"

• "ET TROJAN Cobalt Strike CnC Beacon (POST)"

• "ET CURRENT_EVENTS DRIVEBY Sednit EK Landing"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Pupy DNS Request without SPI M3"

• "ET TROJAN Win32/Nitol.A CnC Checkin M3"

• "ET TROJAN Cinobi Banking Trojan Domain in DNS Lookup (www .supapureigemu .com)"

• "ET TROJAN Windows nbtstat -a Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (myself .hopto .org)"

• "ET TROJAN Possible Maldoc Retrieving Dridex from pastebin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN NSO Group Pegasus CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Sakura Exploit Kit Version 1.1 Archive Request"

• "ET TROJAN W32/Dinwod.Dropper Win32/Xtrat.B CnC Beacon"

• "ET TROJAN Transparent Tribe APT Related Backdoor Receiving Command (Inbound)"

• "ET MOBILE_MALWARE Android/DwnlAPK-A Configuration File Request"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Feb 26 2016"

• "ET TROJAN Red Wolf/RedCurl Domain in DNS Lookup (buyhighroad .scienceontheweb .net)"

• "ET CURRENT_EVENTS Outlook Web App Phishing Landing on Appspot Hosting"

• "ET TROJAN DNS Query to Scattered Spider Domain (victimname-servicedesk .com"

• "ET TROJAN Observed Malicious SSL Cert (ColdRiver APT DNSpionage MITM)"

• "ET TROJAN DarkCrystal Rat Stealer Data Exfiltration Activity"

• "ET TROJAN Lazarus CnC Domain in DNS Lookup (videomeethub .online)"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Backdoor.AndroidOS.Ahmyth.f (DNS Lookup)"

• "ET TROJAN Observed Get2 CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Successful Survey Credential Phish M3 2022-04-04"

• "ET TROJAN 000Stealer Data Exfiltration M2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6w .re)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 32"

• "ET TROJAN Suspected APT28 Related Domain in DNS Lookup (jimbeam .live)"

• "ET MOBILE_MALWARE Observed NSO Group CnC Domain in TLS SNI (flowersarrows .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ArcDoor User-Agent (ALIZER)"

• "ET TROJAN Win32/Backdoor.Randrew.A CnC Checkin"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phishing M1 2016-09-26"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (scanworld .net)"

• "ET CURRENT_EVENTS SNET EK Encoded VBS 1"

• "ET TROJAN Win32/Kryptik.HNBU CryptoMiner - GetTasks Request"

• "ET TROJAN Epsilon Stealer CnC Domain in DNS Lookup (epsilon1337 .com)"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (wallet.dat) M1"

• "ET TROJAN FIN7 JSSLoader Related Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (mygift .website in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (dshellelink .gcloud-share .com)"

• "ET MALWARE Trafficadvance.net Spyware User-Agent (Internet 1.0)"

• "ET CURRENT_EVENTS Successful Microsoft Outlook Credential Phish 2022-10-03"

• "ET MALWARE Win32/Adware.Qjwmonkey.H Variant CnC Activity"

• "ET CURRENT_EVENTS Successful Workspace Phish 2016-01-26"

• "ET TROJAN APT12 THREEBYTE DNS Lookup"

• "ET TROJAN Observed OSX/Silver Sparrow Download Domain in TLS SNI"

• "ET TROJAN Observed IcedID Domain (asleytomafa .com in TLS SNI)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (log .exposedbotnets .ru)"

• "ET MOBILE_MALWARE TransparentTribe AhMyth RAT Variant Activity (POST)"

• "ET MALWARE Win32/Adware.BrowSecX.AB Install Log Sent"

• "ET TROJAN Linux DarkRadiation Ransomware Telegram Activity M1"

• "ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017"

• "ET TROJAN Woody RAT CnC Checkin"

• "ET CURRENT_EVENTS Successful Alibaba Credential Phish 2015-10-05"

• "ET TROJAN Generic - 8Char.JAR Naming Algorithm"

• "ET TROJAN MalDoc/Gamaredon CnC Activity M1"

• "ET TROJAN CyberGate RAT User-Agent (USER_CHECK)"

• "ET TROJAN BleachGap Ransomware Checkin (POST)"

• "ET TROJAN APT28/Sednit DNS Lookup (military-info .eu)"

• "ET USER_AGENTS Suspicious User-Agent (IE)"

• "ET TROJAN Pandorahvnc/Pikolo RAT Checkin Activity"

• "ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (montanatony .xyz in TLS SNI)"

• "ET TROJAN Observed Ttint CnC Domain in DNS Query"

• "ET CURRENT_EVENTS Successful France Ministry of Action and Public Accounts Phish 2019-07-04"

• "ET TROJAN C3Pool CoinMiner Setup Script Download"

• "ET TROJAN FIN7/Carbanak Staging Domain in DNS Lookup (civilizationidium .com)"

• "ET TROJAN Win32/Chinad Retrieving Config"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (docsendinfo .linkpc .net)"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M3"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (esnoptdkkiirzewlpgmccbwuynvxjumf .name)"

• "ET MOBILE_MALWARE Android APT-C-23 (alain .ps in TLS SNI)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 8"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M8"

• "ET MALWARE ThunderUnion Install Checkin"

• "ET CURRENT_EVENTS Successful ANZ Internet Banking Phish 2022-06-23"

• "ET TROJAN JS/Nemucod.M.gen requesting PDF payload 2015-11-02"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server]"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET INFO Possible SMTP Data Exfiltration - File Attachment Named Files.zip"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-11-03 M3"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (scradm .in in DNS Lookup)"

• "ET WEB_SERVER WebShell - ASPyder - File Upload - Response"

• "ET TROJAN Observed DNS Query to Ursnif Domain (astope .xyz)"

• "ET TROJAN ZuoRAT CBeacon CnC"

• "ET TROJAN BatLoader CnC Domain (updatecloudservice1 .com) in DNS Lookup"

• "ET TROJAN Pingback Shell Command Issued"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (tiena .einei .line .pm)"

• "ET CURRENT_EVENTS Successful PHOEN!X Apple Phish M2 2015-12-29"

• "ET TROJAN EvilNum APT Related Domain in DNS Lookup (msdllopt .com)"

• "ET TROJAN Linux.Mumblehard Spam Command CnC"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Mozilla_Firefox_Cookies) M2"

• "ET TROJAN CozyDuke APT HTTP POST CnC Beacon"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful Samsung Portal Phish 2015-10-13"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Mirai pTea Variant - Initial CnC Checkin Inbound"

• "ET TROJAN GCleaner Downloader - Payload Response"

• "ET TROJAN APT28/Sednit DNS Lookup (capisp .com)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (thelegendofberia .top)"

• "ET TROJAN Latrodectus Loader Related Activity (POST)"

• "ET TROJAN Gamaredon C2 Domain (f0559838 .xsph .ru) in DNS Lookup"

• "ET TROJAN STRRAT Initial HTTP Activity"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (blattodea .ru)"

• "ET TROJAN Observed Targeted Attack Malicious SSL Cert (opsonew3org .sg)"

• "ET TROJAN NOBELIUM Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Possible IoT_reaper ELF Binary Request M4 (set)"

• "ET TROJAN Hiloti loader requesting payload URL"

• "ET TROJAN Observed Magecart CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Unknown Java Exploit Kit 32-32 byte hex initial landing"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Patchwork Backdoor Checkin"

• "ET MOBILE_MALWARE Android/Spy.Banker.BOF CnC Domain in DNS Lookup"

• "ET TROJAN AveMaria Initial CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN ErbiumStealer Domain (erbium .ml) in TLS SNI"

• "ET TROJAN Lyceum Golang HTTP Backdoor CnC Checkin"

• "ET TROJAN FOX-SRT ShimRat check-in (php)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN APT-C-27 CnC Domain Observed in DNS Query"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN Observed DNS Query to RisePro Domain (torggissoft .com)"

• "ET MALWARE SoundCloud Downloader Install Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS AES Crypto Observed in Javascript - Possible Phishing Landing"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M15"

• "ET TROJAN Critroni Variant .onion Proxy Domain"

• "ET TROJAN Alphacrypt/TeslaCrypt Ransomware CnC Beacon"

• "ET TROJAN Win32/DarkVision RAT CnC Checkin M2"

• "ET TROJAN Hacking Team Android Implant Exfiltration"

• "ET MOBILE_MALWARE Android APT-C-23 (bitgames .world in TLS SNI)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-08-09"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET MOBILE_MALWARE AdWare.AndroidOS.Ewind.cd Response"

• "ET CURRENT_EVENTS TA398/Sidewinder Credential Phish Landing Page M3 2022-11-18"

• "ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)"

• "ET CURRENT_EVENTS Generic 302 Redirect to Phishing Landing"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 9"

• "ET MOBILE_MALWARE Android/HeHe.Spy RegisterRequest CnC Beacon"

• "ET TROJAN Bitter APT Activity (GET)"

• "ET TROJAN DNS Reply Sinkhole - IP - 161.69.13.44"

• "ET TROJAN APT28/Sednit DNS Lookup (unian-news .info)"

• "ET TROJAN MSIL APT28 Zebrocy/Zekapab Reporting to CnC M2"

• "ET TROJAN Win32/InfoTester Checkin"

• "ET TROJAN IndigoZebra APT xCaon/Textpadx Activity (POST)"

• "ET TROJAN Observed OSX/NukeSped Variant CnC Domain (sctemarkets .com) in TLS SNI"

• "ET TROJAN Win32/Enchanim C2 Client Check-in"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Bladabindi/njrat CnC Command (Kill Process)"

• "ET TROJAN Observed Malicious SSL Cert (Bazar Backdoor)"

• "ET TROJAN ZenRAT Change Status Command"

• "ET TROJAN Win32/OriginLoader CnC Checkin"

• "ET TROJAN SuperFish Possible SSL Cert Signed By Compromised Root CA"

• "ET MOBILE_MALWARE Android APT-C-23 (black-honey .club in TLS SNI)"

• "ET TROJAN Possible CopyKittens DNS Lookup (patch8-windows.com)"

• "ET TROJAN Win32/Goofy Guineapig CnC Activity (GET) M2"

• "ET CURRENT_EVENTS Successful Metawallet Phish 2022-01-13"

• "ET TROJAN ELF/Miner Activity (GET)"

• "ET TROJAN Shuckworm CnC Domain (a0698649 .xsph .ru) in DNS Lookup"

• "ET TROJAN Tandem Espionage CnC Domain (zyzkikpfewuf .ru) in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Observed APT-C-23 Related Domain (linda-gaytan .website in TLS SNI)"

• "ET CURRENT_EVENTS Successful PHOEN!X Apple Phish M1 2015-12-29"

• "ET TROJAN Earth Preta PUBLOAD Activity M1"

• "ET TROJAN Tandem Espionage CnC Domain (rwwmefkauiaa .ru) in DNS Lookup"

• "ET TROJAN Windows executable base64 encoded"

• "ET TROJAN Win32/Spy.Banker.ZZN Variant Checkin"

• "ET TROJAN Moose CnC Request M2"

• "ET TROJAN DecryptmyFiles Ransomware CnC (POST)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Pterodo CnC Activity (POST)"

• "ET ATTACK_RESPONSE Unusual FTP Server Banner on High Port (StnyFtpd)"

• "ET TROJAN Win32/VB.PNU CnC Checkin"

• "ET TROJAN Win32/Kaicone.A Checkin via HTTP POST"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET TROJAN Lemon_Duck Powershell CnC Activity M14"

• "ET WEB_CLIENT Fake Java Installer Landing Page Oct 21"

• "ET TROJAN Driveby Loader Request List.php"

• "ET TROJAN Observed DNS Query to LIGHTSHOW Domain (fainstec .com)"

• "ET TROJAN Linux/Denonia DNS Request Over HTTPS (denonia .xyz) M1"

• "ET TROJAN SupremeLogger CnC Checkin"

• "ET TROJAN Tibs Trojan Downloader"

• "ET TROJAN DeltaStealer CnC Domain (deltaproject .us) in DNS Lookup"

• "ET CURRENT_EVENTS DHL Phish Landing Sept 14 2015"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (atenaeps .com) 2022-12-05"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (update-real .com) in DNS Lookup"

• "ET TROJAN Observed DNS Query to RisePro Domain (pickofiles .com)"

• "ET TROJAN W32/Lalus Trojan Downloader Checkin"

• "ET TROJAN Jaff Ransomware Checkin"

• "ET MALWARE PUP/SpamFighter CnC Request"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2016-08-25"

• "ET TROJAN Win32/Reconyc.equo Checkin"

• "ET CURRENT_EVENTS Microsoft Live Phishing Landing"

• "ET TROJAN [PTsecurity] MSIL/Biskvit.A Check-in"

• "ET CURRENT_EVENTS Successful Generic OWA Phish 2016-10-04"

• "ET TROJAN NodeStealer CnC Activity from Downloaded Archive (GET)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Trojan.Win32.A.FakeAV Reporting"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (group-meeting .online)"

• "ET MALWARE User-Agent (M0zilla)"

• "ET TROJAN W32/Upatre.Downloader Encoded Binary Download Request"

• "ET TROJAN DNS Query to Malicious Domain (mydatayxnhzcs .tech)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (hdfuckedin18 .top in DNS Lookup)"

• "ET TROJAN Nemucod Downloading Payload 2"

• "ET CURRENT_EVENTS Successful Generic .EDU Phish Aug 17 2017"

• "ET TROJAN GravityRAT CnC Domain (sake .mozillaupdates .us in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-10-29"

• "ET TROJAN Ursnif Variant CnC Data Exfil"

• "ET CURRENT_EVENTS Webmail Phishing Landing 2016-06-22"

• "ET TROJAN Win32/Agent.Fish Data Exfiltration"

• "ET TROJAN Volatile Cedar DNS Lookup (saveweb.wink.ws)"

• "ET TROJAN FastPOS Software Update Request"

• "ET TROJAN TwoFace WebShell Detected"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (plastic .delldrivers .in)"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (cisco-helpdesk .cf)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-08-26"

• "ET EXPLOIT Unk.IoT IPCamera Exploit Attempt Inbound"

• "ET TROJAN Platinum APT Activity"

• "ET TROJAN Mirai pTea Variant - Initial CnC Checkin Outbound"

• "ET TROJAN Win32/MagicRAT CnC Activity M1"

• "ET POLICY My2022/Beijing2022 App (DNS Lookup) 2"

• "ET TROJAN Observed Malicious SSL Cert (Maldoc/Zloader CnC)"

• "ET TROJAN LogStih Stealer Data Exfiltration Attempt"

• "ET TROJAN Win32/Backdoor.Graphon Checkin Activity (GET)"

• "ET TROJAN DNS Query to Gamaredon Domain (OpenAsTextStream .zuberipa .ru)"

• "ET TROJAN GCleaner CnC Checkin M1"

• "ET TROJAN TeamTNT Gattling Gun AWS Creds Exfil"

• "ET CURRENT_EVENTS Common Form POST - Microsoft Account Phishing Landing 2020-06-11"

• "ET MOBILE_MALWARE Android APT-C-23 (nightchat .fun in TLS SNI)"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Security Scanner Domain (kryptoslogic-cve-2021-44228 .com)"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN GORGON APT Download Activity"

• "ET TROJAN Win32/Lilith Stealer registerBot CnC Checkin"

• "ET MOBILE_MALWARE Android.Trojan.Rana.A (fullplayersoftware .com in DNS Lookup)"

• "ET TROJAN Stellar Stealer Data Exfiltration Attempt M3"

• "ET TROJAN TA444 Related Domain in DNS Lookup (web .shconstmarket .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (frightysever .org)"

• "ET CURRENT_EVENTS GOV UK Possible COVID-19 Phish 2020-04-06"

• "ET TROJAN BunnyLoader Data Exfiltration Attempt"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Suspicious Long NULL DNS Request - Possible DNS Tunneling"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2015-07-28"

• "ET TROJAN BlackDolphin Ransomware Builder Landing Page M2"

• "ET TROJAN Shifr Ransomware CnC DNS Query (v5t5z6a55ksmt3oh)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (ae-snoctenders .com) 2022-12-05"

• "ET TROJAN CopperStealer - Remote Desktop - CnC Server Request via Pastebin"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT CnC)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-service .com)"

• "ET TROJAN MSIL/Spy.Agent.CVT CnC Exfil"

• "ET TROJAN Nemty Ransomware Payment Page ID File Upload"

• "ET CURRENT_EVENTS Successful Royal Credit Union Credential Phish 2023-02-23"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (number2g .top in TLS SNI)"

• "ET WEB_CLIENT Tech Support Phone Scam Landing (err.mp3) 2016-08-12"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jul 11 2017"

• "ET TROJAN Observed Gamaredon APT Related Domain (aethionemaso .ru in TLS SNI)"

• "ET CURRENT_EVENTS Successful Generic Multi-Account Phish 2018-02-16"

• "ET TROJAN Win32/Tofsee Malformed Spam Template String"

• "ET MALWARE PUP Win32/DownloadGuide.A"

• "ET TROJAN Observed DNS Query to RisePro Domain (webproduct25 .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Atomic macOS (AMOS) Stealer Payload Delivery Domain in DNS Lookup (trabingviews .com)"

• "ET CURRENT_EVENTS Apple Phishing Landing Nov 10 2017"

• "ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Cookie Value M1"

• "ET TROJAN Observed TA401 Related Domain in TLS SNI"

• "ET CURRENT_EVENTS Nuclear Exploit Kit exe.exe Payload"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (incomeudpate .com in TLS SNI)"

• "ET TROJAN MoneroOcean Installer Batch Script Inbound"

• "ET CURRENT_EVENTS Successful Netflix Phish 2016-10-12"

• "ET TROJAN Win32/CryptFile2 / Revenge Ransomware Checkin M3"

• "ET TROJAN Kinsing Botnet Related Domain in DNS Lookup (babaroga .lib)"

• "ET TROJAN Saint Bot CnC Activity"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (zbavitae .com) 2022-12-05"

• "ET TROJAN Possible ShadowHammer DNS Lookup"

• "ET TROJAN Observed BlackGuard_v2 Domain (win .mirtonewbacker .com) in TLS SNI"

• "ET TROJAN Playful Taurus CnC Domain (update .adboeonline .net) in DNS Lookup"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (ovcloud .online)"

• "ET TROJAN Filename explorer.exe Download - Common Hostile Filename"

• "ET POLICY DNS Lookup for Upaste Paste Site"

• "ET TROJAN Observed Malicious SSL Cert (MonetizUs/LNKR)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 6"

• "ET CURRENT_EVENTS SunDown EK RIP Landing M1 B642"

• "ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup"

• "ET TROJAN EvilNum CnC Error Report"

• "ET TROJAN Observed DNS Query to known Avaddon Ransomware Payment Domain"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 14"

• "ET TROJAN Arid Viper APT Related Domain in DNS Lookup (nicholasuhl .website)"

• "ET TROJAN Win32/Agent.WVW CnC Beacon 1"

• "ET TROJAN Win32/Blacktech Plead CnC Activity (POST)"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (www .googlesheetpage .org)"

• "ET TROJAN Observed Malicious SSL Cert (SmokeLoader CnC)"

• "ET CURRENT_EVENTS Fiesta SilverLight Exploit Download"

• "ET MOBILE_MALWARE Android Fancy Bear Checkin"

• "ET TROJAN Known IoT Malware Domain"

• "ET TROJAN JLORAT CnC Checkin"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 16"

• "ET TROJAN Mac Flashback Checkin 2"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hscare .us)"

• "ET MALWARE Suspicious User-Agent (006)"

• "ET CURRENT_EVENTS Successful Linkedin Phish 2016-10-12"

• "ET TROJAN CozyDuke APT HTTP CnC Beacon Response"

• "ET TROJAN Potentially Unwanted Program RebateInformerSetup.exe Download Reporting"

• "ET TROJAN Win32/Winshow User Agent"

• "ET TROJAN Likely Infected HTTP POST to PHP with User-Agent of HTTP Client"

• "ET TROJAN Win32/Gatak.DR Activity"

• "ET TROJAN Observed DNS Query to Ursnif Domain (mamount .cyou)"

• "ET TROJAN Suspicious Email Attachment Possibly Related to Mydoom.L@mm"

• "ET TROJAN Observed Suspected TA453 Related Domain (igsecurity .email in TLS SNI)"

• "ET TROJAN Observed GandCrab Domain (gandcrab .bit)"

• "ET TROJAN ZeroAccess Outbound udp traffic detected"

• "ET TROJAN Suspected NginxSpy Related Request (Inbound)"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (italk-chat .com in DNS Lookup)"

• "ET TROJAN Win32/Spyder Successful CnC Checkin"

• "ET CURRENT_EVENTS Successful Discover Phish M3 2016-12-14"

• "ET TROJAN Kronos Checkin M2"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN JS/Ostap CnC Activity"

• "ET TROJAN FIN7 Related CnC Domain in DNS Lookup (tnskvggujjqfcskwk .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Turla APT/Kazuar Backdoor CnC Activity (POST)"

• "ET TROJAN Win32/Remcos RAT Checkin 66"

• "ET TROJAN Trojan.Agent.AIXD Checkin"

• "ET TROJAN ObliqueRAT CnC Checkin"

• "ET TROJAN ActionLoader CnC Domain in DNS Lookup (mejito .ru)"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (mktrending .com)"

• "ET MALWARE PUA Related User-Agent (WINTERNET)"

• "ET TROJAN Candiru Related Domain in DNS Lookup (llink .link)"

• "ET TROJAN Win32/Remcos RAT Checkin 28"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-03-13"

• "ET TROJAN Mustang Panda/RedDelta Downloader Activity"

• "ET CURRENT_EVENTS Possible Successful Phish to .tk domain Aug 26 2016"

• "ET TROJAN DarkHotel DNS Lookup (apply-wsu.ebizx.net)"

• "ET TROJAN OSX/OceanLotus.D CnC DNS Lookup (ssl .arkouthrie .com)"

• "ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response"

• "ET TROJAN MargulasRAT Checkin M1"

• "ET TROJAN APT-C-27 CnC Domain Observed in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (rx3 .xyz)"

• "ET TROJAN Win32.Drun Checkin"

• "ET TROJAN Win32/frebniis IIS Backdoor Trigger Attempt M2"

• "ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN Observed DNS Query to RisePro Domain (first-mirror .com)"

• "ET TROJAN Sofacy DNS Lookup scanmalware.info"

• "ET TROJAN Lazarus APT Related VSingle Backdoor Activity (GET)"

• "ET TROJAN CryptoWall/TeslaCrypt Payment Domain"

• "ET CURRENT_EVENTS Parrot TDS Check"

• "ET TROJAN MSIL/NoCry Ransomware Checkin Via Discord"

• "ET TROJAN Windows ipconfig Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN SC-KeyLog Keylogger Installed - Sending Initial Email Report"

• "ET TROJAN Reptile Rootkit Default ICMP Magic Packet Trigger"

• "ET CURRENT_EVENTS DHL Phishing Landing 2016-08-31"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (3aqulcx8xkg6qxrhxgmisecrt98kxlenzj .com)"

• "ET TROJAN Possible Win32/SillyFDC WordPress Traffic"

• "ET TROJAN Snake Keylogger CnC Exfil via Telegram"

• "ET TROJAN Kimsuky CnC Domain (okihs .mypressonline .com) Observed in DNS Query"

• "ET CURRENT_EVENTS Observed TOAD Domain (bghelp .online in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (gsheet .gdocsdown .com)"

• "ET TROJAN LokiBot Keylogger Data Exfiltration Detected M2"

• "ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M3"

• "ET CURRENT_EVENTS Successful Office 365 Phish 2022-07-19"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (tin-url .com)"

• "ET TROJAN IIStealer Inbound Exfil Request M2"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M1 Oct 16 2016"

• "ET TROJAN Possible DANDERSPRITZ Default HTTP Headers"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (lovingallupdates .life)"

• "ET TROJAN Win32/FlyStudio.OJJ CnC Checkin"

• "ET WEB_CLIENT Possible eDellRoot Rogue Root CA"

• "ET TROJAN Win32/VBS Backdoor Sending System Information (POST)"

• "ET MOBILE_MALWARE Android APT-C-23 (help-live .club in DNS Lookup)"

• "ET TROJAN SPEAR CnC Beacon"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET TROJAN ABUSE.CH Cerber Ransomware Domain Detected"

• "ET TROJAN DNS Query to Remcos Domain (retghrtgwtrgtg .bounceme .net)"

• "ET CURRENT_EVENTS Successful IRS Phish (set) 2016-01-23"

• "ET TROJAN TeamTNT Gattling Gun CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Sephora Related Activity (POST)"

• "ET MALWARE Hex Encoded IP HTTP Request - Likely Malware"

• "ET CURRENT_EVENTS Successful FreeMobile (FR) Phish M1 2016-10-06"

• "ET MALWARE Casalemedia Spyware Reporting URL Visited 2"

• "ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M2"

• "ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to lcomputers .com"

• "ET MALWARE InstallCore PUA/Adware Activity M1"

• "ET TROJAN SEASALT Server Response"

• "ET MOBILE_MALWARE Android APT-C-23 (firesky .site in TLS SNI)"

• "ET TROJAN Win32/Tosct.B UA Mandiant APT1 Related"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET CURRENT_EVENTS Terror EK CVE-2016-0189 Exploit M2"

• "ET CURRENT_EVENTS Suspicious File Download Post-Phishing 2016-05-25"

• "ET TROJAN DNS Query to Raspberry Robin Domain (s8 .cx)"

• "ET TROJAN Gamaredon APT Related Activity (POST)"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 23"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (q2care .us)"

• "ET TROJAN Win32/Generik.NWVMNHQ Variant Exfil (POST)"

• "ET CURRENT_EVENTS Evil Flash Redirector to RIG EK Dec 17 2014"

• "ET CURRENT_EVENTS Successful CIBC Phish 2016-08-30"

• "ET MOBILE_MALWARE Android APT-C-23 (nightchat .fun in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zi9f .com)"

• "ET TROJAN Possible Duqu 2.0 Request"

• "ET TROJAN GravityRAT CnC Domain (zen .mozillaupdates .us in DNS Lookup)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (brakudafear .pics)"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET TROJAN Win32/SVCReady Loader CnC Activity M2"

• "ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M1"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (pkrepublic .org)"

• "ET TROJAN SSL/TLS Certificate Observed (Maldoc CnC)"

• "ET TROJAN Possible Fake AV Checkin"

• "ET TROJAN Likely Malicious SSL Cert With Script Tags"

• "ET TROJAN TorrentLocker DNS Lookup (octoberpics.ru)"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (cisco-help .cf)"

• "ET TROJAN Win32.Vilsel Checkin"

• "ET MALWARE Spyware User-Agent (sureseeker)"

• "ET CURRENT_EVENTS ClearFake Fingerprinting Domain in DNS Lookup (stats-tracked .com)"

• "ET CURRENT_EVENTS Successful World Health Organization COVID-19 Phish 2020-03-23"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11"

• "ET TROJAN Operation Tripoli Related CnC Checkin"

• "ET TROJAN [Fireeye] Backdoor.BEACON M5"

• "ET TROJAN Carberp checkin task"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN BKDR_BTMINE.MNR BitCoin Miner Retrieving New Malware From Server"

• "ET TROJAN KeyBoy CnC Beacon"

• "ET TROJAN Observed Malicious Domain in DNS Lookup (wpsupdate .luckfafa .com)"

• "ET TROJAN Observed SSV Agent CnC Domain (be-government .com in TLS SNI)"

• "ET MALWARE Malicious Adware Chrome Extension Detected (1)"

• "ET TROJAN W32/Zzinfor.A Retrieving Instructions From CnC Server"

• "ET TROJAN Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 1"

• "ET USER_AGENTS Suspicious User-Agent (HTTPTEST) - Seen used by downloaders"

• "ET TROJAN Win32/SnakeKeyLogger Payload Request (GET)"

• "ET TROJAN HTML/Xbash Hex Encoded PowerShell Args Inbound - Stage 1"

• "ET CURRENT_EVENTS FAKEIE Minimal Headers (flowbit set)"

• "ET TROJAN Observed DNS Query to RisePro Domain (fixgroupfactor .com)"

• "ET MOBILE_MALWARE Arid Viper (play-store-51182 .firebaseio .com in DNS Lookup)"

• "ET TROJAN Observed DNS Query to RisePro Domain (files-rate .com)"

• "ET CURRENT_EVENTS Fake Browser Update Domain in DNS Lookup (onlinecasinopinup .xyz)"

• "ET CURRENT_EVENTS Xbagger Macro Encrypted DL"

• "ET TROJAN Possible NGLite Backdoor C2 Traffic (NKN)"

• "ET MALWARE Win32/DownloadAssistant.A PUP CnC"

• "ET TROJAN Kimsuky CSPY Downloader Activity"

• "ET TROJAN MirrorThief CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Teslacrypt Ransomware .onion domain (epmhyca5ol6plmx3)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Gatak.DR Payload Instructions"

• "ET TROJAN Darkness DDoS Bot Checkin"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (brainassault .top)"

• "ET TROJAN Patchwork Staging Domain in DNS Query"

• "ET TROJAN Bandook v1.35 Initial Connection and Report"

• "ET TROJAN KINS/ZeusVM Variant Retrieving Config"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Staging Domain)"

• "ET TROJAN Win32/Lilith Stealer getCommands Command"

• "ET CURRENT_EVENTS Successful Paypal Account Phish Oct 30"

• "ET TROJAN Possible FakeAV Binary Download (Security)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (logotep .xyz)"

• "ET CURRENT_EVENTS Fake Webmail Account Phishing Landing 2015-09-10"

• "ET TROJAN Legion Loader Activity Observed (suspira)"

• "ET TROJAN Dark Halo/SUNBURST SSL Cert Inbound (solartrackingsystem .net)"

• "ET CURRENT_EVENTS Evil JavaScript Injection Sep 29 2015"

• "ET TROJAN BlackGuard_v2 Data Exfiltration Observed"

• "ET CURRENT_EVENTS Successful Natwest Bank Phish 2015-11-21"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-chat .xyz)"

• "ET TROJAN Win32/PurpleFox Retrieving File (GET)"

• "ET TROJAN Observed Gootloader Domain in DNS Lookup (lakeside-fishandchips .com)"

• "ET TROJAN Malicious Rust Crate Related Domain in DNS Lookup (api .kakn .li)"

• "ET TROJAN Win32/Tofsee Connectivity Check M2"

• "ET TROJAN DNS Query to SupremeBot Domain (shadowlegion .duckdns .org)"

• "ET TROJAN Cryptolocker Payment Page (4nauizsaaopuj3qj)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN FSB Snake CnC Activity Inbound via TCP (AA23-129A) M1"

• "ET TROJAN DNS Query for Known Chewbacca CnC Server"

• "ET TROJAN Win32/Injector.BXEW Variant HTTP CnC Beacon 3"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (SilentLibrarian)"

• "ET TROJAN APT10 Related Domain in DNS Lookup (microsofts .top)"

• "ET TROJAN Transparent Tribe APT Related Backdoor Sending System Information"

• "ET TROJAN Known Hostile Domain ant.trenz .pl Lookup"

• "ET CURRENT_EVENTS Successful Gmail Phish 2016-09-30"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (chrom3 .net)"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Bancos/DarkTequila CnC)"

• "ET TROJAN Win32/TrojanDownloader.VB.RTN Payload Delivery Request"

• "ET TROJAN User-Agent (Visbot)"

• "ET MALWARE Trojan-Dropper.MSIL CnC Traffic - GET"

• "ET WEB_CLIENT Anonisma Phishing CSS 2015-12-29"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET TROJAN HAWKBALL CnC Initial Request"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-02"

• "ET TROJAN W32/BaneChant.APT Initial CnC Beacon"

• "ET INFO Data Submitted to Webeden.co.uk - Possible Phishing"

• "ET TROJAN Win32/FFDroider CnC Activity M2"

• "ET TROJAN O97M/Sadoca.C!ml Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Tinba Checkin 2"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET CURRENT_EVENTS Successful Adobe Credential Phish 2022-07-08"

• "ET MALWARE EZULA Spyware User Agent"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (primerosauxiliosperu .com)"

• "ET TROJAN DNSChanger CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Gamaredon CnC Domain Observed in DNS Query"

• "ET TROJAN PennyWise Stealer Data Exfil M4"

• "ET TROJAN Win32/Arkei Stealer CnC Checkin (POST)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4aw .ro)"

• "ET TROJAN Win32/NetDooka Framework RAT Sending System Information M2"

• "ET TROJAN Win32/CrimsonRAT Activity (Inbound)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (cancelledfirestarter .org)"

• "ET POLICY Suspicious User-Agent Containing .exe"

• "ET TROJAN Rogue.Win32/Winwebsec Install 2"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-chat .com)"

• "ET TROJAN Generic Bot Checkin"

• "ET TROJAN MICROPSIA HTTP Failover Response M2"

• "ET USER_AGENTS Suspicious User-Agent (MadeByLc)"

• "ET CURRENT_EVENTS Successful Banco de la Nacion Phish 2016-10-18"

• "ET TROJAN DeltaStealer CnC Domain (deltastealer .gq) in DNS Lookup"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor.Win32.Pushdo.s Checkin"

• "ET TROJAN BKDR_SLOTH.A Checkin"

• "ET TROJAN Py/MechaFlounder CnC Activity - Reporting Upload Command Error"

• "ET CURRENT_EVENTS Raiffeisen Phishing Domain Nov 03 2017"

• "ET TROJAN Win32/Grandoreiro Sending System Information (POST)"

• "ET CURRENT_EVENTS SUSPICIOUS connhost.exe in URI Probable Process Dump/Trojan Download"

• "ET MOBILE_MALWARE Android APT-C-23 (juana .fun in TLS SNI)"

• "ET TROJAN KeyBoy DNS Lookup (www .backus.myftp.name)"

• "ET TROJAN Umbra/Multibot Loader User-Agent (umbra)"

• "ET TROJAN NSO Group Pegasus CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (quickcitytravel .com) 2022-12-05"

• "ET TROJAN Gamaredon Domain in DNS Lookup (capricious .ru)"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M5"

• "ET TROJAN APT DarkHydrus DNS Lookup 1"

• "ET TROJAN DonotGroup Related Domain in DNS Lookup (wordfile .live)"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN GravityRAT CnC Domain (daily .windowsupdates .eu in DNS Lookup)"

• "ET TROJAN W32/Ke3chang.BMW.APT Campaign CnC Beacon"

• "ET CURRENT_EVENTS KaiXin Exploit Kit Landing Page NOP String"

• "ET TROJAN lu0bot CnC Domain in DNS Lookup"

• "ET TROJAN Quant Loader Download Response M2"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET MALWARE LNKR landing page (possible compromised site) M5"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba.m Checkin"

• "ET MALWARE InstallCore PUA/Adware Activity M2"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-12-16"

• "ET TROJAN Proyecto RAT Variant - Yopmail Stage 2 CnC Retrieval"

• "ET TROJAN LokiBot Related DNS query"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (Gelsemium CnC)"

• "ET TROJAN Observed IcedID Domain (abegelkunic .com in TLS SNI)"

• "ET TROJAN Netbounce Program Wrapper Download"

• "ET TROJAN Win32/Voltron/Spectre Stealer Checkin Activity (GET)"

• "ET TROJAN Win32/RisePro CnC Server Response M5"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (deeptrickday .org)"

• "ET TROJAN Lop.gfr/Swizzor HTTP Update/Checkin"

• "ET TROJAN ELF/Emptiness v2 XOR HTTP Flood Command Inbound"

• "ET TROJAN Revcode RAT CnC 2"

• "ET TROJAN Observed Malicious SSL Cert (MosaicRegressor WinHTTP Downloader)"

• "ET TROJAN Linux/Denonia DNS Request Over HTTPS (denonia .xyz) M2"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-02-13"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-07-26"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (snoc-projectuae .com) 2022-12-05"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework URI Struct Flash Request"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-10-21"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN IXWARE Stealer Domain in DNS Lookup"

• "ET CURRENT_EVENTS HiYu - Victim Enrichment Response M3"

• "ET TROJAN NORTHSTAR Command Response"

• "ET MALWARE W32/Stan Malvertising.Dropper CnC Beacon"

• "ET TROJAN Win32/Ropest.H CnC - INBOUND"

• "ET MALWARE NewWeb User-Agent (Lobo Lunar)"

• "ET CURRENT_EVENTS Capesand EK Visitor Tracking"

• "ET TROJAN Shady RAT Get File Command"

• "ET TROJAN Win32/Sharik Checkin"

• "ET TROJAN Crashedtech Loader Domain (crashedff .xyz) in DNS Lookup"

• "ET TROJAN Arid Viper APT Related Domain in DNS Lookup (dorothymambrose .live)"

• "ET CURRENT_EVENTS Banca Monte dei Paschi di Siena Credential Phish Landing Page 2022-04-22"

• "ET P2P BearShare P2P Gnutella Client User-Agent (BearShare 6.x.x.x)"

• "ET TROJAN Villain C2 Framework HTTP Server Response"

• "ET USER_AGENTS Suspicious User-Agent (SUiCiDE/1.5)"

• "ET TROJAN Legion Loader Activity Observed (heil_moloch)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday GET]"

• "ET CURRENT_EVENTS Lucy Security - Phishing Landing Page M1"

• "ET TROJAN Win32/Sefnit Initial Checkin"

• "ET MALWARE Suspected Adware/AccessMembre Checkin M2"

• "ET TROJAN TROJ_PROX.AFV POST"

• "ET TROJAN Observed DNS Query to Stitch C2 Domain"

• "ET TROJAN Zacom/NFlog HTTP POST Connectivity Check"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 10"

• "ET MALWARE Suspicious User-Agent (FaceCooker)"

• "ET CURRENT_EVENTS DRIVEBY FlashPack Plugin-Detect May 13 2014"

• "ET CURRENT_EVENTS BottleEK Plugin Check Response"

• "ET TROJAN NetWire / Ozone / Darktrack Alien RAT - Client KeepAlive"

• "ET TROJAN Reimageplus Ransomware Checkin"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2018-06-14"

• "ET MALWARE Dollarrevenue.com Spyware Code Download"

• "ET WEB_SERVER Insomnia Shell Outbound CMD Banner"

• "ET USER_AGENTS Suspected Mekotio User-Agent (MyCustomUser)"

• "ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M3"

• "ET CURRENT_EVENTS DRIVEBY Sednit EK IE Exploit CVE-2013-1347 M1"

• "ET TROJAN CBReplay Checkin"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (manderatapple .com)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 2"

• "ET TROJAN GravityRAT CnC Domain (sharify .co .in in DNS Lookup)"

• "ET MOBILE_MALWARE NSO Related Domain 4"

• "ET TROJAN Danabot CnC Checkin"

• "ET TROJAN Observed IcedID Domain (manjuskploman .com in TLS SNI)"

• "ET TROJAN W32/Gagolino Banking Trojan Reporting to CnC"

• "ET TROJAN Win32/Valak - Stage 2 - Response - Task"

• "ET TROJAN Possible Pegasus Related DNS Lookup (topcontactco .com)"

• "ET TROJAN Trojan Downloader User-Agent (NOPE)"

• "ET MALWARE Sidebar Related Spyware User-Agent (Sidebar Client)"

• "ET TROJAN GravityRAT CnC Domain (wesharex .net in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN FIN7 Related CnC Domain in DNS Lookup (bypassociation .com)"

• "ET TROJAN Observed Targeted Attack Malicious Domain in TLS SNI (codevexillium .org)"

• "ET TROJAN Win32/TA402 CnC Response M2"

• "ET MALWARE Win32/SocksTroy Session Initiation Attempt M1"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Histories Google Chrome.txt) M2"

• "ET TROJAN Observed Glupteba CnC Domain (venoxcontrol .com in TLS SNI)"

• "ET TROJAN Win32/Braincrypt Ransomware CnC Checkin"

• "ET TROJAN xpsecuritycenter.com Fake AntiVirus GET-Install Checkin"

• "ET TROJAN DNS Query to TOX Ransomware onion (toxicola7qwv37qj)"

• "ET CURRENT_EVENTS Possible Java Applet JNLP applet_ssv_validated in Base64 2 (Reversed)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 37"

• "ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)"

• "ET MALWARE Ezula Install .exe"

• "ET TROJAN Observed DNS Query to Ursnif Domain (mainwog .xyz)"

• "ET TROJAN Win32/LeftHook Stealer - CnC Response (get_socket)"

• "ET CURRENT_EVENTS Anonisma AES Crypto Observed in Javascript - Possible Phishing Landing 2015-12-29"

• "ET TROJAN Observed Cobalt Strike CnC Domain (onlineworkercz .com in TLS SNI)"

• "ET TROJAN SNIcat - Detected C2 Commands (LIST)"

• "ET TROJAN MRCR1 Ransomware Checkin M1"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (i .ua-passport .space)"

• "ET TROJAN Tandem Espionage CnC Domain (cugdwpnykghx .ru) in DNS Lookup"

• "ET TROJAN NoMercy Data Exfiltration M2"

• "ET TROJAN Upatre Common URI Struct Dec 01 2014"

• "ET TROJAN Zingo/GinzoStealer Downloading Additional Payloads"

• "ET CURRENT_EVENTS Possible Successful Verified by Visa Phish Jan 30 2014"

• "ET CURRENT_EVENTS Successful National Australia Bank Phish 2016-12-02"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 14"

• "ET TROJAN Possible Red October proxy CnC 3"

• "ET TROJAN Linux/ChinaZ DDoS Bot Checkin 2"

• "ET TROJAN Win32/Wacapew.C!ml CnC Checkin"

• "ET TROJAN Amarula IRC Botnet Connection Request"

• "ET TROJAN SpyEye Checkin version 1.3.25 or later"

• "ET TROJAN MEME#4CHAN Redirect Activity to Payload"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (macda .ru)"

• "ET CURRENT_EVENTS Successful Generic 000webhostapp.com Phish 2017-10-27"

• "ET TROJAN Observed DNS Query to RisePro Domain (rate-files .com)"

• "ET CURRENT_EVENTS Observed Possible Phishing Landing Page 2021-06-29"

• "ET CURRENT_EVENTS Successful US Bank Phish 2016-09-20"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET TROJAN PandoraRat/Refroso.bsp Directory Listing Sent To Server"

• "ET TROJAN Win32/Redyms.A Checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 17"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) May 25 2017"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M17"

• "ET POLICY BitCoin User-Agent Likely Bitcoin Miner"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (pwresetcisco .com)"

• "ET TROJAN Scarlet Mimic DNS Lookup 27"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN METALJACK APT32 CnC Host Checkin"

• "ET MALWARE Generic Adware Install Report"

• "ET TROJAN DonotGroup CnC Domain Observed in DNS Query"

• "ET TROJAN JS/Z1_Loader Activity (POST)"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M2"

• "ET CURRENT_EVENTS Bleeding Life 2 GPLed Exploit Pack exploit request"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (fulfillityourself .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Loadmoney Checkin 3"

• "ET TROJAN DNS Query to Raspberry Robin Domain (vn6 .co)"

• "ET TROJAN [PTsecurity] QRat.Java.RAT (state_alive)"

• "ET TROJAN Operation Cobra Venom WSF Stage 2 - CnC Checkin"

• "ET TROJAN Win32/SodaMaster CnC HTTPS Checkin M1"

• "ET TROJAN KeyBoy DNS Lookup (www .eleven.mypop3.org)"

• "ET TROJAN Win32/Backdoor.Dripion HTTP CnC Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MALWARE SoftwareTracking Site - Install Report"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Inter Skimmer CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Spy.Banker.ABCG Checkin"

• "ET MALWARE Adware.MultiInstaller"

• "ET TROJAN IIStealer CnC Domain in DNS Lookup (xinxx .allsoulu .com)"

• "ET ATTACK_RESPONSE Unusual FTP Server Banner (fuckFtpd)"

• "ET TROJAN APT-C-48 Related Activity Retrieving ConsoleHost (GET)"

• "ET MALWARE Adware.MultiInstaller checkin 2"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Win32/MagicRAT CnC Activity M2"

• "ET CURRENT_EVENTS Terror EK Landing T1 Jun 02 2017 M1"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Gamaredon Domain in DNS Lookup (keymnvatipa .ru)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (g0 .pm)"

• "ET TROJAN JSSLoader CnC Domain (essentialsmassageanddayspa .com) in DNS Lookup"

• "ET TROJAN Tandem Espionage CnC Domain (zpuxmwmwdxxk .ru) in DNS Lookup"

• "ET TROJAN Tendrit CnC Beacon 2"

• "ET CURRENT_EVENTS Successful Canada Revenue Agency Phish 2016-08-30"

• "ET TROJAN DNS Query to TA444 Domain (docsend .business)"

• "ET CURRENT_EVENTS SunDown EK CVE-2015-0016 Sep 22 2016 (b643)"

• "ET TROJAN Rilide Stealer Domain in DNS Lookup (ashgrrwt .click)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-blog .xyz)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bscare .us)"

• "ET TROJAN DDoS Win32/Nitol.A Checkin"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .result .garrettcountygranfondo .org)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/HMR RAT Sending System Information M4"

• "ET WEB_SERVER ATTACKER WebShell - Weevely - Cookie"

• "ET WEB_CLIENT Tech Support Phone Scam Landing Feb 09 2017"

• "ET TROJAN Possible Regin Init CnC Beacon UDP"

• "ET CURRENT_EVENTS Successful TA422 Credential Phish 2022-03-17 M1"

• "ET TROJAN Win32/Gh0st RAT Variant CnC Checkin response"

• "ET TROJAN MageCart Skimmer Domain in DNS Lookup (bootstrap2 .xyz)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (meeting-online .site)"

• "ET TROJAN DNS Query to Malicious Domain (2311forget .online)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (damanhealth .online)"

• "ET TROJAN Suspicious User-Agent (Post)"

• "ET TROJAN CHAOS RAT/AlfaC2 CnC Server Status Check"

• "ET TROJAN Deathstalker/Evilnum Delivery Domain in DNS Lookup (storangefilecloud .vip)"

• "ET TROJAN APT DarkHydrus DNS Lookup 5"

• "ET TROJAN Observed Glupteba CnC Domain (limeprime .com in TLS SNI)"

• "ET INFO Possible Phishing Landing via Moonfruit M2 2016-01-26"

• "ET TROJAN DNSG - Data Exfiltration via DNS"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2021-03-16"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (kdf-mail .com)"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET CURRENT_EVENTS Successful My ADP Phish (set) 2017-02-16"

• "ET TROJAN Observed Malicious Debugging Application Related Domain (dbgsymbol .com in TLS SNI)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cvix .live)"

• "ET ATTACK_RESPONSE Matahari client"

• "ET TROJAN W32/FakeAlert Fake Security Tool Checkin"

• "ET TROJAN Gamaredon APT Related Activity (POST)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zie5 .com)"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (yhgrffndvzbtoilmundkmvbaxrjtqsew .com)"

• "ET TROJAN Possible Kaseya VSA Exploit Activity Inbound M2"

• "ET WEB_SERVER ATTACKER WebShell - 1337w0rm - Landing Page"

• "ET TROJAN W32/Waterspout.APT Backdoor CnC Beacon"

• "ET CURRENT_EVENTS SUSPICIOUS winlog.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN TABMSGSQL/Sluegot.C Checkin"

• "ET TROJAN IIStealer Inbound Exfil Request"

• "ET CURRENT_EVENTS SUSPICIOUS .exe Downloaded from SVN/HTTP on GoogleCode"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Wacatac.B!ml CnC Checkin"

• "ET TROJAN Blackmagic Ransomware Checkin Activity (GET)"

• "ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Observed TOAD Domain (bscare .help in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (masuka .club in DNS Lookup)"

• "ET TROJAN Red October/Win32.Digitalia Checkin cgi-bin/nt/th"

• "ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC Scanning Message"

• "ET TROJAN Possible Java/Downloader Observed in Pawn Storm CVE-2015-2590 1"

• "ET TROJAN CN Based APT Related Domain in DNS Lookup (instructor .giize .com)"

• "ET CURRENT_EVENTS Observed Balada TDS Domain (scriptsplatform .com in TLS SNI)"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (app-stat .com)"

• "ET CURRENT_EVENTS GOV UK Possible COVID-19 Phish 2020-04-06"

• "ET TROJAN SpamBanker message"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (nikanps .top)"

• "ET TROJAN Observed Cobalt Strike CnC Domain (defenderupdateav .com in TLS SNI)"

• "ET TROJAN 000Stealer CnC Checkin"

• "ET TROJAN PoshC2 - Observed Default URI Structure M2"

• "ET USER_AGENTS Suspicious user agent (mdms)"

• "ET TROJAN APT34 TONEDEAF 2.0 Requesting Commands from CnC"

• "ET TROJAN Win32/Unknown RAT CnC Server Acknowledgement"

• "ET MALWARE Spylocked Fake Anti-Spyware User-Agent (SpyLocked)"

• "ET TROJAN Win32/Termite Agent Implant Keep-Alive"

• "ET TROJAN GravityRAT CnC Domain (chuki .mozillaupdates .us in DNS Lookup)"

• "ET TROJAN Win32/Fluxer CnC Checkin"

• "ET TROJAN APT41 KEYPLUG Related Domain in DNS Lookup"

• "ET TROJAN ATTACKER IRCBot - PRIVMSG Response - net command output"

• "ET TROJAN Unknown APT Related Domain in DNS Lookup"

• "ET TROJAN Win32/Delf.TJJ CnC Checkin M2"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET CURRENT_EVENTS Successful Chase Phish M3 2016-08-26"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET TROJAN FruityArmor DNS Lookup (weekendstrips .net)"

• "ET CURRENT_EVENTS Successful Banca Monte dei Paschi di Siena Credential Phish 2022-04-22"

• "ET CURRENT_EVENTS EITest SocENG Inject M2"

• "ET MALWARE Zugo.com SearchToolbar User-Agent (SearchToolbar)"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky C2)"

• "ET TROJAN Lyposit Ransomware Checkin 1"

• "ET POLICY Tripod/Lycos Form Submission - Possible Successful Phish"

• "ET ATTACK_RESPONSE Backdoor reDuh http tunnel"

• "ET TROJAN Shady RAT Put File Command"

• "ET USER_AGENTS Suspicious User-Agent Detected (RLMultySocket)"

• "ET TROJAN Win32/Trickbot Data Exfiltration M3"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (configuratorpro .com)"

• "ET TROJAN Godlua Backdoor Downloading Encrypted Lua"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (group .evalaskatours .com)"

• "ET TROJAN Dropper Checkin (often scripts.dlv4.com related)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 3"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed DarkSide Ransomware CnC Domain in TLS SNI"

• "ET TROJAN Lunar Builder Exfil Attempt"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Trickbot Payload Request"

• "ET TROJAN W32/NSISDL.Downloader CnC Server Response"

• "ET TROJAN DNS Query to Raspberry Robin Domain (mirw .wf)"

• "ET TROJAN Win32/Rodecap/Travle/PYLOT CnC Checkin M2"

• "ET TROJAN Delf Alms backdoor checkin"

• "ET TROJAN [FIREEYE] SLIGHTPULSE Webshell Activity M2 (set) M2"

• "ET TROJAN TSPY_BANKER.IDV/Infostealer.Bancos Module Download"

• "ET TROJAN Win32/MagicRAT Additional Payload URI M2"

• "ET CURRENT_EVENTS Nuclear SilverLight Exploit"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-chat .com)"

• "ET TROJAN ActionLoader CnC Domain in DNS Lookup (azure-tech .pro)"

• "ET TROJAN Observed Trojan.Verblecon Related Domain (gaymers .ax in TLS SNI)"

• "ET TROJAN Win32/Backdoor.Dripion External IP Check"

• "ET TROJAN Sharik/Smoke CnC Beacon 10"

• "ET CURRENT_EVENTS DRIVEBY Sednit EK IE Exploit CVE-2014-1776 M1"

• "ET TROJAN PoshC2 - Observed Default URI Structure M20"

• "ET CURRENT_EVENTS Successful Citizenbank Phish 2016-05-24 M1"

• "ET TROJAN [eSentire] VBS Retrieving Malicious Payload"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (emsclikoil .com) 2022-12-05"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (mycisco-helpdesk .ml)"

• "ET TROJAN NSIS/TrojanDownloader.Agent.NZK Server Response"

• "ET CURRENT_EVENTS Observed TOAD Domain (nxhelp .live in TLS SNI)"

• "ET TROJAN Win32/LODEINFO v0.3.6 CnC Checkin"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET MOBILE_MALWARE Android/SMSThief.F Banker CnC Beacon"

• "ET CURRENT_EVENTS Successful Adobe Phish 2022-01-12"

• "ET TROJAN DNS Query to Raspberry Robin Domain (o7car .com)"

• "ET CURRENT_EVENTS Successful America First CU Credential Phish 2022-12-14"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bshelp .live)"

• "ET TROJAN Observed MAZE Ransomware CnC Domain (plaintsotherest .net in TLS SNI)"

• "ET CURRENT_EVENTS Observed TOAD Domain (j2care .cc in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (r2care .us)"

• "ET TROJAN GanDownloader CnC Checkin"

• "ET TROJAN Kpang.com Related Trojan User-Agent (alertup)"

• "ET TROJAN CBReplay.P Ransomware"

• "ET TROJAN Windows/OriginLogger CnC Domain (originproducts .pw) in DNS Lookup"

• "ET CURRENT_EVENTS SUSPICIOUS .PIF File Inside of Zip"

• "ET TROJAN Malicious Domain in DNS Lookup (jscloud .biz)"

• "ET TROJAN TA421/YTTRIUM/APT29 TLS Certificate M3"

• "ET TROJAN Gamaredon Domain in DNS Lookup (marginisbi .ru)"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (fb-accounts .com)"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET USER_AGENTS Suspicious User-Agent (ReadFileURL)"

• "ET CURRENT_EVENTS Base64 HTTP URL Refresh - Common Phish Landing Obfuscation 2016-01-01"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5z .wf)"

• "ET TROJAN Observed Malicious SSL Cert (ElegyRAT)"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN PlugX UDP CnC Beacon"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 16"

• "ET TROJAN Win32/WarHawk Activity (filemgr) M2"

• "ET TROJAN Executable contained in DICOM Medical Image SMB File Transfer"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN HTTP Request to a *.su domain with direct request/fakebrowser (multiple families flowbit set)"

• "ET TROJAN MiniDuke CnC Beacon (string2_slide_2_2)"

• "ET TROJAN PowerTrick Task Answer"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw/SlemBunk/SLocker Checkin"

• "ET TROJAN W32/CoinMiner.ESJ!tr CnC Domain (ui .0x0x0x0x0 .xyz) in DNS Lookup"

• "ET TROJAN Suspected Stealth Soldier Backdoor Related Activity M2 (GET)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 3 Staging Domain)"

• "ET TROJAN Iron Tiger Likely PlugX DNS Lookup (chrome.servehttp.com)"

• "ET MALWARE Win32/Spy.Agent.QCL Variant Activity (POST)"

• "ET TROJAN Higaisa CnC Activity"

• "ET TROJAN Observed Suspicious SSL Cert (Acme Co)"

• "ET TROJAN CN Based APT Related Domain in DNS Lookup (supportteam .lingrevelat .com)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (CobaltStrike C2)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 12 SET"

• "ET TROJAN Observed DNS Query to TA444 Domain (team .msteam .biz)"

• "ET TROJAN APT28/Sednit DNS Lookup (cnnpolitics .eu)"

• "ET TROJAN APT Hellsing Proxy Checker Checkin"

• "ET TROJAN Observed Ursnif Domain in TLS SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ELF/Emptiness v2 XOR Exec Command Inbound"

• "ET TROJAN Win32/Agent.UOI CnC Checkin"

• "ET TROJAN PowerShell/Agent.A DNS Checkin"

• "ET TROJAN Knockbot Proxy Response From Controller (empty command)"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1qm34lsc65zpw79lxes69zkqmk6ee3ew .com in TLS SNI)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (QakBot)"

• "ET TROJAN sLoad Related CnC Domain in DNS Lookup (angedionisu .eu)"

• "ET TROJAN Possible Satan Cryptor GeoIP Lookup"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Observed DNS Query to RisePro Domain (uni-files .com)"

• "ET TROJAN Arkei/Vidar/Mars Stealer Variant DLL GET Request M2"

• "ET MALWARE lolzilla JS/PHP WebSkimmer - Data Exfil"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (mynameisgarfield .top)"

• "ET TROJAN Win32/Backdoor.YesMaster CnC Checkin"

• "ET TROJAN Qbot Payload Request (2023-03-13) M2"

• "ET TROJAN Trojan Downloader User-Agent (Tiny)"

• "ET MOBILE_MALWARE Android APT-C-23 (accounts-googlc .com in DNS Lookup)"

• "ET TROJAN MiniDuke CnC Beacon (string2_slide_1_1)"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC) 2019-11-18"

• "ET TROJAN DNS Query to Raspberry Robin Domain (dsi .mk)"

• "ET CURRENT_EVENTS KaiXin EK Jar URI Struct"

• "ET TROJAN Win32/Gh0stRat C2 Checkin"

• "ET TROJAN TA577 Style Response (2023-05-15)"

• "ET MOBILE_MALWARE Android/Spy.Agent.AON / Glancelove DNS Lookup 5 (updatemobapp .website)"

• "ET TROJAN Mustang Panda APT PlugX Related Domain in DNS Lookup (hilifimyanmar .com)"

• "ET TROJAN Possible Passthru/Kshell Port Redirection Initiation"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 5"

• "ET CURRENT_EVENTS Successful Hotmail Phish 2016-07-14"

• "ET MOBILE_MALWARE [PTsecurity] Spyware.BondPath (PathCall/Dingwe) Check-in"

• "ET TROJAN Win32/Lumma Stealer CnC Domain (765mm .xyz) in DNS Lookup"

• "ET TROJAN W32/Trojan-Gypikon Sending Data"

• "ET TROJAN Win32\Cryptbot CnC Domain (okwnyw02 .top) in DNS Lookup"

• "ET CURRENT_EVENTS Disdain EK Flash Exploit M1 Aug 23 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Magecart Related Domain in DNS Lookup (cdn-mediahub .com)"

• "ET MALWARE Win32/YTDDownloader.F Activity"

• "ET TROJAN Cryptolocker Payment Page (aynfksddnnfwkd)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2022-09-28"

• "ET TROJAN SocGholish Domain in DNS Lookup (stockroom .baybeboutiquellc .com)"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (ny .silvergatehr .com)"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN Win32/Agniane Stealer CnC Exfil (POST)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (neworderspath .org)"

• "ET CURRENT_EVENTS ScanBox Jun 06 2015 M2 T1"

• "ET TROJAN FIN7 JSSLoader Activity (GET)"

• "ET MOBILE_MALWARE Andr/com.sdwiurse"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (d2care .us)"

• "ET TROJAN Tinba Checkin 3"

• "ET TROJAN Win32/Filecoder.STOP Variant Public Key Download"

• "ET INFO Suspicious Possible Process Dump in POST body"

• "ET CURRENT_EVENTS Successful Apple Phish 2016-09-27"

• "ET CURRENT_EVENTS Successful Apple Phish M2 Feb 06 2016"

• "ET TROJAN ConstructorWin32/Agent.V"

• "ET TROJAN Possible Bedep Connectivity Check"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN Win32/TA402 CnC Activity (POST)"

• "ET EXPLOIT Possible CVE-2016-2209 Symantec PowerPoint Parsing Buffer Overflow M2"

• "ET MALWARE MediaTickets Download"

• "ET TROJAN FakeAV Check-in purporting to be MSIE with invalid terse HTTP headers"

• "ET TROJAN Win32/Lilith Stealer uploadFile Data Exfiltration Attempt"

• "ET TROJAN WEBC2-TABLE Checkin 3 - APT1 Related"

• "ET TROJAN W32/Mnless Checkin"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-schnellvpn .xyz)"

• "ET TROJAN Windows executable base64 encoded in XML"

• "ET CURRENT_EVENTS Successful DHL Phish 2015-09-14"

• "ET TROJAN VBS/Wimmie.A Set"

• "ET TROJAN Gamaredon Domain in DNS Lookup (kemoziripa .ru)"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Win32.Genome Initial Checkin"

• "ET TROJAN W32/Armageddon CnC Checkin"

• "ET TROJAN Fake Browser Update via Error Page Payload"

• "ET TROJAN Qbot Payload Request (2023-03-13) M5"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Win32.Bicololo Response 2"

• "ET TROJAN Magecart/Skimmer Domain in DNS Lookup (yzxi .net)"

• "ET TROJAN JS/WSF Downloader Dec 08 2016 M7"

• "ET MOBILE_MALWARE Android APT-C-23 (pml-help .site in DNS Lookup)"

• "ET TROJAN TA453 Related Domain in DNS Lookup (tinyurl .ink)"

• "ET MALWARE Adware.Gamevance.AV Checkin"

• "ET TROJAN [PTsecurity] Tinba (Banking Trojan) Check-in"

• "ET TROJAN Sourtoff Download Simda Request"

• "ET CURRENT_EVENTS Successful Generic Phish (302) 2016-12-16"

• "ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC"

• "ET CURRENT_EVENTS Common Form POST - Yahoo Phishing Landing 2020-06-11"

• "ET TROJAN Mac User-Agent Typo INBOUND Likely Hostile"

• "ET TROJAN MSIL/Agent.CTK Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (bpyo .in)"

• "ET CURRENT_EVENTS Successful PNC Bank Phish M1 2016-10-14"

• "ET CURRENT_EVENTS CDC Coronavirus Related Phishing Landing 2020-04-07"

• "ET MALWARE Spyware User-Agent (Sidesearch)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 93"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Tsunami)"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET TROJAN Socks5SystemZ CnC Checkin Response M1"

• "ET TROJAN OSX/Leverage.A Checkin"

• "ET CURRENT_EVENTS Fake Browser Update Domain in DNS Lookup (bingbuy .com)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (pdf .cisco-webex .online)"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Security Scanner Domain (log4shell .huntress .com)"

• "ET TROJAN Observed DNS Query to RisePro Domain (qd-file .com)"

• "ET CURRENT_EVENTS Common Form POST - Paypal Phishing Landing 2020-06-11"

• "ET TROJAN Possible Winnti DNS Lookup"

• "ET MALWARE yupsearch.com Spyware Install - protector.exe"

• "ET TROJAN Arid Viper APT Related Domain in DNS Lookup (zakaria-chotzen .info)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2015-07-28"

• "ET CURRENT_EVENTS Vietnamese Govt Credential Phish M3 2023-07-18"

• "ET CURRENT_EVENTS Netflix Phishing Landing 2017-07-20"

• "ET CURRENT_EVENTS Possible USAA Phishing Landing 2016-07-05"

• "ET TROJAN Novaloader Stage 2 VBS Request"

• "ET TROJAN Observed Scattered Spider Domain (victimname-servicedesk .com in TLS SNI)"

• "ET TROJAN Win32/DarkCloud Variant Exfil over SMTP (FirefoxCookies.json)"

• "ET TROJAN Panda Banker C2 Domain (uiaoduiiej .chimkent .su in DNS Lookup)"

• "ET TROJAN MSIL/Spy.Agent.AES Zipped Exfil"

• "ET TROJAN ComRAT CnC Domain in DNS Lookup"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (nyqualitypizza .top)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (andreeasasser .com)"

• "ET CURRENT_EVENTS DHL Phish Landing Page 2015-10-17"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET TROJAN Zeus Spam Campaign pdf.exe In ZIP - 26th Feb 2014"

• "ET TROJAN DNS Query to Raspberry Robin Domain (03s30 .com)"

• "ET TROJAN TA444 Domain in TLS SNI (docshared .col-link .linkpc .net)"

• "ET TROJAN Matanbuchus Loader Server Response"

• "ET TROJAN Win32/Backdoor Sending Task Status (POST)"

• "ET MALWARE Adware.InstallCore.B Checkin"

• "ET TROJAN Plurox CnC Domain in DNS Lookup"

• "ET TROJAN GravityRAT CnC Domain (nightlybuild .mozillaupdates .com in DNS Lookup)"

• "ET TROJAN Tandem Espionage CnC Domain (sanlygeljek .ru) in DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 21"

• "ET CURRENT_EVENTS Successful Free Mobile (FR) Phish 2016-12-08"

• "ET MALWARE Win32/Agent.NDV Receiving Task Config File"

• "ET TROJAN Inter Skimmer CnC Domain in DNS Lookup"

• "ET TROJAN KWN Clipper Checkin via Telegram"

• "ET TROJAN LuminosityLink - Outbound Data Channel CnC Delimiter"

• "ET TROJAN MAGICHOUND-related DNS Lookup (analytics-google .org)"

• "ET TROJAN Win32/Trickbot Data Exfiltration M2"

• "ET TROJAN [ANY.RUN] Hydrochasma Fast Reverse Proxy M2"

• "ET TROJAN WS/JS Downloader Mar 07 2017 M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Operation Cobra Venom WSF Stage 1 - File Decode Completed"

• "ET TROJAN Pingback OK Issued"

• "ET TROJAN Locky CnC checkin Nov 21"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (cookie.txt) M1"

• "ET TROJAN FighterPOS CnC Beacon 2"

• "ET TROJAN SSL/TLS Certificate Observed (Get2 CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j4z .xyz)"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (mycisco .gq)"

• "ET CURRENT_EVENTS Successful USAA Phish 2015-10-20"

• "ET TROJAN Dridex Base64 Executable"

• "ET TROJAN Win32/Remcos RAT Checkin 68"

• "ET TROJAN Monsoon Tinytyphon CnC Beacon Exfiltrating Docs"

• "ET MALWARE W32/MediaGet.Adware Installer Download"

• "ET CURRENT_EVENTS BHEK Payload Download (java only alternate method may overlap with 2017454)"

• "ET TROJAN APT34 Related Activity (GET)"

• "ET TROJAN KHRAT DragonOK DNS Lookup (inter-ctrip .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (bestbitloly .website in DNS Lookup)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (autopartslarry .top)"

• "ET TROJAN Observed DNS Query to TA444 Domain (careersbankofamerica .us)"

• "ET TROJAN Jupyter Stealer Reporting System Information M2"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (jobintro .linkpc .net)"

• "ET CURRENT_EVENTS Possible Phishing Landing Hosted on CodeSandbox.io M5"

• "ET TROJAN TransparentTribe CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to TA444 Domain (ledger-cloud .com)"

• "ET TROJAN MSIL/GravityRAT CnC Domain (msoftupdates .com in DNS Lookup)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (metallife .org)"

• "ET TROJAN Suspicious UA Mozilla / 4.0"

• "ET TROJAN APT28/Sednit DNS Lookup (reuters-press .com)"

• "ET TROJAN Observed Malicious SSL Cert (APT32 JEShell CnC)"

• "ET TROJAN Bitter APT Related Domain in DNS Lookup (emshedulersvc .com)"

• "ET TROJAN Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (lm-career .com)"

• "ET TROJAN Observed Epsilon Stealer Domain (epsilon1337 .com) in TLS SNI"

• "ET TROJAN DNS Query For TURNEDUP.Backdoor / NanoCore CnC (microsoftupdated)"

• "ET TROJAN FakeAV.EGZ Checkin 1"

• "ET CURRENT_EVENTS Common Form POST - SunTrust Phishing Landing 2020-06-11"

• "ET WEB_SERVER Jorgee Scan"

• "ET MOBILE_MALWARE Worm.AndroidOS.Selfmite.a Checkin"

• "ET MALWARE Spyware User-Agent (count)"

• "ET TROJAN TorrentLocker DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET TROJAN Chafer CnC Domain in DNS Lookup"

• "ET TROJAN HighTide trojan Checkin"

• "ET TROJAN SysJoker Related Domain in DNS Lookup (winaudio-tools .com)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (wikipedia-book .vote)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (secure-access10 .mx)"

• "ET MALWARE MySideSearch Browser Optimizer"

• "ET TROJAN Vawtrak/NeverQuest .onion Proxy Domain (llgerw4plyyff446)"

• "ET TROJAN Deep Panda Domain in DNS Lookup (vpn2 .smi1egate .com)"

• "ET MALWARE Antivirgear.com Fake Anti-Spyware User-Agent (AntiVirGear)"

• "ET TROJAN Win32/Tflower Ransomware CnC Checkin"

• "ET DNS Reply Sinkhole - sinkhole.cert.pl 148.81.111.111"

• "ET TROJAN Possible Sharik/Smoke Loader Microsoft Connectivity check"

• "ET TROJAN Patchwork APT BADNEWS Variant CnC Checkin M2"

• "ET TROJAN Formbook 0.3 Checkin"

• "ET MALWARE Win32/SmartTab PUP Install Activity 2"

• "ET MALWARE Suspicious User Agent Custom_56562_HttpClient/VER_STR_COMMA"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (QakBot)"

• "ET TROJAN Cobalt Strike Beacon Activity"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-10-06"

• "ET TROJAN DNS Query to Raspberry Robin Domain (xjam .hk)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (m0 .yt)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (nz4 .xyz)"

• "ET ATTACK_RESPONSE PowerShell Internet Connectivity Check via Network GUID Inbound"

• "ET TROJAN Dalexis CnC Beacon"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .ddns .net)"

• "ET TROJAN ZeroAccess/Max++ Rootkit C&C Activity 1"

• "ET MOBILE_MALWARE Arid Viper (fasebaak .com in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (safara .sytes.net)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (videomeethub .online)"

• "ET CURRENT_EVENTS Common Form POST - Instagram Phishing Landing 2020-06-11"

• "ET TROJAN W32/Scar Downloader Request"

• "ET MOBILE_MALWARE Android/Spy.Agent.BEH Variant Activity (POST)"

• "ET CURRENT_EVENTS Excel Online Phishing Landing Aug 09 2016"

• "ET TROJAN Suspicious Download Setup_ exe"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-10-22"

• "ET TROJAN DNS Query to Raspberry Robin Domain (egso .net)"

• "ET TROJAN Diavol Communicating with CnC - Priority Request"

• "ET TROJAN Suspected Jupyter Stealer Related Activity (GET)"

• "ET TROJAN CommentCrew Possible APT crabdance backdoor base64 head"

• "ET TROJAN Matanbuchus Loader CnC M1"

• "ET TROJAN Gamaredon Domain in DNS Lookup (imenandpa .ru)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (dzhumoukpa .ru)"

• "ET TROJAN Suspicious Domain (lawyeryouwant .com) in TLS SNI"

• "ET TROJAN Themedata Embedded OLE Object Maldoc Related Domain in DNS Lookup (support-zabbix .com)"

• "ET CURRENT_EVENTS Successful Paypal Phish M4 2016-10-06"

• "ET CURRENT_EVENTS Observed TOAD Domain (suvfix .us in TLS SNI)"

• "ET TROJAN [PTsecurity] DorkBot.Downloader CnC Beacon"

• "ET MALWARE [PTsecurity] Adware.SearchGo (start_page)"

• "ET USER_AGENTS Dialer-967 User-Agent"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN Win32/RokRat CnC Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Websocket Credential Phish Sep 15 2017"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M3 2022-04-05"

• "ET USER_AGENTS Otwycal User-Agent (Downing)"

• "ET TROJAN APT DarkHydrus DNS Lookup 27"

• "ET TROJAN Win32/DMA Locker CnC Checkin"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M19"

• "ET TROJAN Daemonize.ft HTTP Checkin"

• "ET CURRENT_EVENTS Unknown_MM - Payload Download"

• "ET CURRENT_EVENTS Blocked Email Account Phishing Landing 2016-08-23"

• "ET TROJAN r0 CnC Architecture POST 2"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M7"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (mil-gov .space)"

• "ET WORM TheMoon.linksys.router 3"

• "ET WEB_CLIENT Generic Fake Support Phone Scam Mar 9 M3"

• "ET TROJAN Android/MMRAT CnC Checkin M2"

• "ET CURRENT_EVENTS Unknown EK Landing Page"

• "ET TROJAN DoS.Linux/Elknot.E Checkin"

• "ET TROJAN Miras C2 Activity"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunchtech .linkpc .net)"

• "ET TROJAN linux.backdoor.wordpressexploit file upload test"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (awindakizend .com)"

• "ET TROJAN Win32/Ficker Stealer Activity M2"

• "ET INFO Possible Phishing Landing via Moonfruit M1 2016-10-03"

• "ET MOBILE_MALWARE Backdoor.AndroidOS.Xhunter.a CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phishing 2016-02-23"

• "ET TROJAN Win32/H0lyGh0st Ransomware CnC Activity (GET Public Key)"

• "ET CURRENT_EVENTS TDS Landing Page - Observed Leading to CryptoClipper"

• "ET TROJAN Pegasus Domain in DNS Lookup (akhbar-almasdar .com)"

• "ET CURRENT_EVENTS Successful Microsoft Office Phish 2020-02-26"

• "ET MOBILE_MALWARE Android APT-C-23 (kristy-milligan .website in TLS SNI)"

• "ET TROJAN SNIcat - Detected C2 Commands (LS)"

• "ET CURRENT_EVENTS Possible Tor/Noscript JS Bypass"

• "ET USER_AGENTS Suspicious Generic Style UA Observed (My_App)"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (resolverequest .live)"

• "ET CURRENT_EVENTS Successful Greatness Credential Phish M3 (2023-11-07)"

• "ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M4"

• "ET TROJAN DNS Query to Raspberry Robin Domain (h0 .wf)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Enosch.A gtalk connectivity check"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (google_chrome_default_) M1"

• "ET TROJAN Bifrose/Cycbot Checkin"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Syrian Malware Checkin"

• "ET CURRENT_EVENTS Successful Google Drive Phish Sept 1 M2 2015-09-02"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (nameyourcatlikeshedeserved .top)"

• "ET TROJAN Win32/Pterodo Activity (POST)"

• "ET MOBILE_MALWARE NSO Related Domain 40"

• "ET TROJAN Sharik/Smoke CnC Beacon 8"

• "ET CURRENT_EVENTS FlimKit Post Exploit Payload Download"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (ciscovpn1 .com)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN MACE C2 Framework Activity (GET)"

• "ET TROJAN DNS Query Sykipot Domain insdet.com"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework Landing - Various Exploits"

• "ET TROJAN BazaBackdoor Variant CnC Activity M4"

• "ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup"

• "ET TROJAN Potential Sefnit C2 traffic (from server)"

• "ET TROJAN MS_D0wnl0ad3r Screenshot Upload"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Retadup Success Response from CnC"

• "ET CURRENT_EVENTS SWAT USA Drop Login Panel"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-20"

• "ET TROJAN JS/Nemucod requesting EXE payload 2016-03-31"

• "ET TROJAN Pony DLL Download M2"

• "ET TROJAN Possible Gamaredon APT Related Malicious Shortcut Activity (GET)"

• "ET TROJAN Observed DNS Query to RisePro Domain (xx1-files .com)"

• "ET WEB_SERVER WebShell Generic eval of base64_decode"

• "ET TROJAN Sysget/HelloBridge HTTP GET CnC Beacon"

• "ET TROJAN Win32/Unknown Domain (hackermania .org) in TLS SNI"

• "ET TROJAN Simda.C Checkin"

• "ET TROJAN HermeticWizard - SMB Spreader - Remote Process Creation"

• "ET MALWARE User-Agent (ie) - Possible Trojan Downloader"

• "ET TROJAN DNS Query to Raspberry Robin Domain (omzk .org)"

• "ET CURRENT_EVENTS Generic Custom Logo Phishing Landing"

• "ET MALWARE APN/Ask Toolbar PUA/PUP User-Agent"

• "ET TROJAN Observed Malicious SSL Cert (Coin-Hive In Browser Mining)"

• "ET TROJAN DNS Query to TA444 Domain (waitingfor .cfd)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6c .nz)"

• "ET WEB_CLIENT Tech Support Scam Landing 2020-08-19"

• "ET TROJAN China Based APT Related Domain in DNS Lookup (portal .super-encrypt .com)"

• "ET TROJAN Observed Targeted Attack Malicious Domain in TLS SNI (transplugin .io)"

• "ET CURRENT_EVENTS Successful Zimbra Account Phish 2015-10-23"

• "ET TROJAN Kakfum/COLDSTEEL CnC Beacon M3"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (pak-web .com)"

• "ET TROJAN Backdoor.Win32/Etumbot.B Requesting RC4 Key"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST M4"

• "ET TROJAN APT37 M2RAT CnC Server Command - URL"

• "ET TROJAN Possible FoggyWeb Backdoor Server Response"

• "ET TROJAN Megumin v2 Stealer User-Agent"

• "ET TROJAN Zberp/ZeusVM receiving config via image file (steganography)"

• "ET CURRENT_EVENTS Successful Paypal Phish Oct 16 2017"

• "ET TROJAN Troj/ReRol.A Checkin 2"

• "ET TROJAN Gallium APT Related Domain in DNS Lookup (hinitial .com)"

• "ET MALWARE NewWeb/Sudui.com Spyware User-Agent (aaaabbb)"

• "ET WEB_CLIENT Fake FlashPlayer Update Leading to CoinMiner M1 2018-10-12"

• "ET TROJAN W32/Emotet.v4 Checkin"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (ProcessInfo_Log.txt) M1"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET EXPLOIT Metasploit Plugin-Detect Posting Data 7"

• "ET TROJAN CMDASP Webshell Command Request"

• "ET TROJAN APT LuckyMouse Polpo Malware CnC"

• "ET TROJAN Patchwork APT CnC Beacon 2"

• "ET CURRENT_EVENTS Generic Personalized Google Firebase Hosted Phishing Landing"

• "ET MOBILE_MALWARE Android TrojanFakeLookout.A"

• "ET CURRENT_EVENTS Possible HMRC Phishing Domain 2016-06-08"

• "ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (omegabots .xyz in TLS SNI)"

• "ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M2"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (arauas .com)"

• "ET TROJAN Darkgate Stealer CnC Checkin"

• "ET WEB_CLIENT JS Obfuscation - Possible Phishing 2016-03-01"

• "ET DOS HOIC with booster outbound"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (filesrvr .net)"

• "ET INFO Trend Micro Phishing Simulation Service"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j8 .si)"

• "ET TROJAN MICROPSIA HTTP Failover Reporting Infected System Information and RAT Version"

• "ET TROJAN ProxyBox - HTTP CnC - get_servers.php"

• "ET MALWARE Freeze.com Spyware Download"

• "ET TROJAN Observed Malicious SSL Cert (IcedID CnC)"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2019-09-17 1)"

• "ET CURRENT_EVENTS Successful Windows Live Phish 2016-12-23"

• "ET TROJAN DonotGroup CnC Domain in DNS Lookup (drinkeatgood .space)"

• "ET TROJAN PlugX Checkin"

• "ET TROJAN W32/Depyot.Downloader CnC Beacon"

• "ET MALWARE Win-touch.com Spyware User-Agent (WinTouch)"

• "ET TROJAN Trojan-Ransom.Win32.Blocker.dham Checkin"

• "ET TROJAN Ruskill/Palevo KCIK IRC Command"

• "ET TROJAN Win32/SilentBreak Related Domain in DNS Lookup (eleed .cloud)"

• "ET TROJAN GCleaner Payload Retrieval Attempt"

• "ET TROJAN Rovnix CnC Domain in DNS Query"

• "ET TROJAN DNS Query for IcedID Domain (magizanqomo .com)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2015-11-20"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (group-meeting .team)"

• "ET TROJAN Gamaredon CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS Successful WhatsApp Payment Phish M2 2016-11-15"

• "ET TROJAN XDUpload Sending File Upload Progress"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed IcedID Domain (bruzilovv .top in TLS SNI)"

• "ET CURRENT_EVENTS Successful Microsoft Account Phish 2019-01-29"

• "ET TROJAN Gamaredon Domain in DNS Lookup (jafata .ru)"

• "ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/FunnyDream Backdoor Related Domain in DNS Lookup (www .carelessnessing .com)"

• "ET TROJAN APT32/OceanLotus Associated Domain in DNS Lookup (qh2020 .org)"

• "ET CURRENT_EVENTS Successful DHL Phish 2015-09-17"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-01-15 M3"

• "ET TROJAN TA444 Related Domain (autoprotect .com .de) in DNS Lookup"

• "ET CURRENT_EVENTS CVE-2014-6332 Sep 01 2016 (HFS Actor) M2"

• "ET CURRENT_EVENTS Successful Barclays Phish M1 2016-10-06"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN [PTsecurity] WeChat (Ransomware/Stealer) HttpHeader"

• "ET CURRENT_EVENTS Successful Mailbox Upgrade Phish 2016-06-27 M1"

• "ET TROJAN GravityRAT CnC Domain (nightly .windowsupdates .eu in DNS Lookup)"

• "ET TROJAN Likely Malware CnC Hosted on 000webhostapp - POST to gate.php"

• "ET TROJAN Observed Teal Kurma Domain (querryfiles .com in TLS SNI)"

• "ET TROJAN KeyloggerOnline Keylogger Checkin (sleep)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif Injects)"

• "ET TROJAN Observed CloudAtlas APT Related Domain (checklicensekey .com in TLS SNI)"

• "ET CURRENT_EVENTS Possible Successful Apple Phish 2015-07-27"

• "ET CURRENT_EVENTS - Landing Page Requested - 15Alpha1Digit.php"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Hawkshaw.a (hawkshaw-cae48 .firebaseio .com in DNS Lookup)"

• "ET TROJAN APT DarkHydrus DNS Lookup 26"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"

• "ET INFO Data Submitted to MyFreeSites.com - Possible Phishing"

• "ET TROJAN TeslaCrypt/AlphaCrypt Variant .onion Proxy Domain (kb63vhjuk3wh4ex7)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES GET]"

• "ET CURRENT_EVENTS Successful Chase Phish M4 2016-08-26"

• "ET TROJAN ActionLoader CnC Domain in DNS Lookup (cloud-documents .com)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (excellentpatterns .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (drilledgas .org)"

• "ET TROJAN Win32/ArtraDownloader CnC Activity (GET)"

• "ET TROJAN Parallax CnC Response Activity M18"

• "ET TROJAN ELF Linux/Dnsamp.AB Variant CnC"

• "ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M3"

• "ET TROJAN Downloader.VB.TX/Backdoor.Win32.DSSdoor!IK Checkin"

• "ET TROJAN Possible DANDERSPRITZ HTTP Beacon"

• "ET TROJAN Known Hostile Domain .ntkrnlpa.info Lookup"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN BluStealer - SysInfo Exfil via Telegram M2"

• "ET TROJAN Parallax CnC Activity M10 (set)"

• "ET TROJAN Observed Malicious SSL Cert (W32/TrojanDownloader.Agent.FBF Variant CnC)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Cohhoc RAT CnC Request"

• "ET TROJAN Backdoor.Win32/PcClient.AA Checkin"

• "ET TROJAN Kazy Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebook .cam in TLS SNI)"

• "ET TROJAN Win32/Usteal.B Checkin"

• "ET CURRENT_EVENTS Bank of America Phishing Landing Aug 19 2015"

• "ET CURRENT_EVENTS Successful Emirate Phish 2016-09-29"

• "ET TROJAN OSX/NukeSped Variant CnC Domain in DNS Lookup (woodmate .it)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (nihaobrazzzahit .top in DNS Lookup)"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (bitscrunnch .run .place in TLS SNI)"

• "ET CURRENT_EVENTS Successful Generic Banking Phish 2022-01-11"

• "ET USER_AGENTS Suspicious User-Agent (Errordigger.com related)"

• "ET TROJAN SluttyPutty isDebuggerPresent in Fake Putty Executable"

• "ET TROJAN Win32/PrivateLoader Related Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2018-07-19"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (excellentpatterns .com)"

• "ET CURRENT_EVENTS Possible Crypto Drainer Fetch"

• "ET INFO Suspicious Dropbox Page - Possible Phishing Landing"

• "ET TROJAN [ANY.RUN] Stealc/Vidar Stealer TLS Certificate"

• "ET MOBILE_MALWARE CoolReaper User-Agent"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish Oct 10 2017"

• "ET MOBILE_MALWARE Android/Spy.Agent.ANA (shileyfetwell .com in DNS Lookup)"

• "ET TROJAN OilRig OopsIE CnC Checkin M2"

• "ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Anatsa Checkin"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Agent.ld CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-10-14"

• "ET TROJAN PlutoCrypt Decryption Key Exfil"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN ViperSoftX HTTP CnC Activity"

• "ET CURRENT_EVENTS Successful Excel Online Phish 2015-11-26"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN DLoader File Download Request Activity"

• "ET TROJAN Observed BlackGuard_v2 Domain (umpulumpu .ru) in TLS SNI"

• "ET TROJAN Malicious Domain in DNS Lookup (cloudjs .live)"

• "ET TROJAN UPDATE Protocol Trojan Communication detected on http ports 2"

• "ET TROJAN Observed DOUBLEBACK CnC Domain (bestcake .ca in TLS SNI)"

• "ET DNS Reply Sinkhole - Zinkhole.org"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 10"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (cubicalwave .com)"

• "ET TROJAN Observed Glupteba CnC Domain (nisdably .com in TLS SNI)"

• "ET TROJAN APT28/Sednit DNS Lookup (inteldrv64 .com)"

• "ET TROJAN Dark Halo/SUNBURST CnC Domain (lcomputers .com in TLS SNI)"

• "ET CURRENT_EVENTS Tech Support Scam - Windows Firewall M2 2021-08-17"

• "ET TROJAN Rerdom/Asprox CnC Beacon"

• "ET TROJAN Dragonfly Backdoor.Goodor Go Implant CnC Beacon 1"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (news .networkslaoupdate .com)"

• "ET CURRENT_EVENTS Successful FedEx Phish 2022-07-20"

• "ET MALWARE Websearch.com Spyware"

• "ET TROJAN Observed DNS Query to Pegasus Domain (start-anew .net)"

• "ET TROJAN Win32/Gasti.tm Checkin Activity"

• "ET CURRENT_EVENTS Generic Hidden Text - Possible Phishing Landing"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-09-05"

• "ET CURRENT_EVENTS Generic Google Firebase Hosted Phishing Landing"

• "ET MOBILE_MALWARE Android APT-C-23 (octavia-blake .world in TLS SNI)"

• "ET TROJAN Possible Konni RAT Related Activity Observed"

• "ET TROJAN Win32/Gomorrah Stealer Data Exfiltration"

• "ET TROJAN Sednit/APT28/Sofacy Delphocy CnC Beacon"

• "ET TROJAN Observed IcedID Domain (ewacootili .com in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (SideWinder APT CnC)"

• "ET TROJAN APT-C-27 CnC Domain Observed in DNS Query"

• "ET TROJAN Powershell with Decimal Encoded RUNPE Downloaded"

• "ET TROJAN Win32/Unknown Stealer Command Response (filegrab) (Inbound)"

• "ET TROJAN Kimsuky Related Maldoc Activity (POST)"

• "ET TROJAN Sharik/Smoke CnC Beacon 9"

• "ET USER_AGENTS Suspicious User-Agent (123)"

• "ET TROJAN DDoS.XOR Checkin"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (secured-mail .online)"

• "ET TROJAN Observed IcedID Domain (brojizuza .com in TLS SNI)"

• "ET TROJAN Suspected Blackmoon Related Activity (Response)"

• "ET TROJAN Win32/Sarwent Initial Checkin CnC Response"

• "ET EXPLOIT Possible CVE-2017-0199 HTA Inbound M2"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (dodstep .cyou)"

• "ET TROJAN Pegasus Domain in DNS Lookup"

• "ET TROJAN Drovorub monitor Module Server Response"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (vibedroom .org)"

• "ET TROJAN DNS Query to KEKW Variant Domain (blackcap .ru)"

• "ET TROJAN Faked Russian Opera UA without Accept - probable downloader"

• "ET TROJAN SocGholish Domain in TLS SNI (ghost .blueecho88 .com)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (troffyfrutlot .com)"

• "ET MALWARE W32/SpeedRunner User-Agent SRRemove"

• "ET CURRENT_EVENTS Suspicious Wordpress Redirect - Possible Phishing Landing (set) Jan 7"

• "ET CURRENT_EVENTS GrandSoft PDF Payload Download"

• "ET MOBILE_MALWARE Android APT-C-23 (moneymotion .club in DNS Lookup)"

• "ET TROJAN Observed Lazarus Related Domain (docs .gsheetpage .com in TLS SNI)"

• "ET WEB_SERVER PHP.//Input in HTTP POST"

• "ET MALWARE Unknown Malware patchlist.xml Request"

• "ET CURRENT_EVENTS Successful AOL Phish 2015-10-09"

• "ET CURRENT_EVENTS Successful BB&T Bank Phish 2016-12-15"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (lomhasnopryiyome .top in TLS SNI)"

• "ET CURRENT_EVENTS Possible Successful AirCanada Phish 2015-08-06"

• "ET MALWARE NavExcel Spyware User-Agent (NavHelper)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M12"

• "ET TROJAN RezoStealer CnC Checkin"

• "ET TROJAN Suspected Middle East Threat Group Domain in DNS Lookup (liveupdatedriver .com)"

• "ET TROJAN Win32/ASPC Bot CnC Checkin M3"

• "ET CURRENT_EVENTS Observed TOAD Domain (i2care .cc in TLS SNI)"

• "ET CURRENT_EVENTS Yahoo Account Phish Landing 2015-10-23"

• "ET CURRENT_EVENTS LinkedIn Phish Landing Page 2022-01-31"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M2 2016-09-16"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (mci .ejalase .org)"

• "ET TROJAN TA444 Related Domain (azure-security .site) in DNS Lookup"

• "ET TROJAN Powershell/PowHeartBeat CnC Checkin - HTTPS"

• "ET CURRENT_EVENTS Successful Blockchain Account Phish Aug 19 2016"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 65"

• "ET CURRENT_EVENTS Successful Banco Itau (BR) Phish M2 2016-12-08"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET TROJAN RKO Remote File Upload Attempt"

• "ET TROJAN Filez Downloader Checkin"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (tp-globa .xyz)"

• "ET TROJAN Win32/PSW.Agent.OMP Variant CnC Activity"

• "ET TROJAN Observed IcedID Domain (flarkonafaero .com in TLS SNI)"

• "ET TROJAN Lazarus CnC Domain Observed in DNS Query"

• "ET TROJAN Pegasus Domain in DNS Lookup"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 2"

• "ET TROJAN Suspected Zebrocy Implant CnC Checkin"

• "ET CURRENT_EVENTS Successful Generic Phish 2020-09-21"

• "ET TROJAN MuddyWater Payload - CnC Checkin"

• "ET TROJAN DragonOK KHRAT Downloader Receiving Payload"

• "ET TROJAN Skeleton Key Filename in SMB Traffic (ASCII)"

• "ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup"

• "ET TROJAN Malicious VBE Script (COVID-19 Phish 2020-04-03)"

• "ET CURRENT_EVENTS %Hex Encoded Applet (Observed in Sakura)"

• "ET TROJAN Observed StrongPity CnC Domain (hostoperationsystems .com in TLS SNI)"

• "ET TROJAN Win32/SodaMaster domain observed in DNS query (www. rare-coisns. com)"

• "ET TROJAN HTML/Xbash Hex Encoded WScript.Shell Inbound - Stage 1"

• "ET TROJAN eleethub .com Domain in DNS Lookup (eleethub .com)"

• "ET TROJAN DMSpammer HTTP Post Checkin"

• "ET TROJAN Observed StrongPity Domain (singlefunctionapp .com in TLS SNI)"

• "ET TROJAN Win32/PurpleWave Stealer Requesting Config"

• "ET CURRENT_EVENTS Incognito Exploit Kit PDF request to images.php?t=81118"

• "ET WEB_SERVER China Chopper WebShell Observed Outbound"

• "ET MOBILE_MALWARE Android APT-C-23 (lindamullins .info in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Generic Phish (Redirect to Download PDF) 2016-02-08"

• "ET TROJAN Orca RAT URI Struct 1"

• "ET TROJAN Maldoc Retrieving Remote Template (GET)"

• "ET CURRENT_EVENTS Successful Sparkasse Phish 2016-10-03"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (canolagroove .com)"

• "ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup"

• "ET TROJAN HTA.BabyShark HTTP Exfil"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET TROJAN lu0bot Loader HTTP Response M2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (QakBot)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 13"

• "ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 Unicode"

• "ET TROJAN DNS query for known Anunak APT Domain (ddnservice10.ru)"

• "ET MOBILE_MALWARE Android Spyware Dowgin Checkin"

• "ET CURRENT_EVENTS Tech Support Scam - Windows Firewall M1 2021-08-17"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET CURRENT_EVENTS Successful Halifax Bank Phish M1 2015-12-10"

• "ET TROJAN Observed Suspected TA453 Related Domain (metasupportmail .co in TLS SNI)"

• "ET TROJAN PE EXE or DLL Windows file download disguised as ASCII"

• "ET CURRENT_EVENTS Spelevo VBS Payload Downloaded"

• "ET TROJAN APT/TransparentTribe Style Request"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (wordpress .securityplugins .org)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2020-08-07"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN APT28/Sednit DNS Lookup (updmanager .com)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Win32/Tapazom.A"

• "ET TROJAN Sinowal/sinonet/mebroot/Torpig infected host POSTing process list"

• "ET TROJAN W32/Vundo.Downloader Reporting User Website Session Information"

• "ET TROJAN ChromeLoader CnC Checkin M1"

• "ET TROJAN Scieron DNS Lookup (apple.dynamic-dns.net)"

• "ET TROJAN Polonium APT PAPACREEP Backdoor Related Activity"

• "ET TROJAN HYDSEVEN VBS CnC Host Information Checkin"

• "ET TROJAN Win32/TA402 Checkin"

• "ET CURRENT_EVENTS Double-Encoded Reverse Base64/Dean Edwards Packed JavaScript Observed in Unknown EK Feb 16 2015 b64 1 M2"

• "ET TROJAN Wintervivern Retrieving Task"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (noredirecto .redirectme.net)"

• "ET CURRENT_EVENTS Successful Sparkasse (DE) Phish 2016-12-22"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (nod-update .it)"

• "ET TROJAN KHRAT DNS Lookup (upload-dropbox .com)"

• "ET TROJAN Gh0st Trojan CnC 2"

• "ET TROJAN WebDAV Retrieving .zip from .url M1 (CVE-2023-36025)"

• "ET CURRENT_EVENTS Successful Generic Phish 2019-04-30 (set)"

• "ET TROJAN Win32/Autophyte.F C2 Domain (tpddata .com in TLS SNI)"

• "ET TROJAN FinFisher Malware Connection Handshake"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (youareperfect2day .top in TLS SNI)"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page M1 2022-06-01"

• "ET MOBILE_MALWARE Arid Viper (fasibauik .co in DNS Lookup)"

• "ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1"

• "ET TROJAN Parallax CnC Response Activity M6"

• "ET TROJAN Win32/Recslurp.D C2 Request (no alert)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (contractor-enoc .com) 2022-12-05"

• "ET TROJAN DNS Query to Gamaredon Domain (kaziyapa .ru)"

• "ET TROJAN Mashigoom/Tranwos/RevProxy ClickFraud - hello"

• "ET TROJAN Zingo/GinzoStealer Data Exfiltration M2"

• "ET MOBILE_MALWARE NSO Related Domain 29"

• "ET CURRENT_EVENTS Successful Outlook Password Update Phish M1 2016-09-01"

• "ET TROJAN APT28/Sednit DNS Lookup (aljazeera-news .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Gamaredon Domain in DNS Lookup (len61 .procellarumbi .ru)"

• "ET MALWARE Suspicious User-Agent (NSIS_DOWNLOAD)"

• "ET TROJAN Win32/BlackNET CnC Keep-Alive"

• "ET CURRENT_EVENTS Successful Coinbase Credential Phish 2023-01-09"

• "ET TROJAN Ransomware/Cerber Checkin M3 (10)"

• "ET TROJAN Win32/Packed.BlackMoon.A CnC Checkin"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (internal .group .link-net .publicvm .com)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET MALWARE Loadmoney.A Checkin 5"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Security Scanner Domain (canarytokens .com)"

• "ET TROJAN ELF/RedXOR CnC Response"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Woody RAT Payload Delivery Domain (fcloud .nciinform .ru) in DNS Lookup"

• "ET TROJAN Linux/B1txor20 Backdoor DNS Tunnel Activity M1"

• "ET CURRENT_EVENTS Scam Redirect Domain in DNS Lookup"

• "ET TROJAN Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message"

• "ET TROJAN Ransomware Locky .onion Payment Domain (5n7y4yihirccftc5)"

• "ET CURRENT_EVENTS Generic Credential Phish Activity GET"

• "ET CURRENT_EVENTS GreetingGhoul Stealer Crypto Landing Page"

• "ET TROJAN [ANY.RUN] Win32/DynamicRAT CnC Activity"

• "ET TROJAN Win32/Sharik C2 Incoming Traffic"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Observed Ursnif Domain (mifrutty .com in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (miranda-barlow .website in DNS Lookup)"

• "ET TROJAN Win32/WhiskerSpy - Task Request"

• "ET CURRENT_EVENTS HTTP POST Request to Suspicious *.ma Domain"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET USER_AGENTS Suspicious User-Agent (sickness29a/0.1)"

• "ET CURRENT_EVENTS Sibhost Zip as Applet Archive July 08 2013"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 4"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET CURRENT_EVENTS Lucky7 EK Landing Encoded Plugin-Detect"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN TA444 Related Domain (azure-security .online) in DNS Lookup"

• "ET TROJAN Backdoor.Win32.RShot Ping Outbound"

• "ET TROJAN MAGICHOUND-related DNS Lookup (microsoftexplorerservices .cloud)"

• "ET TROJAN Maldoc Checkin Activity (GET)"

• "ET CURRENT_EVENTS Successful Horde Webmail Phish 2015-08-21"

• "ET CURRENT_EVENTS Malicious Fake JS Lib Inject"

• "ET TROJAN Transparent Tribe/CapraRAT CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Elasticsearch CVE-2015-1427 Exploit Campaign SSL Certificate"

• "ET USER_AGENTS Suspicious Win32 User Agent"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (proposal-enoc .com) 2022-12-05"

• "ET TROJAN Suspected Kimsuky Related Activity (Response)"

• "ET TROJAN SYNful Knock Cisco IOS Router Implant CnC Beacon (INBOUND)"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 15"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M8"

• "ET TROJAN Jasper URI Path Observed M3"

• "ET USER_AGENTS User-Agent (ChilkatUpload)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 36"

• "ET USER_AGENTS Suspicious User-Agent (FULLSTUFF)"

• "ET TROJAN Probable OneLouder downloader (Zeus P2P)"

• "ET TROJAN SFG Client Information POST"

• "ET TROJAN Moose CnC Response"

• "ET TROJAN Loki Locker Ransomware Server Response (Public Key) M1"

• "ET MOBILE_MALWARE Suspected PROJECTSPY Cookie"

• "ET TROJAN Vawtrak/NeverQuest Posting Data"

• "ET USER_AGENTS Suspicious User-Agent (SomeTimes)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (dibfinancialservice-uae .com) 2022-12-05"

• "ET TROJAN Echelon/DarkStealer Variant CnC Exfil"

• "ET CURRENT_EVENTS OneDrive Phishing Landing 2020-04-10"

• "ET TROJAN Win32/Stealc Active C2 Responding with browsers Config"

• "ET MOBILE_MALWARE Android APT-C-23 (max-eleanor .info in TLS SNI)"

• "ET MOBILE_MALWARE Android/TrojanDropper.Agent.EQO Variant CnC Activity"

• "ET MALWARE User-Agent (FileDownloader)"

• "ET MOBILE_MALWARE Arid Viper (stand-by-97c5c .firebaseio .com in DNS Lookup)"

• "ET WEB_CLIENT Tech Support Phone Scam Landing 2017-07-26"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Covenant Framework HTTP Beacon"

• "ET CURRENT_EVENTS Successful ViewDocsOnline Phish 2015-09-15"

• "ET TROJAN [ANY.RUN] Parallax RAT Check-In"

• "ET TROJAN Win32.Agent.cyt (Or variant) HTTP POST Checkin"

• "ET TROJAN Observed Bitter APT Related Domain in TLS SNI"

• "ET TROJAN UAC-0063 Domain in DNS Lookup (diagnostic-resolver .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MALWARE MySearch Products Spyware User-Agent (MySearch)"

• "ET TROJAN Possible Kimsuky Related Malicious VBScript"

• "ET TROJAN Observed Operation Silent Watch Domain in DNS Lookup (avvpassport .info)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j3n .xyz)"

• "ET CURRENT_EVENTS Successful Alibaba Phish 2016-10-26"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN AZORult v3.3 Server Response M2"

• "ET TROJAN Observed 3CX Supply Chain Attack Cookie M2"

• "ET TROJAN njRAT v65.0 CnC Checkin"

• "ET TROJAN Spora Ransomware DNS Query"

• "ET CURRENT_EVENTS Credito Emiliano Credential Phish Landing Page 2022-05-26"

• "ET TROJAN Amadey Stealer CnC - BotKiller Module Checkin"

• "ET TROJAN W32/Dexter Infostealer CnC POST"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor S5CONNECT Command (Inbound)"

• "ET TROJAN Possible CopyKittens DNS Lookup (heartax.info)"

• "ET TROJAN Malvirt/KoiVM Downloader Variant Payload Retrieval Request"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (notixow .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2jks .com)"

• "ET TROJAN Win32/CandyOpen/UniClient Activity (GET)"

• "ET CURRENT_EVENTS Successful Adobe Phish M3 2016-07-11"

• "ET ATTACK_RESPONSE 401TRG Perl DDoS IRCBot File Download"

• "ET TROJAN AppleJeus - Ants2Whale CnC Domain in DNS Lookup (ants2whale .com)"

• "ET TROJAN Arid Viper APT Related Domain in DNS Lookup (earlahenry .com)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2020-11-19"

• "ET TROJAN Observed TA402 Domain in TLS SNI"

• "ET TROJAN METALJACK APT32 DNS Lookup (m.topiccore.com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET USER_AGENTS Observed Suspicious UA (PhoneMonitor)"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M6"

• "ET TROJAN Windows set Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET USER_AGENTS Suspicious User-Agent (IEMGR)"

• "ET TROJAN Observed SSV Agent CnC Domain (flushcdn .com in TLS SNI)"

• "ET USER_AGENTS Suspicious User-Agent VCTestClient"

• "ET TROJAN Win32/Enemyfear Stealer Exfil"

• "ET TROJAN BestAntivirus2011 Fake AV reporting"

• "ET TROJAN Brontok User-Agent Detected (Rivest)"

• "ET TROJAN Linux.Trojan.IptabLex Variant Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE ZeroTier P2P VPN Activity M1"

• "ET EXPLOIT PHP Melody v3.0 SQL Injection Attempt"

• "ET TROJAN METALJACK APT32 DNS Lookup (jcdn.jsoid.com)"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2"

• "ET TROJAN Ozone/Darktrack RAT Variant - Server Hello"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET MOBILE_MALWARE Observed Android/IRATA Domain (rimot-anitain .tk) in TLS SNI"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-cdn .com)"

• "ET TROJAN Roopy File Grabber Exfiltration Attempt"

• "ET CURRENT_EVENTS Possible Successful Bank of America Phishing Domain Feb 02 2017"

• "ET TROJAN ELF/Roboto - Communicating with Hardcoded Peer 1"

• "ET TROJAN MuddyWater APT Related Maldoc Checkin M1"

• "ET TROJAN NimPlant Sending Command (Inbound)"

• "ET MOBILE_MALWARE Android APT-C-23 (engin-altan .website in DNS Lookup)"

• "ET TROJAN Win32/TinyNuke CnC Checkin"

• "ET CURRENT_EVENTS Possible Cryptowallet Mining Pool Scam Landing Page"

• "ET TROJAN DonotGroup CnC Domain Observed in DNS Query"

• "ET TROJAN Linux/DDoS.Sotdas/IptabLex Checkin"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 18"

• "ET WEB_CLIENT c3284d malware network iframe"

• "ET DNS Reply Sinkhole - Georgia Tech (2)"

• "ET MALWARE Webhancer Data Post"

• "ET TROJAN PlugX Related Domain in DNS Lookup (ntpserver .xyz)"

• "ET TROJAN MewsSpy/NionSpy .onion Proxy Domain (z3mm6cupmtw5b2xx)"

• "ET TROJAN Win32/FFDroider CnC Activity"

• "ET TROJAN [CISA AA21-291A] Possible BlackMatter Ransomware Lateral Movement"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET ATTACK_RESPONSE Muhstik Botnet Download Activity (GET)"

• "ET TROJAN CopperStealer - Remote Desktop - CnC Server Response via Pastebin"

• "ET TROJAN eleethub botnet CnC Domain in DNS Lookup (ghost.eleethub .com)"

• "ET TROJAN QuickBooks Pop-Up Scam - Checkin Response"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (ledikexive .com)"

• "ET CURRENT_EVENTS Generic Personalized Google Firebase Hosted Phishing Landing"

• "ET TROJAN Observed DNS Query to Maldoc Domain (webnar .info)"

• "ET TROJAN RHttpCtrl Backdoor CnC"

• "ET CURRENT_EVENTS SUSPICIOUS taskmgr.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN Possible Metasploit Payload Common Construct Bind_API (from server)"

• "ET USER_AGENTS Suspicious User-Agent outbound (bot)"

• "ET CURRENT_EVENTS Suspicious Wordpress Redirect - Possible Phishing Landing Jan 7 2016"

• "ET CURRENT_EVENTS Observed TOAD Domain (catreenpr .is in TLS SNI)"

• "ET TROJAN APT1 WEBC2-UGX Related Pingbed/Downbot User-Agent (Windows+NT+5.x)"

• "ET TROJAN FRAT Downloader Error Report POST"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (registrations-enoc .com) 2022-12-05"

• "ET TROJAN Observed DNSQuery to TA444 Domain (256ventures .us)"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup"

• "ET TROJAN Gamaredon Domain in DNS Lookup (porotad .ru)"

• "ET TROJAN Observed SSL/TLS Cert (Splashtop Remote Support)"

• "ET CURRENT_EVENTS Disdain EK URI Struct Aug 23 2017 M1"

• "ET TROJAN Observed Malware Delivery Landing Page Domain (bigeront .top in TLS SNI)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .scheme .corycabana .net)"

• "ET TROJAN W32/Bakcorox.A ProxyBot CnC Server Connection"

• "ET TROJAN BigLock Ransomware CnC Activity (gen)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-09-26"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (en-gb-wordpress .org)"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (gh.dsaj2a1.org)"

• "ET TROJAN Bifrose Client Checkin"

• "ET TROJAN ELF/STDbot CnC Activity (UNK attack)"

• "ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup"

• "ET TROJAN Possible IRC Bot Common PRIVMSG Commands"

• "ET TROJAN Win32/OnLineGames GetMyIP Style Checkin"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2015-09-04"

• "ET TROJAN Sakula DNS Lookup (inocnation.com)"

• "ET TROJAN Observed TA409 Related Domain (navercorp .ru in TLS SNI)"

• "ET WEB_CLIENT Possible Phishing Redirect Feb 24 2017"

• "ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup"

• "ET CURRENT_EVENTS 401TRG Successful Multi-Email Phish - Observed in Docusign/Dropbox/Onedrive/Gdrive Nov 02 2017"

• "ET TROJAN ISMAgent Receiving Commands from CnC Server"

• "ET TROJAN Win32/Neutrino Checkin 6"

• "ET CURRENT_EVENTS Successful HitBTC Cryptocurrency Exchange Phish 2017-12-28"

• "ET TROJAN DDoSia Client Target Retrieval"

• "ET MOBILE_MALWARE Android APT-C-23 (jorah-mormont .info in DNS Lookup)"

• "ET TROJAN Infostealer.Bancos Sending Stolen info SMTP"

• "ET TROJAN Backdoor.Elise CnC Beacon 1 M2"

• "ET CURRENT_EVENTS Successful Microsoft Live Email Account Phish 2016-10-18"

• "ET TROJAN DarkHotel DNS Lookup (apply.ebizx.net)"

• "ET TROJAN RampantKitten APT TelB Python Variant - CnC Checkin M2"

• "ET CURRENT_EVENTS TodayZoo Phishing Kit GET M1"

• "ET TROJAN Kimsuky Related Host Data Exfil"

• "ET WEB_CLIENT Fake Video Player Update Scam Oct 30"

• "ET TROJAN MSIL/Spy.Agent.CSS Exfil"

• "ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-30 3"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2017-12-26"

• "ET TROJAN DarkGate CnC Domain in DNS Lookup (zochao .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android.C2P.Qd!c Ransomware CnC Beacon"

• "ET TROJAN Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-3)"

• "ET TROJAN Win32/Ropest.H CnC - INBOUND set"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-10-11"

• "ET TROJAN Lop_com or variant Checkin (9kgen_up)"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity Domain)"

• "ET TROJAN X-Malware-Sinkhole Header in HTTP Response"

• "ET MOBILE_MALWARE Observed Android ExobotCompact.D/Octo Domain (xipxesip .design in TLS SNI)"

• "ET TROJAN MSSQL maggie backdoor ListIP Query Observed"

• "ET MALWARE ZoomInfo Contact Contributor Install"

• "ET TROJAN MSIL/Alcatrez Locker Ransomware CnC Checkin"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (climedballon .org)"

• "ET TROJAN Request for fake postal receipt from e-mail link"

• "ET POLICY owncloud .online Hosted Site Observed in TLS SNI"

• "ET TROJAN W32.Duptwux/Ganelp FTP Username - onthelinux"

• "ET TROJAN Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Suspected DonotGroup Dropper Activity"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1qc230lt32ey73qlaj9rkujm0ujtv090 .com in TLS SNI)"

• "ET TROJAN SSL/TLS Certificate Observed (Quasar Related)"

• "ET TROJAN APT28/Sofacy Zebrocy Go Variant CnC Activity"

• "ET TROJAN Dark Halo/SUNBURST SSL Cert Inbound (lcomputers .com)"

• "ET TROJAN Sharik/Smoke Loader Microsoft Connectivity Check"

• "ET TROJAN Possible Pegasus Related DNS Lookup (accounts .mx)"

• "ET CURRENT_EVENTS Disdain EK Payload Aug 23 2017"

• "ET TROJAN Observed DCRat CnC Domain in TLS SNI"

• "ET TROJAN BBSRAT GET request CnC"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-cdn .xyz)"

• "ET TROJAN Qbot Payload Request (2023-03-21) M6"

• "ET TROJAN Mutter Backdoor Checkin"

• "ET TROJAN TrochilusRAT CnC Beacon 1"

• "ET TROJAN DonotGroup Template Download"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (mail-goog1e .com in TLS SNI)"

• "ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page 2022-06-10"

• "ET TROJAN RedLine Stealer Domain in DNS Lookup (nordvpn-media .com)"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN SpamTool.Win32.Agent.gy/Grum/Tedroo Or Similar HTTP Checkin"

• "ET TROJAN Win32/RisePro CnC Server Response M3"

• "ET MALWARE W32/OpenTrio User-Agent (Open3)"

• "ET MOBILE_MALWARE Android/Updtkiller Sending Device Information"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Red Wolf/RedCurl Domain in DNS Lookup (msftcloud .click)"

• "ET CURRENT_EVENTS Redkit Exploit Kit Three Numerical Character Naming Convention PDF Request"

• "ET TROJAN [PTsecurity] DorkBot.Downloader CnC Response"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .brioche-amsterdam .com)"

• "ET CURRENT_EVENTS Docusign Phishing Landing Mar 08 2017"

• "ET CURRENT_EVENTS Generic NewInjection Phishing Landing 2021-03-10"

• "ET TROJAN Ousaban Related Maldoc Activity"

• "ET TROJAN Parallax CnC Activity M8 (set)"

• "ET USER_AGENTS VPNFilter Related UA (Hakai/2.0)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (jjl .one)"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS Successful BankAustria Phish Nov 03 2017"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (docusign .agency)"

• "ET TROJAN Yoda's Protector Packed Binary - VERY Likely Hostile"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (siemenoilandgas .com) 2022-12-05"

• "ET TROJAN FSB Snake CnC Activity Outbound via TCP (AA23-129A) M1"

• "ET CURRENT_EVENTS iCloud Phishing Landing 2016-09-02"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN BlackDolphin Ransomware Builder Landing Page M1"

• "ET TROJAN RedditC2 Related Activity M2 (POST)"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (frances-thomas .com in DNS Lookup)"

• "ET TROJAN W32/DownloaderAgent.fajk Successful Infection CnC Beacon"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (bqtconsulting .com)"

• "ET TROJAN Observed Malicious Domain Targeting Minority Groups (officemodel .org in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Hentai)"

• "ET WEB_CLIENT DRIVEBY Social Engineering Toolkit Web Clone code detected"

• "ET TROJAN WildPressure/Milum CnC Activity"

• "ET TROJAN ServHelper CnC Domain"

• "ET TROJAN ASNAROK Related Domain in TLS SNI"

• "ET TROJAN [Fireeye] Backdoor.BEACON SSL Cert Inbound (incomeupdate .com)"

• "ET TROJAN Observed DNS Query to RisePro Domain (softs-portal .com)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (zalikomanperis .com)"

• "ET TROJAN W32/Syndicasec.Backdoor CnC Beacon"

• "ET CURRENT_EVENTS ElTest Exploit Kit Redirection Script"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (weryfikacja-poczty .space)"

• "ET TROJAN Win32.Cerberus RAT Server ping"

• "ET TROJAN D1onis Stealer Sending Data to CnC"

• "ET MOBILE_MALWARE Observed Trojan-Spy.AndroidOS.Agent.abe Domain in TLS SNI"

• "ET CURRENT_EVENTS Survey Credential Phish Landing Page 2022-04-04"

• "ET TROJAN TeslaCrypt/AlphaCrypt Variant .onion Payment Domain(yez2o5lwqkmlv5lc)"

• "ET TROJAN DPRK APT Related Domain in DNS Lookup (cryptais .com)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 15"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET TROJAN W32/Hesperus.Banker Tr-mail Variant Sending Data To CnC"

• "ET TROJAN Win32/Spy.Agent.PZE Variant CnC Activity"

• "ET TROJAN W32/Karagany.Downloader CnC Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (men-ana .fun in TLS SNI)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-03-01"

• "ET TROJAN Possible Pegasus Related DNS Lookup (ideas-telcel .com.mx)"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (exodus .linkpc .net)"

• "ET TROJAN Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (anydeskupdates .com)"

• "ET TROJAN Win32/CopperStealer Installer Started"

• "ET TROJAN Kimsuky Related Activity (init)"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (metasecurityemail .org)"

• "ET TROJAN Ducktail Malware Related Domain in DNS Lookup (ductai .xyz)"

• "ET CURRENT_EVENTS Successful Apple Phish (set) 2016-03-01"

• "ET TROJAN Qadars CnC DNS Lookup (websecuranalityc.com)"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (signverydn .sharebusiness .xyz)"

• "ET TROJAN Observed Gamaredon Domain (procellarumbi .ru in TLS SNI)"

• "ET TROJAN [ANY.RUN] RisePro TCP (Exfiltration)"

• "ET TROJAN Possible OwlProxy activity M3"

• "ET TROJAN URI Struct Observed in Pawn Storm CVE-2015-2950"

• "ET TROJAN Win32/RecordBreaker - Observed UA M8 (125122112551)"

• "ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-30 2"

• "ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement"

• "ET TROJAN DNS Query to Raspberry Robin Domain (jrtz .re)"

• "ET TROJAN Legion Loader Activity Observed (YourUserAgent)"

• "ET TROJAN SystemBC Powershell bot registration"

• "ET TROJAN Win32/Zemot URI Struct"

• "ET TROJAN Win32/Roficor.A (Darkhotel) Checkin 1"

• "ET TROJAN Win32/Spy.Socelars.S CnC Activity M3"

• "ET CURRENT_EVENTS Successful Woodforest Bank Phish M1 2015-08-31"

• "ET TROJAN BKDR_BTMINE.MNR BitCoin Miner Server Checkin"

• "ET TROJAN VenusLocker Associated User-Agent Activity"

• "ET TROJAN ENV Variable Data Exfiltration Domain (ovz1 .j19544519 .pr46m .vps .myjino .ru) in DNS Lookup"

• "ET TROJAN Win32/WinDealer CnC Activity (Checkin)"

• "ET TROJAN Linux/dtool IRC Command Complete 3"

• "ET TROJAN Observed TrumpHead Ransomware CnC Domain (6bbsjnrzv2uvp7bp .onion .pet in TLS SNI)"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 4"

• "ET TROJAN Bitter APT CHM CnC Activity (GET) M1"

• "ET TROJAN NOBELIUM - Cobalt Strike Malleable Profile M2"

• "ET CURRENT_EVENTS Successful Paypal (DE) Phish 2016-10-04"

• "ET TROJAN QuickBooks Pop-Up Scam - Pop-Up Details Response"

• "ET TROJAN Cobalt Strike CnC Domain (r1 .57thandnormal .com) in DNS Lookup"

• "ET TROJAN Win32/Syndicasec Encoded Response Embedded in XML HTML Title Tags Inbound"

• "ET TROJAN PoshC2 - Observed Default URI Structure M12"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-09-27"

• "ET TROJAN Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN [ESET] TA410 APT LookBack HTTP Server Response"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (meetcentralhub .online)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (freckletropsao .pw)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET SCAN HTExploit Method"

• "ET TROJAN Volex - OceanLotus JavaScript Load (connect.js)"

• "ET TROJAN Win32/BLUELIGHT OAuth Login Attempt M2"

• "ET TROJAN RansomCrypt Intial Check-in"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Generic Credential Phish 2022-03-18"

• "ET TROJAN BAZAR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (frances-thomas .com in TLS SNI)"

• "ET TROJAN Possible Charming Kitten Backdoor Checkin"

• "ET TROJAN APT CozyCar SSL Cert 6"

• "ET TROJAN DNS Query to TA444 Domain (drop-box .cloud)"

• "ET CURRENT_EVENTS Successful View Samples Phish 2016-09-09"

• "ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M1"

• "ET MOBILE_MALWARE NSO Related Domain 18"

• "ET MOBILE_MALWARE Apple iPhone Implant - Command Executed"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M16"

• "ET CURRENT_EVENTS Successful FR Carte Bleue / BCP Phish 2016-09-06"

• "ET TROJAN Possible Tunna Proxy Closing Connection"

• "ET TROJAN DNS Query to Raspberry Robin Domain (n54 .me)"

• "ET TROJAN Possible Dyre SSL Cert (fake state)"

• "ET CURRENT_EVENTS Mailbox Renewal Phish Landing Nov 13"

• "ET TROJAN Possible CryptoPHP Leaking Credentials May 8 2015 M3"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT32/OceanLotus CnC Domain in DNS Lookup (mihannevis .com)"

• "ET TROJAN Observed Malicious SSL Cert (POWERRATANKBA CnC)"

• "ET CURRENT_EVENTS Successful Sparkasse Credential Phish M2 2022-04-13"

• "ET TROJAN ReverseRAT Activity (POST) M1"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-12-01"

• "ET WEB_CLIENT Office UA FB SET"

• "ET TROJAN Lucifer CnC Checkin"

• "ET CURRENT_EVENTS Observed TOAD Domain (c2care .us in TLS SNI)"

• "ET TROJAN Win32/Fireball Activity"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (kokokakalala .com)"

• "ET TROJAN PureCrypter Requesting Injector - Known Campaign ID M1"

• "ET TROJAN Observed Gamaredon Domain (uteroma .ru in TLS SNI)"

• "ET CURRENT_EVENTS Obfuscated LordEK Landing M2"

• "ET CURRENT_EVENTS Generic Financial Phone Support Scam/Phishing Landing M2"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .novelty .akibacreative .com)"

• "ET USER_AGENTS Downloader User-Agent HTTPGET"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(bugmaal)"

• "ET CURRENT_EVENTS Fake Google Chrome Error Landing Page, Anti-Analysis Technique"

• "ET CURRENT_EVENTS Successful Banamex Bank Phish 2016-12-29"

• "ET TROJAN Win32/Rarog Stealer CnC Checkin"

• "ET TROJAN Red Wolf/RedCurl Domain (msftcloud .click) in TLS SNI"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Nov 22 2016"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (enocbids .com) 2022-12-05"

• "ET TROJAN Gamaredon Domain in DNS Lookup (dzhafarho .ru)"

• "ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup"

• "ET TROJAN Snake Keylogger Exfil via SMTP"

• "ET MOBILE_MALWARE Android APT-C-23 (arthursaito .club in TLS SNI)"

• "ET TROJAN Worm.Win32.Ngrbot.lof Join IRC channel"

• "ET TROJAN QuickBooks Pop-Up Scam - Request for QB Download Locations"

• "ET TROJAN Cobalt Strike Infrastructure CnC Domain in DNS Lookup"

• "ET TROJAN JS/TrojanDownloader.Agent.TXV CnC Activity"

• "ET TROJAN Observed Malicious SSL Cert (Malicious Browser Ext CnC)"

• "ET CURRENT_EVENTS SWAT USA Drop Login Panel"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (rentfrejob .com)"

• "ET TROJAN Win32/TrojanDownloader.Agent.APBB Checkin"

• "ET TROJAN CopperStealer - Browser Stealer Exfil via Telegram"

• "ET TROJAN Win32/RisePro CnC Activity (GET)"

• "ET TROJAN W32/Fullstuff Initial Checkin"

• "ET TROJAN Java/QRat Variant Checkin"

• "ET TROJAN SoulSearcher Checkin M2"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (konto-verify .space)"

• "ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Successful Navy Federal Phish 2022-10-11"

• "ET TROJAN eleethub botnet CnC Domain in DNS Lookup (irc.eleethub .com)"

• "ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Yahoo)"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (gentlebouncer .top)"

• "ET MOBILE_MALWARE NSO Related Domain 27"

• "ET MALWARE Theinstalls.com Initial Checkin"

• "ET MALWARE Doctorvaccine.co.kr Related Spyware User-Agent (DoctorVaccine)"

• "ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attacking Message"

• "ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup"

• "ET CURRENT_EVENTS Spox Phishkit HTTP POST Observed"

• "ET CURRENT_EVENTS Successful Personalized Email Update Phish 2016-11-17"

• "ET TROJAN TA410 APT FlowCloud Dependency Download M1"

• "ET TROJAN Possible CopyKittens DNS Lookup (fbstatic-akamaihd.com)"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 12"

• "ET TROJAN Win32/QQPass Checkin"

• "ET TROJAN FinSpy Related WinRAR Activity"

• "ET TROJAN Win32/Delf.OKR Variant CnC M1"

• "ET TROJAN Observed TA444 Domain (mufg .us .org in TLS SNI)"

• "ET TROJAN Microcin Backdoor Related Domain in DNS Lookup (holdmem .dbhubspi .com)"

• "ET TROJAN Embedded ZIP/APK File With Fake Windows Executable Header - Possible AV Bypass Attempt"

• "ET TROJAN [ANY.RUN] Win32/RootTeam Stealer CnC Exfil M3"

• "ET USER_AGENTS Suspicious User-Agent Detected (Downloader1.2)"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (datasend .linkpc .net in TLS SNI)"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET TROJAN Ransomware/Cerber Checkin M3 (11)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Infostealer.Banprox Proxy.pac Download 3"

• "ET TROJAN DNS query for known Anunak APT Domain (ddnservice11.ru)"

• "ET TROJAN Pteranodon Variant 2 Backdoor Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Brute Ratel CnC Activity (xml-c2) M2"

• "ET TROJAN Win32/MuggleStealer CnC Desktop Exfil (POST)"

• "ET MOBILE_MALWARE Observed Android/SpyLoan.9ef8bf95 Domain (api .dreamloan .cc in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (accuant-googlc .com in TLS SNI)"

• "ET TROJAN Win32/Unk.BrowserStealer CnC Keep-Alive"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (heroofthe .top)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (narama .ru)"

• "ET USER_AGENTS Suspicious User-Agent Detected (GetUrlSize)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN LiteDuke Domain Observed"

• "ET TROJAN JS/Cloud9 Domain (download .loginserv .net) in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (apkapps .site in DNS Lookup)"

• "ET TROJAN FatDuke Domain Observed"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful PDF Online Phish 2016-12-19"

• "ET MOBILE_MALWARE Android APT-C-23 (jon-snow .pro in TLS SNI)"

• "ET TROJAN HermeticWizard - WMI Spreader - File Copy via SMB2 (NT Create AndX Request)"

• "ET TROJAN WEBC2-TABLE Checkin 2 - APT1 Related"

• "ET TROJAN DPRK APT Related Domain in DNS Lookup (esilet .com)"

• "ET TROJAN Downeks Checkin"

• "ET TROJAN lu0bot Loader HTTP Request M2"

• "ET TROJAN MSIL/G2 Stealer/GravityRAT CnC Checkin"

• "ET TROJAN Win32/Voltron/Spectre Stealer CnC Activity (POST)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (y0 .pm)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (sheikhmouradoil .com) 2022-12-05"

• "ET TROJAN Lampion CnC Activity"

• "ET TROJAN RansomCrypt Getting Template"

• "ET TROJAN Windows WMIC SYSACCOUNT get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Betabot Checkin 5"

• "ET CURRENT_EVENTS Successful Trust Wallet Phish 2022-10-11"

• "ET TROJAN Mirage Campaign checkin (port 443)"

• "ET TROJAN Possible CopyKitten DNS Lookup (jguery .online)"

• "ET CURRENT_EVENTS Successful Tradekey Phish 2015-11-19"

• "ET TROJAN RShell Backdoor Initial CnC Checkin"

• "ET TROJAN DNS Reply Sinkhole - Anubis - 195.22.26.192/26"

• "ET TROJAN Observed Malicious SSL Cert (chMiner/RAT)"

• "ET MOBILE_MALWARE Android/IRATA CnC Domain (rimot-anitain .tk) in DNS Lookup"

• "ET TROJAN Cryptojoker Checkin"

• "ET TROJAN Trojan.Verblecon Related Domain in DNS Lookup (gaymers .ax)"

• "ET MALWARE Fake Software Download Redirect Leading to Malware M2"

• "ET TROJAN Observed Malicious SSL Cert (FIN8 CnC)"

• "ET MOBILE_MALWARE Android APT-C-23 (1jve .com in TLS SNI)"

• "ET TROJAN APT28/Sednit DNS Lookup (theguardiannews .org)"

• "ET CURRENT_EVENTS Successful Generic L33bo Phish - URI Contents (set)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (profille-cex-io .com)"

• "ET TROJAN Observed Glupteba CnC Domain (dumperstats .org in TLS SNI)"

• "ET CURRENT_EVENTS Microsoft Account Redirect to Phishing Landing"

• "ET TROJAN Win32/Striked Ransomware CnC Checkin"

• "ET TROJAN Observed DNS Query to TA444 Domain (globiscapital .co)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN SEASALT HTTP Checkin"

• "ET CURRENT_EVENTS Successful Outlook Web App Phish 2015-10-15"

• "ET TROJAN Observed Teal Kurma Domain (al-marsad .co in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (tz6 .org)"

• "ET MALWARE User Agent (TEST) - Likely Webhancer Related Spyware"

• "ET TROJAN ELF/Mirai Botnet CnC Activity"

• "ET TROJAN Observed Malicious SSL Cert (More_eggs CnC)"

• "ET DOS SMBLoris NBSS Length Mem Exhaustion Attempt (PoC Based)"

• "ET TROJAN DNS Query to Gamaredon Domain (dzhahipa .ru)"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (picture .efanshion .com)"

• "ET CURRENT_EVENTS EvilProxy AiTM Cookie Value M2"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (pkusamain .cloud)"

• "ET TROJAN IoT_reaper DNS Lookup M3 (hi8529 .com)"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .pd .linkpc .net)"

• "ET TROJAN Sofacy DNS Lookup"

• "ET TROJAN Scarlet Mimic DNS Lookup 42"

• "ET TROJAN Trojan/MSIL.bfsx Checkin"

• "ET TROJAN Spy Banker Outbound Communication Attempt"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET TROJAN Asylum Ambuscade Related CnC Activity (SendLog)"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (jquery-node .com)"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Possible Net Crawler SMB Share Access ascii (Operation Cleaver)"

• "ET TROJAN KeyloggerOnline Keylogger Checkin (kill)"

• "ET TROJAN TAG28 Associated CnC Domain in DNS Lookup (samuelblog .website)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5qw .pw)"

• "ET TROJAN DNS Query to TA444 Domain (cryptyk .sytes .net)"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET TROJAN Playful Taurus CnC Domain (proxy .oracleapps .org)"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Solar)"

• "ET TROJAN W32/UltimateDefender.FakeAV Checkin"

• "ET WEB_CLIENT Possible Phishing Blockchain title over non SSL Jul 10 2017"

• "ET TROJAN Observed DNS Query to MoserPass Download Domain (passwordstate-18ed2 .kxcdn .com)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (nowmcopetroleum .com) 2022-12-05"

• "ET TROJAN Possible W32/KanKan Update officeaddinupdate.xml Request"

• "ET CURRENT_EVENTS Successful Shipping Document Phish 2015-09-29"

• "ET CURRENT_EVENTS Successful Microsoft Phish 2022-07-10"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-08-01"

• "ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement"

• "ET TROJAN hacker87 checkin"

• "ET TROJAN Putter Panda HTTPClient CnC HTTP Request"

• "ET TROJAN TorrentLocker DNS Lookup (doubleclickads.net)"

• "ET TROJAN Pupy DNS Request with SPI M1"

• "ET WEB_CLIENT pshell dl/execute primitives in wideb64 6"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (exodus .linkpc .net in TLS SNI)"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to websitetheme .com"

• "ET MALWARE W32/Dialer.Adultchat Checkin"

• "ET TROJAN Suspected CHAOS CnC Inbound (keylogger start)"

• "ET TROJAN CryptoLuck / YafunnLocker Ransomware CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Google Docs Phish 2016-09-01"

• "ET TROJAN LokiBot File Exfiltration Detected"

• "ET CURRENT_EVENTS Possible Underminer EK Landing"

• "ET TROJAN JS/Nemucod.M.gen requesting EXE payload 2015-11-02"

• "ET CURRENT_EVENTS [TW] Robin Banks HTTP GET Struct"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup"

• "ET TROJAN Jaff Ransomware Checkin"

• "ET TROJAN Observed Malicious FIN12 Related SSL Cert"

• "ET TROJAN PCRat/Gh0st CnC Beacon Request (Xfire variant)"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Jasper URI Path Observed M4"

• "ET TROJAN Possible Darkhotel Higasia Downloader Connectivity Check"

• "ET TROJAN DNS Request for Zaletelly CnC Domain"

• "ET TROJAN DNS Query to Raspberry Robin Domain (u8wp .com)"

• "ET TROJAN Possible APT Sarhurst/Husar/Hussarini/Hassar CnC POST"

• "ET TROJAN PE EXE or DLL Windows file download Text"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 8"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET TROJAN OSX/Shlayer CnC Activity M4"

• "ET TROJAN APT28/Sednit DNS Lookup (updatecenter .name)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart)"

• "ET TROJAN ICEFOG-P Variant CnC Checkin M2"

• "ET TROJAN Spoofed MSIE 7 User-Agent Likely Ponmocup"

• "ET TROJAN ProxyBox - HTTP CnC - POST 1-letter.php"

• "ET TROJAN DNS Query to Raspberry Robin Domain (kglo .link)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .raveready .shop)"

• "ET TROJAN PunkeyPOS HTTP CnC Beacon 9"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (walidacja-uzytkownika .space in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (kelbyonel .nl)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-12-08 M3"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST M1"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Fedex Phish 2015-07-28"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Credit Agricole Credential Phish 2022-11-23"

• "ET TROJAN EvilGrab or APT.9002 DNS Lookup (secvies.com)"

• "ET TROJAN Possibly Malicious Double Base64 Unicode Net.ServicePointManager M3"

• "ET TROJAN Possible IoT_reaper ELF Binary Request M2 (set)"

• "ET TROJAN W32/Mepaow.Backdoor Initial Checkin to Intermediary Pre-CnC"

• "ET TROJAN Cobalt Strike Beacon Activity (UNC2447)"

• "ET MALWARE Win32/Hadsruda!bit Adware/PUA Installation Activity"

• "ET TROJAN Gamut Spambot Checkin"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-27"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (lifemaindecision .top)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (tolofa .ru)"

• "ET TROJAN Win32.Renos/Artro Trojan Checkin M1"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (pingwiskot .com)"

• "ET TROJAN Trojan.Dropper.HTML.Agent Payload"

• "ET TROJAN Suspected Blackmoon Related Activity (GET)"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (ciscovpn3 .com)"

• "ET TROJAN IoT_reaper DNS Lookup M4 (cbk99 .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (z7s .org)"

• "ET TROJAN Possible Rar'd Malware sent when remote host claims to send an Image"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Strongpity CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 45"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN GravityRAT CnC Domain (nortonupdates .online in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .fun in DNS Lookup)"

• "ET TROJAN Trojan.Verblecon Related Domain in DNS Lookup (verble .software)"

• "ET TROJAN Kraken Ransomware Start Activity 1"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.1 Domain (transadforward .icu) in TLS SNI"

• "ET MOBILE_MALWARE Android APT-C-23 (appuree .info in DNS Lookup)"

• "ET POLICY Crypto Coin Miner Login"

• "ET TROJAN DonotGroup CnC Domain Observed in DNS Query"

• "ET TROJAN Suspected Malicious VBS Script Activity"

• "ET TROJAN Candiru Spyware CnC Domain in DNS Lookup (msstore .io)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN LinuxNet.perlbot Checkin Via IRC"

• "ET TROJAN Possible CopyKitten DNS Lookup (broadcast-microsoft .tech)"

• "ET CURRENT_EVENTS GitLab Phishing Landing 2018-07-19"

• "ET MALWARE [PTsecurity] WebToolbar.Win32.Searchbar.k HTTP JSON Artifact"

• "ET TROJAN Win32/Delfinject Check-in"

• "ET CURRENT_EVENTS SunDown EK Slight Sep 22 2016 (b642)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN W32/Echmark/MarkiRAT CnC Request"

• "ET USER_AGENTS Suspicious User-Agent (Hello World)"

• "ET TROJAN Win32/Remcos RAT Checkin 29"

• "ET TROJAN Win32/Parite.B Checkin 3"

• "ET TROJAN Possible APT38 CnC Domain Observed in DNS Query"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (pwn .af)"

• "ET TROJAN Observed JokerSpy Domain (git-hub .me in TLS SNI)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 31"

• "ET TROJAN Lazyscripter Related Activity (Inbound)"

• "ET MALWARE Win32/ReImageRepair.T CnC Cookie Pattern"

• "ET CURRENT_EVENTS Successful Idaho Central CU Phish 2022-07-24"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Cobalt Strike Malleable C2 (WooCommerce Profile)"

• "ET TROJAN EMAIL SSL Cert APT1"

• "ET MOBILE_MALWARE Trojan.AndroidOS.TimpDoor (drproxy .pro in DNS Lookup)"

• "ET TROJAN W32/Rshot.Backdoor File Upload CnC Beacon"

• "ET TROJAN Win32/InnaputRAT CnC DNS Lookup (ninjagames .top)"

• "ET TROJAN Sharik/Smoke CnC Beacon 11"

• "ET MALWARE W32/GameVance Adware Checkin"

• "ET TROJAN Ousaban Banker KeepAlive"

• "ET USER_AGENTS Suspicious User-Agent (RT/1.0)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Hawkshaw.a (spitfirepanel .firebaseio .com in DNS Lookup)"

• "ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M1"

• "ET TROJAN JokerSpy Domain in DNS Lookup (app .influmarket .org)"

• "ET MALWARE Loadmoney Checkin 4"

• "ET CURRENT_EVENTS Successful Wells Fargo Account Phish 2015-08-14"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(folderwin)"

• "ET CURRENT_EVENTS Possible Magento Directory Traversal Attempt"

• "ET MOBILE_MALWARE Android APT-C-23 (clarke-taylor .life in TLS SNI)"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 9"

• "ET TROJAN W32/Banload.VZS Banker POST CnC Beacon 2"

• "ET TROJAN LumOffice Checkin"

• "ET TROJAN OSX/Proton.B DNS Lookup"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Query (daviviendapersonalingresos .live) 2021-04-15"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab1abad1d0c2a .com) Jul 2017"

• "ET MOBILE_MALWARE XML Style POST Of IMSI International Mobile Subscriber Identity"

• "ET TROJAN Gamaredon Domain in DNS Lookup (overjoyed .ru)"

• "ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (SilentLibrarian)"

• "ET TROJAN W32/Farfli.BHQ!tr Dropper CnC Beacon"

• "ET TROJAN Win32/AutoIt.NU Miner Dropper CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN Possible Bedep Connectivity Check (2)"

• "ET WEB_CLIENT Fake Flash Update Mar 23"

• "ET TROJAN Possible Winnti-related DNS Lookup (google-searching .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN StealRat Checkin"

• "ET MALWARE SpamBlockerUtility Fake Anti-Spyware User-Agent (SpamBlockerUtility x.x.x)"

• "ET TROJAN HiddenTears Ransomware Activity (GET)"

• "ET TROJAN x0Proto File Info Request"

• "ET MOBILE_MALWARE Android APT-C-23 (cassy-gray .club in TLS SNI)"

• "ET TROJAN VNCStartServer USR Variant CnC Beacon"

• "ET CURRENT_EVENTS Successful Apple Phish 2015-10-23"

• "ET POLICY dnslog .cn Observed in DNS Query"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Standard Bank Login Phish 2022-02-04"

• "ET TROJAN ChamelGang Related CnC Domain in DNS Lookup (newtrendmicro .com)"

• "ET TROJAN Desert Falcon APT DNS Lookup (liptona.net)"

• "ET TROJAN JS/Agent.NZH CnC Response"

• "ET CURRENT_EVENTS Successful HBL Bank Phish M1 2016-10-12"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j1n .me)"

• "ET TROJAN Lemon_Duck Powershell - Install Tracking"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET WEB_CLIENT Apple Tech Support Phone Scam Jul 07 2017"

• "ET TROJAN APT28/Sednit DNS Lookup (defencereview .eu)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (nerfgamesarche .com)"

• "ET TROJAN DNS Query to MINEBRIDGE CnC Domain (conversia91 .top)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (snocproject-ae .com) 2022-12-05"

• "ET TROJAN SysJoker Bot Configuration Request (POST)"

• "ET TROJAN TA402/Molerats Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Aug 19 2016"

• "ET TROJAN Gamaredon Domain in DNS Lookup (krtkrt .ru)"

• "ET TROJAN ServHelper CnC Domain"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-08-26"

• "ET TROJAN Observed TraderTraitor Domain (reggedrobin .com in TLS SNI)"

• "ET WEB_SERVER Possible Compromised Webserver Retriving Inject"

• "ET TROJAN Observed Malicious SSL Cert (MINEBRIDGE/MINEDOOR CnC)"

• "ET CURRENT_EVENTS Possible Phishing Landing Hosted on CodeSandbox.io M2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Apple Phish M2 Mar 15 2017"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (cloud .skypecloud .net)"

• "ET TROJAN TA421/YTTRIUM/APT29 TLS Certificate M2"

• "ET TROJAN Backdoor.Esion CnC Checkin"

• "ET TROJAN Linux/dtool IRC Command Complete 1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Facebook Phishing Landing"

• "ET TROJAN MSIL/Spy.Keylogger.ENJ Variant CnC Activity"

• "ET TROJAN Suspected Bizarro Banker Activity (POST)"

• "ET USER_AGENTS Suspicious User-Agent (Kvadrlson 1.0)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (fz .ms)"

• "ET TROJAN Win32/LockScreen CnC Beacon 2"

• "ET TROJAN IoT_reaper DNS Lookup M2 (hl859 .com)"

• "ET TROJAN Trojan.Win32.Genome.aetqe Checkin"

• "ET TROJAN Win32/IcedID Requesting Encoded Binary M4"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (vendor-enocbid .com) 2022-12-05"

• "ET CURRENT_EVENTS Possible Successful Phish - Generic Form Names 2016-09-16"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 1/2 Staging Domain)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-07"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (portal .gfinanzen .net)"

• "ET CURRENT_EVENTS Successful iTunes Connect Phish M2 2016-12-13"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebock .info in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (jqueryh .org)"

• "ET CURRENT_EVENTS Unknown EK Landing URL"

• "ET TROJAN ComRAT CnC Domain in DNS Lookup"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET INFO Form Data Submitted to yolasite.com - Possible Phishing"

• "ET TROJAN Observed DNS Query to known Windshift APT Related Domain 1"

• "ET USER_AGENTS Peppy/KeeOIL Google User-Agent (google/dance)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish - Three Security Questions"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [GIGAMON_ATR] FIN8 BADHATCH Remote Shell Banner"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (meta-ua .space)"

• "ET CURRENT_EVENTS Successful Synchronize Email Account Phish 2016-06-15"

• "ET MALWARE MultiPlug.A checkin"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (highdatabase .com)"

• "ET TROJAN Baldr Stealer Checkin M2"

• "ET TROJAN Virtumod/Agent.ufv/Virtumonde Get Request"

• "ET TROJAN Observed DNS Query for APT40 Possible DADSTACHE CnC Domain"

• "ET TROJAN W32.DarkVNC Variant Checkin"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN OSX/Mokes.A CnC Heartbeat Request (set)"

• "ET TROJAN Avzhan DDoS Bot User-Agent MyIE"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to deftsecurity .com"

• "ET TROJAN [ANY.RUN] Remcos RAT Checkin 861"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1q922jh6d3zk0aelqdfc7yygzjr29sle .com in TLS SNI)"

• "ET TROJAN BadRabbit Ransomware Activity Via WebDAV (cscc)"

• "ET TROJAN Alfa/Alpha Ransomware Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Zango Cash Spyware User-Agent (ZC XML-RPC C++ Client)"

• "ET TROJAN TA404/Zinc Trojanized KiTTY CnC Checkin"

• "ET TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (devcisco .com)"

• "ET TROJAN DNS Query to Axile Stealer Domain (axile .su)"

• "ET TROJAN Drive Receiving UDP DDoS instructions"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 85"

• "ET TROJAN Brontok/Joseray User-Agent Detected (Joseray.A3 Browser)"

• "ET TROJAN Zbot download config - SET"

• "ET TROJAN W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (updateadobeflash .com)"

• "ET TROJAN Possible Java/Downloader Observed in Pawn Storm CVE-2015-2590 2"

• "ET TROJAN TA401 Domain in TLS SNI (isabeljwade .icu)"

• "ET TROJAN MuddyWater Payload Sending Command Output to CnC"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Set-Cookie"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (alceaso .ru)"

• "ET TROJAN Scarlet Mimic DNS Lookup 20"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (updatesync .com)"

• "ET TROJAN Win32/Vodkagats Loader Requesting Payload"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Nitol.A Checkin"

• "ET MALWARE User-Agent (ms)"

• "ET MALWARE Searchmeup Spyware Receiving Commands"

• "ET MALWARE Win32/YTDDownloader.F Variant CnC Activity"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (ciscovpn2 .com)"

• "ET TROJAN APT28/Sednit DNS Lookup (nortonupdate .org)"

• "ET TROJAN Observed Gamaredon APT Related Domain (wahibabo .ru in TLS SNI)"

• "ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup"

• "ET TROJAN OilRig CnC DNS Lookup (defender-update .com)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-09-14"

• "ET TROJAN Parallax RAT CnC Domain Observed in DNS Query"

• "ET TROJAN PurpleFox Backdoor Related Domain in DNS Lookup (qq .c1c .ren)"

• "ET TROJAN Win32/DarkWatchMan Checkin Activity (POST) M2"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (cookies.txt) M1"

• "ET TROJAN Win32/Pripyat Activity (POST)"

• "ET TROJAN NanoCore RAT Keepalive 1"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (cresozoq .ru)"

• "ET TROJAN W32/Bingoml!tr CnC Activity"

• "ET TROJAN VPNFilter htpx Module C2 Request"

• "ET MOBILE_MALWARE Android Flubot / LIKEACHARM Stealer Exfil (POST) 3"

• "ET TROJAN ELF/DarkNexus User-Agent"

• "ET TROJAN DNS Query to Raspberry Robin Domain (q2 .rs)"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-12-05"

• "ET TROJAN Win32/Remcos RAT Checkin 61"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Win32/TrojanDownloader.Agent.GEM CnC Checkin"

• "ET CURRENT_EVENTS Successful Amazon Phish 2016-10-27"

• "ET CURRENT_EVENTS Successful Generic Credential Phish Activity POST"

• "ET MALWARE Trojan-Dropper.MSIL CnC Traffic - POST"

• "ET CURRENT_EVENTS SunDown EK RIP Landing M3 B641"

• "ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M1 2022-04-13"

• "ET TROJAN Windows WMIC NIC get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Trojan/Win32.Agent Variant Checkin"

• "ET INFO Suspicious Empty SSL Certificate - Observed in Cobalt Strike"

• "ET TROJAN Konni RAT Exfiltrating Data"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (wahibabo .ru)"

• "ET TROJAN Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (netviewremote .com)"

• "ET TROJAN Silent Miner Changelog Checkin"

• "ET TROJAN Observed Malicious Domain in TLS SNI (2311forget .online)"

• "ET TROJAN Observed Glupteba CnC Domain (safarimexican .net in TLS SNI)"

• "ET TROJAN Observed Thanatos Ransomware Variant Pico User-Agent"

• "ET TROJAN APT28/Sednit DNS Lookup (euroreport24 .com)"

• "ET TROJAN Win32/Teslacrypt Ransomware .onion domain (7hwr34n18.com)"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Get Passwords)"

• "ET TROJAN Mirai pTea Variant - Info Submission Inbound"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-blog .com)"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (elon2xmusk .com)"

• "ET TROJAN Observed Darkgate Domain (trans1ategooglecom .com in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5kj .xyz)"

• "ET TROJAN Observed DarkSide Ransomware Domain (temisleyes .com in TLS SNI)"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (freescanonline .com)"

• "ET TROJAN Win32/Spy.KeyLogger.ODN Checkin"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET TROJAN Skyfall fake Skype install link"

• "ET TROJAN Powersploit Framework Script Downloaded"

• "ET TROJAN Observed Trojan.Verblecon Related Domain (jonathanhardwick .me in TLS SNI)"

• "ET TROJAN TA401 Arid Viper Related Activity (POST)"

• "ET TROJAN Win32/Spy.Agent.POX Variant CnC"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-chat .xyz)"

• "ET TROJAN Possible Banload Downloading Executable"

• "ET CURRENT_EVENTS Successful Personalized Outlook Phish 2016-10-26"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (rithdigit .cyou)"

• "ET TROJAN Suspected CHAOS CnC Inbound (upload command)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2um .xyz)"

• "ET TROJAN SuperKillerX Checkin Activity"

• "ET TROJAN NoMercy Stealer CnC Checkin"

• "ET TROJAN APT SuperhardCorp DNS Lookup (kieti.ipsecsl.net)"

• "ET TROJAN Sarwent CnC Command (rdp)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET TROJAN Nymaim.BA CnC M1"

• "ET TROJAN TA444 Domain in DNS Lookup (internalpdfviewer .ddns .net)"

• "ET CURRENT_EVENTS Successful Chase Phish 2015-09-24"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup Stage 2 CnC)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-chat .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/RM3Loader Server Response"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Winter Vivern APT Aperetif Payload Retrieval Attempt M1"

• "ET TROJAN Tatanga/Win32.Kexject.A Checkin"

• "ET MOBILE_MALWARE Arid Viper (fasebaok .com in DNS Lookup)"

• "ET TROJAN DNSpionage Requesting Config"

• "ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup"

• "ET TROJAN Filez Downloader Checkin"

• "ET TROJAN OSX/WireLurker HTTP Request for manhuaba.com.cn"

• "ET TROJAN Possible CopyKittens DNS Lookup (big-windowss.com)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing Nov 6 2015 M2"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Observed DNS Query to RisePro Domain (jojo-files .com)"

• "ET TROJAN Evilnum APT Related Domain in DNS Lookup (image .jamespage .net)"

• "ET CURRENT_EVENTS Successful Netflix Payment Phish M1 Jan 04 2017"

• "ET TROJAN Win32/Agent.RTQ CnC Activity"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (g2care .cc)"

• "ET TROJAN Observed Malicious SSL Cert (Bazar Backdoor)"

• "ET TROJAN Zeus User-Agent(z00sAgent)"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET TROJAN Gamaredon Domain in DNS Lookup (haramq .ru)"

• "ET TROJAN DPRK HIDDEN COBRA DDoS Handshake Success"

• "ET TROJAN PlugX Related Domain in DNS Lookup (wpsup .daj8 .me)"

• "ET TROJAN Restylink Domain in DNS Lookup (officehoster .com)"

• "ET TROJAN CommentCrew Possible APT c2 communications html return 1"

• "ET TROJAN CoinMiner Domain in DNS Lookup (pool .hashvault .pro)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5ap .nl)"

• "ET TROJAN WebDAV Retrieving .exe from .url M2 (CVE-2023-36025)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M2 2022-06-08"

• "ET CURRENT_EVENTS Java UA Requesting Numeric.ext From Base Dir (Observed in Redkit/Sakura)"

• "ET TROJAN Chanitor .onion Proxy Domain (l7gbml27czk3kvr5)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M23"

• "ET TROJAN MICROPSIA CnC Checkin M2"

• "ET TROJAN APT 41 LOWKEY Backdoor - Ping Success Code sent to CnC"

• "ET TROJAN Backdoor.Win32/Momibot Checkin"

• "ET TROJAN GuLoader Domain in DNS Lookup (zoneofzenith .com)"

• "ET TROJAN Trojan.JS.QLP Checkin"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (iransec .services)"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK September 04 2015"

• "ET TROJAN Win32/Bisonal RC4 Encrypted 8 Byte Static CnC Checkin"

• "ET CURRENT_EVENTS Successful Adobe Phish 2016-09-14"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity CnC)"

• "ET TROJAN OSX/Flashback.K/I reporting failed infection"

• "ET TROJAN Observed DNS Query to TA444 Domain (bankofamerica .tel)"

• "ET TROJAN Georbot checkin"

• "ET CURRENT_EVENTS DHL Phishing Landing 2016-01-07"

• "ET WEB_CLIENT Redirect to Adobe Shared Document Phishing M3 2016-04-18"

• "ET TROJAN BatLoader CnC Domain (cloudsteamview .com) in DNS Lookup"

• "ET CURRENT_EVENTS Possible Apple Phishing Domain Mar 14 2016"

• "ET TROJAN WooSIP Downloader CnC CreateFolderOnServer"

• "ET USER_AGENTS Suspicious User-Agent (QQ)"

• "ET TROJAN Sakula/Mivast C2 Activity"

• "ET TROJAN TA453 Related CnC Domain in DNS Lookup (0standavalue0 .xyz)"

• "ET TROJAN Win32/Meimaii Checkin"

• "ET TROJAN CozyDuke APT Possible SSL Cert 3"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-endpoint .xyz)"

• "ET TROJAN ConnectWise ScreenConnect Payload Delivery Domain (win01 .xyz) in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup/Patchwork CnC)"

• "ET TROJAN Observed Targeted Attack Malicious SSL Cert (investbooking .de)"

• "ET TROJAN Arid Gopher Related User-Agent (aimxxhwpcc)"

• "ET TROJAN W32/TRCrypt.ULPM Downloader CnC Beacon"

• "ET TROJAN FastPOS Sending Status Logs"

• "ET TROJAN Turkojan C&C Info Command Response (MINFO)"

• "ET TROJAN Locky Ransomware Writing Instructions via SMB"

• "ET TROJAN Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M1"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Nov 20 2017"

• "ET TROJAN Executable Download Purporting to be JavaScript likely 2nd stage Infection"

• "ET TROJAN Possible TRAT proxy component user agent detected"

• "ET CURRENT_EVENTS EITest SocEng Inject Jan 15 2017 EXE Download"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (pejapezey .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Vawtrak/NeverQuest Checkin"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (savalanpo .ru)"

• "ET TROJAN Observed IcedID Domain (oopscokir .com in TLS SNI)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (mod-mil .online in TLS SNI)"

• "ET TROJAN Observed Magecart CnC Domain in TLS SNI"

• "ET TROJAN Brute Ratel Fake User-Agent"

• "ET TROJAN APT37 M2RAT CnC Server Command - OKR"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET TROJAN OceanLotus Stage 2 Domain in DNS Lookup (widgets-wp .com)"

• "ET CURRENT_EVENTS Sucessful Alibaba Credential Phish 2022-06-29"

• "ET TROJAN [TGI] Cobalt Strike Malleable C2 Response (YouTube Profile)"

• "ET TROJAN ComRAT CnC Domain in DNS Lookup"

• "ET TROJAN Iron Ransomware Domain (y5mogzal2w25p6bn .ml in DNS Lookup)"

• "ET WEB_CLIENT Tech Support Phone Scam Landing Dec 30 M1"

• "ET TROJAN Gamaredon Domain in DNS Lookup (materialistic .ru)"

• "ET MALWARE Cobalt Strike Activity (GET)"

• "ET WEB_CLIENT Possible Websc Phishing Page 2016-02-05"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (longlakeweb .com)"

• "ET CURRENT_EVENTS Amazon Phish Landing Jun 22 2017"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET WEB_CLIENT BottleEK Payload Request"

• "ET TROJAN Hact .be Pentesting CnC Activity"

• "ET POLICY Suspicious CVV Parameter in HTTP POST - Possible Phishing"

• "ET TROJAN Win32/Matanbuchus Loader Related Domain in DNS Lookup (telemetrysystemcollection .com)"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-11-15"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-10-18"

• "ET EXPLOIT Access To mm-forms-community upload dir (Outbound)"

• "ET TROJAN NORTHSTAR Command Sent to Client"

• "ET MALWARE vaccine-program.co.kr Related Spyware User-Agent (vaccine)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (skaiortalop .com)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to virtualdataserver .com"

• "ET CURRENT_EVENTS Common Form POST - Facebook Phishing Landing 2020-06-11"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (yhorneedminf .com)"

• "ET TROJAN Suspicious User-Agent (Asteria md5)"

• "ET CURRENT_EVENTS Successful Poste Italiane Phish 2016-12-23"

• "ET TROJAN Sharp Panda APT RTF Retrieval (Response)"

• "ET TROJAN Atomic MacOS Stealer CnC Exfil (POST)"

• "ET TROJAN Observed Gamaredon APT Related Domain (buritoc .ru in TLS SNI)"

• "ET TROJAN Win32/Snojan Variant Sending System Information (POST)"

• "ET TROJAN APT39/Chafer Payload - CnC Checkin M1"

• "ET TROJAN Possible Zeus P2P Variant DGA NXDOMAIN Responses July 11 2014"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (darkmansion .org)"

• "ET TROJAN OSX/SHLAYER CnC Activity M2"

• "ET TROJAN Generic CMD Remote Shell"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 83"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Observed Lazarus Domain (safemeeting .online in TLS SNI)"

• "ET TROJAN NimPlant Result Activity (POST)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET TROJAN Havoc Framework CnC Response"

• "ET TROJAN Win32/Necurs Common POST Header Structure"

• "ET TROJAN Win32.VB.tdq - Fake User-Agent"

• "ET TROJAN Seetrol Remote Administration Tool Download"

• "ET CURRENT_EVENTS Successful Generic Phish 2016-10-27"

• "ET CURRENT_EVENTS Observed TOAD Domain (a2care .us in TLS SNI)"

• "ET TROJAN Patchwork APT Related Activity (POST)"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (soap .crmdev .org)"

• "ET CURRENT_EVENTS SUSPICIOUS DOC Download from commonly abused file share site"

• "ET TROJAN Volex - OceanLotus JavaScript Fake Page URL Builder Response"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (bidders-enoc .com) 2022-12-05"

• "ET TROJAN Observed Teal Kurma Domain (lo0 .systemctl .network in TLS SNI)"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M3"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (meetingverse .app)"

• "ET CURRENT_EVENTS RIG EK Landing March 20 2015"

• "ET CURRENT_EVENTS Possible Malicious Redirect Leading to EK Oct 29"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN PlugX or EvilGrab DNS Lookup (websecexp.com)"

• "ET CURRENT_EVENTS Generic Multibrand NewInjection Phishing Landing Template"

• "ET TROJAN Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)"

• "ET WEB_SERVER WebShell Generic eval of gzuncompress"

• "ET TROJAN LokiBot Request for C2 Commands Detected M1"

• "ET TROJAN SNIcat - Detected C2 Commands (CB)"

• "ET TROJAN W32/Downloader.FakeFlashPlayer Status.Php CnC Beacon"

• "ET CURRENT_EVENTS W3LL STORE Phish Kit Landing Page 2023-05-05"

• "ET TROJAN RouteX CnC Domain (cba4a6e5d3c956548a337c52388473f1 .com) in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN MSIL/PSW.Agent.SUD Zipped Data Exfil"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 1"

• "ET CURRENT_EVENTS Successful Danske Bank Phish (DA) 2016-10-27"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN Hiloti/Mufanom Downloader Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (n3 .wf)"

• "ET TROJAN Gozi check-in / update"

• "ET TROJAN Downloader.Win32.Tesch.A Server CnC Sending Executable"

• "ET CURRENT_EVENTS Successful Nordea Netbank Credential Phish 2022-11-04"

• "ET MOBILE_MALWARE Android APT-C-23 (moneymotion .club in TLS SNI)"

• "ET CURRENT_EVENTS Successful Wombat Phishing Test"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET TROJAN OSX/Proton.C/D Domain (handbrakestore .com) in DNS Lookup"

• "ET CURRENT_EVENTS Successful Gmail Account Update Phish 2016-05-10"

• "ET TROJAN VBS/Agent.PUK Data Exfiltration Request M2"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (group-meeting .team)"

• "ET TROJAN Xbash CnC DNS Lookup (3g2upl4pq6kufc4m .tk)"

• "ET TROJAN DNS Query to RokRat Domain (naver-storage .com)"

• "ET TROJAN Likely Bot Nick in IRC ([country|so version|CPU])"

• "ET CURRENT_EVENTS Possible AMSI Powershell Bypass Attempt"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2i .pm)"

• "ET MOBILE_MALWARE NSO Related Domain 20"

• "ET MOBILE_MALWARE Android/Opfake.A Country CnC Beacon"

• "ET TROJAN Observed TA444 Domain (careers .bankofamerica .nyc in TLS SNI)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Sisproc update"

• "ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M2"

• "ET USER_AGENTS Suspicious User-Agent (chrome)"

• "ET TROJAN PS1/Kimsuky CnC Exfil (POST)"

• "ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (marcobrando .xyz in TLS SNI)"

• "ET TROJAN TA422 Related Activity M4"

• "ET TROJAN IMDDOS Botnet User-Agent IAMDDOS"

• "ET MALWARE Win32/Eyoorun.D Variant Checkin"

• "ET TROJAN Cobalt Strike Malleable C2 (WooCommerce Profile)"

• "ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M1"

• "ET TROJAN Observed StrongPity CnC Domain (resolutionplatform .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (AgentTesla CnC)"

• "ET TROJAN Possible WannaCry DNS Lookup 5"

• "ET TROJAN [401TRG] Observed Backdoor.SUNBURST CnC Domain (bigtopweb .com in TLS SNI)"

• "ET MALWARE Win32.EZula Adware Reporting Successful Install"

• "ET TROJAN Win32/Bot.Sezin CnC Checkin"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET ATTACK_RESPONSE Metasploit Meterpreter Reverse HTTPS certificate"

• "ET TROJAN Win32/0xtaRAT CnC Activity M3 (GET)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 68"

• "ET CURRENT_EVENTS Apple Phishing Landing 2015-07-27"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor S5CLOSE Command (Inbound)"

• "ET TROJAN HermeticWizard - WMI Spreader - Remote Process Creation M1"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Sept 02 2016"

• "ET TROJAN APT28/Sednit DNS Lookup (stratforglobal .net)"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M8"

• "ET TROJAN Observed Malicious SSL Cert (MINEBRIDGE/MINEDOOR CnC)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23"

• "ET TROJAN DNS Query to Scattered Spider Domain (victimname-okta .com"

• "ET TROJAN CN Based APT Related Activity (POST)"

• "ET CURRENT_EVENTS PawnStorm Java Class Stage 1 M1 Aug 28 2015"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (rpirpiwhyyouleaveyourhorse .top)"

• "ET TROJAN Win32/HydraCrypt CnC Beacon 1"

• "ET INFO Suspicious User Agent (Autoupdate)"

• "ET INFO Possible Phishing Landing via MoonFruit.com M2 2016-01-22"

• "ET TROJAN RouteX CnC Domain (18bca7c5fd709ac468ba148c590ef6bf .net) in DNS Lookup"

• "ET TROJAN Cobalt Strike Activity"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (youaresoslow .top)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (APT-C-55/BabyShark Staging Domain)"

• "ET TROJAN APT DarkHydrus DNS Lookup 19"

• "ET TROJAN TA444 MacOS/ProcessRequest CnC Domain in DNS Lookup (swissborg .blog)"

• "ET CURRENT_EVENTS Canada Revenue Agency Phishing Landing 2016-01-25"

• "ET CURRENT_EVENTS EITest SocEng Inject Jan 15 2017 M1"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (dunamistrd .com)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic"

• "ET TROJAN Qasar Variant Domain (datapeople-cn .com in DNS Lookup)"

• "ET TROJAN Win32/Criminal RAT CnC Checkin"

• "ET TROJAN Observed TraderTraitor Domain (alwaysckain .com in TLS SNI)"

• "ET CURRENT_EVENTS Observed DNS Query to Nedbank Phishing Domain"

• "ET MOBILE_MALWARE Android APT-C-23 (leonard-kim .website in DNS Lookup)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (y0utube .com.mx)"

• "ET TROJAN Possible Linux/Moose Telnet CnC Beacon"

• "ET TROJAN Turkojan C&C Info Command (MINFO)"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET MALWARE LNKR Request for LNKR js file M1"

• "ET TROJAN Potential FakePAV Checkin"

• "ET TROJAN Downloader.Win32.Tesch.A Bot Command Checkin 2"

• "ET TROJAN Trojan.BlackRev Botnet Command Request CnC Beacon"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK Jul 12 2016"

• "ET TROJAN Win32/Agent.XST Checkin"

• "ET TROJAN Trojan-Dropper.Delf Checkin"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (938jss .com)"

• "ET MALWARE dialno Dialer User-Agent (dialno)"

• "ET TROJAN FrameworkPOS Covert DNS CnC Beacon 2"

• "ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M2"

• "ET TROJAN PurpleFox Backdoor/Rootkit Checkin"

• "ET TROJAN Latrodectus Alive Response M7"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (arabianmigration .com) 2022-12-05"

• "ET TROJAN Corebot Module Download 2"

• "ET TROJAN Mallox Ransomware CnC Domain (whyers .io) in DNS Lookup"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (linedgreen .org)"

• "ET TROJAN Variant.Zusy.45802 Checkin"

• "ET TROJAN W32/Downloader.Mevade.FBV CnC Beacon"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Dec 07 2016"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (ovcloud .online)"

• "ET TROJAN Asprox Data Post to C&C"

• "ET MOBILE_MALWARE signed-unsigned integer mismatch code-verification bypass"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (pbxsources .com)"

• "ET TROJAN MSIL/SkidRat CnC Checkin M2"

• "ET CURRENT_EVENTS Fifth Third Banking Credential Phish Landing Page 2022-12-07"

• "ET TROJAN Likely APT29 Retrieving Payload Embedded In PNG"

• "ET MALWARE DriverPack Update Checkin"

• "ET INFO Trend Micro Phishing Simulation Service"

• "ET CURRENT_EVENTS Vietnamese Govt Credential Phish M1 2023-07-18"

• "ET TROJAN JS/TrojanDropper.Agent.OHE CnC Checkin"

• "ET CURRENT_EVENTS Possible Successful Generic SSN Phish"

• "ET CURRENT_EVENTS Successful Generic Phish 2018-05-16 (set)"

• "ET TROJAN DNS Query to IcedID Domain (kicknocisd .com)"

• "ET TROJAN Win32/APT28 Host Fingerprint Exfiltration via IMAP"

• "ET TROJAN Phorpiex Botnet Downloader Activity (GET)"

• "ET TROJAN Observed IcedID Domain (mineskateroff .com in TLS SNI)"

• "ET TROJAN ELF/muBoT User-Agent (I'm a mu mu mu ?)"

• "ET MOBILE_MALWARE Android APT-C-23 (namyyeatop .club in TLS SNI)"

• "ET TROJAN Platinum APT - Titanium Payload CnC Checkin (x86)"

• "ET TROJAN Observed Malicious SSL Cert (Donot Group/APT-C-35 CnC)"

• "ET TROJAN BunnyLoader CnC Tasking Response"

• "ET TROJAN Observed DNS Query to UNC3890 Domain (xxx-doll .com)"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (submitonline .club)"

• "ET TROJAN Win32/Remcos RAT Checkin 54"

• "ET TROJAN Operation Interception Beacon"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET TROJAN LDPinch Checkin Post"

• "ET TROJAN Glupteba CnC Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j0 .wf)"

• "ET TROJAN Observed DNS Query to RisePro Domain (myrise .pro)"

• "ET TROJAN Possible iKittens OSX MacDownloader CNC Beacon"

• "ET MOBILE_MALWARE NSO Related Domain 1"

• "ET TROJAN Xilcter/Zeus related malware dropper reporting in"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .fun in TLS SNI)"

• "ET TROJAN NightfallGT Discord Nitro Ransomware"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Registry Listing)"

• "ET TROJAN APT DarkHydrus DNS Lookup 23"

• "ET MOBILE_MALWARE Android APT-C-23 (marklavi .com in TLS SNI)"

• "ET TROJAN ValleyRAT CnC Checkin Server Response"

• "ET TROJAN DNS Query to Teal Kurma Domain (dhcp .systemctl .network)"

• "ET MOBILE_MALWARE Android/FakeCalls CnC Server Response"

• "ET CURRENT_EVENTS Successful Bank of America Phish M2 2016-11-23"

• "ET TROJAN Mimikatz x64 Mimidrv.sys File Transfer Over SMB"

• "ET TROJAN Banker.Delf User-Agent (hhh)"

• "ET TROJAN Ponmocup HTTP Request (generic) M9"

• "ET TROJAN Sofacy DNS Lookup microsof-update.com"

• "ET CURRENT_EVENTS Malicious iframe"

• "ET TROJAN Win32/Kryptik.BSYO Checkin 2"

• "ET TROJAN Observed DNS Query to Ursnif SAIGON Variant CnC Domain"

• "ET TROJAN PennyWise Stealer Data Exfil M1"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup Android CnC)"

• "ET TROJAN Win32/Spy.Mekotio.ER Checkin"

• "ET TROJAN IrcBot Downloading .old"

• "ET MOBILE_MALWARE Android APT-C-23 (kik-com .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32.Cerberus RAT Checkin Response"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Matiex Keylogger Exfil Via Telegram"

• "ET TROJAN Observed IcedID CnC Domain (mestorycallin .com in TLS SNI)"

• "ET CURRENT_EVENTS Possible BulletProofLink Phishkit Activity - Redirect"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (pdfinfinity .com)"

• "ET TROJAN Suspicious Request for Pdf.exe Observed in Zeus/Luminosity Link"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS DRIVEBY Likely Evil EXE with no referer from HFS webserver (used by Unknown EK)"

• "ET TROJAN Possible PHP.MAILER WebShell Generic Request Inbound"

• "ET SCAN Internal Dummy Connection User-Agent Inbound"

• "ET MALWARE User-Agent (HTTP_Query)"

• "ET TROJAN Sharp Panda APT Style RTF Request (GET)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 85"

• "ET CURRENT_EVENTS Apple Phishing Landing M2 Sep 14 2017"

• "ET TROJAN Trojan.Proxy.Small.Z CnC Checkin"

• "ET TROJAN [Fireeye] Backdoor.BEACON M4"

• "ET CURRENT_EVENTS Phishing Landing Page - Excel Purchase Order Form"

• "ET TROJAN CryptoLocker EXE Download"

• "ET CURRENT_EVENTS Nuclear SilverLight URI Struct (noalert)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (birdmilk .top in TLS SNI)"

• "ET TROJAN Observed DNS Query to Vicious Panda CnC Domain"

• "ET CURRENT_EVENTS Successful Comcast Phish 2016-08-18"

• "ET MOBILE_MALWARE NSO Related Domain 17"

• "ET TROJAN Buran Ransomware Activity M1"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (panhardware .com in TLS SNI)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Densmail.com Related Trojan Checkin"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1q6zd25jmkfh5x24ymp60tq99xdugpq .com)"

• "ET TROJAN DustySky/Gaza Cybergang Group1 CnC Domain in DNS Lookup (time-loss .dns05 .com)"

• "ET TROJAN Matanbuchus Loader CnC M3"

• "ET TROJAN Win32/GandCrab Ransomware CnC Activity"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2020-06-18)"

• "ET CURRENT_EVENTS Excel Online Phish Landing 2015-12-08"

• "ET USER_AGENTS VPNFilter Related UA (Gemini/2.0)"

• "ET MOBILE_MALWARE Android Fancy Bear Checkin 5"

• "ET MOBILE_MALWARE Android APT-C-23 (easyshow .fun in DNS Lookup)"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (pdjwebrfgdyzljmwtxcoyomapxtzchvn .com)"

• "ET MALWARE ezday.co .kr Related Spyware User-Agent (Ezshop)"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (cnwx .58ad .cn)"

• "ET TROJAN Win32/Cinoshi Stealer Wallet Request (GET)"

• "ET TROJAN Observed Glupteba Domain (ramboclub .net in TLS SNI)"

• "ET CURRENT_EVENTS Generic Bank Captcha Phishing Landing"

• "ET CURRENT_EVENTS Successful Scotiabank Phish M1 May 24 2017"

• "ET CURRENT_EVENTS Successful Clydesdale Bank Phish 2020-12-30"

• "ET TROJAN Observed MageCart Group 12 Domain (pathc .space in TLS SNI)"

• "ET TROJAN PNScan.2 Inbound Status Check - set"

• "ET TROJAN Steganographic Encoded WAV File Inbound via HTTP M1"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET TROJAN GobRAT CnC Domain in DNS Lookup (ktlvz .dnsfailover .net)"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (datasend .linkpc .net)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4xq .nl)"

• "ET CURRENT_EVENTS Successful Generic Redeye Phish 2020-07-24"

• "ET TROJAN Bossabot DDoS tool RFI attempt"

• "ET TROJAN Observed IcedID Domain (filtaferamoza .com in TLS SNI)"

• "ET CURRENT_EVENTS TDS Sutra - cookie set RULEZ"

• "ET MOBILE_MALWARE NSO Related Domain 34"

• "ET TROJAN MiniDuke CnC Beacon (string1_slide_2_1)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET EXPLOIT SolusVM 1.13.03 Access to solusvmc-node setuid bin"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET TROJAN Win32.Genome.boescz Checkin"

• "ET TROJAN Observed Suspected TA453 Related Domain (metasecurityemail .org in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/RocketX Stealer CnC Exfil"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"

• "ET TROJAN Cycbot POST"

• "ET ATTACK_RESPONSE LaZagne Artifact Outbound in FTP"

• "ET WEB_CLIENT Fake Adobe Flash Player malware binary requested"

• "ET TROJAN APT/FamousSparrow CnC Domain in DNS Lookup (credits.offices-analytics .com)"

• "ET MALWARE debelizombi.com (Rizo) related Spyware User-Agent (mc_v1.2.6)"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (news .alberto2011 .com)"

• "ET TROJAN QRat.Java.RAT Post-Checkin Request"

• "ET TROJAN Win32/Delf.UUW CnC Keep-Alive"

• "ET TROJAN Magician/M461c14n Ransomware CnC Checkin"

• "ET TROJAN BigLock Ransomware CnC Activity (info)"

• "ET TROJAN Observed DNS Query to RisePro Domain (my-rise .cc)"

• "ET MOBILE_MALWARE iOS/Xsser sending files"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (allertmnemonkik .com)"

• "ET TROJAN SysJoker Related Domain in DNS Lookup (graphic-updater .com)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (alfayhaatravels .com) 2022-12-05"

• "ET TROJAN Observed Malicious SSL Cert (Sidewinder CnC)"

• "ET CURRENT_EVENTS Successful Battle.net Phish 2015-09-22"

• "ET MALWARE Topgame-online.com Ruch Casino Install User-Agent (RichCasino)"

• "ET TROJAN Observed TA444 Domain (share .anobaka .info in TLS SNI)"

• "ET TROJAN Torpig Reporting User Activity (x25)"

• "ET TROJAN STRRAT Requesting License Check"

• "ET CURRENT_EVENTS Successful Apple Phish M3 2016-09-14"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET TROJAN Octopus Backdoor Related Domain in DNS Lookup"

• "ET TROJAN W32/CoinMinerESJ!tr CnC Domain (ox .mygoodluck .best) in DNS Lookup"

• "ET CURRENT_EVENTS HTTP POST Contains Only Password (tk) 2021-04-05"

• "ET TROJAN Possible Pegasus Related DNS Lookup (smsmensaje .mx)"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 6"

• "ET CURRENT_EVENTS Apple ID Phishing Landing 2015-08-19"

• "ET TROJAN DarkWay Client Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [eSentire] Remcos RAT Checkin 25"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M1 2015-11-21"

• "ET TROJAN Win32/FunnyDream Backdoor Related Domain in DNS Lookup (www .aexhausts .com)"

• "ET CURRENT_EVENTS Sliver Related Domain in DNS Lookup (saleforces-it .com)"

• "ET TROJAN MSIL/Document Stealer Exfil"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M3"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (ewyersbetter .com)"

• "ET TROJAN Observed DangerousPassword APT Related Domain (shopapptech .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful Phish to Compromised Wordpress Site 2016-03-23"

• "ET TROJAN Observed DNS Query to Ursnif Domain (binchfog .xyz)"

• "ET CURRENT_EVENTS DRIVEBY EXE Embeded in Page Likely Evil M2"

• "ET TROJAN Unknown Webserver Backdoor"

• "ET CURRENT_EVENTS Successful Bank of America Phish M1 2016-08-31"

• "ET MALWARE Win32/Adware.iBryte.BO CnC Activity"

• "ET TROJAN W2KM_BARTALEX August 11 2015"

• "ET TROJAN Win32/Phoenix Grabber Sending System Information (POST)"

• "ET TROJAN Common Trojan HTTP GET Logging"

• "ET TROJAN APT28 Zebrocy/Zekapab POST Template Structure"

• "ET TROJAN Common Upatre URI/Headers Struct"

• "ET TROJAN Possible CopyKittens DNS Lookup (windowskernel14.com)"

• "ET TROJAN Red October/Win32.Digitalia Checkin cgi-bin/ms/flush"

• "ET CURRENT_EVENTS Successful Gmail Phish 2016-08-18"

• "ET TROJAN Observed Malicious SSL Cert (Bazar Backdoor)"

• "ET TROJAN MiniDuke CnC Beacon (string1_slide_2_2)"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-08"

• "ET TROJAN Observed Malicious SSL Cert (TA577)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (aalaan .tv)"

• "ET TROJAN AgentTesla Communicating with CnC Server"

• "ET TROJAN Observed TrojanSpy.SH.HADGLIDER.A Exfil Domain in DNS Query"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Operation Cobra Venom Stage 1 DNS Lookup"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Waledac Beacon Traffic Detected"

• "ET TROJAN Observed TraderTraitor Domain (centos-pkg .org in TLS SNI)"

• "ET TROJAN Win32/Nitrokod CnC Domain (nvidiacenter .com) in DNS Lookup"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Windows WMIC OS get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN [ANY.RUN] Possible Gh0stRat Checkin"

• "ET TROJAN Unknown Rootkit Checkin Activity (getSystemInfo)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 2"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Western Union Phish 2016-09-27"

• "ET TROJAN CryptoPatronum Ransomware CnC Checkin"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M7"

• "ET MOBILE_MALWARE Android APT-C-23 (1jve .com in DNS Lookup)"

• "ET CURRENT_EVENTS Possible Malicious Redirect 8x8 script tag URI struct"

• "ET CURRENT_EVENTS SUSPICIOUS waulct.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN DNS Query to Darkgate Domain (trans1ategooglecom .com)"

• "ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M2"

• "ET TROJAN Mustang Panda APT TONESHELL Related Activity"

• "ET MALWARE Win32/Hao123.C Variant CnC Activity"

• "ET TROJAN Win32/Unknown CnC Domain in DNS Lookup (hackermania .org)"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET TROJAN W32/Zemra.DDoS.Bot Variant CnC Beacon"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (gesturefavour .com)"

• "ET TROJAN JavaRAT CnC Checkin"

• "ET TROJAN Win32.TreasureHunter Checkin"

• "ET TROJAN MAGICHOUND-related DNS Lookup (ntg-sa .com)"

• "ET TROJAN TA457 Backdoor CnC Response"

• "ET TROJAN LolliCrypt Ransomware Sending Data to CnC"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN Observed DNS Query to TA444 Domain (smbcgroup .us)"

• "ET TROJAN Sofacy HTTP Request microsof-update.com"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 6"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN Win32/Gamaredon CnC Activity (POST) M2"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET CURRENT_EVENTS Successful Shared Adobe PDF Phish 2016-11-17"

• "ET TROJAN Gamaredon Domain in DNS Lookup (glistening .ru)"

• "ET TROJAN Observed DNS Query to TA444 Domain (azure-protection .cloud)"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2"

• "ET TROJAN W32/Kimsuky Sending Encrypted System Information to CnC"

• "ET CURRENT_EVENTS Successful Alibaba Phish 2016-12-20"

• "ET TROJAN Backdoor.ADDNEW (DarKDdoser) CnC 3"

• "ET MALWARE Hotbar Tools Spyware User-Agent (hbtools)"

• "ET TROJAN DangerousPassword APT Related Domain in DNS Lookup (doc .filesaves .cloud)"

• "ET CURRENT_EVENTS Successful UBS Phish 2016-10-21"

• "ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) (Inbound) M1"

• "ET TROJAN SHARPEXT CnC Domain in DNS Lookup (gonamod .com)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (bitlyy .me)"

• "ET TROJAN IsSpace/Zacom Connectivity Check"

• "ET MOBILE_MALWARE Arid Viper (joe-rumley .pw in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-11-29"

• "ET TROJAN Godlua Backdoor Stage-3 Server Heartbeat Reply (Jun 2019 - Sep 2020)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (apoligazanattions .com)"

• "ET TROJAN Observed JSSLoader Domain (deprivationant .com in TLS SNI)"

• "ET TROJAN Soraya C2 User-Agent (rhyno321)"

• "ET TROJAN MSIL/Whitesnake Variant Stealer Sending System Info via Telegram (GET)"

• "ET TROJAN Kimsuky APT CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Password Protected AMEX Phish 2016-12-09"

• "ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup"

• "ET CURRENT_EVENTS Observed TOAD Domain (bghelp .us in TLS SNI)"

• "ET TROJAN Win32/CosmicRust TA444 CnC Activity (GET)"

• "ET TROJAN Suspected APT34 Related SSD Backdoor Activity (POST)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (antiqueglossary .com)"

• "ET MALWARE UBar Trojan/Adware Checkin 2"

• "ET MALWARE Mysearch.com/Morpheus Bar Spyware User-Agent (Morpheus)"

• "ET CURRENT_EVENTS Successful Bank of America Credential Phish 2022-08-25"

• "ET TROJAN APT34 Related DNS Tunneling Activity"

• "ET TROJAN Fake Virtually SSL Cert APT1"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (auronavtimor .com)"

• "ET TROJAN PHPs Labyrinth Backdoor Stage2 CnC Activity M1"

• "ET TROJAN Observed BatLoader Domain (updatea1 .com) in TLS SNI"

• "ET TROJAN Backdoor.Win32.Pushdo.s Checkin"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (i4x .xyz)"

• "ET CURRENT_EVENTS DHL/EMS Documents Phishing Landing 2016-08-10"

• "ET USER_AGENTS Suspicious User-Agent (INet)"

• "ET TROJAN TA459 Related Activity (Inbound)"

• "ET CURRENT_EVENTS Adobe Shared Document Phishing Landing Nov 19 2015"

• "ET INFO suspicious - gzipped file via JAVA - could be pack200-ed JAR"

• "ET TROJAN Win32/Aurora Stealer WORK Command"

• "ET TROJAN Winnti Payload - XORed Check-in to Infected System (0xd4413890)"

• "ET TROJAN Observed DarkSide Ransomware Domain (catsdegree .com in TLS SNI)"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Rift)"

• "ET INFO Data Submitted to Weebly.com - Possible Phishing"

• "ET TROJAN Observed Cobalt Strike CnC Domain (securityupdateav .com in TLS SNI)"

• "ET TROJAN Win32/Bisonal DNS Lookup 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT DarkHydrus DNS Lookup 20"

• "ET WEB_CLIENT CookieBomb Generic PHP Format"

• "ET MOBILE_MALWARE Android APT-C-23 (liz-keen .website in TLS SNI)"

• "ET TROJAN ZenRAT CnC OK Response"

• "ET TROJAN PoshC2 - Observed Default URI Structure M24"

• "ET TROJAN Ponmocup C2 Post-infection Checkin"

• "ET MOBILE_MALWARE Android/Kemoge DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (clarke-taylor .life in DNS Lookup)"

• "ET TROJAN Win32/TrojanDownloader.Delf.BVP Win32/BioData CnC Beacon"

• "ET TROJAN DNS Query to Raspberry Robin Domain (bo2sv .com)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup CnC)"

• "ET TROJAN Win32/Nemty Ransomware Style Geo IP Check M2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN BadRabbit Ransomware Activity Via WebDAV (infpub)"

• "ET TROJAN Domen SocEng CnC Observed in DNS Query"

• "ET TROJAN Observed Trojan.Verblecon Related Domain (verble .software in TLS SNI)"

• "ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (myself .hopto .org)"

• "ET TROJAN Win32/Phorpiex Template 5 Active - Outbound Malicious Email Spam"

• "ET TROJAN DeathStalker/Janicab CnC Checkin"

• "ET TROJAN Win32/IceXLoader Sending Initial Checkin (POST)"

• "ET EXPLOIT Zollard PHP Exploit UA"

• "ET CURRENT_EVENTS Successful Emirates NBD Bank Credential Phish 2022-06-23"

• "ET TROJAN Win32/Keatep.B Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4s3 .me)"

• "ET TROJAN TA406 Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (ilokod .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (mwgq .net)"

• "ET TROJAN Aurora Ransomware CnC Checkin"

• "ET TROJAN SOMNIRECORD Backdoor CMD Command in DNS Query"

• "ET TROJAN Discord .exe Download URL In HTTP Response"

• "ET TROJAN Observed TA402 Domain in TLS SNI"

• "ET MOBILE_MALWARE Android APT-C-23 (camilleoconnell .website in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Linux/MayhemBruter Inbound Ping From CnC"

• "ET TROJAN Zyklon CnC Activity"

• "ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 3"

• "ET USER_AGENTS suspicious user-agent (REKOM)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Alibaba Phishing Landing 2016-08-31"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hshelp .info)"

• "ET TROJAN Win32/Snatch Ransomware - Encryption Started"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jun 08 2017"

• "ET TROJAN Golang Aurora Stealer Activity (POST)"

• "ET TROJAN Possible Win32/Dimegup.A Downloading Image Common URI Struct"

• "ET TROJAN Win32/Screenshotter Backdoor CnC Activity (GET)"

• "ET TROJAN Observed DNS Query to Ursnif Domain (daydayvin .xyz)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (daddygarages .org)"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT CnC)"

• "ET TROJAN ICEFOG JAVAFOG JAR checkin"

• "ET TROJAN Observed Possible PowerSploit/PowerView .ps1 Inbound"

• "ET CURRENT_EVENTS L33bo Phishing Kit - Successful Credential Phish M4 2016-03-29"

• "ET CURRENT_EVENTS Successful Apple Store Phish M2 2016-12-29"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (b9 .pm)"

• "ET TROJAN Observed Glupteba CnC Domain (filesdumpplace .org in TLS SNI)"

• "ET TROJAN WindowsEnterpriseSuite FakeAV get_product_domains.php"

• "ET TROJAN Lu0bot CnC Domain in DNS Lookup (mko .tinh73 .shop)"

• "ET TROJAN [ANY.RUN] Mekotio Banking Trojan TCP Request"

• "ET CURRENT_EVENTS Nuclear EK Gate Sep 16 2014"

• "ET TROJAN Win32/Lumma Stealer CnC Domain (safe-car .ru) in DNS Lookup"

• "ET TROJAN Drovorub shell Module Server Response"

• "ET CURRENT_EVENTS Successful Webmail Account Upgrade Phish 2016-07-21"

• "ET TROJAN Win32/Denisca.A CnC Beacon"

• "ET TROJAN Observed DNS Query to UNC3890 Domain (rnfacebook .com)"

• "ET TROJAN W32/24x7Help.ScareWare CnC Beacon"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN RedControle Communicating with CnC"

• "ET TROJAN Win32/Trickbot Data Exfiltration"

• "ET TROJAN MSSQL maggie backdoor sysinfo Query Observed"

• "ET MOBILE_MALWARE AdWare.AndroidOS.Ewind.cd Checkin"

• "ET USER_AGENTS Suspicious User-Agent (ISMYIE)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (trulazek .ru)"

• "ET TROJAN TA401 Domain in TLS SNI (francescatmorrison .icu)"

• "ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Win32/CHAOS RAT/AlfaC2 Checkin"

• "ET TROJAN Observed Malicious SSL Cert (POWERSTATS Proxy CnC)"

• "ET TROJAN Spark Backdoor CnC Domain Query"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN TDSS/TDL/Alureon MBR rootkit Checkin"

• "ET TROJAN APT28/SkinnyBoy Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Suspected Golang/Zerobot Websocket Activity (GET)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M6"

• "ET TROJAN DNS Query to Raspberry Robin Domain (8t .pm)"

• "ET TROJAN MiniDuke CnC Beacon (string2_slide_2_1)"

• "ET CURRENT_EVENTS Successful Trademe Phish M3 2015-11-26"

• "ET USER_AGENTS Suspicious user agent (asd)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (h2care .us)"

• "ET CURRENT_EVENTS Chase Phishing Landing 2018-01-18"

• "ET TROJAN Observed StrongPity Domain (lurkingnet .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful Google Drive Phish M2 2016-08-25"

• "ET TROJAN SilentLibrarian Domain in DNS Lookup (login .cardiff .acuk .me)"

• "ET TROJAN MSIL/Unk.CoinMiner Downloader"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6uy .at)"

• "ET TROJAN Win32/Comisproc Checkin"

• "ET TROJAN Observed CoinMiner CnC Domain (enoyq5xy70oq .x .pipedream .net in TLS SNI)"

• "ET WEB_SERVER Win32/SessionManager Backdoor ReadFile Command (Inbound)"

• "ET CURRENT_EVENTS Generic Bank Captcha Phishing Landing"

• "ET CURRENT_EVENTS Observed TOAD Domain (aphelp .us in TLS SNI)"

• "ET TROJAN Observed GandCrab Ransomware Domain (zonealarm .bit in DNS Lookup)"

• "ET TROJAN Win32/DarkVision RAT CnC Checkin M1"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M22"

• "ET CURRENT_EVENTS Successful Google Docs Phish M2 2016-10-19"

• "ET TROJAN Godlua Backdoor Stage-3 Client Heartbeat (Jun 2019- Dec 2019) (set)"

• "ET TROJAN Linux/Tsunami DNS Request (updates.mintylinux.com)"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 3"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (walidacja-uzytkownika .space)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (xairdone .com)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (azureonlinecloud .com)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (mainwog .xyz)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-11-03 M4"

• "ET TROJAN Win32/Rarog Stealer CnC Keep-Alive"

• "ET MOBILE_MALWARE Android APT-C-23 (hitmesanjjoy .pro in DNS Lookup)"

• "ET TROJAN Observed Gamaredon APT Related Domain (acorusso .ru in TLS SNI)"

• "ET TROJAN Dyreza RAT Ex-filtrating Data"

• "ET TROJAN Possible Pony Payload DL"

• "ET TROJAN Win32/AgentTesla Variant Exfil via Telegram"

• "ET CURRENT_EVENTS LightsOut EK POST Compromise POST"

• "ET TELNET Lunar Builder CnC Activity"

• "ET TROJAN Win32/Neutrino Cookie"

• "ET CURRENT_EVENTS Successful Excel Phish Aug 15 2016"

• "ET TROJAN Win32/Grandoreiro Loader Checkin Activity (POST)"

• "ET TROJAN NginxSpy Magic Bytes M1 (Outbound)"

• "ET TROJAN TrueBot/Silence.Downlaoder Screenshot Post M1"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-04-28"

• "ET TROJAN APT28/Sednit DNS Lookup (windowscheckupdater .net)"

• "ET CURRENT_EVENTS [eSentire] Successful Generic Phish 2018-06-15"

• "ET TROJAN HTML/Qbot Dropper (.zip)"

• "ET TROJAN Observed Malicious SSL Cert (Gozi ISFB)"

• "ET TROJAN Win32/WhiskerSpy - Machine ID Registration"

• "ET TROJAN DarkGate CnC Requesting Data Exfiltration from Bot"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M4 2023-02-22"

• "ET CURRENT_EVENTS Successful Facebook Mobile Phish 2017-08-15"

• "ET TROJAN Virut Family GET"

• "ET TROJAN APT DarkHydrus DNS Lookup 8"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (realonlinetrend .top in TLS SNI)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Win32/DarkVision RAT CnC Checkin M3"

• "ET TROJAN Observed DNS Query to herominers Domain (herominers .com)"

• "ET TROJAN Win32/RisePro CnC Command Outbound (freezeStats)"

• "ET TROJAN W32/Nutiliers.A Downloader CnC Checkin - Request Encrypted Response"

• "ET TROJAN MalDoc/Gamaredon CnC Activity M4"

• "ET TROJAN Win32/ChromeBack Browser Hijacker (getAd)"

• "ET TROJAN Win32/H0lyGh0st Ransomware CnC Response"

• "ET CURRENT_EVENTS Successful Anonisma Phish 2015-12-01"

• "ET MOBILE_MALWARE Android/Spy.Agent.ANA (androidsmedia .com in DNS Lookup)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI)"

• "ET TROJAN [ANY.RUN] RisePro TCP (External IP)"

• "ET TROJAN GCleaner Downloader Activity M2"

• "ET TROJAN GravityRAT CnC Domain (teraspace .co .in in DNS Lookup)"

• "ET TROJAN Observed Glupteba CnC Domain (mastiakele .xyz in TLS SNI)"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Feb 26 2016"

• "ET TROJAN Successful Cobalt Strike Shellcode Download (x64) M1"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (carsfootyelo .com)"

• "ET EXPLOIT Possible ECLIPSEDWING RPCTOUCH MS08-067"

• "ET MOBILE_MALWARE Arid Viper (vickeryduncan .site in DNS Lookup)"

• "ET TROJAN Observed Malicious SSL Cert (RampantKitten CnC)"

• "ET TROJAN Possible Win32/Napolar.A URL Response"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (dodsman .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (l6nk .com)"

• "ET TROJAN Kriptovor SMTP Traffic"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (team-meeting .xyz)"

• "ET CURRENT_EVENTS Targeted Office 365 Phishing Landing 2016-08-23"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4j1 .xyz)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (mudadazi .ru)"

• "ET TROJAN Observed TA444 Domain (azure-protect .online in TLS SNI)"

• "ET TROJAN Observed DNS Query to TA444 Domain (salt1ending .com)"

• "ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY."

• "ET TROJAN Ransomware/Cerber Checkin M3 (15)"

• "ET TROJAN Ransomware Locky .onion Payment Domain"

• "ET TROJAN TrickBot Related Activity (GET)"

• "ET TROJAN Vidar/Arkei Stealer Client Data Upload"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[POST]"

• "ET TROJAN Possible Dyre SSL Cert M1 (L O)"

• "ET TROJAN Observed Buer Loader Domain (officewestunionbank .com in TLS SNI)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN DorkBot.Downloader CnC Beacon M2"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Observed TA444 Domain (swissborg .blog) in TLS SNI"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET WEB_CLIENT Fake AV Phone Scam Landing Apr 4"

• "ET TROJAN WikiLoader Activity M1 (GET)"

• "ET TROJAN APT Related - BLACKCOFFEE Command Delimiters in HTTP Response M2"

• "ET TROJAN W32/Antifulai.APT CnC Beacon 3"

• "ET TROJAN Observed Puzzlemaker Remote Shell Domain (media-seoengine .com in TLS SNI)"

• "ET TROJAN OSX/Proton.C/D Domain (handbrake .cc) in DNS Lookup"

• "ET TROJAN ShadowPad CnC Domain in DNS Lookup (soft .mssysinfo .xyz)"

• "ET CURRENT_EVENTS Monzo Credential Phish Landing Page 2022-02-17"

• "ET CURRENT_EVENTS Successful Wells Fargo Mobile Phish 2016-08-01 M3"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 46"

• "ET TROJAN Cryptolocker Payment Domain (3qbyaoohkcqkzrz6)"

• "ET TROJAN DeltaStealer Exfiltrating Data to gofile .io"

• "ET TROJAN Nobelium APT Related Domain in DNS Lookup (theskoolieblog .com)"

• "ET TROJAN Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Session_Id length greater than Client_Hello Length)"

• "ET MALWARE User-Agent (Mozilla/4.0 (compatible))"

• "ET TROJAN ObliqueRAT CnC Heartbeat Packet"

• "ET CURRENT_EVENTS Chase/Bank of America Phishing Landing Uri Structure Nov 27 2012"

• "ET TROJAN Observed Malicious SSL Cert (Baka Skimmer Staging CnC)"

• "ET TROJAN Cobalt Strike Activity"

• "ET TROJAN Win32/SuperBOT CnC Checkin"

• "ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)"

• "ET TROJAN Gameredon Loader Activity"

• "ET TROJAN Rostpay Downloader User-Agent"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky C2)"

• "ET MALWARE WinSoftware.com Spyware User-Agent (NetInstaller)"

• "ET TROJAN Observed DNS Query to IcedID Domain (baherlakerl .online)"

• "ET TROJAN Ousaban Banker Checkin M1"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET CURRENT_EVENTS Successful NAB Bank Phish M2 2016-10-19"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (bid-enoc .com) 2022-12-05"

• "ET TROJAN Windows arp -a Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (kpt-pk .net)"

• "ET TROJAN Observed Malicious SSL Cert (Sidewinder CnC)"

• "ET MOBILE_MALWARE Android APT-C-23 (cecilia-gilbert .com in DNS Lookup)"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET MALWARE Bluebox Data Exfiltration"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23"

• "ET TROJAN ActionLoader CnC Domain in DNS Lookup (roskazna .net)"

• "ET MALWARE [PTsecurity] Adware/Rukometa(LoadMoney) Fake PNG File"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Phoenix Keylogger SMTP Exfil - Screenshot"

• "ET TROJAN lu0bot Loader HTTP Response"

• "ET TROJAN Lunar Builder Exfil Response"

• "ET TROJAN Gasket CnC Checkin"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN NSIS/TrojanDownloader.Agent.NZK CnC Activity M2"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN SSL Cert Used In Unknown Exploit Kit (ashburn)"

• "ET TROJAN Hakbit/Thanos Ransomware Exfil via FTP"

• "ET TROJAN Camaro Dragon APT - Horse Shell CnC Checkin"

• "ET CURRENT_EVENTS Generic Banking Phish Landing Page 2022-01-11"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (mansizeprofile .top)"

• "ET CURRENT_EVENTS Successful BDO Bank Credential Phish 2023-06-23"

• "ET TROJAN CommentCrew Possible APT c2 communications sleep"

• "ET TROJAN DNS Query For TURNEDUP.Backdoor CnC (syn.broadcaster)"

• "ET MOBILE_MALWARE Android/GoldDream Infected Device Registration"

• "ET TROJAN Ponmocup HTTP Request (generic) M3"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Suspicious exe.exe request - possible downloader/Oficla"

• "ET TROJAN Observed Malicious SSL Cert (BitRAT)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zjc .bz)"

• "ET TROJAN CMDASP Webshell Default Title in HTTP Response"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M1"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-02-09"

• "ET CURRENT_EVENTS DRIVEBY GENERIC ShellExecute in URLENCODE"

• "ET USER_AGENTS Suspicious User-Agent (chek)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (edu-cx .org)"

• "ET TROJAN DNS Query to TA444 Domain (forumpatners .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (daario-naharis .info in DNS Lookup)"

• "ET TROJAN Win32/Urausy.C Checkin 3"

• "ET TROJAN Trojan-Spy.Win32.Zbot.qgxi Checkin"

• "ET TROJAN Win32/Spy.KeyLogger.RJA Checkin"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET TROJAN Vawtrak/NeverQuest CnC Beacon"

• "ET MOBILE_MALWARE SSL/TLS Certificate Observed (Betcity CnC)"

• "ET CURRENT_EVENTS Axie Infinity Credential Phish Landing Page M2 2022-05-18"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (ae-snocproject .com) 2022-12-05"

• "ET CURRENT_EVENTS Common Form POST - Yahoo Phishing Landing 2020-06-11"

• "ET MOBILE_MALWARE iOS/Xsser Checkin"

• "ET TROJAN Overtoolbar.net Backdoor ICMP Checkin Request"

• "ET TROJAN [PTsecurity] Botnet Nitol.B Checkin"

• "ET TROJAN Observed DNS Query to Certishell Domain (googleprovider .ru)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 107"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (hamrah .nikanps .top)"

• "ET TROJAN Felismus CnC Beacon 1"

• "ET TROJAN MSIL/Azula Logger CnC Activity"

• "ET TROJAN Inception/CloudAtlas CnC Domain in DNS Lookup (ms-officeupdate .com)"

• "ET TROJAN MegalodonHTTP/LuciferHTTP Client Action"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (seasonsbackup .xyz)"

• "ET TROJAN ELF/muBoT IRC Activity 4"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Volatile Cedar DNS Lookup (erdotntexplore.info)"

• "ET MALWARE searchenginebar.com Spyware User-Agent (RX Bar)"

• "ET TROJAN Sage Ransomware Checkin Primer"

• "ET CURRENT_EVENTS Microsoft Account Credential Phish Landing Page 2022-04-26"

• "ET TROJAN Emotet Wifi Bruter Module Checkin"

• "ET CURRENT_EVENTS Common Form POST - VK Phishing Landing 2020-06-11"

• "ET TROJAN BKransomware Domain (3whyfziey2vr41yq in DNS Lookup)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (mindbreaker .top in TLS SNI)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (videomart .top)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish to .gqn Domain 2018-10-23"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5jk .club)"

• "ET MALWARE TopTools PUP Install Activity"

• "ET TROJAN Virut Counter/Check-in"

• "ET CURRENT_EVENTS Possible Generic Phishing Landing Jul 28 2015"

• "ET TROJAN MargulasRAT Keep-Alive Outbound M2"

• "ET TROJAN TA453 Related Domain in DNS Lookup (de-ma .online)"

• "ET TROJAN Dyreza RAT Checkin 3"

• "ET TROJAN Observed Malicious SSL Cert (DCRat)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 105"

• "ET TROJAN TA444 Domain in DNS Lookup (updatezone .org)"

• "ET TROJAN DeltaStealer CnC Domain (deltastealer .xyz) in DNS Lookup"

• "ET USER_AGENTS VPNFilter Related UA (curl53)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b CnC Beacon"

• "ET TROJAN NIGHTSCOUT Poison Ivy Variant CnC Domain in DNS Lookup (cdn. cloudistcdn .com)"

• "ET TROJAN Win32/CopperStealer CnC Activity M3"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-08-11"

• "ET TROJAN Sharik/Smoke CnC Beacon 2"

• "ET MOBILE_MALWARE GravityRAT CnC Domain (bollywoods .co .in in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query for known ShadowPad CnC 1"

• "ET CURRENT_EVENTS Successful Adobe Phish 2016-03-10"

• "ET CURRENT_EVENTS Observed BottleEK Domain in DNS Lookup 2021-04-15"

• "ET TROJAN W32/Agent.XXZBEN Downloader Activity"

• "ET MOBILE_MALWARE Android/HeHe.Spy ReportRequest CnC Beacon"

• "ET TROJAN WEBMONITOR RAT CnC Domain in DNS Lookup (dabmaster.wm01 .to)"

• "ET TROJAN Observed DNS Query to Ursnif Domain (pipap .xyz)"

• "ET MOBILE_MALWARE Android/FlyTrap Activity (POST)"

• "ET TROJAN Unknown Trojan Downloading PE via MSSQL Connection to Non-Standard Port"

• "ET USER_AGENTS Observed Suspicious UA (h55u4u4u5uii5)"

• "ET TROJAN MSIL/Almashreq CnC Checkin"

• "ET TROJAN Lemon_Duck Powershell CnC Checkin M6"

• "ET TROJAN Backdoor.Win32/Likseput.A Checkin"

• "ET TROJAN Win32/HydraCrypt CnC Beacon 3"

• "ET TROJAN WSHRAT Credential Dump Module Download Command Inbound"

• "ET CURRENT_EVENTS CottonCastle EK URI Struct"

• "ET TROJAN WS/JS Downloader Mar 07 2017 M2"

• "ET TROJAN Observed TA444 Domain (tptf .fund in TLS SNI)"

• "ET CURRENT_EVENTS Possible Google Drive Phishing Domain Aug 25 2016"

• "ET TROJAN Observed DNS Query to RisePro Domain (gg-loader .com)"

• "ET TROJAN SNIcat - Detected C2 Commands (EX)"

• "ET TROJAN Carbanak APT CnC Beacon 1"

• "ET CURRENT_EVENTS Successful Chase Phish Dec 29 2016"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DirtJumper Activity"

• "ET CURRENT_EVENTS Successful Personalized Phish (Multiple Brands) 2016-08-30"

• "ET TROJAN WaterDropX PRISM CnC Response"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M4"

• "ET TROJAN NCSC XAgent itwm beacon v2"

• "ET TROJAN Quant Loader Download Request"

• "ET TROJAN Win32/Cryptbot V2 Data Exfiltration Attempt"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 6.2)"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET CURRENT_EVENTS Observed TOAD Domain (bscare .live in TLS SNI)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Sidecopy APT Related CnC Domain in DNS Lookup (newsroom247 .xyz)"

• "ET TROJAN ATTACKER IRCBot - net user - PRIVMSG Command"

• "ET TROJAN W32/GamesForum.InfoStealer Reporting to CnC"

• "ET TROJAN Observed DNS Query to Impersoni-fake-ator (fcanet .microsoftshop .org)"

• "ET CURRENT_EVENTS Successful Microsoft Phish 2016-12-08"

• "ET TROJAN Kaiten User Agent"

• "ET TROJAN EUPUDS.A Requests for Boleto replacement"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN TA444 Domain in DNS Lookup (www .bitscrunch .co)"

• "ET TROJAN APT DarkHydrus DNS Lookup 10"

• "ET TROJAN Win32/Comrerop Checkin"

• "ET TROJAN VileRAT Related Domain in DNS Lookup (hubflash .co)"

• "ET TROJAN Georbot requesting update"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (privateanbshouse .space in DNS Lookup)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bshelp .support)"

• "ET TROJAN Win.Backdoor.Kolobko-9950676-0 Retrieving CnC Commands"

• "ET TROJAN Troj/ReRol.A Checkin 1"

• "ET SCAN Suspicious User-Agent inbound (bot)"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET TROJAN Kimsuky Related CnC"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN VBS/Kimsuky UA Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/TrojanDownloader.Agent.JVN CnC Checkin"

• "ET TROJAN Soraya C2 User-Agent (xehanort321)"

• "ET TROJAN Gh0st Variant CnC Domain in DNS Lookup (rninhsss .com)"

• "ET TROJAN Mespinoza Ransomware - Pre-Encryption File Exfil to CnC"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to Teal Kurma Domain (eth0 .secrsys .net)"

• "ET TROJAN MalDoc Requesting Payload 2020-04-21"

• "ET TROJAN LokiBot Cryptocurrency Wallet Exfiltration Detected"

• "ET TROJAN Win32.PEx.Delphi.1151005043 Post-infection Checkin"

• "ET MOBILE_MALWARE NSO Related Domain 13"

• "ET TROJAN Win32/Unknown Stealer Command (filegrab) (Outbound)"

• "ET CURRENT_EVENTS Common Form POST - Yahoo Phishing Landing 2020-06-11"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (alqassam .ps)"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-02-21"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-02-25"

• "ET CURRENT_EVENTS Successful Facebook Phish M2 2016-09-30"

• "ET CURRENT_EVENTS Observed TOAD Domain (b2care .cc in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET TROJAN DADJOKE/Rail Tycoon Payload Execution"

• "ET TROJAN APT28/Sednit DNS Lookup (acledit .com)"

• "ET TROJAN Cobalt Strike Malleable C2 (Havex APT)"

• "ET CURRENT_EVENTS Successful FR Gmail Phish M1 2016-03-15"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M18"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (en-ca-wordpress .org)"

• "ET TROJAN TinyLoader.B2 Checkin no architecture"

• "ET TROJAN Potential Juniper Path Traversal RCE Attempt (CVE-2022-22245)"

• "ET CURRENT_EVENTS Successful USAA Phish 2015-09-05"

• "ET TROJAN Ransomware Locky CnC Beacon 4 21 May"

• "ET CURRENT_EVENTS CVE-2017-0199 Common Obfus Stage 2 DL"

• "ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Suncoast Credit Union Credential Phish Landing Page 2022-12-19"

• "ET CURRENT_EVENTS Possible Apple Store Phish Landing 2015-07-30"

• "ET TROJAN SolarBot Plugin Download ComputerInfo"

• "ET TROJAN Trojan-Dropper.Win32.Agent.ksja"

• "ET TROJAN Observed Glupteba CnC Domain (zaoshanghaoz .net in TLS SNI)"

• "ET TROJAN GreenDou Downloader User-Agent (hello crazyk)"

• "ET TROJAN Blackmoon/Banbra Configuration Request M2"

• "ET WEB_CLIENT Fake Adobe Flash Player update warning enticing clicks to malware payload"

• "ET TROJAN SocGholish Domain in DNS Lookup (sommelier .peppertreecanyon .com)"

• "ET TROJAN Win32/Virut.BN Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Win32/BlackSun.B Retrieving Payload"

• "ET TROJAN TyphonStealer Exfil via Telegram"

• "ET TROJAN Sharik/Smoke Loader Adobe Connectivity Check 2"

• "ET TROJAN CoreDDRAT Initial Checkin"

• "ET TROJAN Possible Kaseya VSA Exploit URI Structure Inbound"

• "ET CURRENT_EVENTS Paypal Phishing Landing Jun 28 2017"

• "ET TROJAN Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M2"

• "ET TROJAN Possible CopyKitten DNS Lookup (trendmicro .tech)"

• "ET MALWARE AntiSpywareMaster.com Fake AV User-Agent (AsmUpdater)"

• "ET TROJAN JS Skimmer Domain in DNS Lookup"

• "ET CURRENT_EVENTS SunDown EK RIP Landing M4 B642"

• "ET USER_AGENTS Suspicious User-Agent (GOOGLE)"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET TROJAN Lemon_Duck Powershell CnC Checkin M2"

• "ET CURRENT_EVENTS Known Malicious Expires Header Seen In Malicious JavaScript Downloader Campaign"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (skype .se .net) in DNS Lookup"

• "ET CURRENT_EVENTS Observed TOAD Domain (h2care .cc in TLS SNI)"

• "ET TROJAN TA444 Related Domain (autoprotect .gb .net) in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebock .info in DNS Lookup)"

• "ET TROJAN MZRevenge Ransomware CnC"

• "ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (plitspiritnox .com)"

• "ET CURRENT_EVENTS Disdain EK Flash Exploit M2 Aug 23 2017"

• "ET TROJAN ELF/MooBot Mirai DDoS Variant Server Keep Alive"

• "ET CURRENT_EVENTS Possible Successful USAA Phishing Domain Feb 02 2017"

• "ET TROJAN UNC2628 Malicious MSHTA Activity (GET)"

• "ET TROJAN Cobalt Strike Beacon Observed"

• "ET TROJAN Win32/IcedID Requesting Encoded Binary M5"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Gamaredon CnC Activity (GET)"

• "ET TROJAN ARM Binary Requested via WGET to Known IoT Malware Domain"

• "ET MOBILE_MALWARE Android APT-C-23 (bbc-learning .com in TLS SNI)"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (tp-globa .xyz in TLS SNI)"

• "ET WEB_CLIENT Anonisma Paypal Phishing Uri Structure 2015-12-29"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (bitscrunch .presentations .life)"

• "ET TROJAN Lazarus APT Maldoc Related Domain in DNS Lookup (markettrendingcenter .com)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (a2care .cc)"

• "ET TROJAN MageCart Skimmer Header Observed Outbound"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (bulot .ru)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 24"

• "ET CURRENT_EVENTS Observed Phishing Domain in DNS Lookup (infollnes-r-us .co .uk)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 39"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN ZuoRAT send_http_msg_php Call to dns.php"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious Domain in TLS SNI (hijackson .org)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Exfil Domain)"

• "ET TROJAN UAC-006 Domain in DNS Lookup (ukr-net-download-files-php-name .ru)"

• "ET TROJAN Win32/Trapwot FakeAV Post Infection CnC Beacon"

• "ET CURRENT_EVENTS [TW] Tycoon Phishkit Config Vars"

• "ET MALWARE AppControls.com User-Agent"

• "ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.to)"

• "ET TROJAN DNS Query for known ShadowPad CnC 6"

• "ET TROJAN CozyDuke APT Possible SSL Cert 6"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2021-04-08"

• "ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)"

• "ET TROJAN DNS Query to UNK_BisonBooster Domain (booster724 .online)"

• "ET TROJAN Suspected Stitch Variant Backdoor CnC"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN BlackTech ELF/TSCookie CnC Observed in DNS Query"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET TROJAN Generic Downloader - HTTP POST"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (notburpcollaborator .net)"

• "ET TROJAN Possible Regin Init CnC Beacon ICMP"

• "ET TROJAN Dooptroop Dropper Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Generic Phish 2016-10-07"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (mikkelbourke .pro)"

• "ET CURRENT_EVENTS Mailbox Update Phishing Landing M1 2016-05-16"

• "ET CURRENT_EVENTS RedKit applet + obfuscated URL Apr 7 2013"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Observed Glupteba CnC Domain (cdntokiog .studio in TLS SNI)"

• "ET TROJAN Manjusaka CnC Server Response"

• "ET TROJAN Yayih.A Checkin"

• "ET TROJAN Observed BlackLotus SSL Certificate Observed"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (telegram-update .com) in DNS Lookup"

• "ET TROJAN TA402/Molerats CnC Activity"

• "ET TROJAN PureCrypter Requesting Injector M2"

• "ET TROJAN Agent.BAAB Checkin"

• "ET TROJAN [PTsecurity] Ursnif Encoded Payload Inbound"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (dixavokij .com)"

• "ET TROJAN PE EXE or DLL Windows file download Text M2"

• "ET MOBILE_MALWARE Android APT-C-23 (cerseilannister .info in DNS Lookup)"

• "ET TROJAN Observed IcedID Domain (lohmotarufos .com in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed PyPI Phishing/Malicious Library Data Exfiltration Domain (linkedopports .com) in TLS SNI"

• "ET CHAT Gadu-Gadu Chat Client Checkin via HTTP"

• "ET TROJAN ElectroRAT CnC Checkin"

• "ET CURRENT_EVENTS Successful Amazon Phish 2015-09-22"

• "ET WEB_CLIENT Anonisma Phishing CSS 2015-12-01"

• "ET TROJAN Win32/Vermilion Stager Activity (GET)"

• "ET TROJAN Observed Gamaredon Domain (to30 .procellarumbi .ru in TLS SNI)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES POST]"

• "ET TROJAN FakeYak or Related Infection Checkin 1"

• "ET ATTACK_RESPONSE Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (anydeskupdate .com)"

• "ET TROJAN Observed Malicious SSL Cert (Mirrortheif group)"

• "ET TROJAN GravityRAT CnC Domain (strongbox .in in DNS Lookup)"

• "ET TROJAN Possible Schneebly Posting ScreenShot"

• "ET CURRENT_EVENTS Successful HM Revenue Phish 2016-11-23"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 48"

• "ET TROJAN NORTHSTAR Client CnC Checkin"

• "ET TROJAN Win32/Agent.WVW CnC Beacon 3"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Chalbhai Phishing Landing Feb 18 2016"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (centos-repos .org)"

• "ET CURRENT_EVENTS Successful Apple Phish M2 2015-12-02"

• "ET TROJAN Win32/BUGHATCH SpawnAgent Request (GET) M2"

• "ET TROJAN ELF/RedXOR CnC Checkin"

• "ET MALWARE User-Agent (MyIE/1.0)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (vasepinay .com)"

• "ET TROJAN DNS Query to Remcos Domain (listpoints .click)"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab3520430c23 .com) May 2017"

• "ET TROJAN Possible WannaCry DNS Lookup 4"

• "ET TROJAN r0 CnC Architecture POST 4"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected"

• "ET TROJAN Cryptowall docs campaign Sept 2015 encrypted binary (1)"

• "ET TROJAN Linux/Onimiki DNS trojan activity long format (Outbound)"

• "ET CURRENT_EVENTS Observed TOAD Domain (r2care .cc in TLS SNI)"

• "ET TROJAN Request for fake postal receipt from e-mail link"

• "ET CURRENT_EVENTS Apple Credential Phish Landing Page M2 2022-06-21"

• "ET CURRENT_EVENTS Possible PurpleFox EK Redirect M2"

• "ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attack Done Message"

• "ET TROJAN Operation SpoofedScholars Activity (GET)"

• "ET TROJAN Mirai Variant Checkin Response"

• "ET CURRENT_EVENTS Mailbox Update Phishing Landing M2 2016-05-16"

• "ET TROJAN Reptile Rootkit Default UDP Magic Packet Trigger"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (brhelp .live)"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2016-10-06"

• "ET TROJAN Panda Banker C2 Domain (uiaoduiiej .chimkent .su in TLS SNI)"

• "ET TROJAN Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)"

• "ET TROJAN Observed DNS Query to Ursnif CnC Domain (horulenuke .us)"

• "ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M4"

• "ET TROJAN Chthonic Checkin"

• "ET TROJAN Win32/Ymacco.AA67 CnC Activity"

• "ET TROJAN Cayosin Botnet User-Agent Observed M2"

• "ET TROJAN Gootkit Checkin User-Agent 2"

• "ET TROJAN Nbar.co.kr Related Trojan Checkin"

• "ET TROJAN MSIL/Crimson Receiving Command (folders list)"

• "ET MOBILE_MALWARE Android APT-C-23 (donna-paulsen .info in TLS SNI)"

• "ET TROJAN BellaCiao ASPX Backdoor Response"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Valyria Maldoc Payload Request M2"

• "ET WEB_CLIENT Fake AV Phone Scam Domain M2 Mar 3"

• "ET TROJAN TinyNuke VNC Checkin M2"

• "ET TROJAN Observed DNS Query to ROMCOM RAT Domain (notfiled .com)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN Campo Loader Activity (GET)"

• "ET MALWARE Drivecleaner.com Spyware User-Agent (DriveCleaner Updater)"

• "ET CURRENT_EVENTS GitHub/CicleCI Themed Phishing Domain in DNS Lookup (email-circleci .com)"

• "ET TROJAN NCSC APT28 - Web/request -FILE- contenttype"

• "ET TROJAN SysJoker Related Domain in DNS Lookup (bookitlab .tech)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup)"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET TROJAN W32/Lalus Trojan Downloader User Agent (Message Center)"

• "ET TROJAN Potential Juniper XPATH Injection Attempt (CVE-2022-22244)"

• "ET USER_AGENTS Suspicious User-Agent (Mozil1a)"

• "ET TROJAN Observed DNS Query to TA444 Domain (bankofamerica .offerings .cloud)"

• "ET TROJAN Ponmocup C2 Sending Data to Controller 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/PSW.Discord.AIY CnC Exfil"

• "ET TROJAN Possible Netwire RAT Client HeartBeat C1 (no alert)"

• "ET CURRENT_EVENTS Apple Suspended Account Phishing Landing Aug 09 2016"

• "ET TROJAN W32/SPARS/ARS Stealer Checkin"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M1 2023-02-22"

• "ET TROJAN CrownAdPro CnC Activity M3"

• "ET CURRENT_EVENTS TDS checkResult Request - Observed Leading to CryptoClipper"

• "ET TROJAN DNS Query to Raspberry Robin Domain (3y .nu)"

• "ET TROJAN W32/Citadel Pro File.php CnC POST"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST]"

• "ET TROJAN Win32/Sisproc"

• "ET CURRENT_EVENTS Unknown EK Secondary Landing Page May 01 2015 M2"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (privymeet .com)"

• "ET TROJAN JavaRAT Requesting Screenshot"

• "ET TROJAN NoMercy Data Exfiltration M1"

• "ET CURRENT_EVENTS Adobe Phishing Landing M1 2016-08-16"

• "ET TROJAN Backdoor Lanfiltrator Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (cecilia-dobrev .com in TLS SNI)"

• "ET CURRENT_EVENTS PawnStorm Java Class Stage 2 M2 Aug 28 2015"

• "ET TROJAN DeathStalker/Powersing CnC Checkin"

• "ET TROJAN WatchDog Coinminer Payload Delivery Domain in DNS Lookup (oracle .zzhreceive .top)"

• "ET TROJAN Cybergate/Rebhip/Spyrat Backdoor Keepalive Response"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN SuperSocialat Plugin Backdoor Code Execution Attempt"

• "ET POLICY Possible BitCoin Miner User-Agent (miner)"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-02-21"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M16"

• "ET TROJAN ServHelper CnC Command (Whoami)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Possible DarkFinger ipconfig Retrieval Attempt"

• "ET MOBILE_MALWARE Android APT-C-23 (ososezo .club in TLS SNI)"

• "ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M2 2022-04-13"

• "ET TROJAN W32/Nolja Trojan User-Agent (FileNolja)"

• "ET CURRENT_EVENTS Possible Phishing Landing - Tectite Web Form Abuse"

• "ET ATTACK_RESPONSE Zone-H.org defacement notification"

• "ET MALWARE Observed DNS Query to PUP Domain (omnatuor .com)"

• "ET CURRENT_EVENTS Successful Mailbox Update Phish 2016-02-17"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework URI Struct Landing Request"

• "ET CURRENT_EVENTS Possible Office 365 Phishing Landing 2016-08-24"

• "ET TROJAN Win32/Delf.OKR Variant CnC M2"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1j4 .xyz)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS TA398 Phishing Kit URI Pattern M1"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN Ghostwriter/UNC1151 Related Domain in DNS Lookup"

• "ET TROJAN XcodeGhost CnC M2"

• "ET MALWARE SoftwareTracking Site - Download Report"

• "ET TROJAN Carbanak APT CnC Beacon 2"

• "ET CURRENT_EVENTS Successful Bank of America Phish (set) M2 2016-10-14"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (wpgate .zip)"

• "ET TROJAN OilRig OopsIE CnC Checkin M3"

• "ET TROJAN Bamital checkin"

• "ET TROJAN Chaos Botnet CnC Domain (linuxddos .net) in DNS Lookup"

• "ET USER_AGENTS Suspicious User-Agent (USERAGENT)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (loop71 .procellarumbi .ru)"

• "ET TROJAN W32/PointOfSales.Misc CnC Activity"

• "ET TROJAN Observed Malicious DNS Query (BazarLoader/Team9 Backdoor CnC Domain)"

• "ET INFO Possible Obfuscator io JavaScript Obfuscation Exclusion"

• "ET CURRENT_EVENTS Chalbhai Phishing Landing 2018-03-12"

• "ET EXPLOIT PHP Melody v3.0 SQL Injection Attempt"

• "ET TROJAN WORM_VOBFUS Checkin Generic 2"

• "ET MOBILE_MALWARE Android APT-C-23 (appchecker .us in DNS Lookup)"

• "ET TROJAN PS/PowerRatankba CnC DNS Lookup"

• "ET MALWARE UBar Trojan/Adware Checkin 1"

• "ET TROJAN Sofacy DNS Lookup msonlinelive.com"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (midatlanticlabel .com)"

• "ET TROJAN Possible CopyKitten DNS Lookup (akamaitechnology .com)"

• "ET CURRENT_EVENTS Successful Barclays Phish M1 2016-11-23"

• "ET TROJAN Mimikatz x64 Executable Transfer Over SMB"

• "ET TROJAN WebDAV Retrieving .vbs from .url M2 (CVE-2023-36025)"

• "ET CURRENT_EVENTS Generic Multibrand Ajax XHR CredPost Phishing Landing"

• "ET TROJAN TA453 BellaCiao CnC Domain in DNS Lookup (msn-center .uk)"

• "ET MALWARE Buer - DomainInfo User-Agent"

• "ET TROJAN Parallax CnC Activity M18 (set)"

• "ET TROJAN Konni Group CnC Domain in DNS Lookup"

• "ET TROJAN ProxyBox - HTTP CnC - proxy_info.php"

• "ET MALWARE BoostBeast Checkin M2"

• "ET CURRENT_EVENTS Observed TOAD Domain (d2care .cc in TLS SNI)"

• "ET TROJAN ASPXSPY Webshell Login Attempt"

• "ET WEB_SERVER WebShell Generic eval of str_rot13"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Operation Pawn Storm IOS_XAGENT Checkin"

• "ET TROJAN Observed DNS Query to Ursnif Domain (higmon .cyou)"

• "ET MALWARE PUP Win32.SoftPulse Checkin"

• "ET CURRENT_EVENTS Wells Fargo Mobile Phishing Landing 2016-08-01"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (abdul-sattar-abdul-tr .com) 2022-12-05"

• "ET MALWARE Win-touch.com Spyware User-Agent (WTInstaller)"

• "ET TROJAN Blue Bot DDoS Blog Request"

• "ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible MSIE 7.0 na .NET CLR 2.0.50727 .NET CLR 3.0.4506.2152 .NET CLR 3.5.30729))"

• "ET CURRENT_EVENTS Suspected Evri Phish Landing Page 2023-12-01"

• "ET TROJAN Observed Malicious SSL Cert (MirrorThief CnC)"

• "ET TROJAN TrueBot/Silence.Downloader CnC Checkin 4"

• "ET TROJAN Win32/Agent.AETZ CnC Checkin"

• "ET MOBILE_MALWARE Android/IRATA Data Exfiltration Attempt"

• "ET TROJAN Ursnif Variant CnC Beacon"

• "ET CURRENT_EVENTS Snapchat Credential Phish Landing Page 2023-03-21"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Possible Square Enix Phishing Domain 2016-08-15"

• "ET TROJAN APT29 Duke Variant Malware CnC Checkin Observed"

• "ET TROJAN Observed Princess Ransomware Payment Domain (royal25fphqilqft in DNS Lookup)"

• "ET TROJAN Arkei/Vidar/Mars Stealer Variant"

• "ET TROJAN TA453 BellaCiao ASPX Backdoor User-Agent in HTTP Request"

• "ET CURRENT_EVENTS Unknown Bleeding EK Variant Landing Sep 06 2013"

• "ET TROJAN Observed DNS Query to RisePro Domain (files-sender .com)"

• "ET CURRENT_EVENTS Union Bank Credential Phish Landing Page 2022-08-29"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (fablane .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (myboon .website in TLS SNI)"

• "ET TROJAN Activity related to APT.Seinup Checkin 1"

• "ET TROJAN Plead TSCookie CnC Checkin M1"

• "ET TROJAN Kimsuky CnC Domain Observed in DNS Query"

• "ET TROJAN Win32/StoredBt.A Activity"

• "ET TROJAN W32.Razy Inject Domain in DNS Lookup"

• "ET TROJAN SNIcat - Detected C2 Commands (LD)"

• "ET CURRENT_EVENTS Successful Generic Personalized Phish 2018-09-27 M2"

• "ET TROJAN DarkGate Domain in DNS Lookup (akamai .la)"

• "ET TROJAN Possible CopyKittens DNS Lookup (alhadath.mobi)"

• "ET TROJAN Lunar Builder Exfil via Discord M2"

• "ET TROJAN Win32.UFRStealer.A issuing MKD command FTP"

• "ET CURRENT_EVENTS Successful ABSA Phish 2016-10-26"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN MSIL/Diezen CnC Checkin M1"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN ComRAT CnC Domain in DNS Lookup"

• "ET TROJAN Limitless Logger Sending Data over SMTP 2"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (multifuctionscanner .club in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (b2care .cc)"

• "ET TROJAN FAKE/ROGUE AV/Security Application Checkin"

• "ET INFO DropBox User Content Download for payload.bin"

• "ET TROJAN MSUpdater Connectivity Check to Google"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup FireStarter CnC)"

• "ET TROJAN ELF.SystemdMiner C2 Domain in DNS Lookup"

• "ET TROJAN Win32/Ispen BADNEWS CnC Beacon"

• "ET TROJAN Soraya C2 User-Agent (SBTCM)"

• "ET CURRENT_EVENTS Successful Discover Phish M2 2016-12-14"

• "ET TROJAN Win32/Ficker Stealer Activity"

• "ET TROJAN Parallax CnC Activity M6 (set)"

• "ET WEB_CLIENT c3284d Malware Network Compromised Redirect (comments 3)"

• "ET TROJAN Win32.Sality-GR Checkin"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (alqassam .ps)"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"

• "ET TROJAN SoulSearcher Malware Domain in DNS Lookup (community .weblives .net)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (june85 .cyou)"

• "ET TROJAN AtomLogger Exfil via FTP"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bghelp .live)"

• "ET TROJAN Unk Spam Bot Template 1 Active - Outbound Malicious Email Spam"

• "ET CURRENT_EVENTS Sweet Orange Landing with Applet Oct 4 2013"

• "ET TROJAN Win32/Ymacco.AA60 Checkin"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-10"

• "ET TROJAN Linux Backdoor Linux/Cdorked.A Redirect 2"

• "ET TROJAN Observed Malicious SSL Cert (Darkme CnC)"

• "ET TROJAN DEEP PANDA Checkin 3"

• "ET TROJAN Spora Ransomware SSL Certificate Detected"

• "ET CURRENT_EVENTS Successful DHL Phish 2016-07-11"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Cakle)"

• "ET CURRENT_EVENTS Successful Western Union/Paypal Phish 2016-09-26"

• "ET TROJAN Observed DNS Query to RisePro Domain (gg-download .com)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M5"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ArcDoor Intial Checkin"

• "ET TROJAN Buhtrap SourSnack Domain in DNS Lookup (widget .forum-pokemon .com)"

• "ET CURRENT_EVENTS CSharp SMB Scanner Assembly in PowerShell Inbound M1"

• "ET TROJAN Observed DNS Query to Known Indexsinas CnC Domain"

• "ET MOBILE_MALWARE NSO Related Domain 5"

• "ET TROJAN Philis.J ICMP Sweep (Payload Hello World)"

• "ET TROJAN Suspicious User-Agent (GenericHttp/VER_STR_COMMA)"

• "ET CURRENT_EVENTS [TW] NOTG Check Add User URL Struct"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (en-us-wordpress .org)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6t .re)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (glcloudservice .com)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (rorfog .com)"

• "ET TROJAN Maze/ID Ransomware Activity"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN W32/Goolbot.E Checkin UA Detected iamx"

• "ET TROJAN Known Malicious Server in DNS Lookup (updatecache .com)"

• "ET CURRENT_EVENTS Successful Google Drive Phish Dec 4 2015 M1"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET CURRENT_EVENTS Possible Java Applet JNLP applet_ssv_validated Click To Run Bypass (Reversed)"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M9"

• "ET TROJAN Observed Malicious SSL Cert (Win32/Gadwats Banker CnC Domain)"

• "ET TROJAN FighterPOS CnC Beacon 1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN IRC Bot Download http Command"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jul 10 2017"

• "ET CURRENT_EVENTS Webmail Validator Phishing Landing 2016-09-02"

• "ET TROJAN DNS Query to Raspberry Robin Domain (rn9v .com)"

• "ET TROJAN Win32/Vundo.OD Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (w4 .wf)"

• "ET TROJAN MSIL/Black Hat Worm Checkin"

• "ET CURRENT_EVENTS Successful iTunes Connect Phish M1 2016-10-21"

• "ET TROJAN Suspicious X-mailer Synapse Inbound to SMTP Server"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (nomadpkg .com)"

• "ET MALWARE STOPzilla Download Accelerator Activity"

• "ET TROJAN Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Suspected Win32/Hancitor Checkin"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab6d54340c1a .com) Feb 2017"

• "ET TROJAN Win32/Blacknix CnC Checkin"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (msstorageboxes .com)"

• "ET MALWARE User-Agent (Live Enterprise Suite)"

• "ET TROJAN GCleaner Downloader Activity M4"

• "ET TROJAN Windows gpresult Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback Response (File Manager)"

• "ET TROJAN Observed Gamaredon APT Related Domain (cupata .ru in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (mn1 .biz)"

• "ET CURRENT_EVENTS Flash Exploit Likely SunDown EK"

• "ET TROJAN ELF.MrBlack DOS.TF Malformed Lookup (/lib32/libc.so.6)"

• "ET CURRENT_EVENTS Successful Sparkasse Phish Nov 03 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE MrRobot LYON Admin Panel Inbound"

• "ET CURRENT_EVENTS Successful Bank of Oklahoma Phish M2 Jul 21 2016"

• "ET TROJAN Win32/Bisonal DNS Lookup 4"

• "ET CURRENT_EVENTS PerSwaysion Phishkit Message Variables"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 5.2)"

• "ET TROJAN Win32/Vector Stealer Sending System Information via Telegram (POST)"

• "ET TROJAN Win32/TrojanDownloader.Agent.FLZ CnC Activity"

• "ET TROJAN Linux/Lady CnC Beacon 1"

• "ET MALWARE Lantern Checkin"

• "ET TROJAN Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)"

• "ET TROJAN TeslaCrypt/AlphaCrypt Variant .onion Proxy Domain"

• "ET CURRENT_EVENTS Possible WhiteLotus EK 2013-2551 Exploit 1"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2015-12-10"

• "ET TROJAN MetaStealer Activity (Response)"

• "ET WEB_CLIENT Observed DNS Query to Malicious Cookie Monster Roulette JS Cookie Stealer Exfil Domain"

• "ET WEB_SERVER AnonGhost PHP Webshell"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .info in TLS SNI)"

• "ET TROJAN CommentCrew UGX Backdoor initial connection"

• "ET TROJAN Android Infostealer CnC Check-In"

• "ET TROJAN CopperStealer - Remote Desktop - Task Request"

• "ET USER_AGENTS Observed Malicious User-Agent (CobaltStrike)"

• "ET TROJAN Smokeloader getsock Command"

• "ET CURRENT_EVENTS Unknown Malvertising Exploit Kit Hostile Jar app.jar"

• "ET TROJAN ThirdEye Stealer System Information Gathering Attempt"

• "ET TROJAN TA444 Related Domain (hoststudio .org) in DNS Lookup"

• "ET MALWARE Downloader Checkin - Downloads Rogue Adware"

• "ET TROJAN Win32.Chroject.B Retrieving encoded payload"

• "ET TROJAN Fodcha Botnet Style DNS Server Lookup"

• "ET TROJAN Arechclient2 Backdoor/SecTopRAT CnC Init"

• "ET TROJAN Redline Stealer TCP CnC Activity"

• "ET TROJAN Win32/Zemot Checkin"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (perfilcovid .com)"

• "ET TROJAN SHARPEXT CnC Domain in DNS Lookup (siekis .com)"

• "ET TROJAN r0 CnC GET"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET CURRENT_EVENTS BulletProofLink Phishkit Activity (POST)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish"

• "ET TROJAN Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (windowservicecenter .com)"

• "ET CURRENT_EVENTS Possible FFSniff Inject Observed"

• "ET USER_AGENTS Tear Application User-Agent Detected"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32.Zegost CnC Checkin"

• "ET TROJAN Observed DNS Query to UNC3890 Domain (celebritylife .news)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2017-12-03"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (bid-taqa .com) 2022-12-05"

• "ET TROJAN Latrodectus Alive Request (GET)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (t7 .nz)"

• "ET CURRENT_EVENTS Possible Veil Powershell Encoder B641"

• "ET TROJAN Gamaredon APT Maldoc Retrieving Remote Template (GET)"

• "ET TROJAN Loxes/Mongall Related CnC Beacon M2 (GET)"

• "ET TROJAN SocGholish Domain in TLS SNI (dashboard .renovationsruth .com)"

• "ET TROJAN Alureon Checkin"

• "ET CURRENT_EVENTS Generic Antibot Phish Landing Page 2023-04-05"

• "ET CURRENT_EVENTS Successful Orange (FR) Phish 2016-10-06"

• "ET TROJAN Kimsuky APT Related Domain in DNS Lookup (gooeglle .mypressonline .com)"

• "ET MALWARE Win32/2345.H Variant Activity (POST)"

• "ET TROJAN Win32/Tapazom.A 2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Common Form POST - Whatsapp/Facebook Phishing Landing 2020-06-11"

• "ET MALWARE Trojan.Win32.InternetAntivirus User-Agent (General Antivirus)"

• "ET TROJAN FrauDrop Checkin"

• "ET TROJAN Observed DNS Query to ErbiumStealer Domain (erbium .ml)"

• "ET TROJAN GravityRAT CnC Domain (microsoftupdate .in in DNS Lookup)"

• "ET MALWARE Smileware Connection Spyware Related User-Agent (Smileware Connection)"

• "ET TROJAN Xbash CnC DNS Lookup (blockbitcoin .com)"

• "ET TROJAN Possible Winnti-related DNS Lookup (google-statics .com)"

• "ET CURRENT_EVENTS Possible Credential Phish Landing Page 2023-03-10"

• "ET TROJAN BYOB - Python Backdoor Stager Download"

• "ET TROJAN Possible Pegasus Related DNS Lookup (ooredoodeals .com)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI"

• "ET TROJAN Successful Cobalt Strike Shellcode Download (x64) M2"

• "ET MALWARE Win32/Presenoker Checkin"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish 2016-10-10"

• "ET TROJAN Possible Pegasus Related DNS Lookup (asrararablya .com)"

• "ET TROJAN Observed BLUELIGHT Payload Domain (storage .jquery .services in TLS SNI)"

• "ET CURRENT_EVENTS Sparkasse Phishing Domain Nov 03 2017"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (biteupdates .live)"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .caching .oysterfloats .com)"

• "ET MALWARE Context Plus Spyware Install"

• "ET MALWARE Win32/Toolbar.CrossRider.A Checkin"

• "ET TROJAN Windows WMIC STARTUP get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Win64/Rozena.TD Variant CnC Activity (GET)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (zacharryblogs .com)"

• "ET TROJAN Cookies/Cookiebag Checkin"

• "ET TROJAN Eternity Stealer Screen Capture Activity"

• "ET CURRENT_EVENTS Successful Chase Phish M1 Aug 15 2017"

• "ET TROJAN MSIL/KeyRedirEx Banker Receiving Redirect/Inject List"

• "ET TROJAN DDoSia Client CnC Checkin"

• "ET TROJAN MSIL/Matrix Ransomware Sending Encrypted Filelist"

• "ET TROJAN PUSHCHA Related Domain in DNS Lookup (passport-ua .site)"

• "ET TROJAN Sharik/Smoke Loader Java Connectivity Check"

• "ET TROJAN Win32/Colibri Loader Activity M2"

• "ET TROJAN Zlader Ransomware Worm Propagating Over SMB v1 ASCII"

• "ET TROJAN DNS Query to Raspberry Robin Domain (21k .website)"

• "ET CURRENT_EVENTS Successful Paypal Phish M5 2016-12-13"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN ELF/Roboto - Possible Encrypted Roboto P2P Payload Requested M2"

• "ET TROJAN TA471/UNC2589 Related Domain in DNS Lookup (skreatortemp .site)"

• "ET CURRENT_EVENTS Successful Apple Store Phish M1 2016-12-29"

• "ET TROJAN LuminosityLink - Data Channel Server Response"

• "ET TROJAN Observed TA444 Domain (mizuhogroup .us in TLS SNI)"

• "ET TROJAN Observed Glupteba CnC Domain (zaoshang .moscow in TLS SNI)"

• "ET TROJAN Mirai pTea Variant - Bot Upload Command Outbound"

• "ET TROJAN Win32/Scieron-A UA (HTClient)"

• "ET CURRENT_EVENTS Likely Malicious Windows SCT Download MSXMLHTTP AX M2"

• "ET TROJAN OSX/Mughthesec/SafeFinder/OperatorMac DNS Query Observed"

• "ET TROJAN JavaRAT CnC Init Activity"

• "ET TROJAN Trustezeb Checkin to CnC"

• "ET TROJAN ELF/muBoT IRC Activity 1"

• "ET CURRENT_EVENTS Possible Chase Phishing Domain Mar 14 2016"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (aconitum .xyz)"

• "ET TROJAN PunkeyPOS HTTP CnC Beacon Fake UA"

• "ET TROJAN Gimemo Activity"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (builds-emaar .com) 2022-12-05"

• "ET TROJAN AppleJeus - JMT Trading CnC Domain in DNS Lookup (jmttrading .org)"

• "ET TROJAN Suspected POLONIUM CnC Domain (consulting-ukraine .tk) in DNS Lookup"

• "ET WEB_CLIENT Microsoft Tech Support Phone Scam M2 Jul 07 2017"

• "ET POLICY Possible Successful Phish - Password Submitted to *.000webhostapp.com"

• "ET EXPLOIT Possible CVE-2017-0199 HTA Inbound"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Athena Bot Nick in IRC"

• "ET TROJAN [ANY.RUN] Lu0bot-Style DNS Query in DNS Lookup M3"

• "ET USER_AGENTS Downloader User-Agent Detected (ld)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.cc)"

• "ET TROJAN Dyreza RAT Fake Server Header"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (alockajilly .com)"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (blogs .tourseasons .xyz)"

• "ET TROJAN Possible CopyKittens DNS Lookup (windowssup.in)"

• "ET CURRENT_EVENTS Successful Intuit Phish 2016-08-01"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Quakbot CnC)"

• "ET TROJAN Powershell commands sent B64 2"

• "ET MALWARE AdWare.Win32.Sushi.au Checkin"

• "ET CURRENT_EVENTS Generic Webmail Phishing Landing"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1n4 .xyz)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (mhotepzi .ru)"

• "ET TROJAN W32/Mevade.Variant CnC POST"

• "ET TROJAN RouteX CnC Domain (3ec9b600789b3bacf2c72ebae142a9c3 .net) in DNS Lookup"

• "ET TROJAN PovertyStealer Exfiltration M3"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-08-18"

• "ET TROJAN ELF/Freakout IRC Checkin"

• "ET TROJAN Poweliks Clickfraud CnC M2"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Zacom/NFlog Checkin"

• "ET TROJAN CommentCrew downloader without user-agent string exe download without User Agent"

• "ET MOBILE_MALWARE Android APT-C-23 (michael-keaton .info in DNS Lookup)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (uqw .futbol)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page M2 2022-06-01"

• "ET INFO HTTP POST to Free Webhost - Possible Successful Phish (site40 . net) Jul 18 2017"

• "ET TROJAN Playful Taurus CnC Domain (scm .oracleapps .org) in DNS Lookup"

• "ET TROJAN W32/Bilakip.A Downloader Viruslist Download For Populating FakeAV"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (vibedroom .org)"

• "ET TROJAN Win32/Dorv Stealer Exfiltrating Data to CnC"

• "ET TROJAN Banker PWS/Infostealer HTTP GET Checkin"

• "ET MALWARE User-Agent (AdVantage)"

• "ET TROJAN TA453 ClumsyCover Maldoc Activity (GET)"

• "ET TROJAN Suspected Higaisa APT Related Domain in DNS Lookup (insightinteriors .im)"

• "ET TROJAN [ANY.RUN] DarkCrystal Rat Exfiltration (POST)"

• "ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (gnavigatio .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Infostealer.Jackpos Checkin"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN ZeroLocker Downloading Config"

• "ET TROJAN Downloader.Win32.Adload (KaiXin Payload) Checkin Response"

• "ET TROJAN DNS Query to Raspberry Robin Domain (bcomb .net)"

• "ET TROJAN General Banker.PWS POST Checkin"

• "ET TROJAN Win32/BumbleBee Loader Activity (GET)"

• "ET MOBILE_MALWARE Possible Trojan-Banker.AndroidOS.Sharkbot Activity (DNS Lookup) 2"

• "ET TROJAN GlitchPOS CnC Checkin"

• "ET TROJAN Clipsa Stealer - Coinminer Download"

• "ET TROJAN W32/LockscreenBEI.Scareware Cnc Beacon"

• "ET CURRENT_EVENTS Successful Adobe Online Phish 2015-09-30"

• "ET TROJAN ELF/Muhstik Botnet CnC Activity"

• "ET TROJAN Win32/Sisproc Variant POST to CnC Server"

• "ET TROJAN CenterPOS User Agent Observed"

• "ET USER_AGENTS Suspected Mekotio User-Agent (4M5yC6u4stom5U8se3r)"

• "ET TROJAN Eternity Stealer Data Exfiltration Activity"

• "ET TROJAN Win32/Backdoor.Agent.qweydh CnC Checkin M1"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-26"

• "ET TROJAN ELF/Samba CnC Checkin"

• "ET USER_AGENTS User-Agent (Unknown)"

• "ET CURRENT_EVENTS Successful Bank of America Phish M2 2016-10-27"

• "ET MALWARE Suspicious User-Agent (Nimo Software HTTP Retriever 1.0)"

• "ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (dubai .network .cloud .doc-shared .linkpc .net)"

• "ET TROJAN Bitter APT ZxxZ Downloader CnC Checkin"

• "ET TROJAN ELF.MrBlack DOS.TF Variant"

• "ET TROJAN Observed TWISTEDPANDA Domain in TLS SNI (img .elliotterusties .com)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (ppinewsagency .live)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (asureupdate .pro)"

• "ET TROJAN W32/SpeedingUpMyPC.Rootkit Successful Install GET Type CnC Beacon"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN OILRIG CnC POST"

• "ET TROJAN Observed Magecart CnC Domain in TLS SNI"

• "ET TROJAN Quasar CnC Domain in DNS Lookup (societyf500 .ddns .net)"

• "ET TROJAN MSIL.L4L Stealer IP Check"

• "ET TROJAN Win32.Rioselx.A Checkin"

• "ET TROJAN Win32/VB.SDB CnC Beacon"

• "ET CURRENT_EVENTS Successful Amazon.com Phish M1 2016-06-27"

• "ET CURRENT_EVENTS Observed Possible Phishing Landing Page 2021-06-24"

• "ET TROJAN Win32/RisePro CnC Command Outbound (set_file)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (louisianaworkingdogs .com)"

• "ET TROJAN DonotGroup CnC Domain in DNS Query"

• "ET TROJAN Cobalt Strike Malleable C2 Profile (Teams) M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5v0 .nl)"

• "ET TROJAN Ransomware/Cerber Checkin 2"

• "ET TROJAN Lazarus FALLCHILL Fake SSL Checkin 1"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (govpk-mail .net)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (wiraofise .com)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 2"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (service .exfil .site)"

• "ET CURRENT_EVENTS PerSwaysion JavaScript Response M2"

• "ET TROJAN ELF/Chacha.DDoS/Xor.DDoS Stage 2 CnC Checkin"

• "ET MALWARE User-Agent (Firefox) - Possible Trojan Downloader"

• "ET TROJAN Possible Windows executable sent when remote host claims to send html content"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 94"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M4"

• "ET TROJAN Win32/Bisonal DNS Lookup 1"

• "ET TROJAN PhantomNet/Smanager Related Domain in DNS Lookup"

• "ET MALWARE W32/iBryte.Adware Affiliate Campaign Executable Download"

• "ET MALWARE UCMore Spyware User-Agent (EI)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (wcollopracket .com)"

• "ET CURRENT_EVENTS Fake Browser Update Domain in TLS SNI (s127581-statspixel .com)"

• "ET TROJAN DonotGroup Pult Downloader Activity (POST) M2"

• "ET TROJAN ServHelper CnC Command (Net User)"

• "ET MALWARE Suspicious User-Agent (go-diva)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-06-01"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-28"

• "ET TROJAN Locky CnC checkin Nov 21 M2"

• "ET TROJAN FBot Downloader Generic GET for ARM Payload"

• "ET TROJAN Mozart Loader Command Request (getupdates)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Password Stealer - User-Agent (Ucheck)"

• "ET TROJAN Observed BLINDINGCAN Domain (www .ne-ba .org in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (a2care .us)"

• "ET TROJAN Ransomware/Cerber Checkin M3 (13)"

• "ET TROJAN [TGI] BlackRAT Checkin"

• "ET TROJAN Winter Vivern APT Aperetif Payload Retrieval Attempt M2"

• "ET TROJAN Nobelium APT Related Domain in DNS Lookup (ernesttheskoolie .com)"

• "ET TROJAN Donkeyp2p Update Detected"

• "ET TROJAN Vidar Stealer CnC Checkin"

• "ET TROJAN Banker/Banbra Variant POST via x-www-form-urlencoded"

• "ET TROJAN Parallax CnC Activity (set) M15"

• "ET TROJAN MWI Maldoc Exploit Kit Stats Callout"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Zimbra Phish 2015-10-30"

• "ET TROJAN Emotet Post Drop C2 Comms M2"

• "ET TROJAN Ransomware Win32/WinPlock.A CnC Beacon 3"

• "ET TROJAN MiniDuke Domain Observed"

• "ET TROJAN Win32.Rovnix.I Checkin"

• "ET CURRENT_EVENTS Phishing Landing via Weebly.com 2016-06-22"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious DNS Query (BazarLoader/Team9 Backdoor CnC Domain)"

• "ET CURRENT_EVENTS Volexity - JS Sniffer Data Theft Beacon Detected"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-08-23"

• "ET TROJAN Suspected Cobalt Strike Beacon User-Agent String"

• "ET TROJAN Observed Glupteba CnC Domain (mastiakele .cyou in TLS SNI)"

• "ET TROJAN Zbot POST Request to C2"

• "ET TROJAN ARM Binary Downloaded via WGET Containing GoAhead and Multiple Camera RCE 0Day Vulnerabilities"

• "ET CURRENT_EVENTS Generic Successful Phish 2022-10-11"

• "ET TROJAN FIN12 Related WEIRDLOOP/Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN Observed Malicious SSL Cert (WastedLoader CnC)"

• "ET TROJAN Win32/Remcos RAT Checkin 59"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Ermak.a Checkin"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN JS/Cloud9 Domain (download .agency) in DNS Lookup"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 10"

• "ET TROJAN XLS.Unk DDE rar Drop Attempt (.club)"

• "ET INFO Trend Micro Phishing Simulation Service"

• "ET TROJAN Observed Malicious SSL Cert (Baka Skimmer Staging CnC)"

• "ET USER_AGENTS Suspicious User-Agent (cso)"

• "ET TROJAN Ransomware/Cerber Checkin M3 (6)"

• "ET MOBILE_MALWARE DNS Trojan-Banker.AndroidOS.Marcher.i Query"

• "ET TROJAN HTTPCore CnC Task Response"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor PING Command (Inbound)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (Knotweed/SubZero)"

• "ET CURRENT_EVENTS Terror EK Payload URI T1 Jun 02 2017 M2"

• "ET TROJAN Win32/TA402 CnC User-Agent"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET TROJAN Soraya C2 User-Agent (x09)"

• "ET TROJAN Win32/Trojan.Nymeria CnC Activity (GET) M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN TorrentLocker DNS Lookup (walkingdead32.ru)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 3"

• "ET TROJAN Restylink Domain in DNS Lookup (disknxt .com)"

• "ET CURRENT_EVENTS Observed TOAD Domain (bgcare .help in TLS SNI)"

• "ET TROJAN Win32.Fareit.A/Pony Downloader Checkin (2)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .akrsnamchi .com)"

• "ET TROJAN Observed GandCrab Ransomware CnC/IP Check Domain (politiaromana .bit in DNS Lookup)"

• "ET TROJAN Win32/Snojan Variant Sending System Information (GET)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN [ANY.RUN] Socks5Systemz TCP Backconnect Client Traffic"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (definefolkeloi .pw)"

• "ET TROJAN Tonto_SPM Backdoor CnC Activity"

• "ET TROJAN Likely Linux/IptabLesX C2 Domain Lookup (GroUndHog.MapSnode.CoM)"

• "ET TROJAN Observed DNS Query to Certishell Domain (sivpici .php5 .sk)"

• "ET CURRENT_EVENTS SUSPICIOUS .CPL File Inside of Zip"

• "ET TROJAN Turkojan C&C nxt Command (nxt)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN BatLoader CnC Domain (clodtechnology .com) in DNS Lookup"

• "ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"

• "ET TROJAN W32/Citadel Download From CnC Server /files/ attachment"

• "ET TROJAN Windows sc query Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Matanbuchus CnC Domain in DNS Lookup (eonsabode .at)"

• "ET TROJAN APT34 TONEDEAF 2.0 Uploading to CnC"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (aspbin .net)"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (topgamse .com)"

• "ET TROJAN RampantKitten APT TelB Python Variant - CnC Checkin M1"

• "ET TROJAN W32/Fin4.InfoStealer Uploading User Credentials CnC Beacon"

• "ET TROJAN Win32/Nitrokod Domain (intelserviceupdate .com) in TLS SNI"

• "ET TROJAN Possible CopyKittens DNS Lookup (mswordupdate15.com)"

• "ET TROJAN Observed DNS Query to Impersoni-fake-ator (uc .ejalase .org)"

• "ET TROJAN OpcJacker HVNC Variant Magic Packet"

• "ET TROJAN Limitless Logger RAT HTTP Activity"

• "ET TROJAN LuminosityLink - Inbound Data Channel CnC Delimiter"

• "ET TROJAN Suspected Andariel RexPot CnC Checkin M1"

• "ET TROJAN Win32\Cryptbot CnC Domain (towhfs22 .top) in DNS Lookup"

• "ET CURRENT_EVENTS Successful Facebook Phish 2016-10-06"

• "ET TROJAN Gamaredon Domain in DNS Lookup (neythzi .ru)"

• "ET TROJAN MacOS/Realst CnC Checkin"

• "ET TROJAN Observed Akira Stealer Domain (akira .red) in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity CnC)"

• "ET TROJAN Win32/Valak <v9 Checkin"

• "ET TROJAN Sofacy DNS Lookup malwarecheck.info"

• "ET TROJAN DNS Query to Raspberry Robin Domain (b8x .org)"

• "ET CURRENT_EVENTS Successful Banco Galacia Credential Phish 2023-01-23"

• "ET TROJAN W32/Echmark CnC Activity M2"

• "ET TROJAN DarkHotel Downloader CnC Beacon 2"

• "ET TROJAN Backdoor.Win32/Momibot Ping Checkin"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Win32/Backdoor.Agent.qweydh CnC Activity"

• "ET CURRENT_EVENTS Possible Successful COVID-19 Related Phish M2"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN W32/Gaudox Checkin"

• "ET TROJAN XPSecurityCenter FakeAV Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Fabookie.ek CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .club in TLS SNI)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Dec 27 2016"

• "ET TROJAN Win32/MillionLoader CnC Init Activity"

• "ET TROJAN Win32/Enigma Stealer CnC Checkin"

• "ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain"

• "ET CURRENT_EVENTS PerSwaysion Phishkit Javascript Variable"

• "ET TROJAN DNS Query to Raspberry Robin Domain (7d .wf)"

• "ET CURRENT_EVENTS RIG EK Rip Sep 05 2017"

• "ET TROJAN Win32/Nitrokod CnC Domain (nitrokod .com) in DNS Lookup"

• "ET TROJAN DNS Query to TA444 Domain (docs-send .com)"

• "ET TROJAN Arid Viper APT Possible User-Agent (Skypee)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 6"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (hojimizeg .com)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (seconddoxed .space in DNS Lookup)"

• "ET TROJAN W32.Qakbot Request for Compromised FTP Sites"

• "ET TROJAN Suckfly/Nidiran Backdoor DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MALWARE Fake Adobe Update Request"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k6c .org)"

• "ET TROJAN FoggyWeb Backdoor Incoming Request (POST)"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 73"

• "ET TROJAN CROSSWALK CnC Checkin"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (jqscr .com)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .mommachic .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (tirechinecarpett .pw)"

• "ET TROJAN Observed TraderTraitor Domain (alticgo .com) in TLS SNI"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to panhardware .com"

• "ET USER_AGENTS Suspicious User-Agent (Session) - Possible Trojan-Clicker"

• "ET EXPLOIT Possible EXPLODINGCAN IIS5.0/6.0 Exploit Attempt"

• "ET TROJAN Win32.Sality User-Agent (DEBUT.TMP)"

• "ET TROJAN DNS Query to Gamaredon Domain (zaherpa .ru)"

• "ET TROJAN BAZAR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Sendinblue Credential Phish Landing Page 2022-06-28"

• "ET CURRENT_EVENTS [TW] NOTG Password URL Struct"

• "ET MALWARE W32/Amonetize.Downloader Executable Download Request"

• "ET EXPLOIT Possible Misfortune Cookie - SET"

• "ET TROJAN Symbiote CnC Domain in DNS Lookup (bancodobrasil .dev)"

• "ET MALWARE Win32/CloudScout Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET MOBILE_MALWARE Android APT-C-23 (jimmykudo .online in TLS SNI)"

• "ET MALWARE BundledInstaller PUA/PUP Downloader"

• "ET TROJAN Likely GandCrab Ransomware Domain in HTTP Host M2"

• "ET TROJAN Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M1"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M10"

• "ET TROJAN PandoraRat/Refroso.bsp Activity"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (kilimondoilgas-dubai .com) 2022-12-05"

• "ET TROJAN Instagram Like Bot (like4u) CnC Activity M1"

• "ET TROJAN Observed Magecart Skimmer Domain (googletagsmanager .website in TLS SNI)"

• "ET TROJAN Linux.DDoS Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Coinhive URL Shortener)"

• "ET TROJAN W32/DownloaderAgent.fajk Second Stage Download List Requested"

• "ET TROJAN Linux.Ngioweb Stage 1 CnC Activity Server Response (DISCONNECT)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET TROJAN Win32/RecordBreaker - Observed UA M3 (TakeMyPainBack)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M20"

• "ET TROJAN Infostealer.Jackpos Checkin 2"

• "ET CURRENT_EVENTS Successful Mailbox Shutdown Phish M3 2016-05-16"

• "ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access registerMicListener"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN EICAR File Sent With X-Powered By Kaspersky Labs 2022-11-03"

• "ET USER_AGENTS Suspicious User-Agent (AVP2006IE)"

• "ET MALWARE PUP.Win32.BoBrowser User-Agent (VersionDwl)"

• "ET TROJAN Possible Winnti DNS Lookup"

• "ET TROJAN DNS Query to UNK_BisonBooster Domain (forsports .xyz)"

• "ET TROJAN Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam"

• "ET TROJAN Backdoor.Elise CnC Beacon 2 M2"

• "ET TROJAN Qbot Payload Request (2023-03-21) M4"

• "ET CURRENT_EVENTS Possible Generic Credential Phish with Obfuscated Javascript"

• "ET TROJAN Bandit Stealer Config Inbound"

• "ET TROJAN Ransomware/Cerber Checkin M3 (16)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page from Text Scam M3 2023-05-01"

• "ET TROJAN APT CozyCar SSL Cert 3"

• "ET TROJAN Observed Gamaredon APT Related Domain (bolonna .ru in TLS SNI)"

• "ET TROJAN BB Trojan Communication Protocol detected"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN RegHelper Installation"

• "ET MALWARE Statblaster.com Spyware User-Agent (fetcher)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish M2 2023-02-22"

• "ET TROJAN AlphaCrypt CnC Beacon 6"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN Possible PurpleFox EK Redirect"

• "ET TROJAN Win32/MagicRAT Additional Payload URI M4"

• "ET TROJAN Possible Pegasus Related DNS Lookup (mz-vodacom .info)"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (docsenddata .linkpc .net)"

• "ET USER_AGENTS Suspicious User-Agent (NULL)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-02-21"

• "ET TROJAN Maldoc Retrieving Additional Resources (GET)"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 16"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN W32/Iyus.H work_troy.php CnC Request"

• "ET TROJAN Earth Berberoka Domain in DNS Lookup"

• "ET TROJAN Win32/Varenyky Spambot CnC in DNS Query"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT)"

• "ET TROJAN Plead TSCookie CnC Checkin M4"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN EarthWorm/Termite IoT Agent CnC Response"

• "ET TROJAN MacOS/UpdateAgent.A CnC Activity M2"

• "ET TROJAN Ransomware CrypMIC Payment Onion Domain"

• "ET TROJAN DNS Query for known ShadowPad CnC 10"

• "ET TROJAN EtumBot Ping"

• "ET TROJAN Win32/RedEnergy System Information Retrieval Attempt"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (support .cisco-webex .online)"

• "ET CURRENT_EVENTS Possible click2play bypass Oct 19 2015 as observed in PawnStorm"

• "ET TROJAN ProxyBox - HTTP CnC - botinfo.php"

• "ET CURRENT_EVENTS SUSPICIOUS EXE Download from Google Common Data Storage with no Referer"

• "ET TROJAN APT29 CnC Domain in DNS Lookup (toyy .zulipchat .com)"

• "ET TROJAN [PTsecurity] Adwind SSL Certificate Observed"

• "ET CURRENT_EVENTS Possible Injected JS Form Stealer Checking Page Contents M1"

• "ET TROJAN Possible Konni Encrypted Stage 2 Payload Inbound via HTTP"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (nfcomizsdseqiomzqrxwvtprxbljkpgd .name)"

• "ET TROJAN FakeAV.EGZ Checkin 2"

• "ET TROJAN Win32/Remcos RAT Checkin 63"

• "ET CURRENT_EVENTS Twitter Credential Phish Landing Page 2022-11-04"

• "ET TROJAN APT/Bitter CnC Exfiltration via TCP"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (wpops .zip)"

• "ET CURRENT_EVENTS Possible Interac Phish Aug 18 2017"

• "ET TROJAN Likely Geodo/Emotet Downloading PE"

• "ET TROJAN ELF/Mirai Variant UA Inbound (muhstik)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (uae-snoctenders .com) 2022-12-05"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN Observed Glupteba CnC Domain (mypushtimes .net in TLS SNI)"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (klayerziluska .com)"

• "ET TROJAN Win32.Fareit.A/Pony Downloader Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (stanculinaryblog .top in TLS SNI)"

• "ET INFO Possible Phishing Landing via MoonFruit.com (set)"

• "ET TROJAN Chaos Botnet CnC Domain (skyeda .vip) in DNS Lookup"

• "ET TROJAN Backdoor.Irc.MFV User Agent Detected (IRC-U)"

• "ET TROJAN Observed Raspberry Robin Domain (w0 .pm in TLS SNI)"

• "ET CURRENT_EVENTS Suspicious JS Observed in Unknown EK Landing"

• "ET MALWARE Cobalt Strike Beacon Activity (GET)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (sbmsa .wiki)"

• "ET TROJAN Andromeda Checkin"

• "ET TROJAN Win32/Spy.Agent.QAQ Variant CnC Activity"

• "ET TROJAN GoldenSpy CnC Activity"

• "ET TROJAN Observed Glupteba CnC Domain (realupdate .ru in TLS SNI)"

• "ET CURRENT_EVENTS Successful Account Update Phish 2016-09-06"

• "ET TROJAN Win32/Fosniw MacTryCnt CnC Style Checkin"

• "ET CURRENT_EVENTS PerSwaysion Phishkit Landing Page"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Suspected Kimsuky Related Activity (set)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .qq9122 .com)"

• "ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 3"

• "ET TROJAN ThirdEye Stealer CnC Checkin"

• "ET TROJAN FlashBack Mac OSX malware Checkin"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN RouteX CnC Domain (0a0074066c49886a39b5a3072582f5d6 .net) in DNS Lookup"

• "ET TROJAN linux.backdoor.wordpressexploit.1 CnC Checkin"

• "ET TROJAN ELF/muBoT IRC Activity 5"

• "ET CURRENT_EVENTS Possible Sundown EK Payload Struct T2 M1 Apr 24 2015"

• "ET TROJAN Gamaredon Domain in DNS Lookup (earsplitting .ru)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (mil-gov .space in TLS SNI)"

• "ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017"

• "ET TROJAN Mirage Campaign checkin"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (aserogeege .space in DNS Lookup)"

• "ET TROJAN Win32/Remcos RAT Checkin 55"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (apretakert .com)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Sehyioa Variant Activity (POST)"

• "ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M2"

• "ET TROJAN MegalodonHTTP CnC Checkin"

• "ET CURRENT_EVENTS Successful iCloud Phish 2015-12-02"

• "ET CURRENT_EVENTS Neutrino Exploit Kit Redirector To Landing Page"

• "ET CURRENT_EVENTS Fiesta EK Landing Apr 23 2015"

• "ET TROJAN APT29 Cache_DLL SSL Cert"

• "ET TROJAN Cobalt Strike Malleable C2 Beacon (Custom)"

• "ET TROJAN Win32/Uwamson.A!ml CnC Checkin"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (subsidiaryohio .linkpc.net)"

• "ET CURRENT_EVENTS SUSPICIOUS alg.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN Win32/Detplock Checkin via SMTP"

• "ET TROJAN Panda Banker Injects Domain (urimchi3dt4 .website in DNS Lookup)"

• "ET TROJAN Emotet v2 Exfiltrating Outlook information"

• "ET TROJAN MiniDuke CnC Beacon (string1_slide_1_1)"

• "ET TROJAN Win32/Pift Checkin 1"

• "ET TROJAN Win32/DCRat CnC Exfil"

• "ET TROJAN JS/Nemucod.M.gen requesting EXE payload 2015-10-07"

• "ET CURRENT_EVENTS Successful Microsoft Account Phish 2020-03-04"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Pyramid Framework Payload Request (base-bh.py)"

• "ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M3"

• "ET TROJAN Emotet Checkin"

• "ET TROJAN Kimsuky WildCommand CnC Activity"

• "ET CURRENT_EVENTS Successful iTunes Phish Mar 21 2014"

• "ET TROJAN Bitter APT Related Activity (GET)"

• "ET TROJAN Observed IcedID CnC Domain (nothingtodo .co in TLS SNI)"

• "ET CURRENT_EVENTS MalDoc Retrieving Payload March 30 2017"

• "ET TROJAN Tick Group Payload - Reporting Error to CnC"

• "ET TROJAN DNS query for Known OphionLocker Domain"

• "ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M1 (CVE-2022-21587)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zbs .is)"

• "ET TROJAN AutoHotkey Downloader Checkin via IPLogger"

• "ET MOBILE_MALWARE Arid Viper (calculator-1e016 .appspot .com in DNS Lookup)"

• "ET CURRENT_EVENTS HiYu - Victim Enrichment Response M2"

• "ET TROJAN FSB Snake CnC Activity Outbound via TCP (AA23-129A) M2"

• "ET TROJAN Arkei/Vidar/Mars Stealer Variant Data Exfiltration Attempt"

• "ET CURRENT_EVENTS Successful Generic Banking Phish 2022-01-11"

• "ET TROJAN APT28 Komplex DNS Lookup (appleupdate .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (max-mayfield .com in DNS Lookup)"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (udo .jxwan .com)"

• "ET MOBILE_MALWARE WireX Botnet DNS Lookup"

• "ET CURRENT_EVENTS Paypal Phishing Landing"

• "ET TROJAN NS SSL Cert APT1"

• "ET TROJAN Kaseya VSA Exploit Activity M2 (SET)"

• "ET TROJAN ZenRAT Tasking CnC Response M2"

• "ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)"

• "ET CURRENT_EVENTS Observed OneDrive Phishing Landing Page 2021-08-09"

• "ET TROJAN Trojan-Spy.Win32.KeyLogger.acuj Checkin"

• "ET TROJAN Dridex POST Retrieving Second Stage M2"

• "ET MOBILE_MALWARE Android.Trojan.Rana.A (softwareplayertop .com in DNS Lookup)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (pedaily .online)"

• "ET MOBILE_MALWARE Android APT-C-23 (marklavi .com in DNS Lookup)"

• "ET TROJAN Worm.VBS.ayr Checkin 2"

• "ET TROJAN Kimsuky Related CnC"

• "ET TROJAN Havoc Framework CnC Request"

• "ET TROJAN Observed Malicious SSL Cert (CryptoMimic Staging CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN APT33/CharmingKitten Shellcode Communicating with CnC"

• "ET TROJAN NimPlant Register Activity M2 (POST)"

• "ET TROJAN Observed Glupteba CnC Domain (zaoshang .ooo in TLS SNI)"

• "ET CURRENT_EVENTS Tech Support Scam - Windows Firewall M5 2021-08-17"

• "ET TROJAN AppleJeus - Dorusio CnC Domain in DNS Lookup (dorusio .com)"

• "ET CURRENT_EVENTS Successful Docusign Phish 2016-11-17"

• "ET TROJAN Gozi Communication 2"

• "ET TROJAN Sofacy DNS Lookup updatepc.org"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (QakBot)"

• "ET TROJAN Possible Win32/SysJoker Retrieving CnC Information (GET)"

• "ET CURRENT_EVENTS Successful Facebook Phish 2019-08-29"

• "ET TROJAN W32.Downloader Tibs.jy Reporting to C&C (2)"

• "ET CURRENT_EVENTS GitHub/CicleCI Themed Phishing Domain in DNS Lookup (emails-circleci .com)"

• "ET CURRENT_EVENTS Successful VyStar CU Credential Phish 2023-01-31"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET MOBILE_MALWARE Android APT-C-23 (maxlight .us in TLS SNI)"

• "ET MALWARE Adware.Win32/SProtector.A Client Checkin"

• "ET TROJAN Observed DNS Query to TA444 Domain (docs .azurehosting .co)"

• "ET CURRENT_EVENTS Possible Tsukuba Banker Edwards Packed proxy.pac"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN [ANY.RUN] Meduza Stealer Exfiltration M1"

• "ET TROJAN MSIL/Agent.ATS CnC Activity"

• "ET TROJAN InfoBot Sending LAN Details"

• "ET CURRENT_EVENTS Successful Docusign Phish 2015-10-28"

• "ET TROJAN SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Activity (Download)"

• "ET MOBILE_MALWARE Android APT-C-23 (karenwheeler .club in TLS SNI)"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer CnC Request"

• "ET TROJAN Win32/NitroStealer/exoStub CnC Exfil"

• "ET TROJAN Gimmiv Infection Ping Outbound"

• "ET TROJAN Win32/Delf.TJJ CnC Checkin M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (www .58sky .com)"

• "ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Mambo Scanning Message"

• "ET MALWARE Dropspam.com Spyware Reporting"

• "ET CURRENT_EVENTS Successful Bank of Oklahoma Phish M1 Jul 21 2016"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Pigeon.AYX/AVKill Related User-Agent (CTTBasic)"

• "ET TROJAN Suspected ExtraPulsar Backdoor"

• "ET TROJAN Possible CopyKittens DNS Lookup (cacheupdate14.com)"

• "ET MALWARE W32/LoudMo.Adware Checkin"

• "ET TROJAN Sefnit Checkin"

• "ET TROJAN Win32/Kryptik.HNBU CryptoMiner - Report Request"

• "ET TROJAN Backdoor.Win32.PcClient.bal CnC (OUTBOUND)"

• "ET TROJAN TA410 APT FlowCloud Dependency Download M4"

• "ET TROJAN NuggetPhantom Module Download Request"

• "ET TROJAN OSX/Mughthesec/SafeFinder/OperatorMac Rogue Search Engine DNS Query Observed"

• "ET TROJAN BlackCat Ransomware Related Domain in DNS Lookup (updatedaemon .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN GoldenSpy CnC Activity"

• "ET TROJAN Suspected SandCat Related Communication (POST)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (easyshow .fun in TLS SNI)"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (overingtonray .info)"

• "ET TROJAN TrojanDownloader:Win32/Sinresby.B Checkin"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (ccdata.txt) M1"

• "ET TROJAN Observed GoBotKR Domain in TLS SNI"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (l5k .xyz)"

• "ET MALWARE DealPly Adware CnC Beacon"

• "ET TROJAN oRAT Related CnC Domain in DNS Lookup"

• "ET TROJAN Vawtrak/NeverQuest Server Response"

• "ET TROJAN Scarlet Mimic DNS Lookup 47"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .deck .linkpc .net)"

• "ET TROJAN SSV Agent CnC Activity"

• "ET TROJAN Possible Winnti-related Destination (google-searching .com)"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"

• "ET TROJAN MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (gnavigatio .com)"

• "ET TROJAN Operation EvilTraffic Initial Redirect M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 4"

• "ET TROJAN DNS Query to Raspberry Robin Domain (kj1 .xyz)"

• "ET TROJAN Project Plague CnC Activity"

• "ET CURRENT_EVENTS Successful Apple Phish M1 2016-02-23"

• "ET TROJAN r0 CnC Architecture GET 1"

• "ET TROJAN Backdoor.Win32.Aldibot.A Checkin"

• "ET WEB_SERVER WebShell - GODSPy - Auth Creds"

• "ET TROJAN Observed Lunar Builder Domain (lunarbuilder .000webhostapp .com in TLS SNI)"

• "ET TROJAN Zlob Updating via HTTP"

• "ET TROJAN Sidewinder APT Related Malware Activity M2 (GET)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page using submit-form .com"

• "ET TROJAN APT32 Komprogo DNS Lookup"

• "ET MALWARE Observed PUA SSL/TLS Certificate (HoneyGain)"

• "ET CURRENT_EVENTS Successful Amazon Account Phish M3 2015-08-21"

• "ET TROJAN Unknown Trojan with Fake Java User-Agent"

• "ET TROJAN Possible Pegasus Related DNS Lookup (redcrossworld .com)"

• "ET TROJAN Pyramid Framework Payload Request (base-clr.py)"

• "ET CURRENT_EVENTS Bank of America Phishing Landing 2018-01-18 M1"

• "ET CURRENT_EVENTS Successful Banco do Brasil Phish M3 Sep 29 2017"

• "ET TROJAN Win32/Termite Agent Implant CnC Checkin"

• "ET TROJAN Steam Steal0r"

• "ET MALWARE Win32/Trojan.Nymeria CnC Activity (GET) M7"

• "ET TROJAN Win32/Spark Backdoor Related Domain in DNS Lookup (bundanesia .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (eastrenclouds .com)"

• "ET TROJAN Powershell/PowHeartBeat CnC Checkin - ICMP"

• "ET TROJAN Gamaredon Domain in DNS Lookup (hanotip .ru)"

• "ET WEB_CLIENT Possible Magecart Credit Card Information JS Script"

• "ET MOBILE_MALWARE Android APT-C-23 (bob-turco .website in TLS SNI)"

• "ET CURRENT_EVENTS Tech Support Scam - Windows Firewall M4 2021-08-17"

• "ET CURRENT_EVENTS Successful Telstra Credential Phish 2022-08-29"

• "ET TROJAN Win32/Zemot Fake Search Page"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (docshared .col-link .linkpc .net)"

• "ET MALWARE ToolbarPartner Spyware Agent Download (1)"

• "ET TROJAN Observed JS/Magecart Domain in TLS SNI (manag .icu)"

• "ET TROJAN Miniduke variant FTP upload"

• "ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 2"

• "ET MOBILE_MALWARE Arid Viper (anna-sanchez .online in DNS Lookup)"

• "ET TROJAN Observed Buran Ransomware UA (GHOST)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (ua-passport .space)"

• "ET CURRENT_EVENTS Successful RBC Royal Bank Phish Jan 30 2017"

• "ET TROJAN JSSLoader Initial Checkin"

• "ET TROJAN Sidecopy APT Related CnC Domain in DNS Lookup (afghannewsnetwork .com)"

• "ET TROJAN Supercharge Component Download (ps1)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 56"

• "ET TROJAN Win32/DoNot Observed UA (Mozilla 105.01.05)"

• "ET TROJAN APT32/OceanLotus CnC Domain in DNS Lookup (mykessef .com)"

• "ET CURRENT_EVENTS Successful Tesco Phish (set) M3 Jul 18 2017"

• "ET MALWARE Bypass Ticket Monitoring Activity (POST)"

• "ET TROJAN Hangover Campaign Keylogger Checkin"

• "ET TROJAN Suspected MuddyWater Related CnC Activity"

• "ET TROJAN Potential GCleaner CnC Checkin"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (patrios .ru)"

• "ET USER_AGENTS Suspicious User-Agent (WebForm 1)"

• "ET CURRENT_EVENTS Successful FreeMobile (FR) Phish M1 2016-10-31"

• "ET CURRENT_EVENTS Terror EK Landing M1 Feb 07 2016 M2"

• "ET TROJAN Earth Berberoka CnC Domain in DNS Lookup (flash .wy886066 .com)"

• "ET TROJAN Red October/Win32.Digitalia Checkin cgi-bin/win/cab"

• "ET CURRENT_EVENTS DRIVEBY [PwC CTD] -- MultiGroup - ScanBox and Targetted Watering Holes ActiveX Call"

• "ET TROJAN MiniDuke CnC Beacon (string2_slide_1_2)"

• "ET CURRENT_EVENTS Assurance Maladie Phishing Landing"

• "ET TROJAN Win32.Small.qh/xSock User-Agent Detected"

• "ET TROJAN Possible Win32/DarkWatchMan User Agent M2"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (beepkauftagers .com)"

• "ET TROJAN ATTACKER IRCBot - net add PRIVMSG Command"

• "ET CURRENT_EVENTS Suspicious Script Loaded from Pastebin"

• "ET TROJAN User-Agent in Referer Field - Likely Malware"

• "ET TROJAN Arbitrium-RAT Observed User-Agent (JustKidding)"

• "ET TROJAN HCRootkit CnC Domain in DNS Lookup (ruciplbrxwjscyhtapvlfskoqqgnxevw .name)"

• "ET TROJAN Possible CopyKittens DNS Lookup (kernel4windows.in)"

• "ET TROJAN Socks666 Connection Initial Packet"

• "ET CURRENT_EVENTS Successful Google Docs Phish 2016-09-28"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-10-16"

• "ET TROJAN Observed Teal Kurma Domain (aws .systemctl .network in TLS SNI)"

• "ET CURRENT_EVENTS Terror EK Payload URI T1 Jun 02 2017"

• "ET CURRENT_EVENTS Successful Generic Webmail Phish M1 2016-11-18"

• "ET TROJAN Linux/Tsunami DNS Request (linuxmint.kernel-org.org)"

• "ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 3"

• "ET TROJAN Playtech Downloader Online Gaming Checkin"

• "ET TROJAN FIN8 ShellTea CnC in DNS Lookup"

• "ET TROJAN CommentCrew Possible APT c2 communications get system"

• "ET TROJAN ShadowHammer DNS Lookup"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (bitscrunch .co)"

• "ET CURRENT_EVENTS Anonisma Phishing Landing 2015-12-01"

• "ET TROJAN BPFDoor V2 TCP Magic Packet Inbound"

• "ET CURRENT_EVENTS Successful Bank of America Phish M2 2015-10-02"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (antohub .shop)"

• "ET TROJAN [401TRG] PS/PowDesk Checkin (APT34)"

• "ET TROJAN Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN [ANY.RUN] Lu0bot-Style DNS Query in DNS Lookup M4"

• "ET MALWARE LNKR Request for LNKR js file M2"

• "ET TROJAN DangerousPassword APT Style Request (GET)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (bitscrunch .co)"

• "ET CURRENT_EVENTS Obfuscated Chase Phishing Landing 2016-03-23"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server]"

• "ET TROJAN Suspected CHAOS CnC Inbound (download command)"

• "ET CURRENT_EVENTS Successful Excel Online Phish 2016-10-05"

• "ET MALWARE Suspected Adware/AccessMembre Domain in DNS Lookup (iconm1 .com)"

• "ET CURRENT_EVENTS Possible Evil Redirector Leading to EK Nov 09 2015 M2"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET TROJAN Desert Falcon APT DNS Lookup (androcity.com)"

• "ET TROJAN Observed CobaltStrike CnC Domain (charity-wallet .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful Facebook Phish 2019-08-29"

• "ET TROJAN APT SuperhardCorp DNS Lookup (specs.dnsrd.com)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M3"

• "ET TROJAN Arid Viper APT Advtravel Campaign DNS Lookup (advtravel.info)"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (neurotonix--buy .us)"

• "ET TROJAN Sednit Connectivity Check 0 Byte POST"

• "ET CURRENT_EVENTS Successful Bank of America Phish M2 2016-10-10"

• "ET CURRENT_EVENTS GitHub/CicleCI Themed Phishing Domain in DNS Lookup (circle-ci .com)"

• "ET CURRENT_EVENTS Successful LCL Banque et Assurance (FR) Phish 2016-10-22"

• "ET TROJAN Possible Pegasus Related DNS Lookup (track-your-fedex-package .org)"

• "ET TROJAN Vawtrak/NeverQuest Posting Data"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 69"

• "ET TROJAN Qbot Payload Request (2023-03-13) M3"

• "ET CURRENT_EVENTS Successful Credential Phish M2 2022-09-23"

• "ET TROJAN Win32/Zemot Checkin"

• "ET TROJAN Win32/Common RAT CnC Activity (GET)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN Xwo CnC Activity"

• "ET MOBILE_MALWARE Android/FakeKakao checkin 2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0p .rs)"

• "ET TROJAN Downloader.Win32.Banload Reporting"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (jersydok .com)"

• "ET CURRENT_EVENTS Terror EK Landing M1 Feb 07 2016 M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j2 .gy)"

• "ET TROJAN Sakula/Mivast RAT CnC Beacon 1"

• "ET TROJAN Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message"

• "ET CURRENT_EVENTS Adobe Shared Document Phishing Landing 2016-08-19"

• "ET CURRENT_EVENTS Possible Generic Phishing Landing Jul 28 2015"

• "ET TROJAN APT28 DealersChoice DNS Lookup (gtranm .com)"

• "ET CURRENT_EVENTS Sidewinder Credential Phish Landing Page M2 2023-02-16"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M2"

• "ET TROJAN Win32/TrojanProxy.JpiProx.B CnC Beacon 2"

• "ET TROJAN Kimsuky KGH Malware Suite Checkin M1"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (imbriumbi .ru)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Agent.ld CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Observed Phishing Domain in DNS Lookup (microsoftonlinesupport .cf)"

• "ET TROJAN CN Based APT Related Domain in DNS Lookup (news .wooordhunts .com)"

• "ET TROJAN Cloud Atlas CnC Beacon"

• "ET TROJAN Perfect Keylogger Install Email Report"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 Dec 8 2015"

• "ET TROJAN Observed DNS Query for MageCart Data Exfil Domain"

• "ET TROJAN Zberp/ZeusVM receiving config via image file (steganography) 2"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Cobalt Strike Beacon Activity (Wordpress Profile)"

• "ET CURRENT_EVENTS XHR POST Request - Possible Form Grabber Activity"

• "ET WEB_CLIENT Android Fake AV Download Landing Mar 06 2017"

• "ET MOBILE_MALWARE Android APT-C-23 (dardash .live in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Brontok User-Agent Detected (Brontok.A3 Browser)"

• "ET TROJAN FIN12 Related WHITEDAGGER/Cobalt Strike Beacon Activity (GET)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (dailytickyclock .org)"

• "ET TROJAN DonotGroup CnC Domain in DNS Lookup"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (truecrypte .org)"

• "ET TROJAN Possible CopyKittens DNS Lookup (mswordupdate17.com)"

• "ET TROJAN Pupy DNS Request with SPI M2"

• "ET TROJAN Powershell Octopus Backdoor Activity (GET)"

• "ET TROJAN HermeticWizard - WMI Spreader - Remote Process Creation M2"

• "ET TROJAN CoreDDRAT Screenshot Exfil"

• "ET MALWARE Adaware.BarACE Checkin and Update"

• "ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to solartrackingsystem .net"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 81"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (g2care .us)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN TinyLoader.B1 Sending Processes"

• "ET TROJAN Banload CnC Activity"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(sendFile)"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (jourrapid .com)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (firestansinbox .com)"

• "ET TROJAN ABUSE.CH TorrenLocker Payment Domain Detected"

• "ET TROJAN Win32/Gatak Activity"

• "ET TROJAN Observed DNS Query to TA444 Domain (stablehouses .info)"

• "ET CURRENT_EVENTS Suspicious HTTP Refresh to SMS Aug 16 2016"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Suspected Kimsuky Activity (POST)"

• "ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain"

• "ET MOBILE_MALWARE Android APT-C-23 (namybotter .info in TLS SNI)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET MOBILE_MALWARE Android APT-C-23 (maria-bouchard .website in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (p9 .tel)"

• "ET TROJAN Observed TA444 Domain (docs .azurehosting .co in TLS SNI)"

• "ET TROJAN Playful Taurus Malicious SSL Certificate Observed"

• "ET TROJAN APT28/Sednit DNS Lookup (cloudflarecdn .com)"

• "ET CURRENT_EVENTS Client Cloaking Javascript Observed"

• "ET TROJAN Observed DNS Query to Comm100 Trojan Domain (amazonawsreplay .com)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Possible Router EK Landing Page Inbound 2019-05-24"

• "ET TROJAN Common Downloader Install Count Tracking URL"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 2"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to digitalcollege .org"

• "ET TROJAN DNS Query to Raspberry Robin Domain (i0 .wf)"

• "ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-16"

• "ET TROJAN Gamaredon Maldoc Activity (GET)"

• "ET CURRENT_EVENTS Successful Hotmail Phish 2016-09-29"

• "ET TROJAN Observed BlackGuard_v2 Domain in DNS Lookup (greenblguard .shop)"

• "ET TROJAN Win32/Autophyte.F C2 Domain (www .apshenyihl .com in TLS SNI)"

• "ET TROJAN Phoenix Exploit Kit VBscript download"

• "ET TROJAN Win32/NetDooka Framework RAT Sending File"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc Login Attempt"

• "ET TROJAN Dridex/Bugat/Feodo POST Checkin"

• "ET MALWARE AllaKore CnC Activity"

• "ET TROJAN APT29 Implant8 - Evil Twitter Callback"

• "ET USER_AGENTS MacShield User-Agent Likely Malware"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2018-01-02"

• "ET TROJAN OSX/OceanLotus.D Sending Data to CnC"

• "ET CURRENT_EVENTS Cloned Website Phishing Landing - Mirrored Website Comment Observed"

• "ET TROJAN Observed Malicious SSL Cert (OSX/Nukesped CnC)"

• "ET TROJAN NanoCore RAT CnC 27"

• "ET TROJAN Likely FakeAV/Fakeinit/FraudLoad Checkin"

• "ET CURRENT_EVENTS Successful BECU Phish 2022-09-08"

• "ET TROJAN FIN8 ShellTea CnC in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN ELF/Win32 Lucky Ransomware CnC Checkin"

• "ET TROJAN Possible Sharik/Smoke Loader 7zip Connectivity Check"

• "ET TROJAN Group 21 Payload CnC Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Lazarus Downloader (JEUSD) CnC Beacon"

• "ET TROJAN XDUpload Uploading Directory Listting"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN DNS Query for TA401 Controlled Domain (cryptoanalyzetech .com)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.e CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS HTTP POST Contains Only Password (ml) 2021-04-05"

• "ET CURRENT_EVENTS Successful Google Credential Phish 2016-02-17"

• "ET CURRENT_EVENTS [TW] NOTG Check Expirations URL Struct"

• "ET TROJAN Observed Cobalt Strike User-Agent"

• "ET TROJAN Kimsuky Maldoc Activity (GET)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (acaenaso .ru)"

• "ET CURRENT_EVENTS Successful NatWest Bank Phish 2015-11-03"

• "ET TROJAN Fodcha Bot CnC Client Heartbeat"

• "ET USER_AGENTS User-Agent (single dash)"

• "ET TROJAN Backdoor.Elise Style IP Check M2"

• "ET TROJAN WhiteSnake Stealer Telegram Checkin"

• "ET CURRENT_EVENTS Observed Malicious SSL/TLS Certificate (PayPal Phish Landing)"

• "ET WEB_SERVER Observed FxCodeShell Web Shell Password"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (group .evalaskatours .com)"

• "ET CURRENT_EVENTS Observed TOAD Domain (n2care .us in TLS SNI)"

• "ET TROJAN TA453 Related Domain in DNS Lookup (litby .us)"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 3"

• "ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound"

• "ET TROJAN PowerShell/PowHeartBeat CnC Domain (airplane .travel-commercials .agency) in DNS Lookup"

• "ET TROJAN TraderTraitor AlticGO CnC Checkin (POST)"

• "ET TROJAN Observed TA444 Domain (careersbankofamerica .us in TLS SNI)"

• "ET TROJAN Diavol Communicating with CnC - Ext Request"

• "ET TROJAN Win32/NetDooka Framework Related Activity (POST)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN W2KM_BARTALEX Downloading Payload M2 (set)"

• "ET TROJAN Dark Halo/SUNBURST CnC Domain (solartrackingsystem .net in TLS SNI)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (.ruzipo .ru)"

• "ET TROJAN Trojan.Win32.Yakes.pwo Checkin"

• "ET TROJAN MSIL/Filecoder.EK CnC Checkin"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish M1 2016-12-02"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (online-processing .online)"

• "ET TROJAN TA453 Related Domain in DNS Lookup (mailer-daemon .online)"

• "ET CURRENT_EVENTS Successful Google Docs Phish 2015-12-09"

• "ET TROJAN Win32/WarHawk Activity (filemgr)"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab1145b758c30 .com) Sep 2017"

• "ET MALWARE Win32/Mando Activity (GET)"

• "ET TROJAN Observed DNS Query to IcedID Domain (dogotungtam .com)"

• "ET TROJAN Sarwent CnC Response (download_exec)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (toursolutions4u .com) 2022-12-05"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET TROJAN Malicious Doc CnC Domain (e-demarches .kodeo .ch) in DNS Lookup"

• "ET TROJAN Winter Vivern APT Aperetif CnC Checkin"

• "ET TROJAN Linux/Moose NAT Traversal CnC Beacon - Multiple Tunnel"

• "ET TROJAN Skeleton Key Filename in SMB2 Traffic"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (hpschooluae .com) 2022-12-05"

• "ET USER_AGENTS Suspicious User-Agent (VMozilla)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (asrararabiya .co)"

• "ET TROJAN Possible IoT_reaper ELF Binary Request M3 (set)"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2015-09-22"

• "ET CURRENT_EVENTS Unknown EK Fake Microsoft Security Update Applet Sep 16 2013"

• "ET MOBILE_MALWARE Android/Kemoge Checkin 2"

• "ET TROJAN Win32/Filecoder.OJC CnC Checkin"

• "ET MOBILE_MALWARE Android.Tonclank JAR File Download"

• "ET TROJAN Win32/S1deload Stealer Data Exfiltration Attempt M1"

• "ET TROJAN Punto Loader Checkin"

• "ET TROJAN Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil"

• "ET TROJAN Win32/TrojanDownloader.Agent.GEM Maldoc Remote Template Request M2"

• "ET CURRENT_EVENTS Successful Colleagues Quarantined with COVID-19 Phish 2020-03-25"

• "ET TROJAN Observed PyPI Malicious Library Payload Delivery Domain (h4ck .cfd in TLS SNI)"

• "ET TROJAN Skeleton Key Filename in SMB Traffic (ASCII)"

• "ET TROJAN Win32/RecordBreaker Checkin M2"

• "ET TROJAN APT28/Sednit DNS Lookup (dataclen .org)"

• "ET TROJAN Desert Falcon Related APT DNS Lookup (nauss-lab.com)"

• "ET TROJAN Observed DNS Query to TA455 Domain (linkedinz .me)"

• "ET TROJAN Observed DNS Query to ROMCOM RAT Domain (combinedresidency .org)"

• "ET MALWARE Drpcclean.com Related Spyware User-Agent (DrPCClean Transmit)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (walidacja-poczty .space in TLS SNI)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (fuvataren .com)"

• "ET CURRENT_EVENTS DRIVEBY Redirection - Injection - Modified Edwards Packer Script"

• "ET TROJAN DNS Query to Raspberry Robin Domain (66j .me)"

• "ET TROJAN BabyShark CnC Domain in SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to TA444 Domain (companydeck .online)"

• "ET EXPLOIT Metasploit Plugin-Detect Posting Data 4"

• "ET CURRENT_EVENTS Socios Credential Phish Landing Page 2022-12-22"

• "ET MALWARE Megaupload Spyware User-Agent (Megaupload)"

• "ET TROJAN ZenRAT Update Command"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Win32/MereTam.A Ransomware CnC Init Activity"

• "ET TROJAN DNS Query to Teal Kurma Domain (querryfiles .com)"

• "ET CURRENT_EVENTS Tycoon Landing Page"

• "ET TROJAN Subterranean Crimson Rat - GetInfo Command"

• "ET TROJAN OSX/Proton.C/D Domain (handbrakestore .com in TLS SNI)"

• "ET TROJAN Win32/Asmodeasmo Bot CnC Checkin"

• "ET TROJAN Win32/Agniane Stealer CnC Activity (GET) M1"

• "ET TROJAN Maldoc Second Stage VBS Downloader with URL Padding"

• "ET TROJAN Fullz House Credit Card Skimmer JavaScript Inbound"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (globalhospae .com) 2022-12-05"

• "ET TROJAN TA430/Andariel APT BottomLoader Activity (GET)"

• "ET TROJAN VBS/TrojanDownloader.Agent.XAO Payload Inbound"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1q0hcvl2p88zdv4dj97mfwtwv4usxm .com in TLS SNI)"

• "ET TROJAN KeyBase Keylogger Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Email Termination Phishing Landing 2016-06-22"

• "ET CURRENT_EVENTS Probable Sakura exploit kit landing page obfuscated applet tag Mar 1 2013"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET TROJAN ALFA TEaM Shell Landing Page"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (meetingverse .app)"

• "ET EXPLOIT Possible ETERNALBLUE Probe MS17-010 (Generic Flags)"

• "ET TROJAN Win32/Autophyte.F C2 Domain (www .ap8898 .com in TLS SNI)"

• "ET CURRENT_EVENTS Santander Phishing Landing"

• "ET TROJAN Scarab APT - HeaderTip CnC Domain in DNS Lookup (ebook .port25 .biz)"

• "ET TROJAN Win32/VB.NBI CnC Checkin"

• "ET MALWARE LNKR landing page (possible compromised site) M2"

• "ET TROJAN APT28/Sednit DNS Lookup (advpdxapi .com)"

• "ET TROJAN Observed Suspected TA453 Related Domain (metasupportmail .com in TLS SNI)"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 5.0)"

• "ET TROJAN Win32/Qbot/Quakbot Downloader - Requesting Secondary Download"

• "ET TROJAN Cobalt Strike Stager Time Check M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bgcare .live)"

• "ET TROJAN Sarwent CnC Response (powershell_exec)"

• "ET TROJAN Spora Ransomware DNS Query"

• "ET TROJAN Malicious XLS DDE rar Drop Fake 404 Response"

• "ET TROJAN Android/AhMyth RAT Init Checkin"

• "ET TROJAN Observed Cobalt Strike Domain (zuyonijobo .com) in TLS SNI"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET MALWARE Win32/DownloadAssistant.G Variant Error Report"

• "ET MOBILE_MALWARE Android APT-C-23 (jack-wagner .website in DNS Lookup)"

• "ET TROJAN Observed Lazarus Domain (market .contradecapital .com in TLS SNI)"

• "ET CURRENT_EVENTS Internet Explorer Information Disclosure Vuln as Observed in RIG EK Prefilter M1 Dec 06"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Banker.anv Generally Suspicious User-Agent (CustomExchangeBrowser)"

• "ET TROJAN Linux/Ssemgrvd sshd Backdoor HTTP CNC 1"

• "ET TROJAN VBS/TrojanDownloader.Agent.SEB Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0j .re)"

• "ET MOBILE_MALWARE Android/Opfake.A GetTask CnC Beacon"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Observed Malicious SSL Cert (TA577)"

• "ET TROJAN Backoff POS Checkin"

• "ET TROJAN Win32/NetDooka Framework RAT Sending System Information M1"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET TROJAN Observed DNS Query to LIGHTSHOW Domain (leadsblue .com)"

• "ET WEB_SERVER WebShell - GODSpy - MySQL"

• "ET MALWARE PUP Optimizer Pro Adware Download"

• "ET TROJAN Possible CopyKitten DNS Lookup (ssl-gstatic .online)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M19"

• "ET CURRENT_EVENTS Successful RBC Royal Bank Phish Mar 27 2017"

• "ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Request for lk3_settings.bin Backup File"

• "ET TROJAN DCRat Related CnC Domain in DNS Lookup"

• "ET TROJAN W32/Citadel Content.php CnC POST"

• "ET TROJAN CryptoLocker .onion Proxy Domain (iezqmd4s2fflmh7n)"

• "ET TROJAN Snatch Ransomware Checkin (POST)"

• "ET TROJAN APT Operation Sidecopy lnk Activity (GET)"

• "ET TROJAN Stellar Stealer Data Exfiltration Attempt M1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Google Docs Phish M1 2016-10-19"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (FIN8 Staging CnC)"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2022-08-22"

• "ET MOBILE_MALWARE Android APT-C-23 (david-mclean .club in DNS Lookup)"

• "ET TROJAN Backdoor.Elise Style IP Check"

• "ET MOBILE_MALWARE Android APT-C-23 (ososezo .site in TLS SNI)"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (ProcessInfo_Log.txt) M2"

• "ET CURRENT_EVENTS Successful Facebook Phish 2018-01-26"

• "ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)"

• "ET TROJAN DangerousPassword APT Related Domain in DNS Lookup"

• "ET TROJAN APT32 Win32/Ratsnif POSTing Log Message to CnC"

• "ET TROJAN Win32/Phorpiex Template 3 Active - Outbound Malicious Email Spam"

• "ET TROJAN Observed DNS Query to TA444 Domain (azure-protect .online)"

• "ET TROJAN W32/InstallMonster.Downloader Checkin"

• "ET CURRENT_EVENTS Amazon Phishing Landing 2020-10-13"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET TROJAN MSIL/Agent.TRM Data Exfil (sysinfo)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN 9002 RAT C&C DNS request"

• "ET TROJAN APT28/Sednit DNS Lookup (thediplomat-press .com)"

• "ET TROJAN TA444 Domain in TLS SNI (www .bitscrunch .co)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (kgscrew .com)"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M7"

• "ET TROJAN jFect HTTP CnC Checkin"

• "ET TROJAN Likely CryptoWall .onion Proxy DNS lookup"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET TROJAN Ransomware.Hidden-Tear Variant CnC Checkin"

• "ET TROJAN Cobalt Strike Malleable C2 OCSP Profile"

• "ET TROJAN Win32/TrojanDownloader.Delf.BXC CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (clank .hazari .ru)"

• "ET TROJAN indux.php check-in"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 38"

• "ET TROJAN Possible ShadowHammer DNS Lookup"

• "ET TROJAN JS/WSF Downloader Dec 08 2016 M3"

• "ET TROJAN Sinowal/sinonet/mebroot/Torpig infected host checkin"

• "ET TROJAN Win32/Rovnix.J Checkin 2"

• "ET TROJAN Infostealer.Bancos Checkin via SMTP"

• "ET MOBILE_MALWARE Android APT-C-23 (james-charles .club in TLS SNI)"

• "ET MOBILE_MALWARE Android/Spy.Bahamut.I CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phishing 2016-01-08"

• "ET TROJAN Win32/Spectre Ransomware CnC Checkin"

• "ET TROJAN Win32/Remcos RAT Checkin 67"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN Ekipa RAT Domain in DNS Lookup (nch-software .info)"

• "ET TROJAN Alphacrypt/TeslaCrypt Ransomware CnC Beacon Response"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (internal .bounceme .net)"

• "ET TROJAN Scarlet Mimic DNS Lookup 44"

• "ET TROJAN Moist Stealer CnC Exfil"

• "ET TROJAN Backdoor.Win32.Agent.myttae User-Agent"

• "ET TROJAN FastPOS Initial Checkin"

• "ET TROJAN Win32.Lager Trojan Reporting"

• "ET TROJAN Win32/Arid Gopher CnC Exfil (POST)"

• "ET TROJAN ZuoRAT Windows Loader Shellcode Retrieval"

• "ET TROJAN LuckyCat/TROJ_WIMMIE Checkin"

• "ET CURRENT_EVENTS Silicon Valley Bank Phish Domain in DNS Lookup (cash4svb .com)"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (smartsftp .pw)"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M2 2015-11-21"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hshelp .us)"

• "ET MALWARE WinSoftware.com Spyware User-Agent (WinSoftware)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 67"

• "ET MALWARE RelevantKnowledge Adware CnC Beacon"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET TROJAN Ransomware/Cerber Checkin M3 (14)"

• "ET CURRENT_EVENTS Apple Phishing Landing M1 Sep 14 2017"

• "ET MALWARE Win32/VoipRaider Data Collection Attempt"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (klonpiparf .com)"

• "ET TROJAN Observed Gamaredon APT Related Domain (mojavebo .ru in TLS SNI)"

• "ET TROJAN EvilNum APT Related Domain in DNS Lookup (bookaustriavisit .com)"

• "ET CURRENT_EVENTS DRIVEBY SPL - Landing Page Received"

• "ET TROJAN XCodeGhost DNS Lookup"

• "ET TROJAN Win32/Stealc Requesting plugins Config from C2"

• "ET TROJAN f0xy Checkin"

• "ET TROJAN BatLoader CnC Domain (24xpixeladvertising .com) in DNS Lookup"

• "ET CURRENT_EVENTS Likely Evil Macro EXE DL mar 15 2016"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Libyan Scorpions Adwind DNS Lookup (sara2011 .no-ip.biz)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hscare .online)"

• "ET TROJAN Win32/Neurevt.A/Betabot checkin"

• "ET CURRENT_EVENTS CoolEK - Landing Page - FlashExploit"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET CURRENT_EVENTS Successful ING Group Phish 2022-06-24"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-10-28"

• "ET TROJAN APT28/Sednit DNS Lookup (bbc-press .org)"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (srvrfontsdrive .xyz)"

• "ET TROJAN APT28 CnC Domain DNS Lookup"

• "ET TROJAN Redline Stealer/MetaStealer Family TCP CnC Activity - MSValue (Response)"

• "ET CURRENT_EVENTS Successful HBL Bank Phish M2 2016-10-12"

• "ET TROJAN Observed Gamaredon APT Related Domain (macda .ru in TLS SNI)"

• "ET TROJAN Win32.Zbot.ivgw Downloading EXE"

• "ET TROJAN APT CozyCar SSL Cert 5"

• "ET TROJAN Win32/LeftHook Stealer Browser Extension Config Inbound"

• "ET TROJAN APT32 Komprogo DNS Lookup"

• "ET TROJAN MSIL/Modi RAT CnC Command Inbound (aw)"

• "ET TROJAN Possible CopyKitten DNS Lookup (nameserver .win)"

• "ET TROJAN BPFDoor V2 SCTP Magic Packet Inbound"

• "ET MALWARE Visicom Spyware User-Agent (Visicom)"

• "ET TROJAN KimJongRAT cnc exe pull"

• "ET TROJAN Observed Malicious SSL Cert (TA577)"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 6"

• "ET TROJAN Potential FakeAV HTTP GET Check-IN (/check)"

• "ET TROJAN Zberp receiving config via image file - SET"

• "ET TROJAN Hacking Team Scout Windows Implant Exfiltration"

• "ET TROJAN Suspected REDCURL CnC Activity M2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (fablane .com)"

• "ET CURRENT_EVENTS Successful Paypal Phish M4 2016-12-13"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET CURRENT_EVENTS Keitaro Set-Cookie Inbound to RogueRaticate (17923)"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ProjectSauron Remsec DNS Lookup (asrgd-uz .weedns.com)"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET TROJAN Nitlove POS CnC"

• "ET TROJAN RShell Backdoor Keepalive"

• "ET TROJAN SEASALT Client Checkin"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET TROJAN Win32/Gamaredon CnC Activity (POST) M4"

• "ET TROJAN Teerac/CryptoFortress .onion Proxy Domain (3v6e2oe5y5ruimpe)"

• "ET TROJAN Banload Downloader Infection - Sending initial email to owner"

• "ET MALWARE SurfSidekick Download"

• "ET TROJAN DNS query for known Anunak APT Domain (financialnewsonline.pw)"

• "ET CURRENT_EVENTS Observed DNS Query to Phishing Domain (hombreymaquina .com)"

• "ET TROJAN TorrentLocker DNS Lookup (updatemyhost.ru)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (aiischools .com) 2022-12-05"

• "ET TROJAN Win32/Wacapew CnC Checkin"

• "ET MALWARE Win32/Systweak Checkin M2"

• "ET TROJAN Win32/NewsRat CnC Response"

• "ET TROJAN MSIL/Agent.TRM Task Command"

• "ET CURRENT_EVENTS Successful Linkedin Phish 2016-11-17"

• "ET TROJAN ELF/Emptiness v2 XOR DNS Flood Command Inbound"

• "ET TROJAN Possible Generic RAT over Telegram API"

• "ET TROJAN Win32/Chinad Checkin"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Exfil)"

• "ET WEB_CLIENT Microsoft Tech Support Phone Scam M3 Jul 07 2017"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TrickBot CnC)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN CobaltStrike SMB P2P Default Msagent Named Pipe Interaction"

• "ET TROJAN TA444 Domain in DNS Lookup (video-meet .team)"

• "ET TROJAN PhantomNet/Smanager CnC Domain in DNS Lookup (vgca.homeunix .org)"

• "ET TROJAN DNS Query to Fake Chrome Landing Page (chromiumtxt .space)"

• "ET CURRENT_EVENTS Successful Chase Phishing 2016-12-12"

• "ET TROJAN Observed 3CX Supply Chain Attack User-Agent"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (cinaprofilm .com)"

• "ET TROJAN Win32/Urausy.C response"

• "ET TROJAN Observed DNS Query to Certishell Domain (ms .rousinov .cz)"

• "ET TROJAN Observed DNS Query to Fodcha Bot Domain"

• "ET CURRENT_EVENTS Observed DNS Query to Phishing Domain (igconsulting. pe)"

• "ET TROJAN Interactsh Control Panel (DNS)"

• "ET TROJAN Vundo User-Agent Check-in"

• "ET CURRENT_EVENTS RIG EK Rip Sep 05 2017 M2"

• "ET POLICY RunDll Request Over SMB - Likely Lateral Movement"

• "ET INFO Base64 Encoded ipconfig sent via HTTP POST M2"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET TROJAN Observed Malicious SSL Cert (CoreBot C2)"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing 2021-03-10"

• "ET CURRENT_EVENTS Successful Idaho Central Credit Union Credential Phish"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (kokokakalala .com)"

• "ET TROJAN SERVER SSL Cert APT1"

• "ET MOBILE_MALWARE NSO Related Domain 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Pegasus Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android APT-C-23 (jorah-mormont .info in TLS SNI)"

• "ET WEB_CLIENT Suspicious JS Refresh - Possible Phishing Redirect Feb 24 2017"

• "ET CURRENT_EVENTS Mailbox Renewal Phish Landing 2015-08-14"

• "ET TROJAN SocGholish Domain in TLS SNI (assay .porchlightcommunity .org)"

• "ET WEB_CLIENT Fake FlashPlayer Update Leading to CoinMiner M2 2018-10-12"

• "ET CURRENT_EVENTS Apple Phishing Landing 2016-03-01 M2"

• "ET WEB_CLIENT Microsoft Tech Support Phone Scam M1 Jul 07 2017"

• "ET TROJAN CASHY200 CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Personalized OWA Webmail Phish Oct 04 2016"

• "ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI"

• "ET TROJAN NewPosThings POST with Fake UA and Accept Header"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (duramtravelagency .com) 2022-12-05"

• "ET MALWARE Win32/Adware.Adposhel.A Checkin 3"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (who .worksolution .buzz)"

• "ET MALWARE Suspicious User Agent Smart-RTP"

• "ET TROJAN HiveRAT CnC Activity M2"

• "ET CURRENT_EVENTS Possible AMSI Powershell Bypass Attempt B641"

• "ET TROJAN Nobelium APT Related Activity (GET)"

• "ET CURRENT_EVENTS Successful WhatsApp Payment Phish M1 2016-11-15"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Activity (END)"

• "ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"

• "ET TROJAN OSX/Flashback.K/I User-Agent"

• "ET TROJAN APT28/Sednit DNS Lookup (ausameetings .com)"

• "ET TROJAN APT28/Sednit DNS Lookup (worldpoliticsnews .org)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Suspected APT34 Related SSD Backdoor Response"

• "ET TROJAN VBS.ARS Checkin"

• "ET TROJAN Win32/Kelihos.F Checkin"

• "ET TROJAN BIOPASS RAT Go Activity (GET)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (contracts-adnoc .com) 2022-12-05"

• "ET CURRENT_EVENTS Successful Craigslist (RO) Phish M1 Feb 24 2017"

• "ET CURRENT_EVENTS SunDown EK Slight Sep 22 2016 (b643)"

• "ET TROJAN Shifr Ransomware CnC DNS Query (ojdue4474qghybjb)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (blackleopard .myvnc .com)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Maldoc Activity Sending Windows User Info (GET)"

• "ET TROJAN MSIL/Juliens Botnet CnC Activity M1"

• "ET TROJAN Cobalt Strike Malleable C2 (Magnitude EK)"

• "ET TROJAN Observed APT Actor Payload Domain (e-aks .uz in TLS SNI)"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .deck .linkpc .net)"

• "ET TROJAN Maldoc Sending Windows System Information (POST)"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-05-04"

• "ET TROJAN Win32/Darkme CnC Domain in DNS Lookup (pallomnareraebrazo .com)"

• "ET TROJAN Yahoyah CnC Beacon"

• "ET TROJAN APT28/Sednit DNS Lookup (militaryobserver .net)"

• "ET CURRENT_EVENTS Successful Banco Itau (BR) Mobile Phish Feb 17 2017"

• "ET TROJAN Win32/TA402 Checkin M2"

• "ET CURRENT_EVENTS Successful Paxful Cryptocurrency Wallet Phish Aug 30 2017"

• "ET TROJAN Dridex v2 POST Checkin"

• "ET MALWARE Win32/DownWare.V Checkin"

• "ET TROJAN Suspected APT15/NICKEL KETRUM CnC Activity (GET)"

• "ET TROJAN Win32/TA402 CnC Activity (GET)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (solo-hoy .com)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to deftsecurity .com"

• "ET TROJAN DNS Query to Raspberry Robin Domain (lwip .re)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (i .ua-passport .space in TLS SNI)"

• "ET TROJAN DonotGroup Maldoc Activity (GET)"

• "ET TROJAN Lyceum Backdoor CnC Activity M2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Alloy Taurus APT Zapoa Backdoor Activity"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (SmokeLoader CnC)"

• "ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN TA401 Domain in DNS Lookup (isabeljwade .icu)"

• "ET MALWARE Searchspy.co.kr Spyware User-Agent (HTTPFILEDOWN)"

• "ET TROJAN Likely APT29 Retrieving Payload Embedded In PNG 2"

• "ET CURRENT_EVENTS Successful Dropbox/Docusign Phish 2016-10-28"

• "ET TROJAN CASHY200 CnC Domain in DNS Lookup"

• "ET TROJAN [PTsecurity] Gozi/Ursnif Payload v12"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (fulfillityourself .com)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (faristo .site)"

• "ET USER_AGENTS DanaBot Specific UA Observed"

• "ET TROJAN Win32/WarHawk Activity (ping)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.SmsThief.ta CnC Domain in DNS Lookup"

• "ET MALWARE Zango Seekmo Bar Spyware User-Agent (Seekmo Toolbar)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN SMS-Bomber Activity"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-schnellvpn .com)"

• "ET TROJAN Powershell commands sent B64 3"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M13"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to zupertech .com"

• "ET TROJAN Pingback Exep Command Issued"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (dubaiferryae .com) 2022-12-05"

• "ET MOBILE_MALWARE Android APT-C-23 (mary-crawley .com in TLS SNI)"

• "ET MALWARE LNKR CnC Activity M1"

• "ET TROJAN Desert Falcon APT DNS Lookup (iwork-sys.com)"

• "ET TROJAN DNS Query to Malicious Domain (drive-google-com .tk)"

• "ET TROJAN Suspected APT32/Oceanlotus Maldoc CnC"

• "ET CURRENT_EVENTS Bank of America Phishing Landing 2018-01-18 M2"

• "ET TROJAN Sofacy DNS Lookup"

• "ET WEB_CLIENT Internet Explorer Memory Corruption Vulnerability (CVE-2016-0063)"

• "ET CURRENT_EVENTS Successful LCL Bank Phish 2015-11-05"

• "ET MOBILE_MALWARE Android APT-C-23 (mail-accout .club in DNS Lookup)"

• "ET TROJAN BunnyLoader CnC Checkin - ResultCMD"

• "ET TROJAN TA401 Domain in TLS SNI (jessicakphillips .icu)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful LinkedIn Phish 2015-09-17"

• "ET CURRENT_EVENTS Observed TOAD Domain (hscare .online in TLS SNI)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M21"

• "ET TROJAN Possible Konni RAT Domain in DNS Lookup (documentoffice .club)"

• "ET TROJAN Backdoor.Win32.Ixeshe"

• "ET MOBILE_MALWARE Possible iOS WebView Auto Dialer 1"

• "ET CURRENT_EVENTS Successful Outlook Webmail Phishing 2015-11-21"

• "ET TROJAN Observed GobRAT Domain (su .vealcat .com) in TLS SNI"

• "ET TROJAN Linux/dtool IRC Command (AUTH)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (nipmse .com) 2022-12-05"

• "ET TROJAN AgentTesla HTML System Info Report Exfil via FTP"

• "ET TROJAN Observed DNS Query to Redkeeper Ransomware Domain"

• "ET MALWARE 180 Solutions (Zango Installer) User Agent"

• "ET CURRENT_EVENTS DRIVEBY Router DNS Changer Apr 07 2015 M2"

• "ET TROJAN SideCopy APT Related Activity (GET)"

• "ET TROJAN FakeAV Landing Page (aid sid)"

• "ET TROJAN APT28/Sednit DNS Lookup (microsoftdriver .com)"

• "ET TROJAN TrueBot/Silence.Downloader Keep-Alive"

• "ET TROJAN Possible Linux DarkRadiation Ransomware Telegram Activity"

• "ET TROJAN Upatre User-Agent"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (harvesttravelagency .com) 2022-12-05"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif Inject Domain)"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2019-08-02"

• "ET TROJAN Observed Magecart Skimmer Domain (googie-analitycs .site in TLS SNI)"

• "ET CURRENT_EVENTS Underminer EK Flash/WAV Loader"

• "ET TROJAN Observed Various Malware Staging Domain (direct-trojan .com in TLS SNI)"

• "ET TROJAN AntiVirus exe Download Likely FakeAV Install"

• "ET TROJAN Win32/7ev3n Ransomware Process Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/SamMiner CnC Checkin M1"

• "ET TROJAN Observed DNS Query to RisePro Domain (elite-hacks .ru)"

• "ET WORM Possible Worm Sohanad.Z or Other Infection Request for setting.nql"

• "ET WEB_SERVER WebShell - Pouya - URI - raiz"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN PowerShell/PowHeartBeat CnC Domain (central .suhypercloud .org) in DNS Lookup"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 3"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M4"

• "ET TROJAN RShell CnC Domain (center .veryssl .org) in DNS Lookup"

• "ET CURRENT_EVENTS Successful Outlook Phish 2016-10-25"

• "ET TROJAN Win32/MysterySnail RAT CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Adobe Shared Document Phishing Landing on Appspot Hosting"

• "ET TROJAN MagikPOS Downloader Retrieving Payload"

• "ET TROJAN W32/Backdoor.BlackMonay Checkin"

• "ET TROJAN MintStealer CnC Activity (GET)"

• "ET CURRENT_EVENTS Successful Microsoft Credential Phish 2022-05-26"

• "ET TROJAN Fullspace.cc or Related Checkin (2)"

• "ET TROJAN Possible APT40/Dadstache Stage 2 Payload Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (hareyupnow .club in DNS Lookup)"

• "ET TROJAN Gasket Requesting Commands from CnC"

• "ET TROJAN Observed DCRat Related Domain (crystalfiles .ru in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Arid Viper APT DNS Lookup (ineltdriver.com)"

• "ET TROJAN Win32/TrojanDropper.Agent.SSQ Variant Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN ArtraDownloader/TeleRAT Checkin"

• "ET TROJAN Observed Adwind RAT CnC DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (jzm .pw)"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET TROJAN Zeus Panda CnC Domain (in DNS Lookup)"

• "ET CURRENT_EVENTS Magnitude EK Landing M2 Aug 05 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Linux/B1txor20 Backdoor Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS Fake Browser Update Domain in DNS Lookup (christopherchabannes .com)"

• "ET TROJAN Possible IoT_reaper ELF Binary Request M5 (set)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (throatpills .org)"

• "ET MOBILE_MALWARE Android Dropper Checkin Activity (POST)"

• "ET TROJAN Observed StrongPity CnC Domain (hardwareoption .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (amazonascash .com)"

• "ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain"

• "ET TROJAN Win32.TrojanProxy Configuration file Download"

• "ET TROJAN DustySky CnC Beacon"

• "ET TROJAN Suspected Polonium CnC Checkin (result.php - process list) M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2t .wf)"

• "ET TROJAN Observed Glupteba CnC Domain (deepsound .live in TLS SNI)"

• "ET TROJAN Parallax CnC Activity (set) M16"

• "ET TROJAN IIS-Raid Module Backdoor - Successful INJ Command in HTTP Response"

• "ET CURRENT_EVENTS Possible barclays .co. uk Phishing Domain 2016-06-22"

• "ET TROJAN Ponmocup HTTP Request (generic) M6"

• "ET TROJAN Win32/DataStealer.P CnC Checkin"

• "ET TROJAN SiameseKitten/Lyceum/Hexane MSIL/Shark Uploading to CnC"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (mineskateroff .com)"

• "ET TROJAN FIN7/Carbanak CnC Domain in DNS Lookup (dmnadmin .com)"

• "ET TROJAN Win32/Grandoreiro Related Activity (GET)"

• "ET TROJAN Win32/Wacatac.B!ml Data Exfiltration"

• "ET TROJAN Malicious SSL Certificate detected (Patchwork CnC)"

• "ET TROJAN Observed Malicious SSL Cert (Magecart/Skimmer CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5z .pm)"

• "ET CURRENT_EVENTS Neverquest/Vawtrak Posting Data"

• "ET MOBILE_MALWARE NSO Related Domain 35"

• "ET CURRENT_EVENTS DRIVEBY [PwC CTD] -- MultiGroup - ScanBox and Targetted Watering Holes PDF"

• "ET TROJAN Win32/DanaBot Harvesting Email Addresses 1"

• "ET TROJAN Win32.Agent.Y!c CnC Checkin"

• "ET TROJAN Bitter RAT TCP CnC Beacon"

• "ET WEB_CLIENT Generic Fake Support Phone Scam Mar 8"

• "ET MOBILE_MALWARE Arid Viper (hidden-chat-e58d7 .appspot .com in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Unknown CN Related APT Domain in DNS Lookup (upportteam .lingrevelat .com)"

• "ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to webcodez .com"

• "ET CURRENT_EVENTS Possible Successful Yahoo Phish Nov 21 2012"

• "ET TROJAN Win32/Pterodo CnC Activity (POST)"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .hatch .computer)"

• "ET TROJAN Observed DangerousPassword Related Domain (www .thecloudnet .org in TLS SNI)"

• "ET TROJAN JS/Nemucod.M.gen requesting PDF payload 2015-10-07"

• "ET TROJAN Playful Taurus CnC Domain (vpnkerio .com) in DNS Lookup"

• "ET TROJAN Revcode RAT CnC"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Cartasi Phishing Domain Feb 02 2017"

• "ET TROJAN NOBELIUM (TA421) CEELOADER CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android/Gigabud CnC Domain (lionaiothai .com) in DNS Lookup"

• "ET TROJAN OSX/Proton.B Domain in SNI"

• "ET CURRENT_EVENTS Possible Archie/Metasploit SilverLight Exploit"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-03-06"

• "ET TROJAN Observed DNS Query to Pegasus Domain (news-now .co)"

• "ET CURRENT_EVENTS Unknown_MM EK - Landing Page"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice GET]"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (uae-snocproject .com) 2022-12-05"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (profille-cex-io .com)"

• "ET TROJAN Observed DNS Query to Ursnif Domain (giantos .xyz)"

• "ET TROJAN Backdoor.Graybird Checkin"

• "ET TROJAN Bitter RAT HTTP CnC Beacon M2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (mz3 .biz)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN SharpNoPSExec EXE Lateral Movement Tool Downloaded"

• "ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M3"

• "ET TROJAN Win32/CollectorStealer CnC Exfil M2"

• "ET TROJAN Golang/Sandcat Plugin Activity (POST)"

• "ET TROJAN Arid Viper APT Checking filename"

• "ET CURRENT_EVENTS Possible Malvertising Redirect to EK M1"

• "ET TROJAN Backdoor.Win32.DarkComet Keepalive Inbound"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 8"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (cshelp03 .us)"

• "ET TROJAN Win32/WhiskerSpy - FTP - Observed Creds"

• "ET TROJAN Prometei Botnet CnC Checkin - Payload Retrieval"

• "ET TROJAN Observed DNS Query to APT10 Related CnC Domain"

• "ET TROJAN Cinobi Banking Trojan Domain in DNS Lookup (www .chirigame .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN W32/Beebus HTTP POST CnC Beacon"

• "ET TROJAN CobianRAT Receiving Config Commands from CnC"

• "ET TROJAN Observed Malicious SSL Cert (OilRig QUADAGENT CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0e .si)"

• "ET USER_AGENTS Suspicious User-Agent (MYURL)"

• "ET TROJAN Win32/Flooder.Agent.NAS CnC Domain in DNS Lookup"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-cdn .com)"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup (dazhiruoyu .org)"

• "ET TROJAN Locky CnC Checkin Dec 5 M1"

• "ET MOBILE_MALWARE Android APT-C-23 (firesky .site in DNS Lookup)"

• "ET TROJAN Trojan/Win32.Espy Report via SMTP"

• "ET TROJAN Win32/Nuclear Checkin"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page from Text Scam M1 2023-05-01"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 11"

• "ET TROJAN Suspicious Fake Opera 10 User-Agent"

• "ET TROJAN Win32/SupremeBot CnC Checkin (POST) M1"

• "ET TROJAN CASHY200 CnC Domain in DNS Lookup"

• "ET MALWARE CoinSurf Proxy CnC Response (Network Configuration)"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Arid Viper APT Exfiltrating files"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .pinksugarpopmontana .com)"

• "ET TROJAN Banload HTTP Checkin Detected (envia.php)"

• "ET CURRENT_EVENTS Successful CSIS Credential Phish"

• "ET TROJAN DPRK APT Related Maldoc Activity (POST)"

• "ET TROJAN APT28/Sednit DNS Lookup (kg-news .org)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1u .wf)"

• "ET TROJAN MagikPOS Downloader Checkin"

• "ET TROJAN Turla Kopiluwak User-Agent"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 3"

• "ET TROJAN Cylance Ransomware Sending System Information (POST)"

• "ET TROJAN ATTACKER IRCBot - The command completed successfully - PRIVMSG Response"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Bedep Connectivity Check M2"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-chat .xyz)"

• "ET CURRENT_EVENTS Successful Chase Phish 2015-09-23"

• "ET TROJAN W32/Bapy.Downloader PE Download Request"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .kiavisa .com)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Win32/AppleJeus CnC Checkin (POST)"

• "ET CURRENT_EVENTS Windows Scriptlet Invoking Powershell Likely Malicious"

• "ET TROJAN DNS Query to Raspberry Robin Domain (nzm .one)"

• "ET TROJAN Observed DNS Query to Pegasus Domain (helpusfind .biz)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-03-12"

• "ET TROJAN Linux/HiddenWasp CnC Response"

• "ET TROJAN APT DarkHydrus DNS Lookup 4"

• "ET TROJAN LinPEAS Privilege Escalation Script Response (With Banner)"

• "ET CURRENT_EVENTS Successful Outlook Password Update Phish M3 2016-09-01"

• "ET MOBILE_MALWARE Android/Smspacem CnC Communication Attempt"

• "ET TROJAN Zeus.Downloader Campaign Second Stage Executable Request"

• "ET TROJAN PS1Loader Encoded Profiling POST"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message"

• "ET CURRENT_EVENTS Metawallet Phish Landing Page 2022-01-13"

• "ET TROJAN Win32/Urausy.C Checkin"

• "ET WEB_CLIENT SocEng Fake Font Download Template Nov 14 2017"

• "ET TROJAN DNS Query to Raspberry Robin Domain (v0 .cx)"

• "ET TROJAN MSIL/Almashreq Executing New Processes"

• "ET EXPLOIT SolusVM 1.13.03 SQL injection"

• "ET TROJAN Win32.Riberow.A (fsize)"

• "ET TROJAN EvilNum CnC Client Data Exfil"

• "ET CURRENT_EVENTS Successful Linkedin Phish 2016-09-27"

• "ET CURRENT_EVENTS Observed TOAD Domain (bgcare .cc in TLS SNI)"

• "ET TROJAN Android/AhMyth RAT Command Inbound (Location Manager)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET MOBILE_MALWARE Android Marcher Trojan Download - Raiffeisen Bank Targeting (set)"

• "ET CURRENT_EVENTS Possible ReactorBot .bin Download"

• "ET TROJAN IceRat CnC Acitivty M2"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET CURRENT_EVENTS Successful NAB Bank Phish M1 2016-10-19"

• "ET CURRENT_EVENTS Successful Amazon Phish M1 2016-10-05"

• "ET TROJAN Iron Tiger Backdoor.GTalkTrojan DNS Lookup (update.gtalklite.com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (7d .rs)"

• "ET TROJAN Gatak CnC"

• "ET TROJAN Qudox CnC Activity"

• "ET CURRENT_EVENTS Possible Apple Store Phish Landing 2015-07-30"

• "ET TROJAN ZAccess/Sirefef/MAX++/Jorik/Smadow Checkin"

• "ET TROJAN JS/WSF Downloader Dec 08 2016 M4"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Feb 26 2016"

• "ET CURRENT_EVENTS Apple Account Phishing Landing 2015-11-18"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2016-10-05"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET TROJAN PLATINUM Steganographic HTTP Response Page Inbound"

• "ET TROJAN Observed DNS Query to Ursnif Domain (isteros .com)"

• "ET TROJAN Donot Domain in DNS Lookup (dripgift .live)"

• "ET MALWARE PUP TheSZ AutoUpdate CnC Beacon"

• "ET TROJAN Win32/DTStealer CnC Activity"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2022-04-05"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN ZeuS Post to C&C footer.php"

• "ET TROJAN Observed DNS Query to AppleJeus Domain (strainservice .com)"

• "ET TROJAN Win32/Antilam.2_0 Sending Data over SMTP"

• "ET TROJAN Observed Gamaredon APT Related Domain (dwn-files .shop in TLS SNI)"

• "ET TROJAN Various Ransomware/Stealer Style External IP Address Check (myip .ch)"

• "ET MOBILE_MALWARE Kimsuky AppleSeed CnC Checkin"

• "ET TROJAN Chinotto CnC Activity (command)"

• "ET TROJAN NSO Group Pegasus Related Data Exfil (POST) M3"

• "ET CURRENT_EVENTS Successful Facebook Payment Phish M1 2016-09-29"

• "ET MALWARE PrivaZer Checkin"

• "ET CURRENT_EVENTS SUSPICIOUS Word DOCX with Many ActiveX Objects and Media"

• "ET MOBILE_MALWARE Android BatteryBotPro Checkin 2"

• "ET TROJAN Nazar Implant - Sending Ping Response to CnC"

• "ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (pinki .cyou)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 53"

• "ET TROJAN SocGholish Domain in DNS Lookup (x64 .nvize .com)"

• "ET TROJAN JS/Nemucod requesting EXE payload 2016-02-06"

• "ET TROJAN Observed Glupteba CnC Domain (getyourgift .life in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Possible Kimsuky Related Download"

• "ET TROJAN Win32/Qakbot CnC Activity (POST)"

• "ET TROJAN APT DarkHydrus DNS Lookup 21"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (bitscrunch .pd .linkpc .net)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-09-09"

• "ET TROJAN [ANY.RUN] Win32/Lumma Stealer Configuration Request Attempt"

• "ET TROJAN Observed Reimageplus Ransomware Domain in TLS SNI"

• "ET TROJAN MSIL/GravityRAT CnC Checkin M2"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"

• "ET TROJAN Win32/Trojan.Valyria.6015 CnC Activity (GET)"

• "ET TROJAN Win32/Remcos RAT Checkin 756"

• "ET TROJAN Kimsuky ReconShark Payload Retrieval Request M2"

• "ET TROJAN Observed SSV Agent CnC Domain (hostupoeui .com in TLS SNI)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M9"

• "ET TROJAN Win32/HookSpoofer Stealer Sending System Information via Telegram (GET)"

• "ET CURRENT_EVENTS Successful Yahoo Phish 2016-09-27"

• "ET MALWARE yupsearch.com Spyware Install - sideb.exe"

• "ET CURRENT_EVENTS Successful OWA Credential Phish 2022-07-13"

• "ET TROJAN FOX-SRT ShimRat check-in (Yuok)"

• "ET CURRENT_EVENTS AES Crypto Observed in Javascript - Possible Phishing Landing M1 Dec 28 2015"

• "ET CURRENT_EVENTS KaiXin Landing Page M2"

• "ET TROJAN DirectsX Checkin Response"

• "ET TROJAN [PTsecurity] Trojan.JS.Agent.dwz Checkin 1"

• "ET TROJAN BlueShtorm Infostealer Data Exfiltration"

• "ET TROJAN Cobalt Strike CnC Domain (020 .57thandnormal .com) in DNS Lookup"

• "ET TROJAN Scarlet Mimic DNS Lookup 34"

• "ET CURRENT_EVENTS Malicious Redirect 8x8 script tag"

• "ET TROJAN Win32/SodaMaster CnC HTTPS Checkin M2"

• "ET TROJAN PoshC2 - Observed Default URI Structure M4"

• "ET CURRENT_EVENTS L33bo Phishing Kit - Successful Credential Phish M2 2016-03-29"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (gamefllix .com)"

• "ET TROJAN Windows net statistics workstation Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby"

• "ET TROJAN Unknown Actor Targeting Minority Groups Activity (POST)"

• "ET CURRENT_EVENTS RIG EK Landing Sep 13 2016 (b643)"

• "ET TROJAN Maldoc Activity Sending Windows User Info (GET)"

• "ET TROJAN Win32/Toby.N Multilocker Image Request"

• "ET TROJAN PlugX/Korplug CnC Activity"

• "ET TROJAN WinGO\Monitor.go CnC Checkin"

• "ET TROJAN MSIL/Modi RAT CnC Checkin (DesktopPreview)"

• "ET TROJAN Blaze/Supreme Bot Activity"

• "ET TROJAN Win32/POWERPLANT CnC Exfil (INIT)"

• "ET TROJAN PlugX Related Domain in DNS Lookup (cxks8 .com)"

• "ET TROJAN JS/Batloader Payload Request (GET)"

• "ET TROJAN DNS Query to SysJoker Domain (audiosound-visual .com)"

• "ET TROJAN JS/Comm100 Trojan CnC Payload Inbound"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Keitaro Set-Cookie Inbound to RogueRaticate (3a7ee)"

• "ET TROJAN Win32/Sabsik.FL.B!ml Checkin"

• "ET TROJAN RedLeaves HOGFISH APT Implant CnC"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (thedoccloud .com)"

• "ET MALWARE Win32/Packed.FlyStudio.AA Checkin"

• "ET TROJAN OS X Backdoor Checkin"

• "ET TROJAN Libyan Scorpions Netwire RAT DNS Lookup (wininit .myq-see.com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Deep Panda Domain in DNS Lookup (giga .gnisoft .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (greedyclowns .org)"

• "ET TROJAN W32/Renos.Downloader User Agent zeroup"

• "ET CURRENT_EVENTS SimpleTDS go.php (sid)"

• "ET TROJAN Ursnif Variant CnC Beacon"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2018-02-13"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN LokiBot Keylogger Data Exfiltration Detected M1"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hshelp .cc)"

• "ET MALWARE Fun Web Products Spyware User-Agent (MyWay)"

• "ET TROJAN [PTsecurity] Bladabindi/njRAT (HAMAD versions)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (u0 .nz)"

• "ET TROJAN Suspected Ares Loader Activity (GET)"

• "ET TROJAN JasperLoader CnC Checkin"

• "ET TROJAN APT37 M2RAT CnC Server Command - UPD"

• "ET CURRENT_EVENTS Successful Outlook Webmail Phishing M2 2015-11-21"

• "ET INFO Possible WikiLoader Activity (GET)"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Suspected Donot Group Related Activity (POST)"

• "ET CURRENT_EVENTS Successful Midea Credential Phish 2022-07-12"

• "ET TROJAN Hupigon User Agent Detected (RAV1.23)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Fortigate THINCRUST Backdoor Activity M2"

• "ET MALWARE PUP Win32/Conduit.SearchProtect.O CnC Beacon"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (onewayskateboard .com)"

• "ET MALWARE Loadmoney.A Checkin 4"

• "ET TROJAN Sidecopy APT Related CnC Domain in DNS Lookup (republicofaf .xyz)"

• "ET TROJAN ICEFOG-P Variant CnC Checkin M1"

• "ET WEB_SERVER WebShell - GODSpy - Auth Prompt"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Bookmarks Firefox.txt) M1"

• "ET TROJAN MagicRAT CnC Domain (gendoraduragonkgp126 .com) in DNS Lookup"

• "ET TROJAN Observed GET Request to Jaff Domain (orhangazitur . com)"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2"

• "ET TROJAN APT28/Sednit DNS Lookup (nato-news .com)"

• "ET TROJAN Observed Glupteba CnC Domain (tmetres .com in TLS SNI)"

• "ET TROJAN W32/Skintrim CnC Checkin"

• "ET TROJAN Suspected APT28 Related Domain in DNS Lookup (wordkeyvpload .net)"

• "ET MALWARE Spyware User-Agent (XXX)"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2016-08-31"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-03-16"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish"

• "ET MALWARE Win32/Adware.Adposhel.A Checkin 4"

• "ET CURRENT_EVENTS CoolEK Payload Download (9)"

• "ET TROJAN Observed Adwind RAT CnC DNS Query"

• "ET TROJAN Win32/Agent.ACBD CnC Activity"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (finalcountdown .top)"

• "ET TROJAN IP Grabber CnC Activity"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (sourceslabs .com)"

• "ET MOBILE_MALWARE Android/Spy.Agent.ANA (mediadownload .space in DNS Lookup)"

• "ET TROJAN Observed TWISTEDPANDA Domain in TLS SNI (www .microtreely .com)"

• "ET CURRENT_EVENTS Successful Generic Brand Phish 2016-12-01"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (akamaicontainer .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [DCSO] Andariel Exfil Activity"

• "ET TROJAN Kishop.A checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 99"

• "ET CURRENT_EVENTS Possible Successful Apple Phish 2015-07-31"

• "ET CURRENT_EVENTS Evil Redirector Leading To EK Sep 30 2015"

• "ET MOBILE_MALWARE Android/GoldDream Uploading Watch Files"

• "ET TROJAN Smanager CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M3"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11"

• "ET TROJAN Observed Malicious SSL Cert (Bancos Variant CnC)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (ruslanpo .ru)"

• "ET TROJAN KINS/ZeusVM Variant CnC Beacon"

• "ET TROJAN Win32/Unknown Stealer CnC Exfil via Telegram M2"

• "ET TROJAN Observed TA444 Domain (mufg .tokyo in TLS SNI)"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (zuyonijobo .com)"

• "ET TROJAN Win32.VBKrypt.vquj Checkin"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (nomadpkgs .com)"

• "ET TROJAN Win32/Agniane Stealer CnC Exfil (POST) M2"

• "ET TROJAN x0Proto Download Cmd"

• "ET MOBILE_MALWARE Android APT-C-23 (apkapps .pro in TLS SNI)"

• "ET TROJAN DTLoader Encoded Binary - Server Response"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 10"

• "ET MOBILE_MALWARE NSO Related Domain 22"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (navy-mil-bd .jmicc .xyz)"

• "ET TROJAN Citadel Activity POST"

• "ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup"

• "ET TROJAN FOX-SRT ShimRatReporter check-in"

• "ET USER_AGENTS Suspicious User-Agent (up2dash updater)"

• "ET CURRENT_EVENTS suspicious VBE-encoded script (seen in Sundown EK)"

• "ET TROJAN Win32.Riberow.A (postit3)"

• "ET TROJAN CryptoLocker .onion Proxy Domain (zoqowm4kzz4cvvvl)"

• "ET MALWARE Adware/FakeAV.Kraddare Checkin UA"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (joysaketshops .com)"

• "ET TROJAN Observed Malicious SSL Cert (Sidewinder APT CnC)"

• "ET INFO Suspicious Google Docs Page - Possible Phishing Landing"

• "ET TROJAN Win32/WarHawk Activity (fileupload)"

• "ET TROJAN Generic Downloader Checkin - HTTP GET"

• "ET TROJAN Infostealer.Mysayad Checkin 2"

• "ET TROJAN Winquickupdates.com/Mycashloads.com Related Trojan Install Report"

• "ET TROJAN Win32/Qbot CnC Activity M2"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (informativosatelital .com)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 104"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (dev .sslsharecloud .net)"

• "ET TROJAN Observed DNS Query to TA444 Domain (tptf .fund)"

• "ET TROJAN Patchwork DNS Tunneling (nsn1.winodwsupdates .me)"

• "ET TROJAN Kriptovor Checkin"

• "ET TROJAN MSIL/Spyware Activity via Telegram (Response)"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2022-07-29"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (ahoravideo-endpoint .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Evil Monero Cryptocurrency Miner Request Pools"

• "ET TROJAN Arechclient2 Backdoor CnC Checkin"

• "ET TROJAN Possible APT34 TONEDEAF 2.0 User-Agent Observed"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k0 .pm)"

• "ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to globalnetworkissues .com"

• "ET TROJAN HermeticWizard - SMB Spreader - File Copy via SMB1 (NT Create AndX Request)"

• "ET TROJAN APT28 SEDNIT Variant CnC Beacon 3"

• "ET TROJAN US-CERT TA14-353A Listening Implant 6"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 106"

• "ET TROJAN TA410 APT FlowCloud Dependency Download M3"

• "ET TROJAN Geocon CnC Request"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (alsmgjk-igusj .com)"

• "ET TROJAN Axile Stealer CnC Activity (POST)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 7"

• "ET MALWARE W32/Wajam.Adware Successful Install"

• "ET TROJAN Dmechant Exfil Cryptowallets via SMTP"

• "ET TROJAN W32/ZxShell Server Checkin Response"

• "ET TROJAN Observed Malicious SSL Cert (Gozi CnC)"

• "ET TROJAN Observed TaurusStealer CnC Domain in TLS SNI"

• "ET MOBILE_MALWARE Android APT-C-23 (aamir-khan .site in TLS SNI)"

• "ET TROJAN r0 CnC Report GET"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1q0hcvl2p88zdv4dj97mfwtwv4usxm .com)"

• "ET TROJAN JKDDOS Bot CnC Phone Home Message"

• "ET TROJAN Diavol Communicating with CnC - Wipe Request"

• "ET TROJAN PowerShell/CustomRAT CnC Traffic"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN EVILNUM CnC Connectivity Check"

• "ET WEB_CLIENT Javascript XOR Encoding - Observed in Apple Phishing 2016-12-09"

• "ET CURRENT_EVENTS Bleeding Life 2 GPLed Exploit Pack payload request (exploit successful!)"

• "ET TROJAN DonotGroup/Patchwork CnC DNS Lookup"

• "ET TROJAN Konni Group CnC Domain in DNS Lookup"

• "ET MALWARE MAC/Conduit Component Download"

• "ET MOBILE_MALWARE NSO Related Domain 28"

• "ET MALWARE BoostBeast Task Response"

• "ET TROJAN DNS Query to TA444 Domain (docs-send .cloud)"

• "ET TROJAN Farfli HTTP Checkin Activity"

• "ET TROJAN APT28 CnC Domain DNS Lookup"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (doc .global-link .run .place)"

• "ET TROJAN [ANY.RUN] Konni.APT Exfiltration"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2019-06-04"

• "ET TROJAN Backdoor.Darpapox/Jaku CNAME CnC Beacon (WinVer 6.1)"

• "ET TROJAN W32/Downloader Secondary Download Request - W32/Hupigon.Backdoor Likely Secondary Payload"

• "ET TROJAN Observed Silver Implant Domain (raspoly .biz in TLS SNI)"

• "ET CURRENT_EVENTS Successful Horde Webmail Phish 2015-08-21"

• "ET EXPLOIT SugarCRM Auth Bypass Attempt 2022-12-31"

• "ET TROJAN APT32/OceanLotus Associated Domain in DNS Lookup (tocaoonline .org)"

• "ET TROJAN APT28/Sednit DNS Lookup (osce-info .com)"

• "ET TROJAN Kimsuky Related Activity (GET)"

• "ET MOBILE_MALWARE Android APT-C-23 (new .filetea .me in TLS SNI)"

• "ET TROJAN TontoTeam APT Related Bisonal CnC Activity"

• "ET ATTACK_RESPONSE Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (winserverupdates .com)"

• "ET TROJAN Observed DNS Query to Pegasus Domain"

• "ET TROJAN Win32/Valak Variant CnC"

• "ET CURRENT_EVENTS Successful Mailbox Deactivation Phish 2016-08-19"

• "ET TROJAN Win32/Amadey Payload Request (GET) M1"

• "ET CURRENT_EVENTS Possible Successful Generic Windows.net Hosted Phish 2020-10-14"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-12"

• "ET WORM Win32.Socks.s HTTP Post Checkin"

• "ET TROJAN Kimsuky Related Domain in DNS Lookup"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET TROJAN TA409 Related DNS Lookup (navercorp .ru)"

• "ET TROJAN CrownAdPro CnC Activity M4"

• "ET MOBILE_MALWARE Android APT-C-23 (matthew-stevens .club in TLS SNI)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 12"

• "ET TROJAN Possible CopyKitten DNS Lookup (jguery .net)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (dahilalcapitalinvest .com) 2022-12-05"

• "ET TROJAN Observed TraderTraitor Domain (canolagroove .com in TLS SNI)"

• "ET TROJAN Chthonic CnC Beacon 5"

• "ET TROJAN ELF_BASHLITE.SMB Dropping Files"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (true-crypte .website)"

• "ET TROJAN Matanbuchus Loader CnC M2"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (tornton .xyz)"

• "ET TROJAN Desert Falcon Related APT DNS Lookup (blogging-host.info)"

• "ET TROJAN Kaseya VSA Exploit Activity M1 (SET)"

• "ET CURRENT_EVENTS Successful Chase Phish 2015-09-24"

• "ET TROJAN Manjusaka C2 Client Heartbeat"

• "ET TROJAN Powershell Octopus Backdoor Sending System Information (POST)"

• "ET TROJAN Dridex/Bugat/Feodo Cookie"

• "ET TROJAN W32/TCYWin.Downloader User-Agent"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS Successful Roundcube Credential Phish 2022-11-08"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (aethionemaso .ru)"

• "ET TROJAN Win32/HMR RAT Sending System Information M2"

• "ET TROJAN [PTsecurity] Win32/SpyAgent.Raptor (realtime-spy) CnC activity 2"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Aug 25 2017"

• "ET TROJAN Win32/Root Finder Stealer Sending System Information via Telegram (GET)"

• "ET TROJAN GCleaner Downloader Activity M1"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (newphoneapp .com)"

• "ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Request (set)"

• "ET TROJAN FakeAV oms.php Data Post"

• "ET TROJAN Trojan Related Lame Updater User-Agent"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (xsecuremail .com)"

• "ET INFO Suspicious Minimal HTTP Refresh to Googledrive.com - Possible Phishing"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (krlwin .org)"

• "ET TROJAN TrojanDownloader Win32/Harnig.gen-P Reporting"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN W32/Wadolin.Downloader CnC Beacon"

• "ET TROJAN LokiBot Related DNS query"

• "ET TROJAN DeltaStealer CnC Checkin"

• "ET TROJAN FakeAvCn-A Checkin 1"

• "ET CURRENT_EVENTS Successful Yahoo Phish 2016-10-27"

• "ET TROJAN Observed Malicious SSL Cert (Darkme CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Xoom Phishing 2015-11-24"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2016-01-07"

• "ET TROJAN Suspected Tunna Proxy M4 (Outbound)"

• "ET CURRENT_EVENTS Successful Navy Federal Credit Union Phish 2016-02-01"

• "ET TROJAN Downloader-5265/Torpig/Anserin/Sinowal Unique UA (MSID)"

• "ET TROJAN FRat WebSocket Request M1"

• "ET CURRENT_EVENTS DHL Phishing Landing 2016-07-11"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0v .wf)"

• "ET CURRENT_EVENTS Possible Successful Credential Phish Oct 1 2015"

• "ET TROJAN PWSteal.Bancos Generic Banker Trojan SCR Download"

• "ET CURRENT_EVENTS Observed TOAD Domain (d2care .us in TLS SNI)"

• "ET TROJAN Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M3"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (s3-cdn .net)"

• "ET TROJAN Backdoor Win32/Zegost.Q CnC traffic (OUTBOUND)"

• "ET CURRENT_EVENTS Australian Government Credential Phish Landing Page 2022-07-06"

• "ET TROJAN Possible CopyKittens DNS Lookup (windows-india.in)"

• "ET TROJAN Magecart/Skimmer Domain in DNS Lookup (cdn-filestorm .com)"

• "ET TROJAN SysJoker CnC Checkin (POST)"

• "ET TROJAN APT DarkHydrus DNS Lookup 22"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .cloudid .coffeeonboard .com)"

• "ET TROJAN W32/Caphaw Requesting Additional Modules From CnC"

• "ET TROJAN Shylock Module Server Response"

• "ET MALWARE Win32/LoadMoney Adware Activity M2"

• "ET TROJAN Windows nbtstat -r Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Curso Banker Downloading Modules"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS Sweet Orange Landing Page Dec 09 2013"

• "ET TROJAN Fake Chrome Landing Domain Activity (chromiumbase .site)"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET CURRENT_EVENTS SUSPICIOUS PSHELL Downloader Primitives B645W Oct 19 2017"

• "ET TROJAN Win32/Generik.BUTNSNA Checkin"

• "ET TROJAN Win32/Phoenix Keylogger SMTP Exfil - Logs"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[Build ID]"

• "ET TROJAN W32.Geodo/Emotet Checkin Fake 404 Response"

• "ET TROJAN Win32/Filecoder.GC CnC Credentials Exfil"

• "ET TROJAN PoshC2 - Observed Default URI Structure M11"

• "ET CURRENT_EVENTS Possible Successful Apple Phishing Domain Feb 02 2017"

• "ET TROJAN Red Leaves magic packet detected (APT10 implant)"

• "ET TROJAN Bladabindi/njrat CnC Keep-Alive (INBOUND)"

• "ET TROJAN Win32/SVCReady Loader - SysInfo M1"

• "ET MALWARE Searchmiracle.com Spyware Installer silent.exe Download"

• "ET TROJAN Possible Pegasus Related DNS Lookup (smscentro .com)"

• "ET TROJAN Win32/Dynamer Trojan Dropper User-Agent VB Http"

• "ET TROJAN OilRig SideTwist CnC Domain in DNS Lookup (sarmsoftware .com)"

• "ET TROJAN Sharik/Smoke Fake 404 Response with Payload Location"

• "ET TROJAN Atomic macOS (AMOS) Stealer Payload Delivery Domain in DNS Lookup (app-downloads .org)"

• "ET CURRENT_EVENTS Successful Survey Credential Phish 2015-08-12"

• "ET MALWARE User-Agent (Explorer)"

• "ET TROJAN Mustang Panda APT Related Activity (GET)"

• "ET MALWARE User-Agent (DIALER)"

• "ET CURRENT_EVENTS France Ministry of Action and Public Accounts Phish Landing"

• "ET CURRENT_EVENTS PerSwaysion JavaScript Response M1"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET TROJAN DNS Query to Raspberry Robin Domain (3z .nu)"

• "ET TROJAN Successful CargoBay Exfil"

• "ET TROJAN Common Downloader Install Report URL"

• "ET TROJAN Win32/a310Logger Variant Data Exfil via SMTP"

• "ET TROJAN [FIREEYE] SLIGHTPULSE Webshell Activity M3"

• "ET TROJAN Bitter APT Related Domain in DNS Lookup"

• "ET TROJAN TA455 CnC Domain in DNS Lookup"

• "ET TROJAN Win32.Hyteod.acox Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"

• "ET CURRENT_EVENTS Possible Broken/Filtered RIG EK Payload Download"

• "ET TROJAN REvil Exfil SFTP Certificate Inbound"

• "ET TROJAN Possible Malicious Macro DL EXE Feb 2016 (WinHTTPRequest)"

• "ET TROJAN ServHelper RAT CnC Domain Observed in SNI"

• "ET CURRENT_EVENTS Successful Paypal Phish M3 2016-12-13"

• "ET TROJAN Win32/Wacatac.B Payload Download"

• "ET TROJAN DNS Query to Raspberry Robin Domain (nk0 .club)"

• "ET TROJAN VirTool.Win32/VBInject.gen!DM Checkin"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (pak-gov .com)"

• "ET CURRENT_EVENTS Possible Successful Citibank Phish M1 2016-08-22"

• "ET TROJAN Win32/Unk.VBScript Requesting Instruction from CnC"

• "ET CURRENT_EVENTS Successful TeamIPwned Phish 2016-08-30"

• "ET TROJAN Qbot Payload Request (2023-03-13) M9"

• "ET TROJAN Cybergate/Rebhip/Spyrat Backdoor Keepalive"

• "ET CURRENT_EVENTS Fedex Javascript Phishing Landing 2016-09-08"

• "ET TROJAN Win32.Jadtre Retrieving Cfg File"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Win32/GrandaMisha Sending System Information (POST)"

• "ET CURRENT_EVENTS Successful Apple Phish 2019-12-18"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2"

• "ET USER_AGENTS suspicious user agent string (CholTBAgent)"

• "ET TROJAN Win32/Nitol.B Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Blackrota)"

• "ET TROJAN MSIL/CoderVir Stealer Zip Upload"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET CURRENT_EVENTS Successful Apple Phishing M1 2016-03-01"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET MOBILE_MALWARE Arid Viper (kevin-good .top in DNS Lookup)"

• "ET TROJAN Suspected Tunna Proxy M2 (Outbound)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (on-global .xyz)"

• "ET TROJAN ASCII Executable Inside of MSCOFF File DL Over HTTP"

• "ET ATTACK_RESPONSE MalDoc/Generik.ILNMZZB Payload Inbound"

• "ET TROJAN Zbot .onion Proxy DNS lookup July 31 2014"

• "ET TROJAN Tortoiseshell/HMH Download Request"

• "ET TROJAN Possible Siloscape IRC CnC JOIN Command Observed"

• "ET CURRENT_EVENTS Possible Successful Generic Phish 2015-07-31"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (videomeethub .online)"

• "ET TROJAN Suspected VileRAT Related Request Activity (GET)"

• "ET TROJAN Possible Dyre SSL Cert M3 (O CN)"

• "ET TROJAN Win32/Formgrabber Data Exfil"

• "ET EXPLOIT Metasploit Browser Exploit Server Plugin Detect 2"

• "ET CURRENT_EVENTS DarkWatchman Phish Domain in DNS Lookup (cryptopro-download .one)"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Successful Apple ID Phish 2015-08-18"

• "ET CURRENT_EVENTS Successful Survey Credential Phish M4 2022-04-04"

• "ET MOBILE_MALWARE Android APT-C-23 (joycebyers .club in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (pmi-pna .com in DNS Lookup)"

• "ET TROJAN BatLoader CnC Domain (updateclientssoftware .com) in DNS Lookup"

• "ET TROJAN APT33/CharmingKitten Retrieving New Payload (flowbit set)"

• "ET TROJAN Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection"

• "ET TROJAN W32/Echmark/MarkiRAT CnC Activity M3"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (konto-verify .space in TLS SNI)"

• "ET MALWARE OSX/Adware.Pirrit CnC Activity 1"

• "ET CURRENT_EVENTS Successful Generic Phish 2016-09-08"

• "ET MOBILE_MALWARE Android APT-C-23 (hcttmail .com in DNS Lookup)"

• "ET MOBILE_MALWARE Arid Viper (hidden-chat-e58d7 .firebaseio .com in DNS Lookup)"

• "ET TROJAN Aveo C2 Response"

• "ET TROJAN MargulasRAT Keep-Alive Outbound M1"

• "ET TROJAN Observed Gamaredon APT Related Domain (alliumso .ru in TLS SNI)"

• "ET TROJAN Bzub2 Related RPC/Http Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32.SpyEyes.bllw CnC Exfil"

• "ET TROJAN Python CTX Library Backdoor Domain in DNS Lookup (anti-theft-web .herokuapp .com)"

• "ET TROJAN Possible CopyKittens DNS Lookup (windows-10patch.in)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (maufusjiop .com)"

• "ET TROJAN Bedep Connectivity Check M3"

• "ET CURRENT_EVENTS Disdain EK Landing Aug 23 2017"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (oauth3 .html5100 .com in DNS Lookup)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN Cinobi Banking Trojan Domain in DNS Lookup (www .getkiplayer .com)"

• "ET TROJAN Downloaded .PNG With Embedded File (.sh)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN APT28 Zebrocy/Zekapab CnC Checkin"

• "ET TROJAN Ave Maria RAT CnC Domain in DNS Lookup (uknwn.linkpc .net)"

• "ET TROJAN Win32/Delf.BLL Variant CnC Activity (Outbound)"

• "ET TROJAN Backdoor.Win32.Aldibot.A User-Agent (Aldi Bot)"

• "ET TROJAN TA444 Related Domain in DNS Lookup (wordonline .cloud)"

• "ET TROJAN Diezen/Sakabota CnC Domain Observed in DNS Query"

• "ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2"

• "ET TROJAN APT SideWinder CnC Domain in DNS Lookup (cdn-in. net)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-12"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (windowsupadates .com) in DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Generic Phish to .ml Domain 2018-10-23"

• "ET TROJAN Conficker/MS08-067 Worm Traffic Outbound"

• "ET CURRENT_EVENTS Successful Apple Phishing 2016-03-01 M3"

• "ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (screenshot.) M1"

• "ET TROJAN ToddyCat APT Related CurCore Activity (POST)"

• "ET MALWARE Win32.Bublik.B/Birele/Variant.Kazy.66443 Checkin"

• "ET TROJAN Clipsa Stealer - CnC Checkin"

• "ET TROJAN FROZENLAKE (APT 28) Related Domain in DNS Lookup (setnewcreds .ukr .net .frge .io)"

• "ET TROJAN Fake AV Downloader.Onestage/FakeAlert.ZR User-Agent (AV1)"

• "ET TROJAN NetWire Variant - Server Directory Listing Request"

• "ET CURRENT_EVENTS HanJuan EK Current Campaign Landing URI Struct Jul 10 2015"

• "ET TROJAN DNS Query to Raspberry Robin Domain (kr4 .xyz)"

• "ET CURRENT_EVENTS Axie Infinity Credential Phish Landing Page M3 2022-05-18"

• "ET TROJAN DNS Query to TA444 Domain (gunosis .global)"

• "ET TROJAN Downloader.Banload2.KZU Checkin 1"

• "ET TROJAN HabitsRAT Checkin"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (bitscrunch .im .linkpc .net)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN Backdoor.Win32.RShot HTTP Checkin"

• "ET TROJAN Kimsuky Related CnC Activity"

• "ET MOBILE_MALWARE Android/Drinik CnC Domain (gia .3utilities .com) in DNS Lookup"

• "ET TROJAN Globe Imposter Ransomware Activity (GET)"

• "ET TROJAN TA453 BellaCiao CnC Domain in DNS Lookup (twittsupport .com)"

• "ET TROJAN SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Checkin"

• "ET TROJAN DNS Query to Darkgate Domain (saintelzearlava .com)"

• "ET CURRENT_EVENTS RIG Payload URI Struct March 20 2015"

• "ET TROJAN Observed StrongPity CnC Domain (hierarchicalfiles .com in TLS SNI)"

• "ET TROJAN Win32/Pterodo Activity (POST)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-04-03"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page M2 2022-08-01"

• "ET MALWARE Malware Delivery Landing Page via JS Redirect (2021-06-24)"

• "ET TROJAN Microcin Backdoor Related Domain in DNS Lookup (m .necemarket .com)"

• "ET TROJAN Andariel Backdoor Activity (Checkin)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to Malicious Domain (flyfggfdbvcbvcbc .online)"

• "ET USER_AGENTS Suspicious User-Agent Moxilla"

• "ET MOBILE_MALWARE Android APT-C-23 (harvey-ross .info in DNS Lookup)"

• "ET TROJAN EncryptorRaas .onion Proxy Domain"

• "ET TROJAN Papercut MF/NG User/Group Sync Python Backdoor Trigger"

• "ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1"

• "ET CURRENT_EVENTS Possible Successful Generic Web.App Hosted Phish 2020-10-14"

• "ET TROJAN Win32/Korplug.HQ CnC Activity"

• "ET MALWARE chnsystem.com Spyware User-Agent (Update1.0)"

• "ET TROJAN [PTsecurity] Win32/Randrew!rfn CnC Activity"

• "ET TROJAN Malicious SSL certificate detected (FindPOS)"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (progsupdate .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (debra-morgan .com in DNS Lookup)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android.Dropper.Abd Checkin"

• "ET TROJAN Donot (APT-C-35) Stage 1 Requesting Main Payload"

• "ET TROJAN Win32/CryPy Ransomware Encrypting File"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Staging Domain)"

• "ET TROJAN Free Download Manager Backdoor Domain in DNS Lookup (fdmpkg .org)"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to Ursnif Domain (kidup .xyz)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2023-02-22"

• "ET TROJAN Suspected Kimsuky Related Actvity (GET)"

• "ET CURRENT_EVENTS Underminer EK Resource File Download M2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2i .nu)"

• "ET TROJAN APT28/Sednit DNS Lookup (pakistan-mofa .net)"

• "ET MOBILE_MALWARE Android.Trojan.AndroRAT.CE Checkin"

• "ET TROJAN Observed BLINDINGCAN Domain (www .sanlorenzoyacht .com in TLS SNI)"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (nikanps .top)"

• "ET TROJAN Win32/ViSystem CnC Checkin"

• "ET MOBILE_MALWARE Oscorp/UBEL Activity"

• "ET CURRENT_EVENTS Successful Santander Bank Phish 2016-10-28"

• "ET TROJAN Observed Evrial Domain (cryptoclipper .ru in DNS Lookup)"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (troublendsef .com)"

• "ET MALWARE Win32/DownWare.G Installer Request"

• "ET TROJAN Suspected Polonium CnC Checkin (result.php - process list) M2"

• "ET TROJAN Win32/WhiskerSpy - FTP STOR Command M1"

• "ET TROJAN HawkEye Keylogger FTP"

• "ET TROJAN Suspected DNS2TCP Connect"

• "ET MALWARE Win32/Sogou.H Variant Request"

• "ET TROJAN Observed MageCart CnC Domain in TLS SNI"

• "ET TROJAN Win32/SystemBC CnC Checkin"

• "ET TROJAN Observed DNS Query to Certishell Domain (limousine-service .cz)"

• "ET MOBILE_MALWARE APT33/Charming Kitten Android/LittleLooter Activity (POST) M3"

• "ET MALWARE User-Agent (Win95)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN MAGICHOUND-related DNS Lookup (msservice .site)"

• "ET TROJAN Win32/ArtraDownloader Checkin"

• "ET TROJAN Possible APT Sarhurst/Husar/Hussarini/Hassar CnC GET"

• "ET TROJAN GravityRAT CnC Domain (cvstyler .co .in in DNS Lookup)"

• "ET TROJAN IcedID Fake Resume Server in DNS Lookup"

• "ET TROJAN DPRK APT Related Domain in DNS Lookup (dafom .dev)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-12-06"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET EXPLOIT Metasploit Random Base CharCode JS Encoded String"

• "ET TROJAN Win32/Small.NMZ CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Gamaredon Information Stealer Data Exfiltration Attempt"

• "ET MALWARE Win32/Youtube Bot - CnC Checkin"

• "ET MALWARE Clickspring.net Spyware Reporting"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k6j .pw)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 4"

• "ET CURRENT_EVENTS Tech Support Scam - Generic Components"

• "ET CURRENT_EVENTS c0896 Hacked Site Response Hex (Outbound)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (l9b .org)"

• "ET TROJAN Win32/Expiro.CD Check-in"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Generic NewInjection Phishing Landing 2021-03-10"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Ransomware Decryptor Domain in DNS Query (decryptor .top)"

• "ET TROJAN Fake ChatGPT Domain in DNS Lookup (chat-gpt-pc .online)"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.aam CnC Domain in DNS Lookup"

• "ET TROJAN Possible CopyKittens DNS Lookup (main.windowskernel14.com)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 12)"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET TROJAN Win32/HMR RAT Sending System Information"

• "ET TROJAN ShivaGood Ransomware CnC Checkin"

• "ET TROJAN SManager Backdoor Domain in DNS Lookup"

• "ET TROJAN Linux/B1txor20 Backdoor DNS Tunnel Activity M2"

• "ET CURRENT_EVENTS Generic Personalized Google Firebase Hosted Phishing Landing"

• "ET TROJAN DonotGroup Staging Domain in DNS Query"

• "ET TROJAN Wintervivern Activity M4 (GET)"

• "ET TROJAN BLINDEAGLE CnC Domain (laminascol .linkpc .net) in DNS Lookup"

• "ET TROJAN Win32.Meredrop Checkin"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Fakealert.Rena CnC Checkin 2"

• "ET POLICY Suspicious Invalid HTTP Accept Header of ?"

• "ET TROJAN TA444 Domain in TLS SNI (bitscrunch .im .linkpc .net)"

• "ET TROJAN JanelaRAT CnC Checkin Observed"

• "ET TROJAN TA453 Related Activity (FTP)"

• "ET TROJAN Bandit Stealer Data Exfiltration Attempt"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (ewacootili .com)"

• "ET TROJAN Sofacy DNS Lookup checkwinframe.com"

• "ET TROJAN W32/Citadel File.php CnC POST"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET TROJAN APT CozyCar SSL Cert 2"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.2 Domain (lobbydesires .com) in TLS SNI"

• "ET CURRENT_EVENTS GoonEK encrypted binary (3)"

• "ET TROJAN Dmechant Exfil Passwords via SMTP"

• "ET TROJAN Win32/Unknown CnC Activity"

• "ET CURRENT_EVENTS Obfuscated LordEK Landing M1"

• "ET TROJAN Cobalt Strike Infrastructure CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Phishing Fake Mailbox Quota Increase Messages 2016-05-25"

• "ET TROJAN Win32.Raccoon Stealer Checkin Response M5"

• "ET TROJAN WinGo/YT Stealer CnC Domain in DNS Lookup"

• "ET TROJAN CobianRAT Receiving Additional Commands From CnC"

• "ET MOBILE_MALWARE Android/Spy.Agent.AON / Glancelove DNS Lookup 2 (glancelove .com)"

• "ET TROJAN Gasket Submitting Logs to CnC"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (websitetheme .com)"

• "ET CURRENT_EVENTS Canada Revenue Agency COVID-19 Assistance Eligibility Phishing Landing 2020-04-01"

• "ET TROJAN Win32/Drokbk Checkin Activity (GET)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hscare .info)"

• "ET TROJAN TA402/Molerats Pierogi Backdoor Activity"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Pontoeb CnC"

• "ET TROJAN ServHelper CnC Domain"

• "ET TROJAN Android/AhMyth RAT Command Inbound (Call Manager)"

• "ET TROJAN Observed BazarLoader Domain (dghns .xyz in TLS SNI)"

• "ET TROJAN Downloader.Win32.Adload (KaiXin Payload) Config Download"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN W32/Citadel Infection or Config URL Request"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Android/AhMyth RAT Command Inbound (Files Manager)"

• "ET TROJAN Subterranean Crimson Rat - Client Traffic"

• "ET TROJAN Possible KONNI CnC Activity"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET TROJAN Andariel Group Nukesped Variant CnC Checkin"

• "ET TROJAN OSX/Shlayer CnC Landing M2"

• "ET TROJAN Netwire RAT Check-in 2"

• "ET USER_AGENTS W32/OnlineGames User-Agent (LockXLS)"

• "ET MALWARE Win32/Spy.Agent.QCL Variant Activity (POST) M2"

• "ET MALWARE Observed Seetrol RAT Domain (seetrol .kr in TLS SNI)"

• "ET TROJAN Win32/Arkei Stealer CnC Checkin (GET)"

• "ET TROJAN Win32/Ficker Stealer Activity M3"

• "ET TROJAN Saker UA"

• "ET TROJAN DNS Query to Raspberry Robin Domain (g3 .rs)"

• "ET TROJAN Win32/CryPy Ransomware CnC Checkin"

• "ET TROJAN Soraya C2 User-Agent (default)"

• "ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN Suspected APT28 Related Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (APT34 CnC)"

• "ET TROJAN Mustang Panda APT Related Activity (Response)"

• "ET TROJAN Possible Malicious Invoice EXE"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker Payment)"

• "ET TROJAN DNS Query for known ShadowPad CnC 3"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-blog .com)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (safemeeting .online)"

• "ET MALWARE Suspicious User Agent Mozi11a"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle CDN GET]"

• "ET TROJAN Observed DNS Query to Vicious Panda CnC Domain"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN NORTHSTAR Client Data POST"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (izikatka0010 .com)"

• "ET TROJAN Win32/Trapwot FakeAV Checkin"

• "ET TROJAN ELF/Roboto - Possible Encrypted Roboto P2P Payload Requested M1"

• "ET TROJAN Suspected APT32/OceanLotus Activity"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-10-17"

• "ET MOBILE_MALWARE Arid Viper (es-last-telegram .firebaseio .com in DNS Lookup)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 63"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Cobalt Strike Stager Time Check M2"

• "ET TROJAN CNRarypt Ransomware CnC Activity"

• "ET TROJAN Emotet Certificate Observed M2"

• "ET TROJAN Possible CopyKitten DNS Lookup (ads-youtube .online)"

• "ET CURRENT_EVENTS PerSwaysion Landing Page M3"

• "ET TROJAN Possible DarkFinger tasklist Retrieval attempt"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (msresearchcenter .top in TLS SNI)"

• "ET TROJAN Executioner Ransomware Reporting Infection via SMTP"

• "ET TROJAN Observed DNS Query to AppleJeus Domain (rebelthumb .net)"

• "ET TROJAN TA406 Win32/Updog Backdoor Data Exfiltration Attempt"

• "ET MALWARE AdWare.MSIL.Solimba.b GET"

• "ET TROJAN TA453/CharmingKitten HYPERSCRAPE Tool Check-in Activity (GET)"

• "ET TROJAN Mirai Variant Domain (bigboatreps .pw in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (katesacker .club in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-02-21"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (aloyadakmashin .com)"

• "ET CURRENT_EVENTS Successful Ebay Phish M2 2016-12-29"

• "ET CURRENT_EVENTS Successful Australian Government myGov Credential Phish 2022-12-14"

• "ET TROJAN [ANY.RUN] WhiteSnake Stealer Reporting Request (Outbound)"

• "ET TROJAN BlackTech Plead Encrypted Payload Inbound"

• "ET TROJAN Obitel Downloader Request"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MALWARE Enhance My Search Spyware User-Agent (HelperH)"

• "ET MOBILE_MALWARE Android/LoanBee Data Stealer Data Exfiltration Domain (api .loanbee .tech) in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Airbnb COVID-19 Phish 2020-03-26"

• "ET TROJAN Observed DNS Query to UNC3890 Domain (pfizerpoll .com)"

• "ET TROJAN Mustang Panda APT Related Activity (POST)"

• "ET TROJAN Observed Cobalt Strike Related Domain (world .healthamericacu .com in TLS SNI)"

• "ET CURRENT_EVENTS Generic Bank Captcha Phishing Landing"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN [ANY.RUN] LgoogLoader Retrieving Config File"

• "ET TROJAN Win32/WindowsDefender Bypass Download Request"

• "ET TROJAN IceRat Backdoor Checkin"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (contractors-adnoc .com) 2022-12-05"

• "ET TROJAN Malicious SSL certificate detected (OSX/Keydnap CnC)"

• "ET TROJAN CozyDuke APT Possible SSL Cert 1"

• "ET CURRENT_EVENTS Successful WeTransfer Phish Oct 04 2016"

• "ET TROJAN Common Zbot EXE filename Dec 09 2013"

• "ET TROJAN Win32/RecordBreaker - Observed UA M7 (1235125521512)"

• "ET TROJAN Turla Snake OSX DNS Lookup (car-service .effers.com)"

• "ET TROJAN Win32/Pift Checkin 2"

• "ET TROJAN Zbot/Zeus or Related Infection Checkin"

• "ET TROJAN Observed ZLoader CnC Domain in SNI"

• "ET MOBILE_MALWARE Kimsuky AppleSeed CnC Checkin M2"

• "ET INFO Phishery Phishing Tool - Default SSL Certificate Observed"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (kontrola-poczty .site)"

• "ET TROJAN Possible APT30 or Win32/Nuclear HTTP Framework POST"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible CopyKittens DNS Lookup (windows-drive20.com)"

• "ET TROJAN ATTACKER IRCBot - reg - PRIVMSG Command"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 12"

• "ET TROJAN Win32/Cridex Checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 29"

• "ET TROJAN Observed Ttint Update CnC Domain in DNS Query"

• "ET TROJAN Possible Darkhotel Higasia Downloader Requesting Module"

• "ET TROJAN Sakula/Mivast RAT CnC Beacon 3"

• "ET TROJAN ThiefQuest CnC Domain in DNS Lookup"

• "ET TROJAN Platinum APT - Titanium Hardcoded String Observed"

• "ET CURRENT_EVENTS Phishing Landing via Webeden.co.uk (set) 2016-01-22"

• "ET USER_AGENTS suspicious User Agent (Lotto)"

• "ET MALWARE NivesroCheat CnC Activity M2"

• "ET TROJAN ArtraDownloader CnC Checkin"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (telecomly .info)"

• "ET TROJAN Probable OneLouder downloader (Zeus P2P)"

• "ET TROJAN W32/Lile.A DoS Outbound"

• "ET TROJAN Legion Loader Activity Observed (legion)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Magnitude EK (formerly Popads) Flash Exploit Requested"

• "ET TROJAN Observed BazarLoader Domain (bigjamg .xyz in TLS SNI)"

• "ET TROJAN Kimsuky Related Activity (GET)"

• "ET TROJAN Kimsuky Related FTP File Download"

• "ET TROJAN Win32/CryptFile2 Ransomware Checkin M2"

• "ET TROJAN SideWinder APT antibot script"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-26"

• "ET MALWARE My Search Spyware Config Download"

• "ET TROJAN SocGholish Domain in DNS Lookup (assay .porchlightcommunity .org)"

• "ET MOBILE_MALWARE Android APT-C-23 (kaniel-outis .info in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Bank of America Phish M2 2016-08-31"

• "ET TROJAN Observed Emotet Maldoc Retrieving Payload (2023-03-07) M3"

• "ET TROJAN TROJAN Win32-WebSec Reporting"

• "ET TROJAN OSX/Shlayer CnC Activity M1"

• "ET MALWARE W32/InstallRex.Adware Report CnC Beacon"

• "ET TROJAN Win32/Tofsee Unique Email Body Byte Sequence Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Scieron DNS Lookup (coastnews.darktech.org)"

• "ET TROJAN Soraya C2 User-Agent"

• "ET TROJAN W32.Dreambot File Upload (No Data Sent)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (naborzi .ru)"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN IXWARE Stealer Domain in DNS Lookup"

• "ET MOBILE_MALWARE Arid Viper (es-last-telegram .appspot .com in DNS Lookup)"

• "ET TROJAN Ransomware/Cerber Checkin M3 (3)"

• "ET TROJAN Win32/MillionLoader CnC Activity (Inbound)"

• "ET TROJAN DarkGate Domain in DNS Lookup (battlenet .la)"

• "ET TROJAN SnappyTCP Reverse Shell Header Value Observed"

• "ET TROJAN Chafer CnC DNS Query"

• "ET TROJAN BunnyLoader CnC Checkin - Heartbeat"

• "ET CURRENT_EVENTS Successful Tata Communications Phish 2016-08-19"

• "ET TROJAN Fake Software Download Redirect Leading to Malware M3"

• "ET TROJAN TigerHunter DOTM CnC Checkin"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (gamestoplay .bid)"

• "ET TROJAN Win32/Remcos RAT Checkin 781"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET CURRENT_EVENTS Fake World Health Organization COVID-19 Portal 2020-03-20"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (flywaytravelandtourism .com) 2022-12-05"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (tonikantos .one)"

• "ET TROJAN Win32/Gamaredon CnC Activity (POST) M3"

• "ET TROJAN [PTsecurity] Kraken Ransomware Start Activity 2"

• "ET WEB_CLIENT Tech Support Scam 2019-11-14"

• "ET CURRENT_EVENTS PluginDetect Observed - Possible EK Activity"

• "ET CURRENT_EVENTS Successful Yahoo Phish M1 2016-06-15"

• "ET TROJAN JS/HTA Downloader Behavior M3"

• "ET CURRENT_EVENTS CritXPack - Landing Page - Received"

• "ET CURRENT_EVENTS Github Phishing Landing 2018-07-19"

• "ET TROJAN CobianRAT Checkin to CnC"

• "ET TROJAN DNS Query for known ShadowPad CnC 5"

• "ET TROJAN Driveby Exploit Attempt Often to Install Monkif"

• "ET MOBILE_MALWARE Android APT-C-23 (bellamy-bob .life in TLS SNI)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN Latrodectus Alive Response M3"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-10-03"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (nigaragusoups .com)"

• "ET CURRENT_EVENTS Successful Email Settings Error Phish 2016-11-17"

• "ET TROJAN Win32/Agniane Stealer CnC Activity (GET) M2"

• "ET CURRENT_EVENTS Possible Successful Generic Phish to .gq Domain 2018-10-23"

• "ET TROJAN Linux/dtool IRC Command (EXEC)"

• "ET TROJAN Drive Receiving GET DDoS instructions"

• "ET TROJAN Trickbot Anchor ICMP Request"

• "ET CURRENT_EVENTS Generic Encoded Phishing Landing 2021-03-10"

• "ET TROJAN Observed Gamaredon APT Related Domain (acaenaso .ru in TLS SNI)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2017-12-19"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (admin .nikanps .top)"

• "ET TROJAN Observed DNS Query to ShadowPad Domain (greatsong .soundcast .me)"

• "ET TROJAN Octopus Malware CnC Server Connectivity Check"

• "ET TROJAN Chinotto CnC Activity (result)"

• "ET TROJAN Darkshell.A Checkin XOR C0 Win XP"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (bitscrunch .presentations .life)"

• "ET TROJAN Red Wolf/RedCurl Domain in DNS Lookup (eap .byethost10 .com)"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (down .downloadoneyoutube.co.vu)"

• "ET MALWARE Spyware Related User-Agent (UtilMind HTTPGet)"

• "ET TROJAN OceanLotus Stage 2 Domain in DNS Lookup (bootstraplink .com)"

• "ET TROJAN MAGICHOUND-related DNS Lookup (servicesystem .serveirc.com)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (mclearoptical .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ue2 .eu)"

• "ET TROJAN ELF/Mirai Variant UA Inbound (lessie)"

• "ET CURRENT_EVENTS Common Form POST - Netease Webmail Phishing Landing 2020-06-11"

• "ET TROJAN Win32/Ducktail Exfil Via Telegram (POST)"

• "ET TROJAN Plasmabot CnC Host Checkin"

• "ET TROJAN Possible Pegasus Related DNS Lookup (bulbazaur .com)"

• "ET TROJAN Win32/BlackCarat Response from CnC"

• "ET TROJAN Subterranean Crimson Rat - AssignID Command"

• "ET TROJAN Win32/Shrine.A CnC Checkin"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (greatersky .top)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN APT28/Sednit DNS Lookup (windowsappstore .net)"

• "ET CURRENT_EVENTS rechnung zip file download"

• "ET TROJAN TA453 BellaCiao CnC Domain in DNS Lookup (msn-service .co)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Win32/Unk Downloader CnC Activity"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET TROJAN Suspected Stealth Soldier Backdoor Related Activity M3 (GET)"

• "ET CURRENT_EVENTS Ulpian Credential Phish Landing Page 2022-11-22"

• "ET TROJAN Koobface Checkin via POST"

• "ET TROJAN Golang/Bandit Stealer Telegram Exfil Activity (POST)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Possible PHP.MAILER WebShell Register Shutdown Function Request Inbound"

• "ET TROJAN MalDoc/Gamaredon CnC Activity M3"

• "ET TROJAN Suspected Lazarus APT Validator Related Activity (POST)"

• "ET TROJAN Observed StrongPity CnC Domain (uppertrainingtool .com in TLS SNI)"

• "ET TROJAN APT40/Dadstache Related DNS Lookup"

• "ET TROJAN Backdoor.Win32.Dorkbot.AR Join IRC channel"

• "ET TROJAN VBS/Agent.PUK Data Exfiltration Request M1"

• "ET TROJAN Trojan Downloader User-Agent BGroom"

• "ET MALWARE System-defender.com Fake AV Install Checkin"

• "ET TROJAN ELF/Muhstik Scanner Module Activity"

• "ET TROJAN FatDuke Domain Observed"

• "ET TROJAN Win32/Delf.TJJ CnC Domain in DNS Lookup (cmps .58sky .com)"

• "ET CURRENT_EVENTS Successful Adobe Online Account Phish 2015-08-21"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Win32/TrojanClicker Variant Activity (GET)"

• "ET TROJAN Possible IRCBot.DDOS Common Commands"

• "ET WEB_SERVER Possible SQLi Attempt in User Agent (Inbound)"

• "ET TROJAN SmokeBot grab data plaintext"

• "ET MALWARE Ransomware Decryptor Domain in DNS Query (decoder .re)"

• "ET MALWARE Fake Wget User-Agent (wget 3.0) - Likely Hostile"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (protectionguardapp .club in TLS SNI)"

• "ET TROJAN MSIL.Orion Stealer Exfil via FTP"

• "ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)"

• "ET CURRENT_EVENTS Phishing Landing via Tripod.com M2 2016-03-31"

• "ET TROJAN Win32/Tnega Activity (GET)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M28"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-blog .xyz)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (dodgesteelbuildings .com)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (applicatwindomz .com)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (higmon .cyou)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (gigeram .com)"

• "ET MALWARE SuperAntiSpyware Install Checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 19"

• "ET TROJAN PowerShell/Agent.A DNS Lookup (go0gIe.com)"

• "ET TROJAN W32/iGrabber Info Stealer FTP Upload"

• "ET TROJAN Win32/GenKryptik.FKJZ CnC Exfil"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-04-05"

• "ET CURRENT_EVENTS Generic Phishkit Landing Page M2"

• "ET TROJAN Meredrop/Nusump Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike)"

• "ET TROJAN Backdoor Win32.Idicaf/Atraps"

• "ET CURRENT_EVENTS VigLink Redirect To HiYu Phishing Landing Page"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Activity (Check-in)"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN Possible WEBC2-GREENCAT Response - Embedded CnC APT1 Related"

• "ET TROJAN Observed DeltaStealer Domain (deltastealer .gq) in TLS SNI"

• "ET TROJAN ELF/Mirai Variant Activity (Outbound)"

• "ET CURRENT_EVENTS Successful Apple Phish M1 2016-11-15"

• "ET TROJAN Transparent Tribe/CapraRAT CnC Domain in DNS Lookup"

• "ET TROJAN Qbot Payload Request (2023-03-13) M7"

• "ET TROJAN OSX/Mokes.A CnC Heartbeat"

• "ET TROJAN Pteranodon Variant 1 Backdoor Checkin"

• "ET CURRENT_EVENTS Possible Successful Generic Phish Aug 31 2015"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (hz .nikanpsx .top)"

• "ET CURRENT_EVENTS Possible Phishing Landing Obfuscation 2016-03-17"

• "ET TROJAN Xbash CnC DNS Lookup (leakingprivacy .tk)"

• "ET CURRENT_EVENTS Apple Phishing Landing M2 Feb 13 2017"

• "ET TROJAN Buer Loader Update Request"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Baraka Ransomware CnC activity email SMTP"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Vawtrak CnC)"

• "ET TROJAN Observed Get2 CnC Domain in TLS SNI"

• "ET TROJAN Possible Godzilla Loader Base64 Filename"

• "ET TROJAN MSIL.L4L Stealer Systeminfo Exfiltration"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Win32\Cryptbot CnC Domain (suqpvu08 .top) in DNS Lookup"

• "ET TROJAN DDG Botnet CnC Slave POST"

• "ET TROJAN Possible UNC1878 Cobalt Strike CnC SSL Cert Inbound (Mountainvew)"

• "ET TROJAN Fake Variation of Mozilla 4.0 - Likely Trojan"

• "ET CURRENT_EVENTS Successful Chase Phish M1 2016-08-26"

• "ET CURRENT_EVENTS Possible Glazunov Java payload request /5-digit"

• "ET EXPLOIT Possible ETERNALBLUE MS17-010 Heap Spray"

• "ET TROJAN Malicious XSL file download (FTP)"

• "ET TROJAN Win32/RiskWare.YouXun.X CnC Server Response"

• "ET EXPLOIT Possible $MFT NTFS Device Access in HTTP Response"

• "ET CURRENT_EVENTS Observed TOAD Domain (bghelp .live in TLS SNI)"

• "ET TROJAN DustySky Payload Link Request"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (fenczyflyemiratetravels .com) 2022-12-05"

• "ET TROJAN Observed Glupteba CnC Domain (greenphoenix .xyz in TLS SNI)"

• "ET TROJAN BAZAR CnC Domain in DNS Lookup"

• "ET TROJAN Observed NimPlant UA (NimPlant)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious"

• "ET TROJAN APT37 M2RAT CnC Server Command - CMD"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Histories Google Chrome.txt) M1"

• "ET TROJAN Pteranodon Backdoor CnC POST"

• "ET TROJAN Arid Viper APT Advtravel Campaign DNS Lookup (fpupdate.info)"

• "ET TROJAN Taurus Stealer CnC Host Checkin"

• "ET TROJAN DADJOKE/Rail Tycoon Payload Extraction"

• "ET TROJAN Observed Malicious SSL Cert (LazarusGroup CnC)"

• "ET TROJAN Win32/Blacklegion Ransomware CnC Response"

• "ET TROJAN Win64/Agent.qwiakk CnC Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Spelevo EK Post-Compromise Data Dump"

• "ET CURRENT_EVENTS Successful BoA Credential Phish 2022-10-24"

• "ET TROJAN FakeAvCn-A Checkin 3"

• "ET CURRENT_EVENTS Instagram Phishing Landing 2020-04-10"

• "ET TROJAN Arkei Stealer IP Lookup"

• "ET USER_AGENTS Suspicious User-Agent (dBrowser CallGetResponse)"

• "ET TROJAN Cobalt Strike C2 Profile (news_indexedimages)"

• "ET TROJAN Win32/Kuluoz.B Request"

• "ET TROJAN SSL/TLS Certificate Observed (DiplomatLoader)"

• "ET CURRENT_EVENTS [TW] NOTG Obfuscation Redirect Observed M2"

• "ET CURRENT_EVENTS Fake Browser Update Domain in TLS SNI (onlinecasinopinup .xyz)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (m2care .cc)"

• "ET TROJAN Win32/FakeXPA Checkin URL"

• "ET TROJAN Tandem Espionage CnC Domain (sinelnikovd .ru) in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (g4 .tel)"

• "ET TROJAN NanoCore RAT Keepalive 4"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET TROJAN Observed Malicious SSL Cert (DonotGroup FireStarter CnC)"

• "ET MALWARE pdfspeedup Keep-Alive"

• "ET TROJAN Possible CopyKittens DNS Lookup (mywindows24.in)"

• "ET TROJAN FinSpy Related Flash Installer Activity"

• "ET TROJAN [Flashpoint] Possible CVE-2018-4878 Check-in"

• "ET TROJAN DNS Query to Raspberry Robin Domain (1i .pm)"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing"

• "ET TROJAN Nyanw0rm CnC Keep-Alive (Outbound) M2"

• "ET TROJAN PoshC2 - Observed Default URI Structure M31"

• "ET WEB_CLIENT DRIVEBY Social Engineering Toolkit JAR filename detected"

• "ET TROJAN Win32/Stealc/Vidar Stealer Style Headers In HTTP POST"

• "ET MALWARE MyGlobalSearch Spyware bar update 2"

• "ET TROJAN Win32/LOADOUT CnC Activity"

• "ET TROJAN Observed BazarLoader Domain (doldig .xyz in TLS SNI)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-06-17"

• "ET WEB_CLIENT Anonisma Paypal Phishing Loading Page 2015-12-29"

• "ET TROJAN DDoS.Win32/Nitol.B Checkin"

• "ET TROJAN Observed DNS Query to APT10 Related CnC Domain"

• "ET TROJAN ATTACKER IRCBot - PRIVMSG Response - ipconfig command output"

• "ET TROJAN Possible MalDoc Payload Download Nov 11 2014"

• "ET MOBILE_MALWARE APT33/Charming Kitten Android/LittleLooter Activity (POST)"

• "ET TROJAN Backdoor.Win32.PEx.942728546 Checkin"

• "ET TROJAN APT43 GOLDDRAGON Related Activity (GET)"

• "ET TROJAN Zbot/Beomok/PSW - HTTP POST"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET INFO Phishing Landing via Weebly.com M1 2016-02-02"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (verify-mail .space)"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (File Manager Actions)"

• "ET MOBILE_MALWARE Android APT-C-23 (mail-accout .club in TLS SNI)"

• "ET TROJAN TheTrick Banking Trojan User-Agent"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET TROJAN Diavol Communicating with CnC - Register M1"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (bolonna .ru)"

• "ET TROJAN TA430/Andariel APT Related CnC Domain in DNS Lookup (tech .micrsofts .tech)"

• "ET TROJAN Win32/Poweliks GET Request"

• "ET TROJAN Ransom.Win32.Birele.gsg Checkin"

• "ET CURRENT_EVENTS SUSPICIOUS lgfxsrvc.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN Cobalt Strike Malleable C2 (Custom)"

• "ET TROJAN [Mandiant] UNC4841 SEASPY Backdoor Activity M1"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (stabluk .com) 2022-12-05"

• "ET TROJAN Possible Pegasus Related DNS Lookup (cnn-africa .co)"

• "ET TROJAN Kimsuky ReconShark Related APT Activity"

• "ET CURRENT_EVENTS Successful Paypal Phish Jan 23 2017"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (readyqrscanner .club in TLS SNI)"

• "ET TROJAN Possible Dridex Download URI Struct with no referer"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-07-19"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Activity (Loading) M2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4w .wf)"

• "ET TROJAN LuminosityLink - Data Channel Client Request 2"

• "ET CURRENT_EVENTS Possible Successful Hotmail Phish Nov 21 2012"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-02-21"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN JEUSD CnC Domain Observed in DNS Query"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M12"

• "ET TROJAN AppleJeus - Kupay Wallet CnC Domain in DNS Lookup (kupaywallet .com)"

• "ET CURRENT_EVENTS Successful Yahoo Mail Phish 2016-10-14"

• "ET TROJAN Observed DNS Query to IcedID Domain (ajerlakerl .online)"

• "ET TROJAN CryptoWall/TeslaCrypt Payment Domain"

• "ET TROJAN MSIL/Modi RAT CnC Command Inbound (info)"

• "ET TROJAN W32/Trickbot C2 (networkDll module)"

• "ET TROJAN FormBook CnC Checkin (POST) M2"

• "ET CURRENT_EVENTS Observed TOAD Domain (bscare .us in TLS SNI)"

• "ET TROJAN Mal/Ransom-CE Connectivity Check"

• "ET USER_AGENTS Ufasoft bitcoin Related User-Agent"

• "ET MOBILE_MALWARE MOONSHINE payload C2 activity"

• "ET TROJAN Arid Gopher Related Domain in DNS Lookup (grace-fraser .site)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (consultants-ae-enoc .com) 2022-12-05"

• "ET TROJAN Possible Winnti-related DNS Lookup (resume .immigrantlol .com)"

• "ET TROJAN Win32/Coldstealer Sending System Information (POST)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (ultrafoks .com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (eznb .net)"

• "ET TROJAN Suspected APT43 BITTERSWEET Related Activity (POST)"

• "ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-07"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (teastycandycoffe .top)"

• "ET TROJAN Win32/PlugX Related Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android/SharkBot Related Domain in DNS Lookup"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (websitetheme .com in TLS SNI)"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET TROJAN Win32/TrojanDropper.Agent.SSQ Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (smoothcbots .xyz in TLS SNI)"

• "ET TROJAN dYdX NPM Package Backdoor Exfiltration Domain (api .circle-cdn .com) in DNS Lookup"

• "ET CURRENT_EVENTS Common Unhidebody Function Observed in Phishing Landing"

• "ET MOBILE_MALWARE Android APT-C-23 (aryastark .info in DNS Lookup)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (pakmarines .com)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-02-13"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (online-meeting .team)"

• "ET DOS HOIC with booster inbound"

• "ET TROJAN Observed Gootloader Domain in DNS Lookup (kepw .org)"

• "ET TROJAN Executable contained in DICOM Medical Image PACS DICOM Protocol Transfer"

• "ET MOBILE_MALWARE Android APT-C-23 (hotimael .com in DNS Lookup)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET TROJAN MSIL/TrojanDownloader.Small.CLJ CnC Activity"

• "ET TROJAN DNS Query to Remcos Domain (listpoints .online)"

• "ET TROJAN Candiru Related Domain in DNS Lookup (cuturl .app)"

• "ET TROJAN APT SuperhardCorp DNS Lookup (ohio.sysbloger.com)"

• "ET TROJAN Win32/Gamaredon Payload Request (GET)"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Kelihos.F exe Download 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (cloud-avira .com) in DNS Lookup"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .caching .oysterfloats .com)"

• "ET TROJAN MWI Maldoc Stats Callout Aug 18 2015"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Observed NSO Group CnC Domain in TLS SNI (bananakick .net)"

• "ET TROJAN Malicious SSL Cert (Magecart)"

• "ET TROJAN Arid Viper APT Related Domain in DNS Lookup (deangelomcnay .news)"

• "ET TROJAN Ursnif Variant CnC Beacon 4"

• "ET CURRENT_EVENTS Adobe Online Document Phishing Landing M2 2016-04-25"

• "ET TROJAN DNS Query to Jaff Domain (orhangazitur . com)"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike Malleable C2 Domain)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN SysJoker Successful Command Execution (POST)"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET TROJAN Red October/Win32.Digitalia Checkin cgi-bin/ms/check"

• "ET TROJAN Observed SSV Agent CnC Domain (gitcloudcache .com in TLS SNI)"

• "ET TROJAN Observed Evrial Domain (projectevrial .ru in DNS Lookup)"

• "ET TROJAN Locky Ransomware Renaming File via SMB"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Trojan/Downloader.Fosniw.sap Reporting via SMTP"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 4"

• "ET TROJAN Observed Gamaredon Domain (iraty .ru in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (cecilia-gilbert .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful Google Drive Phish M1 2016-12-02"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET TROJAN Sofacy DNS Lookup check-fix.com"

• "ET TROJAN Magecart/Skimmer Domain in DNS Lookup (cloud-sources .com)"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit HFS Actor"

• "ET CURRENT_EVENTS Dropbox Phishing Landing 2018-01-18"

• "ET MALWARE Vombanetwork Spyware User-Agent (VombaProductsInstaller)"

• "ET TROJAN NginxSpy Magic Bytes M2 (Inbound)"

• "ET TROJAN Win32/Injector.DYZG Variant Checkin"

• "ET TROJAN [ANY.RUN] Win32/EternityClipper CnC Activity (Address Change) (POST)"

• "ET CURRENT_EVENTS Successful Apple Phishing 2016-03-01 M5"

• "ET TROJAN JynxLoaderV2 CnC Command (INSTALL)"

• "ET MOBILE_MALWARE Android/SndApps.SM Sending Information to CnC"

• "ET TROJAN PowerTrick Known Key 2"

• "ET INFO Suspicious HTML Decimal Obfuscated Title - Possible Phishing Landing Apr 19 2017"

• "ET TROJAN W32/Jabberbot.A Trednet XMPP CnC Beacon"

• "ET TROJAN Sofacy DNS Lookup checkmalware.info"

• "ET TROJAN APT32 CnC in DNS Lookup"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5kx .me)"

• "ET TROJAN Soraya C2 User-Agent (VHIbot/1.0)"

• "ET TROJAN APT28/Sednit DNS Lookup (nato-hq .com)"

• "ET TROJAN PureCrypter Requesting Injector M1"

• "ET CURRENT_EVENTS Hostile Gate landing seen with pamdql/Sweet Orange base64"

• "ET TROJAN Possible DarkHotel Landing M3"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Observed TA444 Domain (bankofamerica .offerings .cloud in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4c .pm)"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup"

• "ET CURRENT_EVENTS Successful UPS Phish 2015-11-05"

• "ET CURRENT_EVENTS Zimbra Phishing Landing on Appspot Hosting"

• "ET TROJAN Trickbot Checkin Response"

• "ET TROJAN Inception APT malware"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-cdn .xyz)"

• "ET TROJAN Symbiote CnC Domain in DNS Lookup (dpf .fm)"

• "ET CURRENT_EVENTS Successful SeniorPeopleMeet Phish M2 2016-09-14"

• "ET TROJAN PWS.Win32/Daceluw.A Checkin"

• "ET TROJAN Felismus CnC Beacon 2"

• "ET TROJAN [401TRG] Backdoor.BEACON SSL Cert Inbound (infinitysoftwares .com)"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (dataupdates .live)"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (igsecurity .email)"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (encrypt-email .online)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing on Appspot Hosting"

• "ET CURRENT_EVENTS Successful Bank of America Phish M4 2016-10-27"

• "ET TROJAN Win32/Vulturi CnC Activity (GET)"

• "ET TROJAN ABUSE.CH Zloader CnC Domain Detected"

• "ET TROJAN Observed Magecart Skimmer Domain (cloudflare-cdnjs .com in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Outlook Phish 2022-10-06"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 98"

• "ET TROJAN LNK/Konni APT CnC Checkin (GET)"

• "ET TROJAN Win32.Glupteba/ClIEcker CnC Checkin"

• "ET TROJAN W32/Siggen.Dropper CnC Beacon"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET MALWARE Observed Bypass Ticket Monitoring Domain (www .bypass .cn in TLS SNI)"

• "ET TROJAN Possible Win32/Hupigon ip.txt with a Non-Mozilla UA"

• "ET TROJAN Platinum APT - Titanium Payload CnC Checkin (x64)"

• "ET TROJAN Internet Protection FakeAV checkin"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (alsmgjk-igusj .com)"

• "ET EXPLOIT Access To mm-forms-community upload dir (Inbound)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (achilleaso .ru)"

• "ET CURRENT_EVENTS Internet Explorer Information Disclosure Vuln as Observed in RIG EK Prefilter M2 Dec 06"

• "ET TROJAN SOMNIRECORD Backdoor DATA Command in DNS Query"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET CURRENT_EVENTS Fake Google Chrome Error Landing Page, Load Payload"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful American Express Phish M2 2016-10-31"

• "ET TROJAN Worm.Win32.Vobfus Checkin 3"

• "ET TROJAN China Based APT Related Domain in DNS Lookup (p1 .offline-microsoft .com)"

• "ET TROJAN Fake Browser Update via Error Page Loader"

• "ET TROJAN MSIL/n2019cov (COVID-19) Ransomware CnC Checkin"

• "ET TROJAN Possible JKDDOS download cl.exe"

• "ET CURRENT_EVENTS Successful Personalized Email Phish 2016-07-22"

• "ET TROJAN PoshC2 - Observed Default URI Structure M18"

• "ET MALWARE Successful QuizScope Installation"

• "ET TROJAN FatDuke Domain Observed"

• "ET TROJAN Win32/keyzetsu Stealer Variant Exfil via Telegram (Response)"

• "ET CURRENT_EVENTS Silicon Valley Bank Credential Phish Landing Page M1"

• "ET EXPLOIT Fortra MFT Deserialization Remote Code Execution Attempt (CVE-2023-0669) M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (zxn .fyi)"

• "ET TROJAN TorrentLocker DNS Lookup (ssl-server24.ru)"

• "ET MOBILE_MALWARE Android APT-C-23 (max-eleanor .info in DNS Lookup)"

• "ET CURRENT_EVENTS Successful PlayerUnknown's Battlegrounds Phish 2021-11-10"

• "ET TROJAN JavaRAT Requesting Screen Size"

• "ET TROJAN Observed Gamaredon Domain (len61 .procellarumbi .ru in TLS SNI)"

• "ET TROJAN Java/Jacksbot Check-in"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2019-07-09"

• "ET INFO Base64 Data URI Javascript Refresh - Possible Phishing Landing"

• "ET CURRENT_EVENTS Possible BadRabbit Driveby Download M1 Oct 24 2017"

• "ET TROJAN Golang/Webbfustator DNS Tunneling Activity"

• "ET CURRENT_EVENTS Successful Formbuddy Credential Phish Submission 2016-01-15"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (taysirgi .ru)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (mshelp09 .live)"

• "ET TROJAN Invoke-Phant0m Payload Request (GET)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (darkmansion .org)"

• "ET TROJAN Foudre Checkin M2"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Shaolin)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (for71 .procellarumbi .ru)"

• "ET TROJAN Win32/Upgilf CnC Beacon"

• "ET TROJAN Win32/Remcos RAT Checkin 84"

• "ET CURRENT_EVENTS Successful Gmail Phish 2016-12-06"

• "ET CURRENT_EVENTS Successful RBC Royal Bank Phish M2 Aug 17 2017"

• "ET TROJAN Possible Inbound PowerShell via Invoke-PSImage Stego"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (deftsecurity .com in TLS SNI)"

• "ET TROJAN Win32/Spy.Tuscas"

• "ET TROJAN Linux/ShellshockCampaign.DDOSBot Reporting IP"

• "ET TROJAN Jadtree Downloader rar"

• "ET TROJAN W32/LetsGo.APT Sleep CnC Beacon"

• "ET TROJAN WORM_VOBFUS Requesting exe"

• "ET TROJAN Link Implant CnC Activity (POST)"

• "ET TROJAN Bladabindi/njrat CnC Command (Remote Shell)"

• "ET TROJAN Zebrocy Backdoor CnC Activity"

• "ET TROJAN SSL/TLS Certificate Observed (Magecart)"

• "ET MALWARE SearchProtect PUA User-Agent Observed"

• "ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) M3"

• "ET CURRENT_EVENTS Observed TOAD Domain (a2help .us in TLS SNI)"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (centos-pkg .org)"

• "ET TROJAN W32/Numnet.Downloader CnC Checkin 2"

• "ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Apr 4"

• "ET MOBILE_MALWARE Android APT-C-23 (michael-keaton .info in TLS SNI)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (digitalcollege .org)"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET TROJAN Worm.VBS.ayr CnC command (is-enum-folder)"

• "ET TROJAN MSIL/PSW.Agent.QJK Stealer Data Exfil Via HTTP"

• "ET TROJAN Reptile Linux LKM Rootkit Backdoor Activity"

• "ET TROJAN Observed Malicious SSL Cert (ReactGet Group)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN NSO Group Pegasus CnC Domain Observed in DNS Query"

• "ET TROJAN APT32/OceanLotus Associated Domain in DNS Lookup (facebookdeck .com)"

• "ET TROJAN Win32/MereTam.A Ransomware CnC Checkin"

• "ET TROJAN Banker/Banbra Related HTTP Post-infection Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MALWARE EELoader Malware Packages User-Agent (EELoader)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Solarbot Check-in"

• "ET TROJAN Fullz House Credit Card Skimmer Data Exfil"

• "ET TROJAN Observed Buran Ransomware UA"

• "ET MALWARE Win32/TrojanDownloader.Agent.BXA CnC Activity"

• "ET TROJAN Win32/Trojan.Agent.AXMO CnC Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (harper-monty .site in TLS SNI)"

• "ET TROJAN DonotGroup CnC Domain in DNS Lookup"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (pleaseletmesleep .fun)"

• "ET TROJAN Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (updateservicecenter .com)"

• "ET MALWARE User-Agent (0xa10xa1HttpClient)"

• "ET MALWARE OSX/Bundalore Loader Activity"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (vie-en-islam .com)"

• "ET TROJAN Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (Unicode)"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to highdatabase .com"

• "ET TROJAN Observed Malicious SSL Cert (CoreDn/BLINDINGCAN Activity)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN [PTsecurity] Win32/Remcos RAT Checkin 51"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN W32/VPEYE Trojan Downloader User-Agent (VP-EYE Downloader)"

• "ET TROJAN Possible SQUIRRELWAFFLE Server Response"

• "ET TROJAN Observed DNS Query to ElectronBot Domain (Electron-Bot .s3 .eu-central-1 .amazonaws .com)"

• "ET TROJAN Ponmocup HTTP Request (generic) M1"

• "ET ATTACK_RESPONSE Mana Tools-Lone Wolf Admin Panel Inbound"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jan 17 2017"

• "ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M3"

• "ET TROJAN Bot Backdoor Checkin/registration Request"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M4"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN OilRig CnC DNS Lookup (windowspatch .com)"

• "ET CURRENT_EVENTS Terse POST to Wordpress Folder - Probable Successful Phishing M2"

• "ET CURRENT_EVENTS Successful Adobe Online Document Phish 2016-04-25"

• "ET TROJAN JS/Cloud9 Domain (cloud-miner .de) in DNS Lookup"

• "ET TROJAN CozyDuke APT Possible SSL Cert 8"

• "ET TROJAN Python Stealer/Clipper Related Domain in DNS Lookup (kekwltd .ru)"

• "ET CURRENT_EVENTS EDD Credential Phish Landing Page 2023-03-16 M1"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-schnellvpn .com)"

• "ET CURRENT_EVENTS BT Group Credential Phish Landing Page 2022-07-01"

• "ET TROJAN Observed BazarLoader Domain (gut45bg .xyz in TLS SNI)"

• "ET CURRENT_EVENTS Observed TOAD Domain (brhelp .live in TLS SNI)"

• "ET TROJAN Win32/Coreshell Checkin (APT28 Related)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-10"

• "ET TROJAN AlphaCrypt Connectivity Check 1"

• "ET TROJAN Atom Logger exfil via SMTP"

• "ET TROJAN W32/Farfli.BHQ!tr Dropper CnC Beacon 2"

• "ET CURRENT_EVENTS Revalidation Phish Landing Nov 13 2015"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-endpoint .com)"

• "ET TROJAN Win32/Sventore.B CnC Checkin"

• "ET TROJAN LegionLoader Activity Observed (LegionClient)"

• "ET TROJAN Win32.Cerberus RAT Checkin Outbound"

• "ET MOBILE_MALWARE Android APT-C-23 (login-yohoo .com in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (jscloud .biz in TLS SNI)"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to avsvmcloud .com"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN IrcBot Fantasy Name Gen"

• "ET TROJAN GCleaner Downloader Activity M5"

• "ET TROJAN KilerRAT CnC - Remote Shell"

• "ET TROJAN Malicious SSL certificate detected (Possible Sinkhole)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (7yfb .com)"

• "ET TROJAN Lurk Downloader Check-in"

• "ET MOBILE_MALWARE APT-C-23 Related CnC Domain in DNS Lookup (linda-gaytan .website)"

• "ET TROJAN Win32.Crypt.nc Checkin"

• "ET TROJAN PoshC2 - Observed Default URI Structure M7"

• "ET TROJAN MSIL/Lightning Stealer Exfil Activity"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 23"

• "ET TROJAN MuddyWater Payload Registering with CnC"

• "ET TROJAN Night Dragon CnC Traffic Outbound 2"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET CURRENT_EVENTS SUSPICIOUS mssrs.exe in URI Probable Process Dump/Trojan Download"

• "ET CURRENT_EVENTS Observed TOAD Domain (kelbyonel .nl in TLS SNI)"

• "ET TROJAN AppleJeus - Union Crypto CnC Domain in DNS Lookup (unioncrypto .vip)"

• "ET TROJAN Mekotio HTTP Method (111SA)"

• "ET MALWARE Adware.Kraddare Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Lazarus APT MalDoc 2020-11-30)"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 14"

• "ET WEB_SERVER WebShell - ASPyder - File Create - POST Structure"

• "ET CURRENT_EVENTS Successful Mailbox Update Phish 2016-02-17 M2"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET TROJAN Observed DNS Query to Malicious Powershell Payload domain (onerecovery .click)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart)"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (metaemailsecurity .com)"

• "ET TROJAN Sarwent CnC Response (update_exec)"

• "ET CURRENT_EVENTS Successful PostBank Credential Phish 2022-12-12"

• "ET TROJAN Blackbeard Check-in"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (tplinkupdates .space)"

• "ET MALWARE Antispywaremaster.com/Privacyprotector.com Fake AV Checkin"

• "ET TROJAN ShadowPad Backdoor Related Domain in DNS Lookup (grandfoodtony .com)"

• "ET TROJAN PHPs Labyrinth Backdoor Stage1 CnC Activity"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MALWARE Loadmoney Checkin 2"

• "ET USER_AGENTS Win32/Feebs.kw Worm User-Agent Detected"

• "ET CURRENT_EVENTS US Bank Phishing Landing"

• "ET TROJAN Observed Atomic macOS (AMOS) Stealer Payload Deliver Domain (xn--tradgsvews-0ubd3y .com) in TLS SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (blackleopard .myvnc .com)"

• "ET TROJAN ELF/Emptiness v1.1 UDP Flood Command Inbound"

• "ET TROJAN OSX/WireLurker CnC Beacon"

• "ET ATTACK_RESPONSE Unusual FTP Server Banner on High Port (WinFtpd)"

• "ET TROJAN Possible CopyKittens DNS Lookup (img.gmailtagmanager.com)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4n .wf)"

• "ET USER_AGENTS Suspicious User-Agent (CFS Agent)"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (internal-message .app)"

• "ET TROJAN Observed Malicious SSL Cert (Gootkit CnC)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Sundown EK Secondary Landing Apr 20 2015"

• "ET TROJAN APT DarkHydrus DNS Lookup 13"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (hamrah .nikanps .top)"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (nikanpsx .top)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (deportes24-7 .com)"

• "ET TROJAN LNK/Sherlock Stealer Payload Inbound"

• "ET TROJAN Cobalt Strike Beacon Activity"

• "ET TROJAN DonotGroup Stage 2 CnC Domain in DNS Lookup"

• "ET TROJAN Wonton-JH Checkin"

• "ET POLICY My2022/Beijing2022 App (DNS Lookup) 3"

• "ET TROJAN Suspected DNS2TCP Auth"

• "ET CURRENT_EVENTS FoxxySoftware - Landing Page"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET CURRENT_EVENTS USPS Credential Phish Landing Page M1 2023-04-28"

• "ET TROJAN MSIL/Unk.HT-Based Ransomware CnC Checkin"

• "ET TROJAN W32/Dridex Binary Download Mar 23 2016"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (frightysever .org)"

• "ET TROJAN Win64/Vabushky.A Malicious driver download"

• "ET TROJAN MSIL/Crimson CnC Server Command (info) M1"

• "ET TROJAN Observed Gamaredon Domain (marginisbi .ru in TLS SNI)"

• "ET TROJAN Win32/Phoenix Keylogger SMTP Exfil - Clipboard"

• "ET MOBILE_MALWARE Android APT-C-23 (account-googlc .com in DNS Lookup)"

• "ET TROJAN MSIL/CoalaBot CnC Activity"

• "ET TROJAN Win32/0xtaRAT CnC Activity M4 (GET)"

• "ET TROJAN Aura Ransomware User-Agent"

• "ET TROJAN Observed Malicious SSL Cert (Zloader CnC)"

• "ET MALWARE W32/WinWrapper.Adware Initial Install Beacon"

• "ET TROJAN Win32.MSUpdater C&C traffic GET"

• "ET TROJAN W32/Zbot.Variant CnC Response"

• "ET TROJAN Observed DNS Query to ROMCOM RAT Domain (gov .mil .ua .aspx .io)"

• "ET TROJAN OSX/ZuRu Activity (POST)"

• "ET CURRENT_EVENTS Generic Phish Landing Page (2023-10-26)"

• "ET CURRENT_EVENTS Possible Java Applet JNLP applet_ssv_validated Click To Run Bypass"

• "ET TROJAN Observed Ducktail Malware Related Domain in TLS SNI (ductai .xyz)"

• "ET CURRENT_EVENTS Successful Adobe Phish Jun 17 2015"

• "ET TROJAN Asterope Checkin"

• "ET TROJAN Kimsuky CnC Domain (lifehelper .kr) in DNS Lookup"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (minotos .xyz)"

• "ET TROJAN Observed Malicious SSL Cert (Possible APT33 CnC)"

• "ET MOBILE_MALWARE Android/Drinik Checkin Activity (POST)"

• "ET TROJAN Possible MSIL/Solorigate.G!dha/SUPERNOVA Webshell Access Request"

• "ET TROJAN Observed Teal Kurma Domain (ud .ybcd .tech in TLS SNI)"

• "ET TROJAN MSIL/NR42 Bot Parsing Config From Webpage"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 4"

• "ET TROJAN Unicorn Stealer Activity (POST)"

• "ET TROJAN Win32/Unknown Stealer Command (domaindetect) (Outbound)"

• "ET TROJAN Alman Dropper Checkin"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Veridian Credit Union Credential Phish 2022-11-08"

• "ET TROJAN Glupteba CnC Domain in DNS Lookup"

• "ET MALWARE DealPly Adware CnC Beacon 3"

• "ET TROJAN Win32/Vflooder.C Connectivity Check"

• "ET CURRENT_EVENTS Banque et Assurances Phishing Landing"

• "ET TROJAN IcedID CnC Domain in SNI"

• "ET TROJAN ComRAT CnC Domain in DNS Lookup"

• "ET TROJAN Possible Pegasus/Trident Related HTTP Beacon 5"

• "ET TROJAN W32/Dridex POST CnC Beacon"

• "ET TROJAN APT CozyCar SSL Cert 7"

• "ET CURRENT_EVENTS Successful Google Drive Phish M2 2016-12-02"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN DNS Query to IcedID Domain (guaracheza .pics)"

• "ET TROJAN Win32/Neshta.A Posting Data"

• "ET TROJAN Win32/0xtaRAT CnC Activity M1 (GET)"

• "ET TROJAN Backdoor.Darpapox/Jaku Initial C2 Checkin"

• "ET CURRENT_EVENTS Successful SFR Phishing 2015-11-24"

• "ET TROJAN Possible Andromeda download with fake Zip header (2)"

• "ET CURRENT_EVENTS Possible Sucessful Generic Phish (set) 2020-08-04"

• "ET TROJAN Parallax CnC Activity M7 (set)"

• "ET TROJAN Evilnum Activity (GET)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2019-12-12"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN Win32/Kumquat Loader Activity (Connect)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (journalide .org)"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M1"

• "ET TROJAN W32/Rovnix Activity"

• "ET TROJAN Windows driverquery -si Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN Observed DNS Query to Buer - DomainInfo Domain"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Nivdort Checkin"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (treegreeny .org)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET MALWARE Win32/Adware.YoutubeDownloaderGuru.A Variant CnC Activity"

• "ET TROJAN Possible Tinba DGA NXDOMAIN Responses"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Secure Email Portal Lure Landing Page"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN [PTsecurity] Fake SSL Certificate Observed (Google)"

• "ET TROJAN Possible Drive DDoS Check-in"

• "ET TROJAN Linux/dtool IRC Command (STOP)"

• "ET MOBILE_MALWARE Android APT-C-23 (lord-varys .info in TLS SNI)"

• "ET MALWARE Sality Virus User Agent Detected (KUKU)"

• "ET TROJAN Possible Winnti TLS Certificate Observed"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 5"

• "ET TROJAN DeathStalker/PowerPepper CnC Domain in DNS Lookup (gofinancesolutions .com)"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing on Appspot Hosting"

• "ET MALWARE Surfaccuracy.com Spyware Install User-Agent (SF Installer)"

• "ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in"

• "ET CURRENT_EVENTS TMOBILE Successful Credential Phish 2022-11-01"

• "ET CURRENT_EVENTS KaiXin Landing Page Oct 05 2015"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.hk)"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 Sep 15 2017"

• "ET CURRENT_EVENTS Possible CookieBomb Generic JavaScript Format"

• "ET MOBILE_MALWARE Android APT-C-23 (maxlight .us in DNS Lookup)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (attentionmagnet .top in TLS SNI)"

• "ET TROJAN IMDDOS Botnet User-Agent STORMDDOS"

• "ET TROJAN Dridex Post Check-in Activity"

• "ET TROJAN Observed Glupteba CnC Domain (zaoshang .ru in TLS SNI)"

• "ET WEB_SERVER WebShell - ASPyder - File Browser - Interface"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (secure-message .online)"

• "ET TROJAN AZORult Variant.4 Checkin M2"

• "ET TROJAN ModPipe CnC Activity (POST)"

• "ET TROJAN Suspected Sidewinder APT Phishing Activity - Landing Page URI Pattern"

• "ET TROJAN Win32.Chroject.B ClickFraud Request"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Win32/Small.NQT!tr CnC Activity"

• "ET TROJAN Observed Operation Silent Watch Domain in DNS Lookup (edupoliceam .info)"

• "ET TROJAN Cayosin/Mirai CnC Domain in DNS Lookup"

• "ET TROJAN W32/Kazy.325252 Variant CnC Beacon 2"

• "ET TROJAN PowerGhost Checkin CnC in DNS Query"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET TROJAN Linux.Ngioweb Stage 1 CnC Activity Server Response (WAIT)"

• "ET TROJAN DNS Query to TA444 Domain (docupload .site)"

• "ET TROJAN OSX/Keydnap DNS Query to CnC"

• "ET TROJAN Possible CopyKittens DNS Lookup (windows-kernel.in)"

• "ET CURRENT_EVENTS Successful Apple Phish M1 2015-12-02"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup"

• "ET TROJAN Linux/HiddenWasp CnC Request (set)"

• "ET TROJAN XDUpload Sending Screenshot Upload Progress"

• "ET TROJAN MyKings Bootloader Variant Requesting Payload M2"

• "ET TROJAN Py/MechaFlounder CnC Activity - Reporting Download Command Error"

• "ET TROJAN Suspicious bot.exe Request"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (villageskaier .com)"

• "ET CURRENT_EVENTS Observed Coin-Hive In Browser Mining Domain (coin-hive .com in TLS SNI)"

• "ET TROJAN W32/DoubleTap.APT Downloader CnC Beacon"

• "ET TROJAN Magecart Loader Domain in DNS Lookup (2xdepp .com)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing Sept 3"

• "ET TROJAN Cobalt Strike Infrastructure CnC Domain in DNS Lookup"

• "ET INFO Download file with BITS via LNK file (Likely Malicious)"

• "ET TROJAN Malicious Second Stage Payload Inbound 2021-02-19"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .sync .oystergardens .club)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Observed Malicious SSL Cert (ServHelper CnC)"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (mnem .wf)"

• "ET MOBILE_MALWARE Android APT-C-23 (italk-chat .info in TLS SNI)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Win32/Fujacks Activity"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (cr20g .org)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN PunkeyPOS HTTP CnC Beacon 1"

• "ET CURRENT_EVENTS Successful Email Login Phish 2016-06-02"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish Loading Page 2016-01-07"

• "ET CURRENT_EVENTS Generic Custom Logo Phishing Landing"

• "ET CURRENT_EVENTS Microsoft Encrypted Email Phishing Landing 2016-06-23"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 13"

• "ET CURRENT_EVENTS Yahoo Password Strength Phishing Landing 2016-08-24"

• "ET TROJAN Observed Sandman APT LuaDream Backdoor Domain (ssl .explorecell .com) in TLS SNI"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Origami.b / Donot DNS Lookup"

• "ET TROJAN Tandem Espionage CnC Domain (ckrddvcveumq .ru) in DNS Lookup"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (axhelp .us)"

• "ET TROJAN Darkgate Stealer CnC Checkin (POST)"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET CURRENT_EVENTS Caixa Phishing Landing"

• "ET TROJAN W32/Safe User Agent Fantasia"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[Yelp GET]"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (sabitpo .ru)"

• "ET MALWARE Potentially Unwanted Application AirInstaller"

• "ET TROJAN APT28 DealersChoice DNS Lookup (zpfgr .com)"

• "ET MALWARE Win32/MobiGame Install Stats Checkin M3"

• "ET TROJAN Suspected fraud-bridge DNS Tunnel"

• "ET CURRENT_EVENTS [TW] Robin Banks HTTP HOST M2"

• "ET MALWARE Observed Seetrol RAT Domain (seetrol .co .kr in TLS SNI)"

• "ET TROJAN Suspicious User-Agent (hi)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Transparent Tribe/CapraRAT CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Docusign Phishing Landing Hosted via Weebly"

• "ET CURRENT_EVENTS Successful Postbank Online Banking Phish M2 2016-09-30"

• "ET TROJAN Rogue.Win32/FakePAV Checkin"

• "ET WEB_SERVER IIS ISN BackDoor Command Get Logpath"

• "ET TROJAN Observed TA444 Domain (doc .apple .com .premienoe .aidl .eonw .line .pm) in TLS SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sharik/Smoke Loader Microsoft Connectivity check"

• "ET MALWARE PUP Win32/DownloadAssistant.A Checkin"

• "ET TROJAN W32/DelfInject.A CnC Checkin 2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to Gamaredon Domain (80delay .dzhabaripa .ru)"

• "ET CURRENT_EVENTS Observed TOAD Domain (mshelp09 .live in TLS SNI)"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M14"

• "ET TROJAN Observed IcedID CnC Domain (carsfootyelo .com in TLS SNI)"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M15"

• "ET MALWARE Potentially Unwanted Application AirInstaller CnC Beacon"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN AZORult v3.3 Server Response M3"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (mailh .alit .live)"

• "ET TROJAN Win32/a310Logger Data Exfil via SMTP"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (ns4.hostasa.org)"

• "ET TROJAN FIN12 Related ICECANDLE/Cobalt Strike Activity (GET)"

• "ET INFO Phishing Landing via Weebly.com M4 2016-02-02"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET MALWARE Suspicious User-Agent (Updater)"

• "ET USER_AGENTS Si25f_302 User-Agent"

• "ET TROJAN XDMonitor Checkin Activity"

• "ET POLICY Android.Plankton/Tonclank Successful Installation Device Information POST Message Body"

• "ET TROJAN Malicious Mega Chrome Extension Exfil Domain (www .megaopac .host in DNS Lookup)"

• "ET TROJAN Likely Evil Request for uac.exe With Minimal Headers"

• "ET MOBILE_MALWARE Android GolfSpy (services4me .net in TLS SNI)"

• "ET TROJAN IRC channel topic misc bot commands"

• "ET CURRENT_EVENTS Evil Redirect Compromised WP Feb 01 2016"

• "ET CURRENT_EVENTS PlayerUnknown's Battlegrounds Credential Phish Landing Page M1 2022-07-05"

• "ET TROJAN [TGI] Py.Machete FTP Exfil 1"

• "ET INFO Phishing Landing via Weebly.com M2 2016-02-02"

• "ET TROJAN Luminosity Link Variant CnC Activity (get_failed)"

• "ET CURRENT_EVENTS Successful Wells Fargo Mobile Phish 2016-08-01 M1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (oj8 .eu)"

• "ET MALWARE Deep Panda CnC Check-In"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher Sending Credit Card Info"

• "ET CURRENT_EVENTS DHL Credential Phish Landing Page 2022-06-09"

• "ET TROJAN DNS Query to Raspberry Robin Domain (xz4 .biz)"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor GETFILE Command (Inbound)"

• "ET TROJAN Remote Desktop Spy Install Checkin"

• "ET INFO Data Submitted to ukit domain - Possible Phishing M2 2016-06-29"

• "ET MALWARE SilverSpeedup Generic PUA Software UA"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phishing 2015-11-20"

• "ET CURRENT_EVENTS Linkedin Phishing Landing on Appspot Hosting"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (owisportlittle .com)"

• "ET CURRENT_EVENTS Parrot TDS Malicious Response"

• "ET TROJAN Possible CopyKittens DNS Lookup (wethearservice.com)"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Rift)"

• "ET CURRENT_EVENTS Successful FreeMobile (FR) Phish M2 2016-10-06"

• "ET TROJAN Deathstalker/Evilnum Delivery Domain in DNS Lookup (puccino .altervista .org)"

• "ET TROJAN Unk/LNKR CnC Domain Observed in DNS Query"

• "ET MOBILE_MALWARE Trojan-Ransom.AndroidOS.CryCrypt.c Checkin"

• "ET TROJAN FakeAV Win32/Antivirus2008 CnC Beacon"

• "ET MALWARE E2give Related Downloading Code"

• "ET CURRENT_EVENTS SunDown EK RIP Landing M1 B643"

• "ET CURRENT_EVENTS Possible BulletProofLink Phishkit Activity - Retrieving Images"

• "ET TROJAN Win32/KLBanker Activity (GET)"

• "ET MOBILE_MALWARE Android APT-C-23 (mygift .website in DNS Lookup)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish to .ma Domain 2020-07-15"

• "ET MALWARE Target Saver Spyware User-Agent (TSA)"

• "ET CURRENT_EVENTS Cloned IRS Page - Possible Phishing Landing"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (alawaeltech .com)"

• "ET CURRENT_EVENTS Adobe Shared Document Phishing Landing M2 2016-08-31"

• "ET TROJAN Datoploader Activity M2 (GET)"

• "ET MOBILE_MALWARE Observed Android ExobotCompact.D/Octo Domain (equisdeperson .space in TLS SNI)"

• "ET TROJAN Ursnif Payload Downloader Inbound"

• "ET TROJAN Win32.Raccoon Stealer Checkin Response M4"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Agent Tesla SMTP Clipboard Exfil"

• "ET TROJAN Win32/CandyOpen/UniClient Activity (POST)"

• "ET TROJAN Observed DNS Query to TA455 Domain (enerflex .org)"

• "ET TROJAN Dooptroop CnC Beacon"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-09-02"

• "ET TROJAN Win32/Backdoor.Atharvan CnC Checkin"

• "ET WORM W32/Njw0rm CnC Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (olivia-hartman .info in TLS SNI)"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M19"

• "ET CURRENT_EVENTS Successful OWA Phish 2022-06-23"

• "ET TROJAN Observed Cobalt Strike CnC Domain in TLS SNI (cs .lg22l .com)"

• "ET TROJAN Observed Malicious SSL Cert (Gozi ISFB)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 82"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET WEB_SERVER open_basedir PHP config option in uri"

• "ET TROJAN VBA/Agent.ADT Checkin"

• "ET TROJAN Gaboc Trojan Check-in"

• "ET CURRENT_EVENTS Successful National Bank Phish Mar 13 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE DealPly Adware CnC Beacon 2"

• "ET TROJAN Win32/LODEINFO v0.3.5 CnC Checkin"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a CnC Beacon"

• "ET TROJAN Observed Elysium Stealer Domain in TLS SNI (get-europe-group .bar)"

• "ET TROJAN SteamStealer DNS Lookup (steamdesktop)"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (info .fazlollah .net)"

• "ET TROJAN Unknown Actor Targeting Minority Groups Activity (GET)"

• "ET TROJAN BlackDolphin Ransomware Builder Landing Page M4"

• "ET TROJAN CrownAdPro CnC Activity M1"

• "ET USER_AGENTS Suspicious User-Agent (HardCore Software For)"

• "ET TROJAN StormKitty Data Exfil via Telegram"

• "ET TROJAN Win32/Darkme Trojan Checkin M2"

• "ET WEB_CLIENT Tech Support Phone Scam Landing 2017-07-26"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful UK Tax Phishing M2 2016-02-01"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET MOBILE_MALWARE Android/Harly.AO CnC Domain in DNS Lookup"

• "ET TROJAN Moses Staff APT Related Domain in DNS Lookup (techzenspace .com)"

• "ET TROJAN Tandem Espionage CnC Domain (dvizhdom .ru) in DNS Lookup"

• "ET CURRENT_EVENTS Successful Barclays Phish M1 2016-09-09"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2016-09-29"

• "ET EXPLOIT Metasploit FireFox WebIDL Privileged Javascript Injection"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 23"

• "ET TROJAN [PTsecurity] Tinba (Banking Trojan) HTTP Header"

• "ET TROJAN DNS Query to Raspberry Robin Domain (y3x .biz)"

• "ET MOBILE_MALWARE Arid Viper (fasebaook .com in DNS Lookup)"

• "ET TROJAN Win32/LeftHook Stealer CnC Activity (GET) M2"

• "ET WEB_CLIENT Office Requesting .HTA File Likely CVE-2017-0199 Request"

• "ET TROJAN LeChiffre Ransomware CnC"

• "ET MOBILE_MALWARE Android APT-C-23 (lyanna-stark .info in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2016-05-26"

• "ET TROJAN MiniDuke CnC Beacon (string1_slide_3_1)"

• "ET TROJAN Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 3"

• "ET CURRENT_EVENTS Successful Adobe Personalized Phish 2016-10-04"

• "ET TROJAN DADJOKE/Rail Tycoon Initial Macro Execution"

• "ET INFO SUSPICIOUS Possible Evil Download wsf Double Ext No Referer"

• "ET MALWARE Possible FakeAV Binary Download"

• "ET TROJAN MSIL/KeyRedirEx Banker Receiving Exit Instruction"

• "ET TROJAN TA452 Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful iCloud Phish Oct 10 2016"

• "ET TROJAN FAKBEN Ransomware"

• "ET TROJAN Possible Turla Carbon Paper CnC Beacon (Fake User-Agent)"

• "ET TROJAN TA569 Keitaro TDS Domain in DNS Lookup (libertader .org)"

• "ET TROJAN PowerGhost Staging CnC in DNS Query"

• "ET TROJAN Scarlet Mimic DNS Lookup 24"

• "ET MOBILE_MALWARE PJobRat CnC Checkin"

• "ET TROJAN Dorkbot Loader Payload Request"

• "ET TROJAN Win32/Kryptik.GSKY CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (moma-pk .org)"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Histories Firefox.txt) M2"

• "ET TROJAN UAC-0114/Winter Vivern Screenshot Upload M1"

• "ET TROJAN Lyceum Golang HTTP Backdoor Requesting Commands"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 66"

• "ET TROJAN Observed ZLoader CnC Domain in SNI"

• "ET TROJAN Observed Malicious SSL Cert (WastedLoader CnC)"

• "ET TROJAN Observed Malicious SSL Cert (Lazarus APT MalDoc DL 2020-05-05)"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity Domain)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 22"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bghelp .cc)"

• "ET TROJAN Observed DNS Query to TA444 Domain"

• "ET TROJAN Observed IcedID Domain (grafielucho .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server]"

• "ET CURRENT_EVENTS Successful Webmail Account Phish 2015-09-02"

• "ET TROJAN APT28/Sednit DNS Lookup (softwaresupportsv .com)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Domino Loader CnC Domain (upperdunk .com) in DNS Lookup"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab3d685a0c37 .com) Nov 2017"

• "ET TROJAN TEMP.Periscope APT Domain in DNS Lookup"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Activity (Loading) M1"

• "ET TROJAN GravityRAT CnC Domain (gozap .co .in in DNS Lookup)"

• "ET TROJAN Cryptowall docs campaign Aug 2015 encrypted binary (1)"

• "ET TROJAN Unknown Maldoc CnC Activity (2022-07-25)"

• "ET TROJAN PingPull ICMP Activity M2 (Outbound)"

• "ET TROJAN ABUSE.CH Locky Domain"

• "ET TROJAN MalDoc/Gamaredon CnC Activity M2"

• "ET MALWARE W32/BettrExperience.Adware POST Checkin"

• "ET CURRENT_EVENTS Possible WhiteLotus EK 2013-2551 Exploit 2"

• "ET TROJAN W32/Downloader_x.EJK!tr CnC Activity"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (appkasnofert .com)"

• "ET TROJAN Win32/Valak - Plugin Data Exfil"

• "ET TROJAN W32/CoinMiner.ESJ!tr CnC Domain (qb .1c1c1c1c .best) in DNS Lookup"

• "ET TROJAN NanoCore RAT Keepalive Response 3"

• "ET MOBILE_MALWARE Android APT-C-23 (flirtymania .fun in DNS Lookup)"

• "ET TROJAN Observed IcedID CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Successful Banco do Brasil Phish M2 2016-10-25"

• "ET MALWARE UBar Trojan/Adware Checkin 3"

• "ET TROJAN TA444 Domain in DNS Lookup (nor-health .xyz)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed TA444 Domain (dnx .capital in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (account-googlc .com in TLS SNI)"

• "ET TROJAN Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5jb .me)"

• "ET TROJAN Linux/Moose NAT Traversal CnC Beacon set"

• "ET CURRENT_EVENTS Likely Evil JS used in Unknown EK Landing"

• "ET TROJAN APT41 CnC Domain (www .vietsovspeedtest .com) in DNS Lookup"

• "ET TROJAN Smanager CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to Reverse Shell Payload Domain (opentunnel .quest)"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M2 2016-08-12"

• "ET TROJAN Unknown - Loader - Check .exe Updated"

• "ET TROJAN Sofacy DNS Lookup azureon-line.com"

• "ET TROJAN Trojan.BlackRev Get Command Rev3"

• "ET TROJAN Suspected CHAOS CnC Inbound (openurl)"

• "ET TROJAN Win.Trojan.Chewbacca connectivity check"

• "ET MOBILE_MALWARE Android APT-C-23 (mail-goog1e .com in DNS Lookup)"

• "ET MOBILE_MALWARE Arid Viper (stacks-zadar .website in DNS Lookup)"

• "ET TROJAN Observed DNS Query to Ursnif Domain (logotep .xyz)"

• "ET TROJAN FakeAV Variant CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Outlook Webapp Phishing Landing on Appspot Hosting"

• "ET TROJAN Win32/ErbiumStealer Panel CnC Checkin"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (api .vmwareapi .net)"

• "ET TROJAN ZenRAT Get Status Command"

• "ET MOBILE_MALWARE Android APT-C-23 (ezofiezo .website in TLS SNI)"

• "ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M3"

• "ET MALWARE W32/BettrExperience.Adware Initial Checkin"

• "ET TROJAN SManager Backdoor Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Spyus Phish (Multiple Brands) M1 2016-12-12"

• "ET TROJAN ZhCAT.HackTool Operation Cleaver HTTP CnC Beacon"

• "ET TROJAN Latrodectus Alive Response M5"

• "ET TROJAN Linux/Xnote Keep-Alive"

• "ET TROJAN Unk.CoinMiner Loader Checkin"

• "ET TROJAN SC-KeyLog Keylogger Installed - Sending Log Email Report"

• "ET TROJAN Win32/MuggleStealer CnC Wincreds Exfil (POST)"

• "ET TROJAN Recaptcha Magecart Skimmer Domain in DNS Lookup (cdn-cgi .net)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (cashapphelp2 .us)"

• "ET TROJAN APT SideWinder CnC Domain in DNS Lookup (cdn-dl. cn)"

• "ET TROJAN TA444 Domain in TLS SNI (cisco-webex .online)"

• "ET TROJAN Cobalt Strike Malleable C2 (Unknown Profile)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (doem .re)"

• "ET CURRENT_EVENTS Parrot TDS Check M2"

• "ET TROJAN Aveo C2 Request"

• "ET TROJAN NanoCore RAT CnC 26"

• "ET CURRENT_EVENTS Midea Credential Phish Landing Page 2022-07-12"

• "ET TROJAN Observed Gootloader Domain in DNS Lookup (kakiosk .adsparkdev .com)"

• "ET CURRENT_EVENTS Metro Document Phishing Landing 2015-11-17"

• "ET MOBILE_MALWARE Android.Trojan.Rana.A (wherisdomaintv .com in DNS Lookup)"

• "ET TROJAN AHK.CREDSTEALER.A MalDoc Retrieving Payload"

• "ET TROJAN MSIL/KeyRedirEx Banker Requesting Redirect/Inject List"

• "ET TROJAN IoT_reaper DNS Lookup M1 (hl852 .com)"

• "ET TROJAN Gamaredon APT Related CnC Activity (POST) M3"

• "ET TROJAN IcedID CnC Domain in DNS Lookup"

• "ET TROJAN NanoCore RAT Keepalive Response 4"

• "ET CURRENT_EVENTS RIG EK Landing Sep 13 2016 (b641)"

• "ET CURRENT_EVENTS Successful Generic Phish 2018-05-08 (set)"

• "ET TROJAN Observed BlackCat Ransomware Related SSL Cert (updatedaemon .com)"

• "ET CURRENT_EVENTS Successful Credential Phish M1 2022-09-23"

• "ET TROJAN Win32/Warzone RAT Variant CnC Domain in DNS Lookup (dost .igov-service .net)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious Domain (jscdn .biz in TLS SNI)"

• "ET TROJAN Qbot Payload Request (2023-03-21) M3"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN ProjectSauron Remsec DNS Lookup (wildhorses.awardspace.info)"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET CURRENT_EVENTS Possible Veil Powershell Encoder B642"

• "ET TROJAN Win32/PlugX Variant CnC Activity"

• "ET CURRENT_EVENTS Successful Amazon Account Phish 2015-08-21"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M5"

• "ET CURRENT_EVENTS Outlook WebApp Phish Landing 2015-11-05"

• "ET TROJAN DNS Query to Raspberry Robin Domain (w4 .rs)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-cdn .com)"

• "ET TROJAN Hupigon User Agent Detected (VIP2007)"

• "ET TROJAN WikilLoader Activity M2 (Response)"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET TROJAN Zbot CnC POST /common/timestamps.php"

• "ET CURRENT_EVENTS Successful Bank of America Phish M1 2016-10-27"

• "ET TROJAN Lyceum Golang HTTP Backdoor Connectivity Check"

• "ET TROJAN APT DarkHydrus DNS Lookup 7"

• "ET TROJAN Observed Targeted Attack Malicious Domain in TLS SNI (blog .br0vvnn .io)"

• "ET TROJAN Generic Cryptocurrency Credential Phish Related Domain in DNS Lookup (thedoodles .site)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN carberp check in"

• "ET TROJAN PoshC2 - Observed Default URI Structure M27"

• "ET EXPLOIT Possible ETERNALCHAMPION MS17-010 Sync Request (set)"

• "ET TROJAN Gallium APT Related Domain in DNS Lookup (micfkbeljacob .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Linux/ShellshockCampaign.DDOSBot Terminate Process CnC Server Message"

• "ET MOBILE_MALWARE Android APT-C-23 (buymicrosft .com in DNS Lookup)"

• "ET TROJAN Dyre CnC Checkin"

• "ET TROJAN RouteX CnC Domain (2fa3c2fa16c47d9b9bff8986a42b048f .com) in DNS Lookup"

• "ET TROJAN Java/QRat Checkin"

• "ET MALWARE Win32/44Caliber Stealer Variant Activity (POST)"

• "ET TROJAN Trojan.Win32.VB.cefz Checkin"

• "ET TROJAN Urlzone/Bebloh/Bublik Checkin /was/vas.php"

• "ET TROJAN Suspected POLONIUM CnC Domain (ukrsupport .info) in DNS Lookup"

• "ET TROJAN Linux.Mumblehard Command Status CnC"

• "ET TROJAN APT SuperhardCorp DNS Lookup (drometic.suroot.com)"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (rashidiso .ru)"

• "ET POLICY External IP Address Lookup DNS Query (2ip .ua)"

• "ET MOBILE_MALWARE NSO Related Domain 15"

• "ET TROJAN Unknown AutoIt Bot - Initial Server Response"

• "ET TROJAN Gamaredon Domain in DNS Lookup (butiram .ru)"

• "ET CURRENT_EVENTS CSharp SMB Scanner Assembly in PowerShell Inbound M2"

• "ET TROJAN Win32/Wacapew.C!ml Checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 34"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK Feb 05 2016"

• "ET TROJAN Win32/ErbiumStealer CnC Activity (GetBuild)"

• "ET TROJAN [PT MALWARE] Hacked Mikrotik C2 Request"

• "ET MOBILE_MALWARE Android APT-C-23 (alisonparker .club in DNS Lookup)"

• "ET TROJAN FakeAV User-Agent XML"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (team-meeting .pro)"

• "ET TROJAN Win32/Emotet CnC Checkin Response"

• "ET TROJAN Suspected Gamaredon Related Activity (GET)"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(FMBVDFRESCT)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (luzidzhso .ru)"

• "ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain"

• "ET TROJAN DNS Query for Operation Cleaver Domain"

• "ET TROJAN DNS Query for known ShadowPad CnC 7"

• "ET TROJAN Observed DNS Query to Vicious Panda CnC Domain"

• "ET TROJAN Suspected RULER.Hacktool HTML Payload"

• "ET EXPLOIT F5 BIG-IP iControl REST Authentication Bypass (CVE-2022-1388) M1"

• "ET MALWARE OSX/Adware.Pirrit CnC Activity 3"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Win32/Autophyte.F C2 Domain (tpddata .com in DNS Lookup)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (2t .pm)"

• "ET CURRENT_EVENTS Successful OWA Phish 2022-07-11"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible APT28 Xtunnel Activity"

• "ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to kubecloud .com"

• "ET CURRENT_EVENTS BankAustria Phishing Domain Nov 03 2017"

• "ET TROJAN DEEP PANDA Checkin 1"

• "ET MOBILE_MALWARE Android APT-C-23 (accountusers .website in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-10-05"

• "ET TROJAN Known Malicious Doc Downloading Payload Dec 06 2016"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (bitscrunnch .linkpc .net in TLS SNI)"

• "ET TROJAN Possible TDSS User-Agent CMD"

• "ET TROJAN Kazy/Kryptor/Cycbot Trojan Checkin 2"

• "ET USER_AGENTS Suspicious User-Agent Detected (Compatible)"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .zapto .org)"

• "ET TROJAN Comfoo Outbound Communication"

• "ET TROJAN Email Contains wininet.dll Call - Potentially Dridex MalDoc 2"

• "ET TROJAN Ransomware Locky CnC Beacon"

• "ET TROJAN MSIL/Modi RAT CnC Screenshot Outbound"

• "ET TROJAN LankerBoy HTTP CnC Beacon"

• "ET TROJAN Possible APT28 Phishing Domain in DNS Query"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1qjywr9cpsm5u7e4yrmnx2jsahgzzmm7 .com)"

• "ET TROJAN njRAT Variant Outbound CnC Beacon"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (gpksanfrancisco .com)"

• "ET CURRENT_EVENTS TodayZoo Phishing Kit GET M2"

• "ET TROJAN Likely Geodo/Emotet Downloading PE"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious Domain (cloudjs .live in TLS SNI)"

• "ET TROJAN MSIL/Bobik CnC Traffic"

• "ET MALWARE Errorsafe.com Fake antispyware User-Agent (ErrorSafe)"

• "ET TROJAN WEBC2-DIV UA"

• "ET TROJAN NewsPenguin CnC Checkin"

• "ET TROJAN Mirai Variant Domain (blacklister .nl in DNS Lookup)"

• "ET TROJAN Diavol Communicating with CnC - Landing Request"

• "ET TROJAN Downeks Variant CnC Beacon"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN Lyposit Ransomware Checkin 2"

• "ET TROJAN QuickBooks Pop-Up Scam - Checkin"

• "ET TROJAN TransparentTribe Related CnC Activity"

• "ET TROJAN Parallax CnC Activity M17 (set)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed DNS Query to Vicious Panda CnC Domain"

• "ET MALWARE Redline Stealer TCP CnC - Id1Response"

• "ET TROJAN DNS Query to Raspberry Robin Domain (iz .gy)"

• "ET TROJAN MSIL/Agent.DNL CnC Activity M1"

• "ET TROJAN Win32/SVCReady Loader - Screenshot"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (thebestthings1337 .online)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-02"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (raloco .com)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 11 CnC)"

• "ET CURRENT_EVENTS Wire Transfer Phishing Landing 2015-11-19"

• "ET MOBILE_MALWARE Phenakite Audio Upload CnC"

• "ET MALWARE Antibody Software Installed (PUA)"

• "ET TROJAN Pupy DNS Request with SPI M3"

• "ET TROJAN APT37 M2RAT CnC Server Command - RES"

• "ET TROJAN DNS Query to Raspberry Robin Domain (j4r .xyz)"

• "ET MOBILE_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration"

• "ET CURRENT_EVENTS Possible Successful Generic Phish to .ga Domain 2018-10-23"

• "ET TROJAN Observed MageCart Group 12 Domain (zolo .pw in TLS SNI)"

• "ET TROJAN lu0bot CnC Domain in DNS Lookup"

• "ET TROJAN Banking Trojan HTTP Cookie"

• "ET TROJAN IIS-Raid Module Backdoor - Successful PING in HTTP Response (PONG)"

• "ET TROJAN OSX/Proton.C/D Domain (eltima .in in TLS SNI)"

• "ET TROJAN [PTsecurity] TR/Spy.Banker.agdtw Checkin"

• "ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Magecart/Skimmer - _try_action Exfil Attempt"

• "ET CURRENT_EVENTS Successful AOL Phish 2016-10-24"

• "ET TROJAN W32/Liftoh.Downloader Get Final Payload Request"

• "ET TROJAN Suspicious User-Agent (Agent and 5 or 6 digits)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (opela .ru)"

• "ET TROJAN Black KingDom Ransomware Related Activity"

• "ET CURRENT_EVENTS Successful Generic Phish (Meta HTTP-Equiv Refresh) Dec 29 2016"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET CURRENT_EVENTS DRIVEBY [PwC CTD] -- MultiGroup - ScanBox Watering Hole iframe"

• "ET TROJAN Observed Maldoc CnC Domain (cloud-documents .com in TLS SNI)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (rambolloil .com) 2022-12-05"

• "ET USER_AGENTS Suspicious User-Agent (INSTALLER)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 72"

• "ET TROJAN StormKitty Exfil via AnonFiles"

• "ET CURRENT_EVENTS Mailgun Phishing Landing"

• "ET TROJAN Bamital Connectivity Check"

• "ET CURRENT_EVENTS Possible Successful Citibank Phish M2 2016-08-22"

• "ET TROJAN CCleaner Backdoor DGA Domain (aba9a949bc1d .com) Mar 2017"

• "ET WEB_SERVER WebShell - ASPyder - Auth Prompt"

• "ET TROJAN Observed BatLoader Domain (internalcheckssso .com) in TLS SNI"

• "ET CURRENT_EVENTS Observed Possible Phishing Landing Page 2021-06-22"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (fineg .xyz)"

• "ET TROJAN DNS Query for known ShadowPad CnC 9"

• "ET TROJAN RedDelta Poison Ivy Domain in DNS Lookup"

• "ET CURRENT_EVENTS DRIVEBY EL8 EK Landing"

• "ET TROJAN DNS Query for known ShadowPad CnC 2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6t .nz)"

• "ET MALWARE CoinSurf Proxy Client Registration"

• "ET CURRENT_EVENTS Successful Earthlink Phish 2016-07-19"

• "ET CURRENT_EVENTS Netflix Phishing Landing 2016-08-17"

• "ET TROJAN ISMAgent DNS Lookup (msoffice-cdn . com)"

• "ET CURRENT_EVENTS Suspicious IPFS Domain Rewritten with Google Translate"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (defeatdiseasewithdata .com)"

• "ET TROJAN Kimsuky APT CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Phishing Landing via MyFreeSites.com M2 2016-03-31"

• "ET MALWARE User-Agent (Internet Explorer 6.0) - Possible Trojan Downloader"

• "ET TROJAN Observed Win32.Raccoon Stealer Domain (hellowoodie .top in TLS SNI)"

• "ET TROJAN Orca RAT URI Struct 3"

• "ET TROJAN Win32/Nitrokod Domain (nvidiacenter .com) in TLS SNI"

• "ET TROJAN Possible Red October proxy CnC 1"

• "ET TROJAN Possible DarkFinger Payload Retrieval Attempt - ps10"

• "ET TROJAN Observed Turla/APT34 CnC Domain Domain (dubaiexpo2020 .cf in TLS SNI)"

• "ET CURRENT_EVENTS Successful Paypal (FR) Phish Oct 16 2017"

• "ET TROJAN Win32/AZORult V3.2 Client Checkin M21"

• "ET TROJAN SocGholish Domain in TLS SNI (standard .architech3 .com)"

• "ET TROJAN Godlua Backdoor Stage-3 Server Heartbeat Reply (Sep 2020 - Nov 2023)"

• "ET TROJAN Observed APT29 Domain (sgrhf .org .pk) in TLS SNI"

• "ET WEB_CLIENT c3284d Malware Network Compromised Redirect (comments 1)"

• "ET WEB_CLIENT APT SWC PluginDetect Landing Cookie 2015-10-15"

• "ET TROJAN MINEBRIDGE CnC Activity"

• "ET TROJAN Linux/Moose HTTP CnC Beacon Response"

• "ET TROJAN NanoCore RAT Keepalive 2"

• "ET CURRENT_EVENTS Successful Facebook Credential Phish 2022-08-01"

• "ET CURRENT_EVENTS Possible Successful Phish to Hostinger Domains Apr 4 M4"

• "ET CURRENT_EVENTS Cloud Drive Phish Landing 2015-08-12"

• "ET TROJAN Observed DNS Query to RisePro Domain (gs24softeasy .com)"

• "ET TROJAN DonotGroup CnC Observed in DNS Query"

• "ET CURRENT_EVENTS TDS Sutra - cookie is set RULEZ"

• "ET TROJAN X-Files Stealer CnC Exfil Activity M2"

• "ET TROJAN Upatre Binary Download Jan 02 2014"

• "ET CURRENT_EVENTS Successful Gmail Phish 2015-11-05"

• "ET TROJAN [PTsecurity] Win32/Ramnit Stage 0 Communicating with CnC"

• "ET MALWARE Context Plus User-Agent (PTS)"

• "ET CURRENT_EVENTS Webshell Access with Known Password Inbound - Possibly Iran-based"

• "ET TROJAN CoinVault CnC Beacon M1"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (aconitumso .ru)"

• "ET TROJAN DarkCloud Stealer FirefoxCookies.json Exfiltration via Telegram"

• "ET TROJAN JS/Cloud9 Domain (zmsp .top) in DNS Lookup"

• "ET CURRENT_EVENTS DRIVEBY [PwC CTD] -- MultiGroup - ScanBox Watering Hole Content form tag appended to head"

• "ET TROJAN LuminosityLink - CnC"

• "ET TROJAN IceApple User-Agent observed"

• "ET TROJAN Magniber Ransomware CnC Domain in DNS Lookup"

• "ET TROJAN Observed Gamaredon APT Related Domain (tolofa .ru in TLS SNI)"

• "ET CURRENT_EVENTS Possible Amazon Phishing Domain 2016-06-21"

• "ET TROJAN ELF/Emptiness v2 XOR (b2bb01039307baa2) CnC Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Skeleton Key Filename in SMB Traffic (Unicode)"

• "ET MALWARE Loadmoney Checkin 1"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (speedbind .com)"

• "ET ATTACK_RESPONSE DNS Query for Observed CVE-2021-44228 Callback Domain (ceye .io)"

• "ET TROJAN Suspected REDCURL CnC Activity M1"

• "ET TROJAN Email Contains wininet.dll Call - Potentially Dridex MalDoc 3"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (oceanicflyimmigration .com) 2022-12-05"

• "ET MOBILE_MALWARE Android APT-C-23 (nissour-beton .com in DNS Lookup)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (yuiw .xyz)"

• "ET TROJAN Yayih.A Checkin 2"

• "ET TROJAN Scieron DNS Lookup (demon.4irc.com)"

• "ET TROJAN BalkanDoor CnC Checkin - Server Response"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (creditals-mirohost .space)"

• "ET CURRENT_EVENTS Successful Google Drive Phish 2016-12-22"

• "ET TROJAN Windows netstat Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS Bingo EK Payload Download"

• "ET TROJAN CenterPOS CnC"

• "ET TROJAN 44Calibar Variant Exfil via Telegram"

• "ET TROJAN OSX/NukeSped Variant CnC Activity"

• "ET TROJAN [PTsecurity] Gozi/Ursnif Payload v14"

• "ET TROJAN Win32/Snatch Ransomware - Encryption Finished"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET TROJAN Win32/Tofsee Connectivity Check M3"

• "ET TROJAN Pony Loader default URI struct"

• "ET MOBILE_MALWARE Trojan.AndroidOS.TimpDoor (purple .m-ads .net in DNS Lookup)"

• "ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M5"

• "ET TROJAN Win32.Small.AB or related Post-infection checkin"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky C2)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-endpoint .com)"

• "ET TROJAN Pyramid Framework Payload Request (base-impacket-secretsdump.py)"

• "ET TROJAN W32/Pgift.Backdoor APT CnC Beacon"

• "ET CURRENT_EVENTS US Government Bid Credential Phish Landing Page 2022-12-28"

• "ET CURRENT_EVENTS Shared Document Phishing Landing Nov 16 2016"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Maldoc Retrieving Payload 2022-06-15"

• "ET TROJAN W32/Asprox.ClickFraudBot POST CnC Beacon"

• "ET TROJAN DonotGroup APT DNS Lookup (bulk .fun)"

• "ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Hqwar.hf Checkin"

• "ET TROJAN Win32/SVCReady Loader - Logs"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET TROJAN Win32/DownloadAdmin Activity"

• "ET CURRENT_EVENTS Successful USAA Phish 2016-08-30"

• "ET CURRENT_EVENTS ING Banking Credential Phish Landing Page 2022-12-12"

• "ET TROJAN Credit Card Scraper Domain in DNS Lookup (authorizen .net)"

• "ET CURRENT_EVENTS Evil Redirector Sep 29 2015"

• "ET TROJAN APT 41 CnC Domain Observed in DNS Query"

• "ET TROJAN Ousaban Banker Server Response M1"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish Oct 07 2016"

• "ET TROJAN APT28 CnC Domain DNS Lookup"

• "ET TROJAN Drive Receiving POST2 DDoS instructions"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-03-02"

• "ET MALWARE W32/OpenCandy Adware Checkin"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-07-30"

• "ET CURRENT_EVENTS Possible Successful Phish to Hostinger Domains M3 2016-04-04"

• "ET TROJAN Socelars Stealer CnC Activity"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET CURRENT_EVENTS RIG encrypted payload M1 Aug 01 2017"

• "ET MOBILE_MALWARE Arid Viper (play-store-51182 .appspot .com in DNS Lookup)"

• "ET TROJAN HompesA Activity"

• "ET MOBILE_MALWARE Android.AdSms Retrieving XML File from CnC Server"

• "ET CURRENT_EVENTS Generic Financial Phone Support Scam/Phishing Landing M1"

• "ET TROJAN Cryptowall 2.0 DL URI Struct Oct 2 2014"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 84"

• "ET MALWARE Rogue.WinPCDefender Checkin"

• "ET TROJAN APT DarkHydrus DNS Lookup 11"

• "ET TROJAN Vidar Stealer - FaceIt Checkin Response"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 12"

• "ET TROJAN Bitter APT Related Domain in DNS Lookup (youtubepremiumapp .com)"

• "ET MALWARE Trinityacquisitions.com and Maximumexperience.com Spyware Activity"

• "ET TROJAN Win32/Remcos RAT Checkin 64"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed AridViper CnC Domain in TLS SNI"

• "ET TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (Likely Shylock/URLzone/Gootkit/Zeus Panda C2)"

• "ET INFO Possible Bot CnC Beacon (GET)"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-08-11"

• "ET TROJAN BITTERBUG Checkin"

• "ET TROJAN Bitter APT Payload Request"

• "ET CURRENT_EVENTS Adobe Cloud Phishing Landing 2016-06-02"

• "ET TROJAN ELF/Emptiness CnC Domain in DNS Query"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2016-10-25"

• "ET TROJAN FRat WebSockets Request M2"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Laplas Clipper - GetAddress CnC Checkin"

• "ET TROJAN MSIL.Kraken.v2 HTTP Pattern"

• "ET TROJAN r0 CnC Architecture GET 4"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Acecard.c Checkin"

• "ET CURRENT_EVENTS Successful Westpac Bank Phish 2016-08-31"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (camschooluae .com) 2022-12-05"

• "ET TROJAN APT28/Sednit DNS Lookup (ciscohelpcenter .com)"

• "ET CURRENT_EVENTS Successful Wildblue Phishing M1 2015-11-24"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Suspected Win32/TinyNode Activity (Outbound)"

• "ET MALWARE W32/iBryte.Adware Installer Download"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected"

• "ET TROJAN Subterranean Crimson Rat - FileManager List Command"

• "ET CURRENT_EVENTS Possible Successful Generic Phish to .cf Domain 2018-10-23"

• "ET CURRENT_EVENTS Successful Zimbra Phish 2015-11-03"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (westernmedicalspecialisthosp .com) 2022-12-05"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (harvey-ross .info in TLS SNI)"

• "ET CURRENT_EVENTS Successful Supplier Portal Phish 2016-10-07"

• "ET TROJAN Observed GoBotKR Domain in TLS SNI"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page from Text Scam M4 2023-05-01"

• "ET TROJAN Ponmocup C2 Sending Data to Controller 1"

• "ET TROJAN Win32/GenKryptik.GCJX Data Exfiltration Attempt"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (reggedrobin .com)"

• "ET TROJAN Observed Suspected TA453 Related Domain (metaemailsecurity .net in TLS SNI)"

• "ET TROJAN Encoded JinxV2DEV User-Agent Observed (4a696e785632444556)"

• "ET TROJAN Fraudload/FakeAlert/FakeVimes Downloader - POST"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET TROJAN [ANY.RUN] Lu0bot-Style DNS Query in DNS Lookup M2"

• "ET DNS Reply Sinkhole - 106.187.96.49 blacklistthisdomain.com"

• "ET CURRENT_EVENTS Successful Generic Phish 2021-11-10"

• "ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)"

• "ET TROJAN Malicious Cobalt Strike SSL Cert (asurecloud .tech)"

• "ET TROJAN HB_Banker16 Get"

• "ET TROJAN Desert Falcon Related APT DNS Lookup (facebook-emoticons.bitblogoo.com)"

• "ET MOBILE_MALWARE Android APT-C-23 (davina-claire .xyz in DNS Lookup)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (team-meeting .xyz)"

• "ET TROJAN Observed DNS Query to RisePro Domain (m-rise .pro)"

• "ET CURRENT_EVENTS Successful Postbank Online Banking Phish M1 2016-09-30"

• "ET USER_AGENTS Downloader User-Agent Detected (Windows Updates Manager|3.12|...)"

• "ET TROJAN Dridex POST CnC Beacon 2"

• "ET EXPLOIT Possible ETERNALBLUE Probe MS17-010 (MSF style)"

• "ET MOBILE_MALWARE DNS Query Targeted Tibetan Android Malware C2 Domain"

• "ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD IE Flash request to set non-standard filename (some overlap with 2021752)"

• "ET TROJAN MSIL/GravityRAT CnC Domain (mylogisoft .com in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Intuit Phish 2022-02-03"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebookvideo .com in TLS SNI)"

• "ET CURRENT_EVENTS Possible Phishing Landing Hosted on CodeSandbox.io M6"

• "ET CURRENT_EVENTS Possible AMSI Powershell Bypass Attempt B642"

• "ET TROJAN [PTsecurity] Possible Backdoor.Win32.TeamBot / RTM C2 Response"

• "ET CURRENT_EVENTS Successful Paypal Phish M3 2016-09-29"

• "ET MALWARE Adware-Win32/EoRezo Reporting"

• "ET CURRENT_EVENTS Nourblog1 Phish Kit"

• "ET USER_AGENTS Suspicious User Agent (ScrapeBox)"

• "ET TROJAN MSIL/Crimson Receiving Command (getavs)"

• "ET TROJAN NetSupport RAT Domain (tradinghuy .duckdns .org) in DNS Lookup"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (catsndogz .org)"

• "ET TROJAN Win32/Adware.Agent.NSU CnC Activity"

• "ET TROJAN VBA/Agent.AAV CnC Checkin"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .sync .oystergardens .club)"

• "ET MALWARE Win32.Magania"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (downloadmyhost .zapto.org)"

• "ET TROJAN TA444 Related Domain in DNS Lookup (fclouddown .co)"

• "ET TROJAN CoreDn CnC Checkin M2"

• "ET TROJAN [PTsecurity] JS.Trojan-Downloader.Nemucod.yo HTTP POST (:Exec:)"

• "ET MOBILE_MALWARE Android APT-C-23 (bob-turco .website in DNS Lookup)"

• "ET TROJAN Observed Malicious SSL Cert (POWERSTATS Proxy CnC)"

• "ET CURRENT_EVENTS Paypal Phishing Landing (DE) 2016-10-04"

• "ET TROJAN Win32/CopperStealer CnC Activity"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET TROJAN TA457 Related Activity M2 (POST)"

• "ET TROJAN ELF/muBoT IRC Activity 2"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (aplikacje .ron-mil .space in TLS SNI)"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET TROJAN TA402/Molerats CnC Checkin"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-26"

• "ET MALWARE Miuref/Boaxxe Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Teal Kurma Domain (dhcp .systemctl .network in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible KONNI URI Path Observed"

• "ET TROJAN Gamut Spambot Checkin Response"

• "ET TROJAN Fbot/Satori CnC DNS Lookup (ukrainianhorseriding .com)"

• "ET TROJAN Powershell/CustomRAT CnC Domain in DNS Lookup (kleinm .de)"

• "ET TROJAN Pteranodon Backdoor Checkin"

• "ET TROJAN FakeAV FakeSmoke HTTP POST check-in"

• "ET TROJAN Observed DNS Query to RisePro Domain (boost-files .com)"

• "ET TROJAN ConnectWise ScreenConnect Payload Delivery Domain (win02 .xyz) in DNS Lookup"

• "ET TROJAN Possible CopyKittens DNS Lookup (windowsupup.com)"

• "ET TROJAN Bandit Stealer Host Details Exfil"

• "ET TROJAN Linux/Tsunami DNS Request (eggstrawdinarry.mylittlerepo.com)"

• "ET TROJAN LYCEUM CnC Domain Observed in DNS Query"

• "ET MOBILE_MALWARE Android.BankBot.11270 (DNS Lookup)"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Response"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 9"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish 2018-03-12"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed Teal Kurma Domain (nmcbcd .live in TLS SNI)"

• "ET TROJAN Chafer CnC Domain in DNS Lookup"

• "ET TROJAN Andariel Elf Backdoor Activity"

• "ET TROJAN Diezen/Sakabota CnC Domain Observed in DNS Query"

• "ET TROJAN W32/Trustezeb.C CnC Beacon"

• "ET MALWARE W32/Linkular.Adware Successful Install Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible SharpShooter Framework Generated Script"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 97"

• "ET TROJAN Win32/RokRat CnC Activity (POST)"

• "ET TROJAN Kimsuky APT Related Host Data Exfil M5"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lazarus APT Related Domain (designautocad .org in TLS SNI)"

• "ET TROJAN ISRStealer Checkin"

• "ET TROJAN DNS Query to Raspberry Robin Domain (xtabr .com)"

• "ET TROJAN ZuoRAT GoBeacon CnC"

• "ET TROJAN [TGI] Cobalt Strike Malleable C2 Request (O365 Profile)"

• "ET TROJAN Cobalt Strike Domain in DNS Lookup (fepopeguc .com)"

• "ET TROJAN Operation Blockbuster User-Agent (Mozillar)"

• "ET TROJAN BigLock Ransomware CnC Activity (id)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET MALWARE Searchmiracle.com Spyware Install (silent_install)"

• "ET ATTACK_RESPONSE Unusual FTP Server Banner (warFTPd)"

• "ET TROJAN MWI Maldoc Load Payload"

• "ET TROJAN Gamaredon Domain in DNS Lookup (donkorpa .ru)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Google Drive Phishing Landing M1 July 24 2015"

• "ET TROJAN Observed DNS Query to TA444 Domain (docuprivacy .com)"

• "ET CURRENT_EVENTS Common Form POST - CenturyLink Phishing Landing 2020-06-11"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET TROJAN Shark Pass Stealer Email Report"

• "ET TROJAN TA444 Domain in TLS SNI (voldemort .myvnc .com)"

• "ET TROJAN Win32.Crypren/Zcrypt Ransomware Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Google Drive Phish M1 2015-07-28"

• "ET TROJAN TrueBot/Silence.Downloader CnC Checkin"

• "ET TROJAN DDoS.XOR Checkin 2"

• "ET CURRENT_EVENTS Possible Successful Phish - Other Credentials Nov 21 2012"

• "ET TROJAN Ransomware/Cerber Checkin M3 (12)"

• "ET TROJAN W32/SecVerif.Downloader Initial Checkin"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (devcodejs .org)"

• "ET MOBILE_MALWARE AndroidOS/Basbanke.A Activity (POST)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23"

• "ET MOBILE_MALWARE Android/Spy.Kasandra.A Checkin"

• "ET TROJAN CobianRAT Screenshot Exfil to CnC"

• "ET CURRENT_EVENTS Nemucod JS Downloader June 12 2017"

• "ET TROJAN Suspected Lazarus APT Related Activity (GET)"

• "ET TROJAN Magniber Ransomware Retrieving Instructions"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (oopscokir .com)"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (javan-demsky .website in DNS Lookup)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (acanthusso .ru)"

• "ET TROJAN TransparentTribe CnC Domain in DNS Lookup"

• "ET TROJAN FIN7 JSSLoader Activity (POST)"

• "ET TROJAN Observed Card Skimmer CnC Domain in TLS SNI"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity CnC)"

• "ET TROJAN Likely Bot Username in IRC (XP-..)"

• "ET TROJAN Bitter APT Related Domain in DNS Lookup (huandocimama .com)"

• "ET MOBILE_MALWARE Android APT-C-23 (hcttmail .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful OX App Suite Phish 2017-10-12"

• "ET CURRENT_EVENTS Successful WhatsApp Phish M2 2016-12-07"

• "ET CURRENT_EVENTS Successful Linkedin Phish 2016-12-09"

• "ET CURRENT_EVENTS Successful RBFCU Credential Phish 2022-10-31"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (kontrola-poczty .site in TLS SNI)"

• "ET TROJAN Win32/Spy.Agent.OHT - AnunakAPT TCP Keep-Alive"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK Dec 09"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (en-za-wordpress .org)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 64"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (alhmodzinoilfildservices .com) 2022-12-05"

• "ET TROJAN Win32/BlackMagic Ransomware Payload Request (GET)"

• "ET TROJAN Pupy RAT Default TLS Proxy Certificate"

• "ET TROJAN Observed BlackGuard_v2 Domain in DNS Lookup (umpulumpu .ru)"

• "ET TROJAN Win32/BUGHATCH SpawnAgent Request (GET) M1"

• "ET MOBILE_MALWARE Android/Revive Banking Trojan Initial Checkin Activity (POST)"

• "ET TROJAN Possible CopyKitten DNS Lookup (1e100 .tech)"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (gallant-william .icu)"

• "ET TROJAN Common Upatre Header Structure 2"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-07-08"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Latrodectus Alive Response M2"

• "ET TROJAN Observed Malicious SSL Cert (ColdRiver APT DNSpionage MITM)"

• "ET TROJAN TA444 Related Domain in DNS Lookup (onlinecloud .cloud)"

• "ET TROJAN Trojan Downloader.Bancos Reporting"

• "ET TROJAN PDF 0day Communication - agent UA Feb 14 2013"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Quant Loader Download Request"

• "ET TROJAN Possible Pegasus Related DNS Lookup (sabafon .info)"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (devciscoprograms .com)"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Shaolin)"

• "ET USER_AGENTS Suspicious User-Agent (RBR)"

• "ET CURRENT_EVENTS RIG EK Landing Sep 12 2016 T2"

• "ET TROJAN EvilGrab/Vidgrab Checkin"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(UPHTTP)"

• "ET TROJAN MAGICHOUND.FETCH CnC Beacon"

• "ET CURRENT_EVENTS Common Form POST - Cox Phishing Landing 2020-06-11"

• "ET USER_AGENTS Suspicious User-Agent (Clever Internet Suite)"

• "ET CURRENT_EVENTS Webshell Execute Command Inbound - Possibly Iran-based M1"

• "ET TROJAN W32/Zbot.Variant Fake MSIE 6.0 UA"

• "ET CURRENT_EVENTS Successful Sparkasse (DE) Phish 2016-11-28"

• "ET TROJAN Konni RAT Querying CnC for Commands"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN KeyBase Keylogger HTTP Pattern"

• "ET CURRENT_EVENTS Possible Injected JS Form Stealer Checking Page Contents M2"

• "ET MALWARE W32/GameVance Adware User Agent"

• "ET TROJAN DangerousPassword APT Related Domain in DNS Lookup (shopapppro .com)"

• "ET TROJAN Suspected Andariel RexPot CnC Checkin M2"

• "ET TROJAN Win32/Packed.BlackMoon.A Variant Checkin"

• "ET TROJAN Successful Win32/TrojanDownloader.VB.RUI Exfil Activity M2"

• "ET TROJAN W32/Zeus.InfoStealer Infection Campaign Heap.exe Request"

• "ET TROJAN Win32/NetDooka Framework Related Activity (POST) M2"

• "ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI"

• "ET TROJAN Win32/Lumma Stealer Data Exfiltration in URI (GET)"

• "ET TROJAN TA444 Domain in DNS Lookup"

• "ET CURRENT_EVENTS Office 365 Credential Harvesting Domain (rightofcourse .com) in TLS SNI"

• "ET CURRENT_EVENTS Fake Browser Update Domain in DNS Lookup (s127581-statspixel .com)"

• "ET CURRENT_EVENTS Successful Blocked Email Account Phish M1 2016-08-23"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (verify-email .space)"

• "ET TROJAN DNS query for known Anunak APT Domain (great-codes.com)"

• "ET TROJAN Fake Chrome Landing Domain Activity (chromiumlink .site)"

• "ET TROJAN Trojan.Karagany C&C Response"

• "ET EXPLOIT WinRAR WinAce Containing CVE-2018-20250 Inbound - Path Traversal leading to RCE"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker Payment)"

• "ET POLICY Suspicious ToTok Mobile Application DNS Request"

• "ET MOBILE_MALWARE Android APT-C-23 (harrykane .online in DNS Lookup)"

• "ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1"

• "ET TROJAN Xbash CnC DNS Lookup (realnewstime .xyz)"

• "ET TROJAN Possible APT-12 Related C2"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL) 2019-10-24"

• "ET TROJAN Miuref/Boaxxe Checkin"

• "ET CURRENT_EVENTS Possible Evil Redirector Leading to EK June 10 2015"

• "ET CURRENT_EVENTS Adobe PDF Zero Day Trojan.666 Payload libarhlp32.dll Second Stage Download POST"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2023-02-27"

• "ET TROJAN Possible Trojan.APT.9002 POST"

• "ET TROJAN Win32/Amadey Payload Request (GET)"

• "ET TROJAN Observed Malicious SSL Cert (Win32/Unk Downloader CnC)"

• "ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN TA404 Comebacker Related Activity (POST)"

• "ET CURRENT_EVENTS DarkX Phish Landing Page 2022-12-19"

• "ET TROJAN Win32/Infostealer.Snifula File Upload"

• "ET TROJAN Win32/Xtrat C2 Response"

• "ET TROJAN Backdoor.Win32.Xyligan Checkin"

• "ET CURRENT_EVENTS PyPI Successful Credential Harvesting Attempt"

• "ET TROJAN Observed Remcos Domain (listpoints .click in TLS SNI)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server]"

• "ET TROJAN HAWKBALL CnC Activity"

• "ET TROJAN W32/GCman.Backdoor CnC Beacon"

• "ET TROJAN Possible DeadlyKiss APT CnC Domain Observed in DNS Query"

• "ET TROJAN NewsPenguin Domain in DNS Lookup (sailorjobs .world)"

• "ET TROJAN TA455 Related CnC Domain in DNS Lookup"

• "ET TROJAN W32.Qakbot Update Request"

• "ET MALWARE Freeze.com Spyware User-Agent (YourScreen123)"

• "ET MOBILE_MALWARE Android Trojan Cloudsota HTTP Host"

• "ET TROJAN Georbot initial checkin"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker Payment)"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (modir .nikanps .top)"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Microsoft HTTP HOST M11"

• "ET CURRENT_EVENTS Phishing Landing via Tripod.com M1 2016-03-31"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN SystemdMiner CnC Activity"

• "ET TROJAN Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-2)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN WikiLoader Activity M4 (Response)"

• "ET TROJAN Possible IndigoDrop/Cobalt Strike Download"

• "ET TROJAN Win32.Hupigon.dkwt Related Checkin"

• "ET TROJAN Win32/Unknown Stealer CnC Log Exfil"

• "ET MOBILE_MALWARE Android APT-C-23 (account-gocgle .com in DNS Lookup)"

• "ET TROJAN SSL/TLS Certificate Observed (WRAT)"

• "ET TROJAN Trojan.Nurjax Downloading PE"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Cookies Firefox.txt) M2"

• "ET CURRENT_EVENTS Successful Wallet Connect Key Store Phish 2023-02-03"

• "ET TROJAN [PTsecurity] Remcos RAT Checkin 71"

• "ET MALWARE Winxpperformance.com Related Spyware User-Agent (Microsoft Internet Browser)"

• "ET TROJAN Vawtrak/NeverQuest Posting Data"

• "ET CURRENT_EVENTS Successful Blocked Email Account Phish M2 2016-08-23"

• "ET TROJAN DecebalPOS User-Agent"

• "ET TROJAN Cobalt Strike Malleable C2 Profile (extension.css)"

• "ET CURRENT_EVENTS Successful PNC Bank Phish M2 2016-10-14"

• "ET TROJAN Observed TA444 Domain (ms .onlineshares .cloud in TLS SNI)"

• "ET TROJAN Trojan.BlackRev V1.Botnet HTTP Login POST Flood Traffic Outbound"

• "ET TROJAN EvilNum APT Related Domain in DNS Lookup (pcamanalytics .com)"

• "ET TROJAN Chaos Botnet CnC Domain (quanquandd .top) in DNS Lookup"

• "ET TROJAN x0Proto Pong"

• "ET EXPLOIT Observed Orange LiveBox Router Information Leakage Attempt (CVE-2018-20377)"

• "ET MALWARE LNKR CnC Activity M2"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Ymacco.AA2F Checking (Multiple OS)"

• "ET TROJAN Win32/Agent.XXZ Checkin"

• "ET TROJAN Zbot CnC POST /common/versions.php"

• "ET MALWARE Win32/SuperDiag PUP CnC Activity"

• "ET TROJAN Observed Malicious SSL Cert (OZH Rat)"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2020-09-03"

• "ET TROJAN Win32.Pamesg/ArchSMS.HL CnC Checkin"

• "ET TROJAN Darkness DDoS HTTP Target/EXE"

• "ET TROJAN Redirect on ActiveXObject support"

• "ET TROJAN Observed Win32/CollectorStealer User-Agent M2"

• "ET TROJAN Golang Aurora Stealer Exfil Activity"

• "ET MALWARE User-Agent (browserbob.com)"

• "ET TROJAN SWORD Sending Sword Marker"

• "ET MOBILE_MALWARE Android APT-C-23 (men-ana .fun in DNS Lookup)"

• "ET TROJAN Red Leaves magic packet response detected (APT10 implant)"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (kojgimagi .com)"

• "ET TROJAN Phorpiex Botnet Downloader Activity (GET)"

• "ET CURRENT_EVENTS Possible Successful Docusign Phish 2015-07-27"

• "ET CURRENT_EVENTS Apple Phishing Redirect 2019-01-02"

• "ET TROJAN DNS Query to Raspberry Robin Domain (gloa .in)"

• "ET TROJAN APT41 CnC Domain (www .affice366 .com) in DNS Lookup"

• "ET TROJAN Win32/Malgent!MSR User-Agent"

• "ET CURRENT_EVENTS Successful NHS Webmail Phish 2020-03-23"

• "ET CURRENT_EVENTS KaiXin Secondary Landing Page M2"

• "ET TROJAN Observed Lazarus Maldoc CnC Domain (shopweblive .com in TLS SNI)"

• "ET TROJAN CoreDn CnC Checkin M1"

• "ET TROJAN Likely Linux/Xorddos DDoS Attack Participation (gggatat456.com)"

• "ET TROJAN Win32/Geodo Checkin"

• "ET TROJAN Possible Winnti-related DNS Lookup (macos .exoticlol .com)"

• "ET TROJAN Observed MSIL/Lightning Stealer Domain (panelss .xyz in TLS SNI)"

• "ET USER_AGENTS Suspicious User-Agent (Loands) - Possible Trojan Downloader GET Request"

• "ET TROJAN DNS Query to Raspberry Robin Domain (9r .sk)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET MALWARE Win32/Adware.WDJiange.A CnC Checkin M1"

• "ET TROJAN W32/Lici Initial Checkin"

• "ET CURRENT_EVENTS Successful American Express Phish M1 2016-10-31"

• "ET TROJAN MacOS/RustBucket System Information Exfiltration Attempt"

• "ET TROJAN Sofacy DNS Lookup updatesoftware24.com"

• "ET TROJAN JS Sniffer Framework Sending to CnC"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Gondad Exploit Kit Post Exploitation Request"

• "ET CURRENT_EVENTS W3LL STORE Credential Phish Landing Page (Capt) 2023-05-05"

• "ET TROJAN Alloy Taurus Reshell Backdoor URI pattern Observed M1"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Golang/Linux Kaiji Variant Activity"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bgcare .cc)"

• "ET USER_AGENTS Suspicious User-Agent (svchost)"

• "ET TROJAN EvilNum CnC Client Data Exfil"

• "ET TROJAN DNS Query to Raspberry Robin Domain (3e .pm)"

• "ET TROJAN Possible TransparentTribe APT CnC Activity"

• "ET TROJAN PowerShell Downloader CnC Activity"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Damien)"

• "ET TROJAN PSEmpire Checkin via POST"

• "ET TROJAN PHPs Labyrinth Backdoor Stage2 CnC Activity M2"

• "ET TROJAN Sality - Fake Opera User-Agent"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (risenpeaches .org)"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK Apr 28 2016"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET TROJAN Win64/TrojanDownloader.AHK.CH Checkin"

• "ET TROJAN MSIL/Black Hat Worm Server Response"

• "ET TROJAN Snake rootkit usermode-centric encrypted command from server"

• "ET TROJAN Linux/Lady CnC Beacon 2"

• "ET TROJAN Generic gate .php GET with minimal headers"

• "ET TROJAN L0rdix Stealer CnC Sending Screenshot"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.e CnC Domain in DNS Lookup"

• "ET MALWARE Win32/RemoteUtilities Checkin via SMTP"

• "ET TROJAN Win32/Ymacco.AA2F Checking (Multiple OS)"

• "ET CURRENT_EVENTS Successful Generic Banking Phish 2016-10-28"

• "ET TROJAN UNC4841 Related Domain in DNS Lookup (togetheroffway .com)"

• "ET TROJAN SSL Cert Associated with Lazarus Downloader (JEUSD)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful FreeMobile (FR) Phish 2016-09-28"

• "ET TROJAN Turkojan C&C Keepalive (BAGLANTI)"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Observed Suspected TA453 Related Domain (xn--metaspport-v43e .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2022-04-05"

• "ET USER_AGENTS Suspicious User-Agent (ms_ie) - Crypt.ZPACK Gen Trojan Downloader GET Request"

• "ET CURRENT_EVENTS Paypal Phishing Landing Jan 09 2017"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (paf-gov .org)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (5qe8 .com)"

• "ET CURRENT_EVENTS Successful Spyus Phish (Multiple Brands) M2 2016-12-12"

• "ET TROJAN Win32/RisePro CnC Server Response M3"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (runfs .icu)"

• "ET TROJAN Observed Malicious SSL Cert (Fullz House CC Skimmer)"

• "ET MOBILE_MALWARE Android APT-C-23 (chat-often .com in DNS Lookup)"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(DSMBVCTFRE)"

• "ET TROJAN Konni Related Activity"

• "ET MOBILE_MALWARE Android/SndApp.B Sending Device Information"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Ferest Smuggler Request M1"

• "ET TROJAN Observed DNS Query to Known Gelsemium CnC"

• "ET CURRENT_EVENTS Possible Phishing Script Hosted on 000webhostapp"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (pdfinfinity .com)"

• "ET TROJAN TA444 Domain in DNS Lookup (docsend .linkpc .net)"

• "ET TROJAN W32/Tobfy.Ransomware CnC Request - status.php"

• "ET EXPLOIT TrendMicro node.js (Remote Debugger)"

• "ET TROJAN Win32/Duino-Coin Miner CnC Checkin"

• "ET MOBILE_MALWARE Suspected PROJECTSPY CnC (video)"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (mail .irir .org)"

• "ET TROJAN Observed Operation Silent Watch Domain in DNS Lookup (mediacloud .space)"

• "ET TROJAN Dorkbot GeoIP Lookup to wipmania"

• "ET MALWARE MyWebSearch Spyware User-Agent (MyWebSearch)"

• "ET TROJAN EVILNUM CnC Response"

• "ET TROJAN Win32/SparkRAT CnC Checkin (GET)"

• "ET CURRENT_EVENTS Possible Java Applet JNLP applet_ssv_validated in Base64"

• "ET TROJAN TripleNine RAT Checkin"

• "ET TROJAN Windows Microsoft Windows DOS prompt command Error not found"

• "ET MALWARE PUP.GigaClicks Checkin"

• "ET CURRENT_EVENTS Successful Paypal Phish M3 2016-10-26"

• "ET TROJAN Nebuler/Dialer.qn HTTP Request - Checkin"

• "ET TROJAN ELF.Initdz.Coinminer C2 Systeminfo (D2)"

• "ET MALWARE AdWare.Win32.Yotoon.hs Checkin"

• "ET CURRENT_EVENTS Successful Wells Fargo Account Phish 2015-08-18"

• "ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Paypal Phishing Domain Mar 14 2016"

• "ET TROJAN Gamaredon APT Maldoc Related Activity (GET)"

• "ET CURRENT_EVENTS Successful Generic Epass Phish 2016-09-01"

• "ET TROJAN DonotGroup Activity (GET)"

• "ET CURRENT_EVENTS Javascript Displays malicious download page"

• "ET TROJAN Observed DNS Query to Vicious Panda CnC Domain"

• "ET TROJAN Patchwork Backdoor - Sending Task Results"

• "ET USER_AGENTS Suspicious User-Agent (MSIE)"

• "ET TROJAN Magecart/Skimmer Domain in DNS Lookup (cxizi .net)"

• "ET CURRENT_EVENTS Successful Facebook Credential Phish 2022-07-05"

• "ET TROJAN APT28/Sednit DNS Lookup (microsofthelpcenter .info)"

• "ET USER_AGENTS ErbiumStealer UA Observed"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN Linux Backdoor Linux/Cdorked.A Redirect 1"

• "ET TROJAN Proyecto RAT Variant - Yopmail Login attempt (set)"

• "ET TROJAN GreetingGhoul Stealer CnC Exfil (POST)"

• "ET TROJAN SharpPanda APT Maldoc Activity"

• "ET CURRENT_EVENTS Possible Glitch.me Phishing Domain"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET EXPLOIT Eir D1000 Modem CWMP Exploit Retrieving Wifi Key"

• "ET CURRENT_EVENTS Successful Chase Phish 2016-12-13"

• "ET TROJAN Win32/MailerBot CnC Activity"

• "ET TROJAN FTCode Stealer Init Activity"

• "ET MOBILE_MALWARE Arid Viper (jennifer-marler .pw in DNS Lookup)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (enacopetroleum .com) 2022-12-05"

• "ET TROJAN BackSwap Trojan C2 Domain Observed (debasuin .nl in DNS Lookup)"

• "ET TROJAN DonotGroup Maldoc Activity (GET)"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (wpgate .zip)"

• "ET CURRENT_EVENTS Adobe Online Document Phishing Landing M1 Mar 25 2017"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (emperorplan .org)"

• "ET TROJAN Possible UNC1878/FIN12 Cobalt Strike CnC SSL Cert Inbound (Texsa)"

• "ET CURRENT_EVENTS CritXPack Jar Request"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (digiboxes .us)"

• "ET TROJAN CoinVault CnC Beacon M2"

• "ET MALWARE BoostBeast Task Request M1"

• "ET POLICY External IP Lookup (extreme-ip-lookup .com)"

• "ET TROJAN WindowsEnterpriseSuite FakeAV check-in GET"

• "ET CURRENT_EVENTS Successful Survey Credential Phish M6 2022-04-04"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-schnellvpn .xyz)"

• "ET TROJAN Deep Panda Downloader User-Agent (mozilla_horizon) GET request observed"

• "ET TROJAN Inception/CloudAtlas CnC Domain in DNS Lookup (newmsoffice .com)"

• "ET CURRENT_EVENTS Possible USAA Phishing Domain Mar 14 2016"

• "ET CURRENT_EVENTS Successful Generic Credential Phish - Loading Messages 2015-08-12"

• "ET TROJAN Kimsuky Maldoc Activity"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M3"

• "ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)"

• "ET TROJAN Observed DNS Query to Gryphon CnC Domain / GlobeImposter Payment Domain"

• "ET TROJAN Bamital Checkin"

• "ET TROJAN BrushaLoader CnC DNS Lookup"

• "ET TROJAN Domen SocEng CnC Observed in DNS Query"

• "ET USER_AGENTS Kimsuky CnC Checkin User-Agent"

• "ET TROJAN Kimsuky Operation Blue Estimate CnC Activity"

• "ET TROJAN Trojan.Bayrob Keepalive"

• "ET TROJAN [ANY.RUN] Win32/ObserverStealer CnC Activity (Screenshot)"

• "ET MOBILE_MALWARE Android.Plankton/Tonclank Successful Installation Device Information POST"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 70"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (datasamsung .com)"

• "ET WEB_SERVER disable_functions PHP config option in uri"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (en-au-wordpress .org)"

• "ET WEB_CLIENT Phishing Fake Document Loading Error 2015-10-01"

• "ET TROJAN Donot APT Related Domain in DNS Lookup (biteupdates .site)"

• "ET MOBILE_MALWARE Android APT-C-23 (mediauploader .info in DNS Lookup)"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (naverk .myvnc .com)"

• "ET CURRENT_EVENTS Successful Facebook Phish 2016-09-02"

• "ET MALWARE DriverFinder User-Agent Observed in HTTP Traffic"

• "ET MALWARE Internet Optimizer User-Agent (ROGUE)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (rewujisaf .com)"

• "ET TROJAN Cinoshi Clipper Domain (tryno .ru) in TLS SNI"

• "ET TROJAN Mylobot Receiving XOR Encrypted Config (0xde)"

• "ET TROJAN lu0bot Loader HTTP Request M3"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1qr0kxc4gcqt2lcpkdnz8ehs02u9n2xkgz89rwpr .com)"

• "ET TROJAN TA402/Molerats Related Malware Domain in DNS Lookup"

• "ET TROJAN CosmicDuke Exfiltrating Data via FTP STOR"

• "ET TROJAN Lazarus APT Related Valefor/VSingle CnC Beacon"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (pahtafinlund .com)"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-02-21"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Yobit Cryptocurrency Exchange Phish 2017-12-28"

• "ET TROJAN Ponmocup Post Infection DNS Lookup fasternation"

• "ET CURRENT_EVENTS Prohqcker Phish Kit"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc 2020-03-09)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab2da3d400c20 .com) Apr 2017"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M21"

• "ET TROJAN APT LuckyMouse Polpo Malware CnC"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Strike CnC)"

• "ET MOBILE_MALWARE Android APT-C-23 (billy-bones .info in DNS Lookup)"

• "ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup"

• "ET TROJAN Win32/Cryptbotv2 CnC Activity (POST) M1"

• "ET TROJAN Lazarus Decafett DNS Lookup 3"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-01"

• "ET CURRENT_EVENTS MalDoc Request for Payload (TA505 Related)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (network190 .com)"

• "ET CURRENT_EVENTS Observed Possible Phishing 2021-06-29"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed DonotGroup Related Domain (furnish .spacequery .live in TLS SNI)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN Drovorub file Module Server Response"

• "ET TROJAN Linux/Onimiki DNS trojan activity long format (Inbound)"

• "ET TROJAN Cobalt Strike Infrastructure CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (AnubisStealer CnC)"

• "ET WEB_CLIENT pshell dl/execute primitives in wideb64 5"

• "ET TROJAN Observed CobInt CnC Domain in TLS SNI"

• "ET TROJAN Cridex Post to CnC"

• "ET TROJAN Scarab APT - HeaderTip CnC Domain in DNS Lookup (mert .my03 .com)"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (27o .nl)"

• "ET TROJAN Win32.Riberow.A (listdir)"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET CURRENT_EVENTS Successful Generic AES Phish M2 Oct 24 2017"

• "ET TROJAN Ponmocup HTTP Request (generic) M8"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (wpsrv .zip)"

• "ET TROJAN Spy-Net Trojan Connection"

• "ET TROJAN Possible Bitter APT Activity (GET)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Observed Malicious SSL Cert (AZORult Cnc Server) 2019-09-27"

• "ET TROJAN Ozone/Darktrack RAT Variant - Client Hello (set)"

• "ET TROJAN SmokeLoader - Init 0x"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Sakula/Mivast RAT CnC Beacon 7"

• "ET TROJAN Win32/Toby.N Multilocker Request"

• "ET TROJAN Likely Linux/Tsunami DDoS Attack Participation (s-p-o-o-f-e-d.h-o-s-t.name)"

• "ET TROJAN DeepEnd Research Ransomware Domain Detected"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (MagnitudeEK Associated)"

• "ET TROJAN ARM Binary Downloaded via WGET Containing Suspicious Netcat Command - Possible IoT Malware"

• "ET WEB_CLIENT Microsoft Tech Support Scam M2 2016-09-15"

• "ET TROJAN Linux/B1txor20 Backdoor Connectivity Check"

• "ET TROJAN MICROPSIA Sending JPG Screenshot to CnC with .his Extension"

• "ET TROJAN Observed Malicious SSL Cert (MalDoc DL 2020-02-21 3)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (bgcare .us)"

• "ET TROJAN Corebot Module Download"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/Crimson Rat CnC Server Response"

• "ET TROJAN Win32.Banload.BTQP Checkin 2"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M9"

• "ET TROJAN UAC-0114/Winter Vivern Screenshot Upload M2"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TeslaCrypt Payment)"

• "ET TROJAN PoshC2 - Observed Default URI Structure M25"

• "ET TROJAN Common Downloader Install Report URL (wmid - ucid)"

• "ET CURRENT_EVENTS Observed TOAD Domain (i2care .us in TLS SNI)"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (onlinesoft .space)"

• "ET TROJAN TraderTraitor CnC Domain in DNS Lookup (alwaysckain .com)"

• "ET TROJAN Observed DNS Query to CnC Domain (StrongPity)"

• "ET MALWARE OSX/Adware.Pirrit CnC Activity 4"

• "ET CURRENT_EVENTS DRIVEBY Possible Goon/Infinity/Magnitude EK SilverLight Exploit"

• "ET MALWARE PUP Win32/ELEX Checkin"

• "ET TROJAN APT10 Related Domain in DNS Lookup (08mma .com)"

• "ET CURRENT_EVENTS Generic Phishkit Activity (GET)"

• "ET TROJAN Buran Ransomware Activity M2"

• "ET TROJAN W32/Emotet CnC Beacon 1"

• "ET MOBILE_MALWARE Android APT-C-23 (katesacker .club in TLS SNI)"

• "ET CURRENT_EVENTS Horde Webmail Phishing Landing 2015-08-21"

• "ET CURRENT_EVENTS Successful Onedrive Phish 2016-05-16"

• "ET WEB_SERVER DNS Query for Suspicious 54dfa1cb.com Domain - Anuna Checkin - Compromised PHP Site"

• "ET TROJAN Various Malware Staging Domain in DNS Lookup (direct-trojan .com)"

• "ET TROJAN AlinaPOS Exfiltration via DNS"

• "ET MALWARE Win32/GameHack.DJC CnC Activity"

• "ET TROJAN Win32/H0lyGh0st Ransomware Exfil Activity (POST)"

• "ET CURRENT_EVENTS Successful GNCU Credential Phish 2022-11-14"

• "ET TROJAN [ANY.RUN] Echida Botnet Check-In M1"

• "ET CURRENT_EVENTS Phishing Landing via MyFreeSites.com (set) 2016-03-31"

• "ET TROJAN FIN8 ShellTea CnC in DNS Query"

• "ET TROJAN DNS Query to Raspberry Robin Domain (0t .yt)"

• "ET CURRENT_EVENTS Successful Gmail Phish M1 2016-08-12"

• "ET TROJAN Possible GhostMiner CCBOT Component - CnC Checkin"

• "ET TROJAN ELF/Mirai Variant UA Inbound (Yakuza)"

• "ET TROJAN FAKE AV HTTP CnC Post"

• "ET TROJAN Observed Malicious SSL Cert (OSX/Nukesped CnC)"

• "ET TROJAN LogStih Stealer CnC Checkin"

• "ET CURRENT_EVENTS Successful Excel Shared Document Phish 2016-06-02"

• "ET TROJAN Trojan.Win32.Qadars Checkin"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (ksew .org)"

• "ET TROJAN Sakula/Mivast RAT CnC Beacon 6"

• "ET TROJAN Win32/Plugx CnC Activity (CONNECT)"

• "ET TROJAN Godlua Backdoor Stage-3 Client Heartbeat (Jul 2020- Jan 2021) (set)"

• "ET TROJAN HAMAS affiliated Domain in TLS SNI (user .nikanps .top)"

• "ET TROJAN Gamaredon CnC Domain (celticso .ru) in DNS Lookup"

• "ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound"

• "ET USER_AGENTS Suspicious User-Agent Sample"

• "ET WEB_CLIENT Suspected Credit Card Stealer Related Domain Domain in DNS Lookup (byvlsa .com)"

• "ET TROJAN Satan/5ss5c Ransomware CnC Activity"

• "ET TROJAN Win32/WarHawk Sending Windows System Information (POST)"

• "ET TROJAN Win32/Sehyioa Variant Activity (Download)"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (snxn298y5brpxd67rbntynb6p4qupuuv .com)"

• "ET TROJAN Hawkeye Keylogger SMTP Beacon"

• "ET MOBILE_MALWARE Android APT-C-23 (kik-com .com in DNS Lookup)"

• "ET TROJAN CenterPOS Load Plugins"

• "ET EXPLOIT FireEye Appliance Unauthorized File Disclosure"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Hawkshaw.a (bald-panel .firebaseio .com in DNS Lookup)"

• "ET TROJAN Possible Malicious Macro DL EXE May 2016 (Mozilla compatible)"

• "ET TROJAN Linux/ChinaZ 2.0 DDoS Bot Checkin 3"

• "ET TROJAN Observed Win32/Backdoor Related Domain (swordoke .com in TLS SNI)"

• "ET TROJAN APT29 CnC Domain in DNS Lookup (sgrhf .org .pk)"

• "ET TROJAN BIOPASS RAT Related Domain in DNS Lookup (0x3s .com)"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"

• "ET MOBILE_MALWARE Android APT-C-23 (help-sec .club in DNS Lookup)"

• "ET TROJAN Observed Godlua Backdoor Domain (c .heheda .tk in TLS SNI)"

• "ET TROJAN Mocelpa Client Hello CnC Beacon"

• "ET TROJAN GO/Titan Stealer Data Exfiltration Attempt"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN GobRAT CnC Domain in DNS Lookup (wpksi .mefound .com)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (onthewire1 .top)"

• "ET TROJAN Win32/Ursnif Checkin"

• "ET CURRENT_EVENTS Evil Redirector Leading to EK March 15 2017"

• "ET TROJAN FakeAV Landing Page"

• "ET TROJAN OSX/Mami Possible DNS Query to Evil DNS Server"

• "ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to virtualdataserver .com"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-08"

• "ET TROJAN Plurox CnC Domain in DNS Lookup"

• "ET TROJAN HawkEye Keylogger Report SMTP"

• "ET TROJAN dlink router access attempt"

• "ET TROJAN Win32/CONFUCIUS_B CnC Checkin"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN MSIL/DataMilk Stealer Communicating with CnC"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (eaglestravels-ae .com) 2022-12-05"

• "ET TROJAN Win32/Namsoth.A Checkin/NEWSREELS APT1 Related"

• "ET USER_AGENTS Suspicious User-Agent (Internet HTTP Request)"

• "ET WEB_SERVER FOX-SRT - Backdoor - CryptoPHP Shell C2 POST"

• "ET TROJAN CBeplay Downloading Design"

• "ET TROJAN Zlob User Agent (securityinternet)"

• "ET TROJAN NIGHTSCOUT Malware CnC Domain in DNS Lookup (q. cloudistcdn .com)"

• "ET TROJAN NOBELIUM (TA421) EnvyScout Fingerprint Checkin"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN DonotGroup APT Related Domain in DNS Lookup (ser .dermlogged .xyz)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET WEB_CLIENT Fake AV Phone Scam Landing June 16 2015 M4"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 14"

• "ET TROJAN [eSentire] Cobalt Strike Beacon"

• "ET TROJAN SmugX Domain (jcswcd .com) in TLS SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Adobe Phish Landing Page 2022-01-12"

• "ET TROJAN APT33/CharmingKitten DDNS Overlap Domain in DNS Lookup M1"

• "ET TROJAN Vawtrak/NeverQuest - Post Data Form 01"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (safemeeting .online)"

• "ET TROJAN Variant.Kazy.174106 Checkin"

• "ET TROJAN TA401 Domain in DNS Lookup (francescatmorrison .icu)"

• "ET TROJAN M3RAT CnC Checkin Outbound"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.a Checkin"

• "ET TROJAN Suspected DPRK APT Related Activity (GET)"

• "ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)"

• "ET TROJAN Zbot CnC GET /lost.dat"

• "ET TROJAN Possible Kelihos.F EXE Download Common Structure 2"

• "ET TROJAN Observed IcedID Domain (ldrtoyota .casa in TLS SNI)"

• "ET INFO Possible Phishing Landing via MoonFruit.com M3 2016-01-22"

• "ET TROJAN Win32/Nivdort Posting Data 2"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-03-02"

• "ET CURRENT_EVENTS Observed TOAD Domain (hscare .live in TLS SNI)"

• "ET TROJAN Win32/Girostat Stealer (POST)"

• "ET MOBILE_MALWARE Android/SOVA Banking Trojan Activity (log post)"

• "ET MALWARE Security-updater.com Spyware Posting Data"

• "ET TROJAN Malicious SSL Certificate detected (Cobalt Strike CnC)"

• "ET TROJAN Woody RAT CnC Domain (oakrussia .ru) in DNS Lookup"

• "ET WEB_CLIENT Tech Support Phone Scam Landing M1 Jun 29 2016"

• "ET TROJAN Blaze/Supreme Bot Activity M2"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET TROJAN Trojan.APT.9002 CnC Traffic"

• "ET TROJAN Bookworm CnC Beacon 2"

• "ET MOBILE_MALWARE Android/FakeKakao checkin 3"

• "ET TROJAN W32/Liftoh.Downloader Feed404 CnC Beacon"

• "ET TROJAN Win32/Injector.ULH CnC Activity"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 89"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4m .wf)"

• "ET TROJAN MSIL/Golroted.B Keylogger FTP"

• "ET CURRENT_EVENTS Successful Generic Phish - Fake Loading Page 2017-08-03"

• "ET TROJAN Observed Malicious SSL Cert (Zeromax Stealer CnC)"

• "ET TROJAN NetBackdoor Checkin"

• "ET MALWARE Observed Honeygain Domain (api .honeygain .com in TLS SNI)"

• "ET TROJAN Win32/RecordBreaker - Library Request"

• "ET TROJAN Win32/Ruckguv.A Requesting Payload"

• "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 10"

• "ET CURRENT_EVENTS [TW] NOTG Obfuscation Redirect Observed M1"

• "ET MOBILE_MALWARE NSO Related Domain 14"

• "ET TROJAN TA444 Domain in DNS Lookup (hoststudio .org)"

• "ET TROJAN Optix Pro Trojan/Keylogger Reporting Installation via Email"

• "ET TROJAN Win32/MagicRAT CnC Checkin M2"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-02-13"

• "ET TROJAN TeleBots VBS Backdoor CnC Beacon 2"

• "ET CURRENT_EVENTS Successful Generic Phish (set) Sep 28 2017"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (chestedband .org)"

• "ET TROJAN ServHelper CnC Domain"

• "ET USER_AGENTS User-Agent (STEROID Download)"

• "ET TROJAN Win32/I'm_Better Stealer CnC Command - get_key"

• "ET TROJAN Win32/PSW.WOW.NLZ CnC Activity"

• "ET TROJAN Observed DNS Query to Ursnif SAIGON Variant CnC Domain"

• "ET TROJAN DustySky Downeks/Quasar/other DNS Lookup (webfile .myq-see.com)"

• "ET TROJAN TA444 Domain in TLS SNI (video-meet .team)"

• "ET WEB_CLIENT Generic Attempted Executable Drop via VBScript"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN DNS Query to Ursnif Domain (communicalink .com)"

• "ET TROJAN Suspicious Domain (judgebryantweekes .com) in TLS SNI"

• "ET TROJAN NEODYMIUM Wingbird DNS Lookup (srv602 .ddns.net)"

• "ET CURRENT_EVENTS Avast Phishing Landing 2016-06-02"

• "ET TROJAN W32/SpyBanker Infection Confirmation Email 2"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (binchfog .xyz)"

• "ET TROJAN PennyWise Stealer Data Exfil M2"

• "ET TROJAN W32.Razy Inject Domain in DNS Lookup"

• "ET TROJAN Possible Pegasus Related DNS Lookup (twiitter .com.mx)"

• "ET TROJAN Rogue AV Downloader concat URI"

• "ET TROJAN Hiatus RAT CnC Checkin"

• "ET CURRENT_EVENTS CirtXPack - No Java URI - /a.Test"

• "ET CURRENT_EVENTS Successful US Bank Phish M2 2015-12-22"

• "ET TROJAN Win32/Enchanim Checkin"

• "ET CURRENT_EVENTS PerSwaysion Phishkit Javascript Checks if New Visitor"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Kimsuky Related Activity (POST)"

• "ET TROJAN [PTsecurity] Donut Ransomware CnC Checkin"

• "ET TROJAN Kimsuky Related CnC"

• "ET TROJAN CHIMNEYSWEEP Backdoor CnC Domain (update-pgp .com) in DNS Lookup"

• "ET TROJAN Possible Zeus P2P Variant Check-in"

• "ET TROJAN Win32/Mole Ransomware CnC Beacon"

• "ET TROJAN ShellCrew.APT StreamEx DNS Lookup 25"

• "ET TROJAN TA402 CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS BulletProofLink Phishkit Password-Processing URL"

• "ET TROJAN Fasec/FakeAV Alert/Keylogger/Dropper/DNSChanger Possible Rootkit - HTTP GET"

• "ET CURRENT_EVENTS Possible Paypal Phishing Domain (IT) Oct 10 2017"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (SilentLibrarian)"

• "ET TROJAN SSL/TLS Certificate Observed (StrongPity)"

• "ET TROJAN TA453 Related CnC Domain in DNS Lookup (0brandaeyes0 .xyz)"

• "ET TROJAN Pegasus Domain in DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Brute Ratel CnC Activity (json-c2) M2"

• "ET TROJAN Stonefly APT Related Domain in DNS Lookup (tecnojournals .com)"

• "ET TROJAN Possible Winnti-related DNS Lookup"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Windows/OriginLogger CnC Domain (originlogger .com) in DNS Lookup"

• "ET TROJAN S400 RAT Client Checkin"

• "ET TROJAN W32/Zeus.InfoStealer Infection Campaign Wav.exe Request"

• "ET TROJAN Regin Hopscotch Module Accessing SMB2 Named Pipe (Unicode) 1"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN CopyKittens Cobalt Strike DNS Lookup (cloudflare-analyse . com)"

• "ET TROJAN Win32/Remcos RAT Checkin 809"

• "ET MOBILE_MALWARE NSO Related Domain 21"

• "ET CURRENT_EVENTS Likely Malicious wininet UA Downloading EXE"

• "ET TROJAN Bifrose/Cycbot Checkin 2"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible CopyKitten DNS Lookup (microsoft-ds .com)"

• "ET TROJAN Win32/PlagueBot User-Agent"

• "ET TROJAN DNS Query to Raspberry Robin Domain (4s .pm)"

• "ET TROJAN TinyNuke VNC Checkin"

• "ET CURRENT_EVENTS Observed TOAD Domain (hshelp .online in TLS SNI)"

• "ET TROJAN Observed Sofacy CnC Domain (ndpmedia24 .com in DNS Lookup)"

• "ET MOBILE_MALWARE Android APT-C-23 (joycebyers .club in TLS SNI)"

• "ET TROJAN Gimemo Ransomware Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (davina-claire .xyz in TLS SNI)"

• "ET TROJAN Win32.Chroject.B Receiving ClickFraud Commands from CnC 2"

• "ET MALWARE Win32/Adware.Bang5mai.BB CnC Activity M1"

• "ET MOBILE_MALWARE Android APT-C-23 (mofa-help .site in TLS SNI)"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS [eSentire] Adobe Phishing Landing 2018-07-04"

• "ET TROJAN Win32/Bancos.AMM CnC Beacon"

• "ET TROJAN GreetingGhoul Stealer Domain in DNS Lookup (cryptohedgefund .us)"

• "ET TROJAN Observed CobaltStrike Loader Domain (cybersecyrity .com in TLS SNI)"

• "ET TROJAN Possible Worm W32.Svich or Other Infection Request for setting.xls"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original GET]"

• "ET TROJAN Observed Malicious SSL Cert (ACBackdoor CnC)"

• "ET TROJAN TinyTurla CnC Activity"

• "ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin UA"

• "ET TROJAN TA401 Arid Viper CnC Domain in DNS Lookup (sknzy-mysl .vip)"

• "ET TROJAN FlawedGrace CnC Activity"

• "ET CURRENT_EVENTS Nedbank Phishing Landing Page 2022-06-22"

• "ET MOBILE_MALWARE Android Nexus Banking Botnet Activity (GET)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (wmail-blog .xyz)"

• "ET TROJAN Potao CnC"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-cdn .xyz)"

• "ET TROJAN Win32/Phorpiex Template 4 Active - Outbound Malicious Email Spam"

• "ET TROJAN FastPOS Sending Keystrokes"

• "ET TROJAN PhantomNet/Smanager CnC Domain in DNS Lookup (office365.blogdns .com)"

• "ET TROJAN Criptobit/Mobef Ransomware Checkin"

• "ET TROJAN Tinba Banker CnC Response"

• "ET TROJAN AlphaCrypt .onion Proxy Domain (djdkduep62kz4nzx)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (metallife .org)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Arkei Stealer Config Download Request"

• "ET TROJAN DonotGroup/Patchwork CnC DNS Lookup"

• "ET TROJAN Linux/Tsunami DNS Request (updates.absentvodka.com)"

• "ET CURRENT_EVENTS Generic Phishing DNS Lookup (xn--sapeaunoticias-kjb .com .br)"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET TROJAN Linux/AES.DDoS Sending Real/Fake CPU&BW Info"

• "ET TROJAN Win32/TrojanDownloader.Agent.RFS Variant Checkin"

• "ET TROJAN HermeticWizard - WMI Spreader - File Copy via SMB1 (NT Create AndX Request)"

• "ET TROJAN DNS Query to IcedID Domain (grafielucho .com)"

• "ET CURRENT_EVENTS Successful Gmail Phish M2 2016-09-29"

• "ET TROJAN Cobalt Strike Malleable C2 Profile wordpress_ Cookie Test"

• "ET TROJAN TA427 Suspected ReconShark Related Response (Inbound)"

• "ET TROJAN OSX/WireLurker CnC Beacon"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in TLS SNI (wpops .zip)"

• "ET TROJAN Volatile Cedar Win32.Explosive Fake User-Agent"

• "ET TROJAN W32/Madness Checkin"

• "ET TROJAN UsefulTyphon CnC Activity M2"

• "ET WEB_SERVER Possible Darkleech C2"

• "ET TROJAN Observed DNS Query to Ursnif SAIGON Variant CnC Domain"

• "ET TROJAN NetWire Variant - Client Hello"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 44"

• "ET TROJAN TA452 Related Backdoor Activity (POST)"

• "ET TROJAN Suspicious User-Agent - Possible Trojan Downloader (ver18/ver19 etc)"

• "ET TROJAN APT.Agtid callback"

• "ET TROJAN 7ev3n Ransomware Related Activity (GET)"

• "ET MALWARE Tibsystems Spyware Download"

• "ET TROJAN Observed TA444 Domain (sharedrive .ink in TLS SNI)"

• "ET TROJAN SSL/TLS Certificate Observed (Link Implant Default)"

• "ET TROJAN Known Sinkhole Response Header"

• "ET TROJAN SideCopy APT Related Backdoor Victim Response (infoback)"

• "ET TROJAN Citadel Checkin"

• "ET WORM Rimecud Worm checkin"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to RisePro Domain (get-24files .com)"

• "ET TROJAN Linux/Moose HTTP CnC Beacon"

• "ET TROJAN Bladabindi/njrat CnC Command Response (Remote Desktop)"

• "ET TROJAN GravityRAT CnC Domain (msoftserver .eu in DNS Lookup)"

• "ET TROJAN Mimikatz x86 Executable Transfer Over SMB"

• "ET MALWARE Observed Win32/Foniad Domain (insupposity .info in TLS SNI)"

• "ET TROJAN DEEP PANDA Checkin 2"

• "ET MOBILE_MALWARE Android/FluBot Trojan Sending Information (POST)"

• "ET TROJAN Observed linux.backdoor.wordpressexploit.2 Domain (deliverygoodstrategies .com) in TLS SNI"

• "ET TROJAN [PTsecurity] Win32/SocStealer.Socelars C2 Response"

• "ET TROJAN Fake IBM SSL Cert APT1"

• "ET TROJAN System Progressive Detection FakeAV (GenuineIntel)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Possible Successful Phish to Hostinger Domains M2 2016-04-04"

• "ET TROJAN Diavol Communicating with CnC - Key Request"

• "ET TROJAN Kuluoz Activity"

• "ET MALWARE Fun Web Products Spyware User-Agent (FunWebProducts)"

• "ET CURRENT_EVENTS Xbagger Macro Encrypted DL Jun 13 2016"

• "ET CURRENT_EVENTS Successful Apple Phish M1 Mar 15 2017"

• "ET TROJAN Possible Outbound WebShell JPEG"

• "ET TROJAN Observed Malicious SSL Cert (Microsoft Security localhost)"

• "ET TROJAN Win32/Denisca.A CnC Beacon 2"

• "ET TROJAN Win32/Goofy Guineapig CnC Activity (GET) M1"

• "ET TROJAN SoulSearcher Malware Domain in DNS Lookup (app .tomelife .com)"

• "ET TROJAN RisePro CnC Activity (Inbound)"

• "ET TROJAN DownloaderExchanger/Cbeplay Variant Checkin"

• "ET TROJAN Observed DNS Query to Ursnif Domain (fineg .xyz)"

• "ET TROJAN [FIREEYE] PULSECHECK Webshell Access Outbound"

• "ET TROJAN DonotGroup Staging Domain in DNS Query"

• "ET TROJAN Targeted Activity - CnC Domain in SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN ABUSE.CH Ransomware Domain Detected (TorrentLocker Payment)"

• "ET CURRENT_EVENTS Successful Generic Phish 2018-05-08 (set)"

• "ET TROJAN Windows/OriginLogger CnC Domain (originproducts .xyz) in DNS Lookup"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN Legion Loader Activity Observed (Amen)"

• "ET TROJAN SysJoker Bot Registration (POST)"

• "ET TROJAN Observed DNS Query to Known Gelsemium CnC"

• "ET TROJAN ChromeLoader CnC Domain (istakechau .autos) in DNS Lookup"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (umousteraton .com)"

• "ET TROJAN CORESHELL Malware Response from server"

• "ET TROJAN Dyreza RAT Checkin 2"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (onlinestockwatch .net)"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework Flash GET Request"

• "ET MALWARE Better Internet Spyware User-Agent (poller)"

• "ET MALWARE Win32/RemoteUtilities Checkin via SMTP M2"

• "ET TROJAN Observed Malicious SSL Cert (FIN8 ShellTea CnC)"

• "ET MOBILE_MALWARE Android APT-C-23 (accountforuser .website in DNS Lookup)"

• "ET TROJAN VenusLocker Activity"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (privatproxy-endpoint .xyz)"

• "ET TROJAN SteamStealer DNS Lookup (lightalex)"

• "ET TROJAN Banload POST Checkin (dados)"

• "ET TROJAN SYS01 Information Stealer - CnC Checkin"

• "ET TROJAN Sarwent CnC Response (rdp_exec)"

• "ET TROJAN Gh0st Trojan CnC 3"

• "ET CURRENT_EVENTS Successful Barclays Phish M3 2016-09-09"

• "ET CURRENT_EVENTS Successful Wells Fargo Phish M1 2016-09-16"

• "ET TROJAN Observed TA444 Domain in TLS SNI"

• "ET TROJAN Mozart Loader Command Request (gettasks)"

• "ET TROJAN Win32/SVCReady Loader - SysInfo M2"

• "ET TROJAN TorrentLocker DNS Lookup (deadwalk32.ru)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-09-26"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/Crimson Rat CnC Exfil"

• "ET TROJAN Observed TA444 Domain (smbcgroup .us in TLS SNI)"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 3 Staging Domain)"

• "ET TROJAN Observed Buran Ransomware UA (BURAN)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[Yelp Request]"

• "ET TROJAN COMRAT CnC"

• "ET MALWARE Toolbar User-Agent (BrandThunderHelper)"

• "ET MOBILE_MALWARE Android Fancy Bear Checkin 4"

• "ET TROJAN DNS Query for known ShadowPad CnC 11"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 71"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc System Details Request"

• "ET TROJAN Observed LegionLoader Domain in TLS SNI (legions .win)"

• "ET TROJAN Possible OwlProxy activity M1"

• "ET TROJAN Win32/Inido!rts Checkin"

• "ET TROJAN BunnyLoader CnC Checkin - Echoer"

• "ET TROJAN DNS Query for known ShadowPad CnC 8"

• "ET TROJAN Common Downloader Access Count Tracking URL"

• "ET MALWARE Easy Search Bar Spyware User-Agent (ESB)"

• "ET TROJAN Win32.Pony Variant FOX Checkin"

• "ET TROJAN Stellar Stealer Data Exfiltration Attempt M5"

• "ET TROJAN Redfly APT Shadowpad Backdoor Domain in DNS Lookup (websencl .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (antiqueglossary .com)"

• "ET TROJAN ELF/LiLocked Ransom Note in HTTP Response"

• "ET TROJAN OSX/WireLurker HTTP Request for www.comeinbaby.com"

• "ET TROJAN Known Skunkx DDOS Bot User-Agent Cyberdog"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (panahaziso .ru)"

• "ET TROJAN NetBackdoor User-Agent (.net backdoor)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (7r6 .nl)"

• "ET TROJAN Koobface HTTP Request (2)"

• "ET TROJAN Win32/TrojanDropper.Agent.SRM Exfil via Discord"

• "ET TROJAN Win32/PurpleFox Related Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Successful Phish - Verify Email Error Message M1 Aug 14 2017"

• "ET TROJAN ELF/Mayhem Checkin"

• "ET TROJAN Cobalt Strike Infrastructure CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-02"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (limeerror .org)"

• "ET CURRENT_EVENTS Successful Apple Phish M3 2016-09-29"

• "ET TROJAN DNS Query to TA444 Domain (doc .apple .com .premienoe .aidl .eonw .line .pm)"

• "ET CURRENT_EVENTS RIG EK Landing Sep 13 2016 (b642)"

• "ET WEB_CLIENT CookieBomb 2.0 In Server Response Jan 29 2014"

• "ET TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Malware C2)"

• "ET TROJAN JS/Cloud9 Cookie Exfiltration Attempt"

• "ET TROJAN Possible Pegasus Related DNS Lookup (emiratesfoundation .net)"

• "ET TROJAN TrojanSpy.KeyLogger Hangover Campaign User-Agent(vbusers)"

• "ET TROJAN TR/Spy.Gen checkin via dns ANY query"

• "ET WEB_SERVER Generic PHP Webshell Activity"

• "ET TROJAN PlugX DNS Lookup (mailsecurityservice.com)"

• "ET TROJAN Win32/Limbozar Ransomware Activity (POST)"

• "ET TROJAN LYCEUM CnC Domain in DNS Lookup"

• "ET TROJAN Storm-0978 RomCom RAT CnC Checkin"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (mindsnatchers .com)"

• "ET TROJAN MacOS/MacStealer Data Exfiltration Attempt"

• "ET CURRENT_EVENTS [TW] EvilProxy AiTM Network Reporting"

• "ET TROJAN Observed IcedID Domain in DNS Lookup (spkdeutshnewsupp .com)"

• "ET TROJAN Gift Cardshark CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Dark Halo/SUNBURST CnC Domain (webcodez .com in TLS SNI)"

• "ET TROJAN APT32/OceanLotus Associated Domain in DNS Lookup (nhansudaihoi13 .org)"

• "ET TROJAN SysJoker Host Details Exfil (POST)"

• "ET CURRENT_EVENTS Successful Generic Phish 2022-07-29"

• "ET TROJAN Gamaredon Related Maldoc Activity (GET)"

• "ET TROJAN TWISTEDPANDA CnC Domain in DNS Lookup (img .elliotterusties .com)"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET TROJAN Observed Gamaredon APT Related Domain (bulot .ru in TLS SNI)"

• "ET TROJAN Win32/Remcos RAT Checkin 26"

• "ET TROJAN Oficla Downloader Activity Observed"

• "ET WEB_CLIENT Tech Support Phone Scam Landing (msg.mp3) 2016-08-12"

• "ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration"

• "ET TROJAN Observed DNS Query to Win.Backdoor.Kolobko Domain in DNS Lookup (mycisco .cf)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Oct 26 2016"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (safetravel-services .com) 2022-12-05"

• "ET TROJAN Possible Upatre Downloader SSL certificate (fake loc)"

• "ET CURRENT_EVENTS Successful Vmware/Zimbra Phish 2015-09-28"

• "ET TROJAN Foudre Checkin M1"

• "ET TROJAN StartPage Userclass HTTP Request"

• "ET TROJAN Observed Glupteba CnC Domain (cdneurops .health in TLS SNI)"

• "ET TROJAN Observed DNS Query to TA444 Domain (cloud .mufg .uk)"

• "ET TROJAN Lyceum Group Activity (DNS)"

• "ET EXPLOIT CVE-2015-2419 As observed in Magnitude EK"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET WEB_CLIENT BottleEK Plugin Check JS"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (metasupportmail .com)"

• "ET TROJAN Observed SluttyPutty Maldoc User-Agent"

• "ET TROJAN Haxdoor Reporting User Activity"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (unicornhub .top)"

• "ET CURRENT_EVENTS DrSpam Phishing Landing 2016-06-08"

• "ET TROJAN BIOPASS RAT Python Activity (GET)"

• "ET TROJAN APT_NGO_wuaclt C2 Check-in"

• "ET CURRENT_EVENTS Successful Apple Phish M1 2016-09-14"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (headertolz .com)"

• "ET TROJAN Common Downloader Install Report URL (farfly checkin)"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (yachtbars .fun)"

• "ET TROJAN MageCart CnC Domain in SNI"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework URI Struct Jpg Request"

• "ET USER_AGENTS Suspicious User-Agent (CFS_DOWNLOAD)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (y0 .wf)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (catsndogz .org)"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1q922jh6d3zk0aelqdfc7yygzjr29sle .com)"

• "ET CURRENT_EVENTS Possible Phishing Landing Hosted on CodeSandbox.io M4"

• "ET TROJAN W32/SecVerif.Downloader Second Stage Download Request"

• "ET TROJAN Linux/Yangji.A Checkin"

• "ET TROJAN Windows WMIC SHARE get Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2020-02-25"

• "ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M1"

• "ET TROJAN Comfoo Checkin"

• "ET CURRENT_EVENTS SNET EK Encoded VBS 3"

• "ET CURRENT_EVENTS Fiesta URI Struct"

• "ET TROJAN Go/Hack Browser Data Exfil Attempt"

• "ET TROJAN Win32/Cryptrun.B/MSUpdater C&C traffic 1"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-11-17"

• "ET TROJAN Win32/Emold.C Checkin"

• "ET TROJAN MINEBRIDGE CnC Activity"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Echelon/Mist Stealer CnC Activity"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS NATO Themed Maldoc Related Domain in DNS Lookup (am .my-zo .org)"

• "ET TROJAN Pegasus Domain in DNS Lookup"

• "ET TROJAN LogPOS Sending Data"

• "ET TROJAN Gamaredon Domain in DNS Lookup (ishakpa .ru)"

• "ET TROJAN DNSTrojan FakeAV Dropper Activity Observed (1)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Gamaredon Domain in DNS Lookup (aydynpo .ru)"

• "ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server]"

• "ET TROJAN TDTESS Backdoor User-Agent"

• "ET TROJAN Sofacy Request Outbound"

• "ET TROJAN Win32/TrickBot maserv Module CnC Activity"

• "ET TROJAN StormKitty Download Request With Minimal Headers"

• "ET TROJAN Win32.Application.ThunderN.A Checkin"

• "ET TROJAN Observed JSSLoader Variant Domain (legislationient .com in TLS SNI)"

• "ET CURRENT_EVENTS Successful Apple Phish M1 Feb 06 2016"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN CoreDDRAT KeepAlive Message"

• "ET TROJAN RustyBuer CnC Domain in SNI"

• "ET TROJAN ReverseRAT Activity (POST) M3"

• "ET CURRENT_EVENTS Successful Linkedin Phish 2016-11-18"

• "ET TROJAN Observed Gamaredon APT Related Domain (acanthusso .ru in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android/Comll.Banker RAT CnC Beacon"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phishing 2016-09-12"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (tenders-aisschools .com) 2022-12-05"

• "ET TROJAN Possible APT30 or Win32/Nuclear HTTP Framework"

• "ET TROJAN Nuke Ransomware Checkin"

• "ET TROJAN Observed BatLoader Domain (cloudupdatesss .com) in TLS SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN UAC-0063 Domain in DNS Lookup (ms-webdav-miniredir .com)"

• "ET TROJAN Laplas Clipper CnC Domain (clipper .guru) in DNS Lookup"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2019-04-12"

• "ET CURRENT_EVENTS Successful Poste Italiane Phish Jun 08 2017"

• "ET TROJAN APT28/Sednit DNS Lookup (shurl .biz)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN RocketMan Win32/Drun"

• "ET TROJAN APT DarkHydrus DNS Lookup 12"

• "ET TROJAN DNS Query to Raspberry Robin Domain (13j .me)"

• "ET MOBILE_MALWARE Android/TrojanDropper.Agent.EP HTTP Host"

• "ET TROJAN W32/Trojan-Gypikon Server Check-in Response"

• "ET USER_AGENTS Possible QBot User-Agent"

• "ET TROJAN DNS Query to Raspberry Robin Domain (i6n .xyz)"

• "ET MALWARE Alexa Search Toolbar User-Agent 2 (Alexa Toolbar)"

• "ET TROJAN Backdoor.Meciv Checkin"

• "ET TROJAN Win32/Autophyte.F C2 Domain (www .apshenyihl .com in DNS Lookup)"

• "ET TROJAN Laplas Clipper - SetOnline CnC Checkin"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 12"

• "ET CURRENT_EVENTS Possible PurpleFox EK Framework Flash HEAD Request"

• "ET MALWARE Adware.Ezula Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (lets-see .site in TLS SNI)"

• "ET CURRENT_EVENTS Successful Dynamic Folder Phish 2016-11-28"

• "ET TROJAN CommentCrew Possible APT c2 communications get command client key"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 6"

• "ET TROJAN Naikon DNS Lookup (greensky27.vicp.net)"

• "ET TROJAN RouteX CnC Domain (aaafc94b3a37b75ae9cb60afc42e86fe .org) in DNS Lookup"

• "ET TROJAN ELF/lizkebab CnC Activity (Flooding 1)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE Win32/DealPly.EJ Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Silver Keylogger)"

• "ET TROJAN Possible PaperCut MF/NG Post Exploitation Domain in DNS Lookup (windowcsupdates .com)"

• "ET TROJAN HAMAS affiliated Domain in DNS Lookup (modir .nikanps .top)"

• "ET TROJAN Alina Checkin"

• "ET WEB_CLIENT Tech Support Scam Sep 08 2017"

• "ET TROJAN [ANY.RUN] StatusRecorder Stealer Sending System Information"

• "ET TROJAN Deathstalker/Evilnum Delivery Domain (bukjut11 .com) in TLS SNI"

• "ET TROJAN [eSentire] Win32/Spy.Banker CnC Command (DOWNLOAD)"

• "ET TROJAN Win32/Fynloski.AA CnC Checkin"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-10-06"

• "ET TROJAN Dialer.Trojan Activity"

• "ET CURRENT_EVENTS Possible Phishing Landing via GetGoPhish Phishing Tool"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET MOBILE_MALWARE Android Trojan MSO.PJApps checkin 1"

• "ET TROJAN Malware Connectivity Check to Google"

• "ET CURRENT_EVENTS Successful ING Banking Credential Phish 2022-12-12"

• "ET TROJAN Candiru Related Domain in DNS Lookup (cuturl .space)"

• "ET TROJAN DNS query for known Anunak APT Domain (paradise-plaza.com)"

• "ET EXPLOIT Possible ECLIPSEDWING MS08-067"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/RootTeam Stealer CnC Exfil M1"

• "ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M3"

• "ET TROJAN Possible W32/VBKlip BAN Download"

• "ET TROJAN Win32/Filecoder Ransomware Variant .onion Proxy Domain (tkj3higtqlvohs7z)"

• "ET TROJAN Win32/Zacom.A CnC Beacon 1"

• "ET MOBILE_MALWARE Android/CoolPaperLeak Sending Information To CnC"

• "ET CURRENT_EVENTS Inbound PowerShell Saving Base64 Decoded Payload to Temp M1 2018-11-29"

• "ET TROJAN Lazarus APT Related CnC Domain in DNS Lookup (product .onlinedoc .dev)"

• "ET TROJAN Ransomware/Cerber Onion Domain Lookup"

• "ET TROJAN TA577 Style Request (2023-05-15)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (verify-email .space in TLS SNI)"

• "ET EXPLOIT GitLab Pre-Auth RCE Detected (CVE-2021-22205)"

• "ET MOBILE_MALWARE Arid Viper (fasebcak .com in DNS Lookup)"

• "ET TROJAN DCRat Related CnC Domain in DNS Lookup"

• "ET INFO Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)"

• "ET USER_AGENTS Suspicious User Agent (_)"

• "ET TROJAN Likely CryptoWall 2.0 .onion Proxy domain lookup"

• "ET MOBILE_MALWARE Arid Viper (dash-chat-c02b3 .firebaseio .com in DNS Lookup)"

• "ET TROJAN Observed TA444 Domain in TLS SNI (docsend .linkpc .net)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 Staging Domain)"

• "ET TROJAN DDG Botnet CnC Job Request"

• "ET TROJAN Iron/Maktub Locker Ransomware CnC Checkin"

• "ET MALWARE Win32/InstallCore Initial Install Activity 1"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6t4 .nl)"

• "ET TROJAN Observed BatLoader Domain (105105105015 .com) in TLS SNI"

• "ET TROJAN Perl/Shellbot.SM IRC CnC Checkin"

• "ET TROJAN Observed TA444 Domain (cloud .mufg .uk in TLS SNI)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (bahrainsms .co)"

• "ET TROJAN Win32/Colibri Loader Activity M3"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (iconiqueimmigration .com) 2022-12-05"

• "ET TROJAN Sality Variant Downloader Activity (3)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-06-29"

• "ET TROJAN [Fireeye] Backdoor.BEACON M3"

• "ET CURRENT_EVENTS CritXPack Landing Pattern"

• "ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (twethujsnu .cc in DNS Lookup)"

• "ET WEB_SERVER Win32/SessionManager2 Backdoor FILESIZE Command (Inbound)"

• "ET TROJAN Win32/ASPC Bot CnC Checkin M2"

• "ET TROJAN X-Tag Zeus Mitmo user agent"

• "ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup"

• "ET TROJAN Kimsuky KGH Backdoor CnC Activity M2"

• "ET TROJAN Cobalt Strike Related Activity (GET)"

• "ET TROJAN ClipBanker Variant Activity (POST)"

• "ET TROJAN Win32/Satana Ransomware Checkin"

• "ET CURRENT_EVENTS Successful HM Revenue Phish 2016-10-06"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .nationalrecoveryllc .com)"

• "ET INFO Data Submitted to Weebly.com - Possible Phishing"

• "ET TROJAN Win32/Backdoor Retrieving Task (POST)"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (edicupd002 .com)"

• "ET CURRENT_EVENTS Successful NatWest Bank Phish M3 2016-10-19"

• "ET TROJAN Observed Malicious SSL Cert (MageCart CnC)"

• "ET CURRENT_EVENTS Successful Bank of America Phish 2016-12-05"

• "ET TROJAN Locky Intermediate Downloader"

• "ET WEB_CLIENT Multibrowser Resource Exhaustion observed in Tech Support Scam"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2020-06-10"

• "ET TROJAN PowerShell/Agent.A DNS File Transfer CnC Beacon"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (andreeasasser .com)"

• "ET TROJAN Win32/0xtaRAT CnC Activity M2 (GET)"

• "ET MOBILE_MALWARE Observed Oscorp/UBEL CnC Domain (gogleadser .xyz in TLS SNI)"

• "ET TROJAN Win32/MagicRAT CnC Checkin M1"

• "ET TROJAN Win32/Fewin Stealer Data Exfiltration Attempt"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN APT CozyCar SSL Cert 8"

• "ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017 M2"

• "ET TROJAN Desert Falcon Related APT DNS Lookup (nice-mobiles.com)"

• "ET MOBILE_MALWARE Android.Walkinwat Sending Data to CnC Server"

• "ET TROJAN Sofacy DNS Lookup testsnetcontrol.com"

• "ET TROJAN Possible Malicious Gzip PowerShell over HTTP"

• "ET TROJAN [ANY.RUN] Gh0stBins RDP Remote Connection"

• "ET TROJAN Poweliks Abnormal HTTP Headers high likelihood of Poweliks infection"

• "ET TROJAN Win32/NewsRat CnC Exfil via Telegram (POST)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android Fancy Bear Checkin 6"

• "ET CURRENT_EVENTS [eSentire] Successful 163 Webmail Phish 2018-07-25"

• "ET TROJAN Email Contains wininet.dll Call - Potentially Dridex MalDoc 1"

• "ET CURRENT_EVENTS [TW] Observed Microsoft Credential Phish V3 Domain (bc1q6zd25jmkfh5x24ymp60tq99xdugpq .com in TLS SNI)"

• "ET TROJAN DNS Query to TA444 Domain (autoupdatecheck .work .gd)"

• "ET TROJAN Win32/ElectricFish Authentication Packet Observed"

• "ET TROJAN Win32/ViperSoftX Stealer Activity M3 (POST)"

• "ET MOBILE_MALWARE Android/Drinik Activity (POST)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (mydrinksare .top)"

• "ET POLICY Powershell Activity Over SMB - Likely Lateral Movement"

• "ET TROJAN BLINDEAGLE CnC Domain (systemwin .linkpc .net) in DNS Lookup"

• "ET TROJAN ReverseRat 3.0 CnC Checkin M2"

• "ET TROJAN Linux.Ngioweb Stage 1 CnC Activity Server Response (CONNECT)"

• "ET TROJAN W32.Razy Inject Domain in DNS Lookup"

• "ET TROJAN Win32/AZORult V3.3 Client Checkin M24"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Dec 20 2016"

• "ET TROJAN Observed Malicious SSL Cert (FIN7/GRIFFON CnC)"

• "ET TROJAN SAD Ransomware CnC Activity"

• "ET TROJAN APT10 Related Domain in DNS Lookup (3mmlq .com)"

• "ET TROJAN Win32.Spy/TVRat Checkin"

• "ET CURRENT_EVENTS Observed Phishing Domain in DNS Lookup (circle-ci .com)"

• "ET TROJAN Observed Malicious SSL Cert (Ursnif CnC)"

• "ET TROJAN Vicious Panda CnC Activity"

• "ET TROJAN Skeleton Key Filename in SMB Traffic (Unicode)"

• "ET TROJAN Observed Malsmoke Staging Domain in SNI"

• "ET TROJAN Observed IcedID Domain (qousahaff .com in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (chestedband .org)"

• "ET TROJAN MegalodonHTTP CoinMiner Activity"

• "ET TROJAN DNS Query to Raspberry Robin Domain (jrx .tw)"

• "ET TROJAN Win32/Zemot Requesting PE"

• "ET TROJAN Win32/Sabsik.FL.B!ml CnC Activity"

• "ET TROJAN Fbot/Satori CnC DNS Lookup (rippr .cc)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Trojan.BlackRev Registration Rev3"

• "ET TROJAN VBA/TrojanDownloader.Agent.PAC Retreiving Malicious VBScript"

• "ET TROJAN TA453 BellaCiao CnC Domain in DNS Lookup (mailupdate .info)"

• "ET TROJAN Win32/MuggleStealer CnC DiskInfo Exfil (POST)"

• "ET CURRENT_EVENTS Successful Paypal Phish M1 2016-12-05"

• "ET TROJAN Suspected Glupteba Download"

• "ET TROJAN OneLouder Common URI Struct"

• "ET CURRENT_EVENTS Successful Made in China Credential Phish 2022-12-14"

• "ET CURRENT_EVENTS Successful MetaMask Pass Phrase Phish 2022-12-27"

• "ET CURRENT_EVENTS KaiXin Secondary Landing Page"

• "ET TROJAN MACE C2 Framework Response M1"

• "ET TROJAN MalDoc Retrieving Payload May 23 2017 2"

• "ET TROJAN Win32/Datper CnC Activity"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Generic Spambot (often Tibs) Post-Infection Checkin (justcount.net likely)"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)"

• "ET TROJAN PROMETHIUM/StrongPity DNS Lookup (myrappid .com)"

• "ET CURRENT_EVENTS Successful National Bank Phish Jan 05 2017"

• "ET CURRENT_EVENTS Observed TOAD Domain (cancel247 .info in TLS SNI)"

• "ET TROJAN PureCrypter Requesting Injector - Known Campaign ID M5"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin 2"

• "ET TROJAN DNS Query to TA444 Domain (companydeck .cloud)"

• "ET CURRENT_EVENTS Evil Redirect Leading to EK Mar 18 2016"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) 2019-11-06"

• "ET TROJAN Jorik FakeAV GET"

• "ET MALWARE Suspected Adware/AccessMembre Checkin M3"

• "ET TROJAN Observed Gamaredon APT Related Domain (wadibo .ru in TLS SNI)"

• "ET TROJAN AZORult v3.2 Server Response M1"

• "ET TROJAN Likely Koobface Beaconing (getexe)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Jul 06 2017"

• "ET TROJAN Wintervivern Related CnC Domain in DNS Lookup (securetourspd .com)"

• "ET TROJAN Suspected CloudAtlas APT Related Activity (GET)"

• "ET CURRENT_EVENTS Possible iTunes Phishing Landing - Title over non SSL"

• "ET CURRENT_EVENTS Generic Cryptowallet Credential Phish Landing Page 2022-06-03"

• "ET TROJAN Kuluoz/Asprox CnC Response"

• "ET CURRENT_EVENTS Successful Citizenbank Phish 2016-05-24 M2"

• "ET CURRENT_EVENTS Successful Paxful Cryptocurrency Wallet Phish 2020-08-17"

• "ET TROJAN System Progressive Detection FakeAV (INTEL)"

• "ET TROJAN Win32/Unknown Stealer Command (loader) (Outbound)"

• "ET TROJAN Banker.Delf User-Agent (WINDOWS_LOADS)"

• "ET TROJAN Dumador Reporting User Activity"

• "ET TROJAN Win32/Neutrino Checkin"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Observed DNS Query to ElectronBot Domain (11k .online)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-10-16"

• "ET TROJAN DarkIRC Bot CnC Domain Lookup"

• "ET TROJAN Observed Malicious SSL Cert for IRS Credential Phish Domain (supportmicrohere .com)"

• "ET INFO Suspicious VNC Remote Admin Request"

• "ET TROJAN IoT_reaper DNS Lookup M7 (ha859 .com)"

• "ET TROJAN Observed Trojan.Verblecon Related Domain (.verble .rocks in TLS SNI)"

• "ET TROJAN Observed JSSLoader Domain (essentialsmassageanddayspa .com) in TLS SNI"

• "ET TROJAN Volatile Cedar DNS Lookup (explorerdotnt.info)"

• "ET TROJAN HAWKBALL CnC Sending System Information"

• "ET TROJAN ViperSoftX CnC Activity M2"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin"

• "ET USER_AGENTS Suspicious User-Agent (xr - Worm.Win32.VB.cj related)"

• "ET TROJAN Unattributed CnC Domain in DNS Lookup (microsoftonline-secure-login .com)"

• "ET TROJAN Observed CobaltStrike CnC Domain (gmbfrom .com in TLS SNI)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Possible CryptoPHP Leaking Credentials May 8 2015 M2"

• "ET TROJAN Possible Tunna Proxy Closing Connection"

• "ET TROJAN WorldWind Stealer Sending System information via Telegram (POST)"

• "ET MALWARE Win32/TrojanDownloader Variant Activity (GET)"

• "ET TROJAN Kinsing Botnet Related Domain in DNS Lookup (dragon .lib)"

• "ET TROJAN Backdoor.Win32.Vertexbot.A User-Agent (VERTEXNET)"

• "ET ATTACK_RESPONSE Nemesis Admin Panel Inbound"

• "ET MALWARE MediaDrug CnC Activity"

• "ET TROJAN W32/BaneChant.APT Data Exfiltration POST to CnC"

• "ET USER_AGENTS Suspicious User-Agent (xfilesreborn)"

• "ET TROJAN DNS Query to TA444 Domain (nextera .capital)"

• "ET WEB_SERVER WebShell - ASPyder - File Browser - POST Structure"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET TROJAN Linux/dtool IRC Command Complete 2"

• "ET TROJAN pswshopro_bot Stealer data exfiltration attempt"

• "ET TROJAN SA Banker Checkin"

• "ET TROJAN PS1/Unknown Payload C2 Downloader (GET)"

• "ET TROJAN Suspected CHAOS CnC Inbound (screenshot command)"

• "ET TROJAN Win32/Beapy CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Targeted Attack from APT Actor Delivering HT SWF Exploit RIP"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing on Appspot Hosting"

• "ET TROJAN Observed TA444 Domain (perseus .bond in TLS SNI)"

• "ET MALWARE [PTsecurity] Adware.FileFinder Activity"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (cookies.txt) M2"

• "ET TROJAN Observed Glupteba CnC Domain (zaoshanghao .su in TLS SNI)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (fgcz .net)"

• "ET TROJAN Win32/TrojanDownloader.Waski.F Locker DL URI Struct Jul 25 2014"

• "ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01 2016 (dll generic custom headers)"

• "ET USER_AGENTS Suspicious User-Agent (MSIE)"

• "ET TROJAN Win32/Unk.Coinminer Checkin"

• "ET TROJAN Poweliks Clickfraud CnC M1"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 8"

• "ET TROJAN Win32/CopperStealer CnC Activity M2"

• "ET TROJAN Qbot Payload Request (2023-03-21) M7"

• "ET CURRENT_EVENTS Successful Personalized Adobe PDF Online Phish 2016-10-26"

• "ET TROJAN BlackEnergy POST Request"

• "ET TROJAN [401TRG] Malicious SSL Cert (Dreambot CnC)"

• "ET CURRENT_EVENTS Coinbase Credential Phish Landing Page 2022-11-29"

• "ET TROJAN Banker.Delf User-Agent (Ms)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE XX-Net VPN Client CnC Checkin"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed TA444 Domain (bankofamerica .nyc in TLS SNI)"

• "ET TROJAN APT28 Uploader Variant CnC Beacon"

• "ET TROJAN APT-C-48 Related CnC Domain in DNS Lookup (nitb .pk-gov .org)"

• "ET TROJAN PolyglotDuke Domain Observed"

• "ET TROJAN Sidecopy APT Related Activity (POST)"

• "ET TROJAN W32/Asprox.Bot Knock Variant CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN TA402 CnC Domain in DNS Lookup"

• "ET TROJAN r0 CnC POST"

• "ET TROJAN Fake Google Chrome Error Domain in DNS Lookup (fastjscdn .org)"

• "ET TROJAN Turla SHIRIME DNS Lookup"

• "ET TROJAN Possible Zeus GameOver Connectivity Check 2"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious SSL Cert (Get2 CnC)"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (readyqrscanner .club in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-06-13"

• "ET USER_AGENTS Fake Mozilla User-Agent String Observed (M0zilla)"

• "ET CURRENT_EVENTS Successful Paypal Phish 2016-01-15 M2"

• "ET CURRENT_EVENTS Successful Generic Credential Phish 2022-02-04"

• "ET TROJAN Malicious XLS DDE rar Drop Attempt (.live)"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-06-02"

• "ET TROJAN W32/Spy.KeyLogger.OCI CnC Checkin"

• "ET TROJAN Fake ChatGPT Domain in DNS Lookup (openai-pc-pro .online)"

• "ET CURRENT_EVENTS Possible Successful Paypal Phishing Domain Feb 02 2017"

• "ET CURRENT_EVENTS Coinbase Credential Phish 2023-02-24"

• "ET TROJAN LazyScripter Related Domain in DNS Lookup (hpsj .firewall-gateway .net)"

• "ET TROJAN W32/Quasar 1.3/Venom RAT Connectivity Check 3"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (team-meet .online)"

• "ET MOBILE_MALWARE Trojan/iOS Operation Triangulation CnC Domain in DNS Lookup"

• "ET MOBILE_MALWARE Android/GoldDream Task Information Retrieval"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN NOBELIUM (TA421) Cobalt Strike CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful iCloud Credential Phish 2023-06-12"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN JS/Ostap Maldoc Check-in"

• "ET TROJAN MSIL/Eredel Stealer CnC Checkin"

• "ET TROJAN Win32/Variant.Zusy.402698 Checkin"

• "ET EXPLOIT F5 BIG-IP iControl REST Authentication Bypass Server Response (CVE-2022-1388)"

• "ET TROJAN ReverseRat 3.0 CnC Checkin M1"

• "ET TROJAN Possible APT28 DOC Uploader SSL/TLS Certificate Observed"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (abegelkunic .com)"

• "ET CURRENT_EVENTS Possible Generic Phishing Landing Jul 28 2015"

• "ET MOBILE_MALWARE Android/FakeWallet.AH!tr (TLS SNI) 19"

• "ET TROJAN Mirai Botnet Domain Observed"

• "ET TROJAN Trojan.Delf-5496 New Infection Report"

• "ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Intuit Phish 2016-07-21"

• "ET TROJAN njrat ver 0.7d Malware CnC Callback (Microphone)"

• "ET TROJAN NSO Group Pegasus CnC Domain Observed in DNS Query"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (syncmeet .online)"

• "ET TROJAN W32.Geodo/Emotet Checkin"

• "ET TROJAN MINEBRIDGE CnC Request"

• "ET TROJAN Possible Covenant Framework Grunt PowerShell Stager HTTP Download"

• "ET CURRENT_EVENTS Successful HM Revenue & Customs Phish M1 Apr 07 2017"

• "ET MOBILE_MALWARE Android APT-C-23 (everyservices .space in TLS SNI)"

• "ET CURRENT_EVENTS Successful Apple Phish 2016-10-05"

• "ET MOBILE_MALWARE Android Brunhilda Dropper (multifuctionscanner .club in DNS Lookup)"

• "ET TROJAN Observed DNS Query to ROMCOM RAT Domain (optasko .com)"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup"

• "ET TROJAN Win64/Spy.Agent.EU CnC Checkin"

• "ET CURRENT_EVENTS PerSwaysion Landing Page M1"

• "ET MOBILE_MALWARE ITW Android Post-Exploit Downloader CnC Activity"

• "ET MOBILE_MALWARE Android/Smsilence.A Sending SMS Messages CnC Beacon"

• "ET TROJAN Win32/Ketrican CnC Activity"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN TA430/Andariel APT Related CnC Domain in DNS Lookup (tech .micrsofts .com)"

• "ET TROJAN NSIS/TrojanDownloader.Agent.NZK CnC Activity M1"

• "ET MOBILE_MALWARE Android APT-C-23 (natemunson .com in TLS SNI)"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET CURRENT_EVENTS Synchronize Email Account Phishing Landing 2016-07-15"

• "ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (DNS Lookup) 6"

• "ET TROJAN JokerSpy Domain in DNS Lookup (git-hub .me)"

• "ET TROJAN TA444 Domain in TLS SNI (internalpdfviewer .ddns .net)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (k6j .me)"

• "ET TROJAN Fake Windows Scam ScreenLocker"

• "ET TROJAN Win32/Ramsay CnC Domain in DNS Query"

• "ET TROJAN NanoCore RAT Keepalive 3"

• "ET TROJAN Waledac FACEPUNCH Traffic Detected"

• "ET DNS Reply Sinkhole - Georgia Tech (1)"

• "ET TROJAN CloudAtlas APT Maldoc Activity (GET)"

• "ET TROJAN JS/Nemucod requesting EXE payload 2016-01-28"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (gamefllix .com)"

• "ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M3"

• "ET CURRENT_EVENTS Successful Cryptocurrency Exchange Phish (set) 2018-10-25"

• "ET TROJAN APT28/Sednit DNS Lookup (microsoftsupp .com)"

• "ET TROJAN Likely GandCrab Ransomware Domain in HTTP Host M1"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (antargi .ru)"

• "ET CURRENT_EVENTS Successful Apple ID Phish M1 2016-10-04"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) Aug 22 2017"

• "ET CURRENT_EVENTS Phishing Landing via Weebly.com (set) 2016-02-02"

• "ET CURRENT_EVENTS Successful Bank of America Phish 2015-11-21"

• "ET TROJAN Possible CopyKittens DNS Lookup (wheatherserviceapi.info)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (koltary .com)"

• "ET TROJAN Gamut Spambot Checkin 2"

• "ET WEB_CLIENT Possible Phishing Data Submitted to yolasite.com M2"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (fairu-schnellvpn .com)"

• "ET TROJAN Possible Duqu 2.0 Accessing backdoor over 443"

• "ET MOBILE_MALWARE Android Spy APT-C-23 (amanda-hart .website in TLS SNI)"

• "ET TROJAN Observed Win32/DecryptStealer Exfil Domain (geroipanel .site in TLS SNI)"

• "ET TROJAN Suspected Kimsuky Activity (GET)"

• "ET TROJAN Observed DNS Query to Ursnif Domain (lionnik .xyz)"

• "ET TROJAN W32/SCKeyLog.InfoStealer Installation Confirmation Via SMTP"

• "ET TROJAN Cobalt Strike Malleable C2 (Custom)"

• "ET TROJAN PS/PSRansom Server Status Check (GET)"

• "ET TROJAN Possible Pegasus Related DNS Lookup (sms .webadv.co)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (hshelp .online)"

• "ET CURRENT_EVENTS Successful Generic Adobe Phish 2019-07-29"

• "ET TROJAN Observed Magecart CnC Domain in TLS SNI"

• "ET TROJAN MSIL/HadesLocker Ransomware Checkin"

• "ET TROJAN Linux/Moose NAT Traversal CnC Beacon - Sleep"

• "ET TROJAN DNS Query to Raspberry Robin Domain (r0 .wf)"

• "ET TROJAN Bahamut APT Group CnC Domain in DNS Lookup (laborer-posted .nl)"

• "ET TROJAN Observd DNS Query to Impersoni-fake-ator Domain (iranwatch .tech)"

• "ET TROJAN Sarwent CnC Response (cmd_exec)"

• "ET TROJAN PHP Skimmer Exfil Attempt"

• "ET TROJAN APT-C-23 MICROPSIA Variant CnC Domain in DNS Lookup (irenewansley .icu)"

• "ET TROJAN Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5"

• "ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 11"

• "ET CURRENT_EVENTS Successful IBC Bank Phish 2015-10-29"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (butoza .ru)"

• "ET CURRENT_EVENTS Successful Paypal Phish M2 2016-11-17"

• "ET TROJAN Polonium APT CREEPYSNAIL Backdoor Related Activity (GET)"

• "ET MOBILE_MALWARE Arid Viper (moggfelicio .info in DNS Lookup)"

• "ET TROJAN Observed Malicious SSL Cert (Android/FakeAdBlocker CnC)"

• "ET TROJAN Aveo Checkin"

• "ET MOBILE_MALWARE Android/RatMilad CnC Checkin"

• "ET MOBILE_MALWARE Android/SOVA Banking Trojan Activity (bot update)"

• "ET MALWARE InstallCore PUA/Adware Activity M3"

• "ET CURRENT_EVENTS Observed TOAD Domain (bscare .info in TLS SNI)"

• "ET TROJAN Suspicious User-Agent (Testing)"

• "ET TROJAN Socks5Systemz CnC Checkin M2"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (paradoxmarine .com)"

• "ET TROJAN [Fireeye] Observed Backdoor.SUNBURST CnC Domain (freescanonline .com in TLS SNI)"

• "ET MOBILE_MALWARE Android APT-C-23 (namybotter .info in DNS Lookup)"

• "ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns"

• "ET TROJAN Lemon_Duck CnC Domain in DNS Lookup"

• "ET TROJAN Win32/Bisonal CnC Checkin"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (restohalto .site)"

• "ET MOBILE_MALWARE AndroidOS/Lotoor.Q"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Pykspa.C Public IP Check"

• "ET TROJAN Observed Glupteba CnC Domain (robloxcdneu .net in TLS SNI)"

• "ET CURRENT_EVENTS Successful Generic Phish to zap-webspace.com Webhost 2018-10-25"

• "ET TROJAN Downloader General Bot Checking In via HTTP Post (bot_id push)"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (v8.f1122.org)"

• "ET TROJAN TeslaCrypt/AlphaCrypt Payment DNS Lookup"

• "ET TROJAN Observed Magecart CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (docshared .col-link .linkpc .net)"

• "ET CURRENT_EVENTS Nuclear EK Gate Injected iframe Oct 22 2014"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (askamoshopsi .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Kelihos/Hlux GET jucheck.exe from CnC"

• "ET TROJAN Locky CnC Checkin HTTP Pattern"

• "ET MOBILE_MALWARE Apple iPhone Implant - Boundary Observed"

• "ET WEB_SERVER suhosin.simulation PHP config option in uri"

• "ET TROJAN Hangover related campaign Response"

• "ET TROJAN Possible APT 41 Fake Server Response"

• "ET WEB_CLIENT Evil Keitaro Set-Cookie Inbound (85937)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 13"

• "ET CURRENT_EVENTS Successful LocalBitcoins Cryptocurrency Exchange Phish Aug 30 2017"

• "ET MOBILE_MALWARE Android APT-C-23 (cassy-gray .club in DNS Lookup)"

• "ET TROJAN Possible Babar POST Request"

• "ET TROJAN MINEBRIDGE CnC Activity"

• "ET TROJAN Win32/SandCat CnC Checkin"

• "ET TROJAN Earth Lusca/SprySOCKS CnC Domain in DNS Lookup"

• "ET WEB_CLIENT PHOEN!X Phish Loading Page 2015-12-29"

• "ET INFO Possible Obfuscator io JavaScript Obfuscation"

• "ET TROJAN Win32/VictoryGate/Orchard Botnet CnC Checkin"

• "ET MOBILE_MALWARE Android APT-C-23 (assets-acc .club in TLS SNI)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Query (daviviendapersonalingresos .xyz) 2021-04-15"

• "ET TROJAN Operation Buhtrap CnC Beacon 2"

• "ET TROJAN Bozok.RAT checkin"

• "ET TROJAN Win32/WarHawk Activity (task_done)"

• "ET TROJAN Observed Malicious SSL Cert (StrongPity CnC)"

• "ET TROJAN Win32/Pottieq.A Check-in"

• "ET TROJAN Possible Tinba DGA NXDOMAIN Responses (2)"

• "ET CURRENT_EVENTS Successful 163.com Email Account Phish 2016-10-26"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (golddisco .top)"

• "ET TROJAN TA453 Related Domain in DNS Lookup (universityofmhealth .biz)"

• "ET EXPLOIT Possible Microsoft Edge Chakra.dll Type Confusion (CVE-2016-7200 CVE-2016-7201) B642"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET TROJAN Observed DNS Query to AppleJeus Domain (oilycargo .com)"

• "ET TROJAN MSUpdater POST checkin to CnC"

• "ET TROJAN Win32/Ymacco.AA1C Activity"

• "ET TROJAN Arid Viper APT Related Activity (POST)"

• "ET TROJAN APT SuperhardCorp DNS Lookup (docume.sysbloger.com)"

• "ET MALWARE Win32/Adware.Bang5mai.BB CnC Activity M3"

• "ET MALWARE Rebate Informer User-Agent (REBATEINF)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32/Variant.Babar.74963 CnC Exfil"

• "ET TROJAN Win32/Chopstick Checkin (APT28 Related)"

• "ET TROJAN Volatile Cedar DNS Lookup (dotnetexplorer.info)"

• "ET TROJAN Diavol HTTP Cookie Observed"

• "ET CURRENT_EVENTS Possible BadRabbit Driveby Download M2 Oct 24 2017"

• "ET TROJAN DNS Query to Raspberry Robin Domain (n51 .biz)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN [ANY.RUN] Lu0bot-Style DNS Query in DNS Lookup M1"

• "ET ATTACK_RESPONSE Redline Stealer Stager WebPage Inbound"

• "ET TROJAN Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 2"

• "ET TROJAN Known Sinkhole Response Header CERT.PL"

• "ET TROJAN Observed Malicious SSL Cert (APT32 CnC)"

• "ET TROJAN r0 CnC Architecture GET 2"

• "ET CURRENT_EVENTS Manhattan College Phish Landing Page 2022-01-10"

• "ET TROJAN Win32.Agent.pt User-Agent Detected"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (creditals-email .space)"

• "ET TROJAN Observed Malicious Mustang Panda APT Related SSL Cert (File Transfer Service)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET MALWARE User-Agent (CustomSpy)"

• "ET TROJAN Gamaredon/Armageddon Activity (Retrieving Remote .dot)"

• "ET TROJAN DonotGroup Maldoc Activity (GET)"

• "ET TROJAN DOUBLEBACK CnC Activity"

• "ET TROJAN JS Skimmer Domain in DNS Lookup"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (hitfromthebong .top)"

• "ET CURRENT_EVENTS Adobe Shared Document Phishing Landing 2016-08-30"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed Magecart Skimmer Domain (analiticsweb .site in TLS SNI)"

• "ET TROJAN MiniDuke CnC Beacon (string1_slide_1_2)"

• "ET TROJAN Win32/SystemHijack.gen CnC Checkin"

• "ET TROJAN APT33/CharmingKitten DDNS Overlap Domain in DNS Lookup M2"

• "ET CURRENT_EVENTS Successful Personalized Phish 2016-09-14"

• "ET TROJAN Observed DNS Query to Gamaredon Domain (takyygi .ru)"

• "ET TROJAN MSSQL maggie backdoor whoami Query Observed"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MassLogger Client Data Exfil SMTP"

• "ET TROJAN Candiru Related Domain in DNS Lookup (url-tiny .co)"

• "ET TROJAN Observed Malicious SSL Cert (ColdRiver APT DNSpionage MITM)"

• "ET TROJAN MoneroPay Ransomware Payment Activity"

• "ET MOBILE_MALWARE Android APT-C-23 (jon-snow .pro in DNS Lookup)"

• "ET TROJAN Gamaredon APT Related Domain in DNS Lookup (humorumbi .ru)"

• "ET TROJAN Observed DNS Query to Monero Miner Related Domain (monerohash .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN OceanLotus System Profiling JavaScript HTTP Request"

• "ET CURRENT_EVENTS DRIVEBY [PwC CTD] -- MultiGroup - TH3BUG and Non-Targetted Groups Watering Hole Deobfuscation function"

• "ET TROJAN DNS Query to Raspberry Robin Domain (iyw5 .com)"

• "ET TROJAN CollectorStealer CnC Exfil"

• "ET CURRENT_EVENTS Successful o365 Credential Phish 2022-12-19"

• "ET TROJAN BatLoader CnC Domain (grammarlycheck2 .com) in DNS Lookup"

• "ET TROJAN DNS Query to Fake Chrome Landing Page (chromiumbase .site)"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (footballstar .top in TLS SNI)"

• "ET TROJAN Generic Win32.Autorun HTTP Post"

• "ET TROJAN Malicious Debugging Application Related Domain in DNS Lookup (blgbeach .com)"

• "ET TROJAN Win32/CrimsonRAT Activity (Outbound)"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN FIN7 JSSLoader Variant Activity (GET)"

• "ET CURRENT_EVENTS HiYu - Request for User Specific Landing Page"

• "ET TROJAN Malicious Domain in DNS Lookup (jscdn .biz)"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (dingpsounda .space in DNS Lookup)"

• "ET TROJAN Observed Malicious SSL Cert (Sidewinder CnC)"

• "ET CURRENT_EVENTS Observed TOAD Domain (bghelp .cc in TLS SNI)"

• "ET TROJAN Observed DNS Query to Cinoshi Stealer Domain (anaida .evisyn .lol)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Android/AhMyth RAT WebSocket Session"

• "ET TROJAN Cobalt Strike CnC Domain in DNS Lookup (zuppohealth .com)"

• "ET TROJAN Commonly Abused Domain in DNS Lookup (gk-stst .ru)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (cwgmanagementllc .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (nelubelei .com)"

• "ET TROJAN Observed Malicious SSL Cert (CobaltStrike CnC)"

• "ET TROJAN Possible CopyKittens DNS Lookup (windows-my50.com)"

• "ET TROJAN Unknown Possibly Ransomware (Dropped by RIG) CnC Beacon"

• "ET CURRENT_EVENTS Outlook 365 Encrypted Email Phishing Landing M1 2016-08-31"

• "ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 6"

• "ET TROJAN SharpPanda APT Downloader Activity (GET)"

• "ET MOBILE_MALWARE Android APT-C-23 (leslie-barnes .website in DNS Lookup)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to SysJoker Domain (sharing-u-file .com)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Possible CopyKittens DNS Lookup (haaretz.link)"

• "ET CURRENT_EVENTS Successful Email System Manager Phish 2016-04-13"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain in DNS Lookup (mirohost .site)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6t .pm)"

• "ET TROJAN Possible Upatre Downloader SSL certificate"

• "ET TROJAN Observed DNS Query to Ursnif Domain (gigimas .xyz)"

• "ET TROJAN Possible CopyKitten DNS Lookup (fdgdsg .xyz)"

• "ET TROJAN Possible 3CX Supply Chain Attack (2023-03-29) Domain Indiciator in DNS Lookup (pbxphonenetwork .com)"

• "ET TROJAN Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 1"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 16"

• "ET CURRENT_EVENTS Successful Paypal Phish Mar 22 2017"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Java/QRat Retrieving PE"

• "ET WEB_CLIENT Fake AV Phone Scam Landing June 11 2015 M1"

• "ET MOBILE_MALWARE Android/FakeTimer.A Reporting to CnC"

• "ET TROJAN Observed DNS Query to TA444 Domain (wpsonline .co)"

• "ET TROJAN Lu0bot CnC Domain in DNS Lookup (bic .xdk03 .fun)"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (mariofart8 .top)"

• "ET TROJAN OSX/Keydnap DNS Query to CnC"

• "ET TROJAN Havex RAT CnC Server Response"

• "ET TROJAN Observed Emotet Maldoc Retrieving Payload (2023-03-07) M2"

• "ET TROJAN APT_NGO_wuaclt"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 8"

• "ET TROJAN Critroni Variant .onion Proxy Domain"

• "ET CURRENT_EVENTS Fake WordPress CVE Plugin Domain in DNS Lookup (en-gb-wordpress .org)"

• "ET MOBILE_MALWARE Android Marcher Trojan Download - Sparkasse Bank Targeting (set)"

• "ET CURRENT_EVENTS Suspected TA445 Spearphishing Related Domain (mirohost .online in TLS SNI)"

• "ET TROJAN Trojan.BlackRev Registering Client"

• "ET TROJAN ELF/Emptiness v2 XOR UDP Flood Command Inbound"

• "ET TROJAN IcedID CnC Domain in DNS Lookup (skofilldrom .com)"

• "ET TROJAN ZenRAT Tasking CnC Response M1"

• "ET TROJAN Suspected Kimsuky APT RevClient Related Activity"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (mail .igov-service .net)"

• "ET WEB_SERVER Possible OpenX Backdoor Backdoor Access POST to flowplayer"

• "ET TROJAN EncryptorRaas .onion Proxy Domain"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (alzarafatravellsae .com) 2022-12-05"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1q8hn7d0uhpspz9xcp3hl9e5erddlew .com)"

• "ET TROJAN LockPOS CnC"

• "ET MOBILE_MALWARE Observed Android ExobotCompact.D/Octo Domain (s22231232fdnsjds .top in TLS SNI)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (stalinschoolintlacademy .com) 2022-12-05"

• "ET TROJAN Quasar CnC Domain in DNS Lookup"

• "ET TROJAN APT Lurker POST CnC Beacon"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Possible Raspberry Robin Activity M2 (GET)"

• "ET CURRENT_EVENTS Generic Phishing Domain in DNS Lookup (info-getting-eu. com)"

• "ET TROJAN Observed Malicious SSL Cert (AZORult CnC Server) 2019-10-03"

• "ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M10"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET TROJAN Observed TraderTraitor Domain (centos-repos .org in TLS SNI)"

• "ET TROJAN Win32/Kumquat Loader Activity (Publish)"

• "ET TROJAN Win32/Backdoor Checkin (POST)"

• "ET WEB_SERVER DNS Query for Suspicious e5b57288.com Domain - Anuna Checkin - Compromised PHP Site"

• "ET CURRENT_EVENTS OneDrive Phishing Landing 2021-03-15"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN STRRAT CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (Cobalt Group/More_Eggs CnC)"

• "ET MALWARE W32/PullUpdate.Adware CnC Beacon"

• "ET TROJAN Backdoor.Win32.DarkComet Keepalive Outbound"

• "ET TROJAN Dosenjo/Kvadr Proxy Trojan Activity"

• "ET CURRENT_EVENTS JS ShellWindows/AddInProcess Win10 DeviceGuardBypass Inbound"

• "ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Generic Custom Logo Phishing Landing 2021-03-10"

• "ET MOBILE_MALWARE Android.HongTouTou Checkin"

• "ET TROJAN Banker.Delf Infection variant 4 - Sending Initial Email to Owner"

• "ET TROJAN AlphaCrypt CnC Beacon 3"

• "ET MOBILE_MALWARE Android APT-C-23 (fasebook .cam in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Generic PII Phish"

• "ET CURRENT_EVENTS SUSPICIOUS wsqmocn.exe in URI Probable Process Dump/Trojan Download"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT)"

• "ET TROJAN CozyDuke APT HTTP GET CnC Beacon"

• "ET TROJAN SocGholish Domain in TLS SNI (cpanel .gtiyeshua .com)"

• "ET TROJAN SideCopy APT Related Backdoor Sending System Information (GET)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN VBS/Agent.6B29!tr CnC Checkin"

• "ET TROJAN MiniDuke Domain Observed"

• "ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL Certificate Detected (Sinkhole)"

• "ET TROJAN Observed Malicious SSL Cert (NHS UK Covid Passport Phish)"

• "ET TROJAN TA422 Related Activity M3"

• "ET TROJAN Filename hkcmd.exe Download - Common Hostile Filename"

• "ET CURRENT_EVENTS Cool Exploit Kit Plugin-Detect July 08 2013"

• "ET TROJAN DNS Query to Raspberry Robin Domain (6ax .nl)"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Possible Pegasus Related DNS Lookup (turkishairines .info)"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Win32/I'm_Better Stealer CnC Checkin"

• "ET TROJAN CCleaner Backdoor DGA Domain (ab70a139cc3a.com) Dec 2017"

• "ET TROJAN Octopus Malware CnC Activity"

• "ET MOBILE_MALWARE Android/TrojanDropper.Agent.GWO Checkin"

• "ET TROJAN Observed DNS Query to Pegasus Domain (reunionlove .net)"

• "ET TROJAN ZenRAT Request Module Command"

• "ET CURRENT_EVENTS Possible Java Applet JNLP applet_ssv_validated in Base64 (Reversed)"

• "ET MALWARE Gamehouse.com User-Agent (GAMEHOUSE.NET.URL)"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN Win32/Bumblebee Loader Checkin Activity (set)"

• "ET TROJAN Win32/Eternity Stealer Activity (POST)"

• "ET TROJAN Observed SystemBC CnC Domain in DNS Query"

• "ET CURRENT_EVENTS Successful Phish OWA Credentials 2022-06-20"

• "ET TROJAN TWISTEDPANDA CnC Domain in DNS Lookup (www .miniboxmail .com)"

• "ET MALWARE RemoteSpy.com Upload Detected"

• "ET TROJAN Sn0wsLogger CnC Exfil M2"

• "ET TROJAN W32/TrojanSpy.MSIL Set Done Day CnC Beacon"

• "ET MALWARE Mirar Bar Spyware User-Agent (Mbar)"

• "ET TROJAN Ursnif Variant Retrieving Payload (x32)"

• "ET TROJAN Observed DNS Query to RisePro Domain (factor1right .com)"

• "ET TROJAN Evrial Stealer Retrieving CnC Information"

• "ET MOBILE_MALWARE Android/Zanubis CnC Domain (fullcircleteam .com) in DNS Lookup"

• "ET TROJAN ATTACKER IRCBot - PRIVMSG Response - Directory Listing *nix"

• "ET TROJAN Win32/Syndicasec Encoded Response Embedded in HTML Title Tags Inbound"

• "ET MOBILE_MALWARE Arid Viper (log-yoheo .info in DNS Lookup)"

• "ET TROJAN Py/MechaFlounder CnC Activity - Reporting Directory Change Command Success"

• "ET TROJAN ABUSE.CH Cryptolocker Payment Page (de2nuvwegoo32oqv)"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (kidup .xyz)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MOBILE_MALWARE Android APT-C-23 (pml-help .site in TLS SNI)"

• "ET TROJAN Suspected Stealth Soldier Backdoor Related Activity M1 (GET)"

• "ET TROJAN Instagram Like Bot (like4u) CnC Domain in DNS Lookup"

• "ET TROJAN US-CERT TA14-353A Lightweight Backdoor 5"

• "ET TROJAN RShell CnC Domain (linux .updatelive-oline .com) in DNS Lookup"

• "ET TROJAN Magecart Skimmer Domain in DNS Lookup (okqtfc1 .org)"

• "ET TROJAN Win32/Unk HeavensGate Loader CnC in DNS Lookup"

• "ET TROJAN MWI Maldoc Stats Callout Oct 28"

• "ET CURRENT_EVENTS Common Form POST - Chase Phishing Landing 2020-06-11"

• "ET TROJAN Zeoticus Ransomware CnC Activity"

• "ET MOBILE_MALWARE AndroRAT Bitter DNS Lookup (info2t .com)"

• "ET TROJAN Trojan.Verblecon Related Domain in DNS Lookup (.verble .rocks)"

• "ET TROJAN FormBook CnC Checkin (GET)"

• "ET TROJAN Observed Malicious SSL Cert (MINEBRIDGE/MINEDOOR CnC)"

• "ET MOBILE_MALWARE Android/Spy.Agent.ANA (androidssystem .com in DNS Lookup)"

• "ET TROJAN Backdoor Win32/Hupigon.CK Server Checkin"

• "ET TROJAN Win32/PSWStealer Data Exfiltration Attempt"

• "ET TROJAN ApolloLocker Ransomware CnC Checkin 2"

• "ET MOBILE_MALWARE Android/Spy.Vultur.A CnC Domain in DNS Lookup"

• "ET TROJAN Critroni Variant .onion Proxy Domain"

• "ET TROJAN DarkGate CNC Checkin"

• "ET TROJAN Win32/Sinresby.B Downloader CnC Activity M1"

• "ET MALWARE Debelizombi.com Spyware User-Agent (blahrx)"

• "ET CURRENT_EVENTS Dropbox Shared Document Phishing Landing Feb 21 2017"

• "ET TROJAN SNIcat - Detected C2 Commands (EXIT)"

• "ET TROJAN AHK.CREDSTEALER.A CnC Activity"

• "ET TROJAN Win32/PurpleFox Related Activity (GET)"

• "ET TROJAN Cobalt Strike Activity (GET)"

• "ET MALWARE W32/AdLoad.Downloader Download"

• "ET TROJAN ELF/AbcBot CnC Checkin"

• "ET TROJAN MSIL/Small.FU Variant CnC Activity M2"

• "ET TROJAN Win32/CONFUCIUS_B External IP Check to CnC M2"

• "ET MOBILE_MALWARE Android Banker Octo CnC Domain in DNS Lookup"

• "ET TROJAN GravityRAT CnC Domain (gyzu .mozillaupdates .us in DNS Lookup)"

• "ET CURRENT_EVENTS Successful Apple Phish 2016-03-09"

• "ET WEB_SERVER allow_url_include PHP config option in uri"

• "ET MALWARE Context Plus Spyware User-Agent (Apropos)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ownerbuffersuperw .pw)"

• "ET TROJAN APT28 DealersChoice DNS Lookup"

• "ET TROJAN Sharik/Smoke CnC Beacon 3"

• "ET TROJAN Pushdo Update URL Detected"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS BulletProofLink Phishkit Template"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI (return2monkey .fun)"

• "ET MALWARE Malicious Chrome Extension"

• "ET TROJAN MINEBRIDGE/MINEDOOR CnC Checkin"

• "ET TROJAN Trojan:Win32/Sabsik.FL.B!ml CnC Activity"

• "ET CURRENT_EVENTS HM Revenue Phishing Landing"

• "ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.d (dosandiq .space in DNS Lookup)"

• "ET TROJAN Win32/Nitrokod CnC Domain (Intelserviceupdate .com) in DNS Lookup"

• "ET TROJAN Observed DNS Query to TA455 Domain"

• "ET TROJAN Backdoor.Win32.Poison.AU checkin"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 59"

• "ET TROJAN Win32/Kribat-A Downloader Activity"

• "ET TROJAN Possible Pegasus Related DNS Lookup (uaenews .online)"

• "ET TROJAN Possible Derusbi/Winnti Receiving Configuration"

• "ET TROJAN Social-bos.biz related trojan checkin (trackid=hex)"

• "ET MALWARE Searchmiracle.com Spyware Install (protector.exe)"

• "ET TROJAN APT-C-27 CnC Domain Observed in DNS Query"

• "ET TROJAN Observed Gamaredon APT Related Domain (cresozoq .ru in TLS SNI)"

• "ET TROJAN MiniDuke CnC Beacon (string2_slide_3_1)"

• "ET TROJAN Trojan.Dropper.Win32.Dapato.braa.AMN CnC traffic"

• "ET MALWARE malwarewipeupdate.com Spyware User-Agent (MalwareWipe)"

• "ET TROJAN Lazarus APT Related Domain in DNS Lookup (ougreen .com)"

• "ET CURRENT_EVENTS Keitaro Set-Cookie Inbound to RogueRaticate (7fcd2)"

• "ET USER_AGENTS Suspicious User-Agent (runPatch.html)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .cloudid .coffeeonboard .com)"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET CURRENT_EVENTS Possible Styx EK SilverLight Payload"

• "ET TROJAN Win32/1xxbot CnC Checkin"

• "ET TROJAN Sorano Stealer CnC Checkin"

• "ET TROJAN Observed Malicious SSL Cert (OSX/Calender 2 Mining)"

• "ET CURRENT_EVENTS America First CU Successful Phish 2022-10-27"

• "ET TROJAN Qbot Payload Request (2023-03-13) M6"

• "ET USER_AGENTS Suspicious User-Agent (Our_Agent)"

• "ET TROJAN Warzone RAT Response (Inbound)"

• "ET TROJAN Win32/Backdoor Related Domain in DNS Lookup (swordoke .com)"

• "ET TROJAN Observed Malicious SSL Cert (SedUploader)"

• "ET TROJAN MAZE Ransomware Payment Domain in DNS Lookup"

• "ET TROJAN Windows qwinsta Microsoft Windows DOS prompt command exit OUTBOUND"

• "ET TROJAN KeyBoy Backdoor Login"

• "ET MALWARE Suspicious User-Agent (Mozilla/4.0 (compatible ICS))"

• "ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98"

• "ET TROJAN Zacom/NFlog HTTP POST Fake UA CnC Beacon"

• "ET TROJAN Possible OSX/SHLAYER Checkin M2"

• "ET TROJAN Observed BatLoader Domain (clodtechnology .com) in TLS SNI"

• "ET TROJAN Trojan.BlackRev Botnet Monitor Request CnC Beacon"

• "ET CURRENT_EVENTS [TW] Microsoft Credential Phish V3 CnC Domain in DNS Lookup (bc1q6crq62w2sclm0cwwk6m2wugr6jkh .com)"

• "ET TROJAN Possible IoT_reaper ELF Binary Download"

• "ET CURRENT_EVENTS Successful Webmail Account Upgrade Phish 2016-07-15"

• "ET MOBILE_MALWARE Android APT-C-23 (namyyeatop .club in DNS Lookup)"

• "ET CURRENT_EVENTS IRS Payment Credential Phish Form"

• "ET TROJAN Maldoc Domain (word2022 .c1 .biz) in DNS Lookup"

• "ET TROJAN Observed Cobalt Strike CnC Domain (yuxicu .com in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (cancel247 .info)"

• "ET TROJAN Win32/Malgent!MSR Dropper Requesting Payload"

• "ET TROJAN Suspicious Zipped Filename in Outbound POST Request (cookie.txt) M2"

• "ET TROJAN Observed Malicious SSL Cert (Meterpreter Paranoid Mode CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE PUP Win32/AdWare.Sendori User-Agent"

• "ET TROJAN Harvester Group Downloader Activity (GET)"

• "ET TROJAN Ragnarok Ransomware CnC Activity M2"

• "ET MALWARE Win32/DealPly Checkin"

• "ET CURRENT_EVENTS Successful Bank of America Credential Phish 2023-04-17"

• "ET TROJAN Win32/Phoenix Keylogger Exfil via SMTP - Generic"

• "ET WEB_CLIENT Malicious Chrome Extension Domain Request (stickies .pro in DNS Lookup)"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN Observed DarkSide Ransomware Domain (baroquetees .com in TLS SNI)"

• "ET TROJAN Kimsuky Related Malicious VBScript Inbound M3"

• "ET TROJAN APT DarkHydrus DNS Lookup 6"

• "ET TROJAN Candiru Spyware CnC Domain in DNS Lookup (adtracker .link)"

• "ET MOBILE_MALWARE Android APT-C-23 (mail-presidency .com in TLS SNI)"

• "ET TROJAN DarkComet-RAT server join acknowledgement"

• "ET TROJAN DNS Query to SockRacket/KANDYKORN Domain (bitscrunnch .run .place)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET WEB_CLIENT Fake Windows Security Warning - png"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (GET)"

• "ET TROJAN TA410 APT FlowCloud Dependency Download M2"

• "ET CURRENT_EVENTS Successful Outlook Phish 2016-10-26"

• "ET TROJAN Win32/Suspected Reverse Shell Connection"

• "ET WEB_CLIENT c0896 Hacked Site Response Octal (Inbound)"

• "ET TROJAN DPRK APT Related Maldoc Activity (POST) M2"

• "ET TROJAN Possible CopyKittens DNS Lookup (micro-windows.in)"

• "ET TROJAN FAKE AOL SSL Cert APT1"

• "ET TROJAN Scarlet Mimic DNS Lookup 17"

• "ET TROJAN Possible CopyKitten DNS Lookup (qoldenlines .net)"

• "ET CURRENT_EVENTS Successful RoundCube Phish 2022-07-18"

• "ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 ASCII"

• "ET TROJAN Win32/Adware.Adposhel.A Checkin M6"

• "ET MOBILE_MALWARE Android APT-C-23 (login-yohoo .com in DNS Lookup)"

• "ET TROJAN Observed Atomic macOS (AMOS) Stealer Payload Deliver Domain (app-downloads .org) in TLS SNI"

• "ET TROJAN DarkComet-RAT init connection"

• "ET TROJAN Chafer CnC Domain in DNS Lookup"

• "ET TROJAN CozyDuke APT Possible SSL Cert 7"

• "ET TROJAN Gamaredon APT Related Activity (GET)"

• "ET SCAN ZmEu Scanner User-Agent Inbound"

• "ET TROJAN [PTsecurity] PS/TrojanDownloader.Agent.NNR XORed Zip payload (key 0x91)"

• "ET TROJAN W32/Downvision.A Initial Checkin"

• "ET MALWARE Win32/FeIQ Activity (GET)"

• "ET TROJAN Win32/ProtonBot CnC Response"

• "ET CURRENT_EVENTS Generic Phishkit Javascript Response with Phishy Text"

• "ET MALWARE iframebiz - loadadv***.exe"

• "ET TROJAN Magecart CnC Domain Observed in DNS Query"

• "ET WEB_CLIENT Possible Phishing Verified by Visa title over non SSL Feb 17 2017"

• "ET TROJAN PlugX DNS Lookup"

• "ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile Response"

• "ET CURRENT_EVENTS Sucessful Global Sources Credential Phish 2022-06-29"

• "ET TROJAN W32/Pterodo CnC Checkin"

• "ET TROJAN Nymaim.BA CnC M2"

• "ET TROJAN DNS Query to Raspberry Robin Domain (p3 .ms)"

• "ET MALWARE Balada Injector Script"

• "ET TROJAN Observed Malicious SSL Cert (AsyncRAT CnC)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET MALWARE W32/Softpulse PUP Install Failed Beacon"

• "ET TROJAN Win32/Spy.Agent.OHT - AnunakAPT HTTP Checkin 2"

• "ET TROJAN Critroni Variant .onion Proxy Domain"

• "ET TROJAN Netbounce Proxy Activity"

• "ET TROJAN Zbot downloader Installing Zeus"

• "ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (wangzongfacai.com)"

• "ET TROJAN DNS Query to TA444 Domain (docs-send .online)"

• "ET TROJAN TA444 Related Domain (updatezone .org) in DNS Lookup"

• "ET MALWARE Yourscreen.com Spyware User-Agent (FreezeInet)"

• "ET CURRENT_EVENTS Possible Apple Store Phish Landing 2015-07-30"

• "ET TROJAN Observed DNS Query to known Windshift APT Related Domain 2"

• "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 51"

• "ET TROJAN Likely CryptoWall .onion Proxy domain in SNI"

• "ET TROJAN Corebot Requesting Module"

• "ET MALWARE host-domain-lookup.com spyware related Start Report"

• "ET TROJAN Ponmocup HTTP Request (generic) M5"

• "ET TROJAN Observed Win32.Raccoon Stealer CnC Domain (gopstoporchestra .top in TLS SNI)"

• "ET TROJAN TWISTEDPANDA CnC Domain in DNS Lookup (www .microtreely .com)"

• "ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Win32 Dialer Variant"

• "ET TROJAN Observed Bahamut APT Group Domain (laborer-posted .nl) in TLS SNI"

• "ET CURRENT_EVENTS Sidewinder Credential Phish Landing Page M1 2023-02-16"

• "ET TROJAN MINEBRIDGE CnC Domain in DNS Lookup (vikingsofnorth .top)"

• "ET CURRENT_EVENTS TA444 Domain in TLS SNI (skyboxdrive .cloud)"

• "ET TROJAN Win32/Caypnamer.A RAT CnC Keepalive"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-05-24"

• "ET TROJAN TA402/Molerats Pierogi CnC Response (Command)"

• "ET TROJAN Rilide Stealer Domain in DNS Lookup (vceilinichego .ru)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (kgscrew .com)"

• "ET TROJAN W32/Snojan.BNQKZQH Payload Inbound"

• "ET CURRENT_EVENTS Sutra TDS /simmetry"

• "ET MOBILE_MALWARE Android/Netisend.A Posting Information to CnC"

• "ET MOBILE_MALWARE Observed Trojan-Spy.AndroidOS.Origami.b / Donot Domain in TLS SNI"

• "ET CURRENT_EVENTS Observed TOAD Domain (m2care .us in TLS SNI)"

• "ET CURRENT_EVENTS lordspartner Phish Kit"

• "ET TROJAN Stately Taurus APT Toneshell Backdoor Domain in DNS Lookup (www .uvfr43p .com)"

• "ET CURRENT_EVENTS Successful Generic Phish (set) 2018-03-08"

• "ET TROJAN [PTsecurity] Tinba Checkin 4"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET CURRENT_EVENTS [TW] Tycoon Phishkit CSS"

• "ET TROJAN Observed SockRacket/KANDYKORN Domain (docsendinfo .linkpc .net in TLS SNI)"

• "ET TROJAN Suspicious HTTP Referer C Drive Path"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Cookies Firefox.txt) M1"

• "ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2022-12-27"

• "ET TROJAN SysJoker Related Domain in DNS Lookup (office360-update .com)"

• "ET TROJAN Observed Malicious SSL Cert (Python RAT (Aurora Campaign))"

• "ET CURRENT_EVENTS Microsoft Live Email Account Phishing Landing Mar 16 2017"

• "ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-08-10"

• "ET TROJAN TA455 Related CnC Domain in DNS Lookup"

• "ET TROJAN SnappyTCP Reverse Shell Client Checkin M1"

• "ET TROJAN APT DarkHydrus DNS Lookup 24"

• "ET TROJAN PingPull ICMP Activity (Outbound)"

• "ET TROJAN CommentCrew Possible APT c2 communications download client.png"

• "ET CURRENT_EVENTS Successful Banco Itau (BR) Phish Jun 09 2017"

• "ET TROJAN ELF/Mirai Variant UA Outbound (Yakuza)"

• "ET TROJAN Restylink Domain in DNS Lookup (youmiuri .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET USER_AGENTS Suspicious User-Agent (DownloadMR)"

• "ET TROJAN RegSubsDat Checkin Off Ports"

• "ET CURRENT_EVENTS Successful Greatness Credential Phish M1 (2023-11-07)"

• "ET CURRENT_EVENTS Phishing Landing via Tripod.com Mar 31 M3"

• "ET TROJAN Legion Loader Activity Observed (Mylegion666)"

• "ET TROJAN APT28/Sednit DNS Lookup (updatesystems .net)"

• "ET TROJAN Win32/Blacknix CnC Heartbeat"

• "ET TROJAN Miniduke Checkin"

• "ET TROJAN RDP Brute Force Bot Checkin"

• "ET TROJAN Win32/AnteFrigus Ransomware Activity"

• "ET TROJAN Datoploader Activity (GET)"

• "ET MALWARE Suspicious User-Agent (GeneralDownloadApplication)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Successful Dynamic Folder FreeMobile (FR) Phishing 2016-10-06"

• "ET MOBILE_MALWARE Trojan.AndroidOS.TimpDoor (purple .itraffic .click in DNS Lookup)"

• "ET TROJAN DNS Query to IcedID Domain (belliecow .wiki)"

• "ET CURRENT_EVENTS RogueRaticate Domain in DNS Lookup (rentfrejob .com)"

• "ET TROJAN JS/WSF Downloader Dec 08 2016 M6"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-23"

• "ET CURRENT_EVENTS Successful Docusign Phish M1 2016-08-17"

• "ET TROJAN PyPI Phishing/Malware Data Exfiltration Domain (linkedopports .com) in DNS Lookup"

• "ET TROJAN [Akamai] Panchan Miner Botnet Checkin"

• "ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message Header Local"

• "ET CURRENT_EVENTS Common Form POST - Linkedin Phishing Landing 2020-06-11"

• "ET TROJAN Possible APT38 CnC Domain Observed in DNS Query"

• "ET TROJAN Diavol Communicating with CnC - Register M2"

• "ET TROJAN Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4"

• "ET CURRENT_EVENTS Binance Credential Phish Landing Page 2022-10-07"

• "ET TROJAN SocGholish Domain in DNS Lookup (sermon .pastorbriantubbs .com)"

• "ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce 2]"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (astope .xyz)"

• "ET TROJAN [Fireeye] Backdoor.SUNBURST SSL Cert Inbound (avsvmcloud .com)"

• "ET INFO MacOS Process List in HTTP POST Request (/sbin/launchd) M1"

• "ET TROJAN ELF/Mirai Variant UA Outbound (lessie)"

• "ET EXPLOIT Possible Misfortune Cookie RomPager Server banner"

• "ET MOBILE_MALWARE Arid Viper (julie-parker .top in DNS Lookup)"

• "ET TROJAN Vidar Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Observed Ursnif Domain in TLS SNI (fishenddog .xyz)"

• "ET TROJAN Win32/LeftHook Stealer Payload Inbound"

• "ET TROJAN Observed TA444 Domain in TLS SNI (jaicvc .com)"

• "ET CURRENT_EVENTS Covid19 Stimulus Payment Phish Inbound M1 (2021-10-21)"

• "ET TROJAN SocGholish Domain in DNS Lookup (dashboard .renovationsruth .com)"

• "ET TROJAN Sality - Fake Opera User-Agent"

• "ET TROJAN Win32/Corrempa/HZRAT CnC Checkin"

• "ET MALWARE User-Agent (TALWinInetHTTPClient)"

• "ET TROJAN Suspected Bitter Elephant APT Related Activity (GET)"

• "ET TROJAN ViperSoftX CnC Domain in DNS Lookup (bideo-endpoint .xyz)"

• "ET TROJAN Loxes/Mongall Related CnC Beacon (GET)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .settings .oysterfloats .org)"

• "ET CURRENT_EVENTS Lucy Security - Phishing Framework Plugin List POST"

• "ET TROJAN Observed DNS Query to Pirate Stealer Domain (mdvksublbpczqluqvvbytfprxdwakuke .nl)"

• "ET TROJAN TAG28 Associated CnC Domain in DNS Lookup (samuelblog .xyz)"

• "ET TROJAN Pingback Download Command Issued"

• "ET CURRENT_EVENTS Fake 404 With Hidden Login Form"

• "ET TROJAN SocGholish Domain in DNS Lookup (cpanel .gtiyeshua .com)"

• "ET CURRENT_EVENTS EITest Inject July 25 2017"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (gov-mail .net)"

• "ET CURRENT_EVENTS Observed Phish Domain in DNS Lookup (rakpetrolae .com) 2022-12-05"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Bookmarks Firefox.txt) M2"

• "ET TROJAN CoreDDRAT CnC Activity"

• "ET TROJAN Kuluoz/Asprox Activity"

• "ET TROJAN ServHelper CnC Command (Reg Add)"

• "ET TROJAN Possible Winnti-related Destination"

• "ET TROJAN Observed Gamaredon APT Related Domain (imbriumbi .ru in TLS SNI)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET TROJAN TEMP.Periscope APT Domain in DNS Lookup"

• "ET TROJAN Cobalt Strike Beacon Activity (GET)"

• "ET TROJAN TA444 Domain in DNS Lookup (bitscrunch .presentations .life)"

• "ET TROJAN APT33 CnC Domain in DNS Lookup"

• "ET MALWARE User-Agent (Microsoft Internet Explorer 6.0) Possible Reverse Web Shell"

• "ET MALWARE Malicious Chrome Ext. DNS Query For Adware CnC (startupfraction)"

• "ET TROJAN APT32 Win32/Ratsnif Submitting Output of Command to CnC"

• "ET TROJAN ELF/Roboto - Communicating with Hardcoded Peer 3"

• "ET TROJAN TA457 Backdoor CnC Activity"

• "ET TROJAN JynxLoaderV2 CnC Server Command (NOTASK)"

• "ET MOBILE_MALWARE NSO Pegasus iOS CnC Domain in DNS Lookup (opposedarrangement .net)"

• "ET TROJAN Vawtrak HTTP CnC Beacon"

• "ET TROJAN Trojan Internet Connectivity Check"

• "ET TROJAN Observed Malicious SSL Cert (FIN7/JSSLoader CnC)"

• "ET CURRENT_EVENTS Instagram Phishing Landing 2020-10-13"

• "ET CURRENT_EVENTS RogueRaticate Domain in TLS SNI (zxcdota2huysasi .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup"

• "ET CURRENT_EVENTS Possible Successful Generic Phish - Credit Card"

• "ET TROJAN Diezen/Sakabota CnC Domain Observed in DNS Query"

• "ET TROJAN Win32/Retadup CnC Checkin M1"

• "ET TROJAN Generic Dropper Installing PUP 2"

• "ET TROJAN Suspicious User Agent Detected (RookIE) - Common with Downloaders"

• "ET MALWARE W32/DownloadAdmin.Adware User-Agent"

• "ET TROJAN Maldoc Retrieving Remote Template (GET)"

• "ET MALWARE InstallCore PUA/Adware Activity M4"

• "ET TROJAN Suspected TA453 Related Domain in DNS Lookup (metaemailsecurity .net)"

• "ET TROJAN Known Malicious Redirector in DNS Lookup (vip.rm028 .cn)"

• "ET TROJAN Win32/WhiskerSpy - FTP STOR Command M2"

• "ET TROJAN Win32/Valak - Stage 2 - Response - Plugin"

• "ET TROJAN Troj_Yahoya Variant CnC Checkin"

• "ET TROJAN Ponmocup Redirection from infected Website to Trojan-Downloader"

• "ET CURRENT_EVENTS Successful Phish Gmail Recovery Information 2015-10-01"

• "ET MOBILE_MALWARE Android APT-C-23 (eleanor-guthrie .info in TLS SNI)"

• "ET TROJAN APT28/Sednit DNS Lookup (osce-press .org)"

• "ET TROJAN DNS Query to Gamaredon Domain (dzhabaripa .ru)"

• "ET TROJAN Sidewinder APT Related Domain in DNS Lookup (bbcnew .cn)"

• "ET TROJAN Win32/BanloadDownloader.XZY Retrieving Payload"

• "ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)"

• "ET CURRENT_EVENTS Successful Excel Phish 2016-08-19"

• "ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection"

• "ET TROJAN Dark Halo/SUNBURST SSL Cert Inbound (webcodez .com)"

• "ET TROJAN Observed DNS Query to RisePro Domain (teleportsoft .com)"

• "ET CURRENT_EVENTS Possible Successful Generic Phish (set) May 31 2017"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Observed DNS Query to Vicious Panda CnC Domain"

• "ET TROJAN Stately Taurus APT Related Domain in DNS Lookup (Feed-5613 .coderformylife .info)"

• "ET TROJAN Possible CopyKittens DNS Lookup (fbstatic-a.space)"

• "ET TROJAN Observed FIN7 CnC Domain (injuryless .com in TLS SNI)"

• "ET MALWARE Webhancer Data Upload"

• "ET TROJAN DTLoader Binary Request"

• "ET CURRENT_EVENTS TA444 Domain in DNS Lookup (team-meet .xyz)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (7k .rs)"

• "ET TROJAN HackTool.Linux.SSHBRUTE.A Haiduc Initial Compromise C2 POST"

• "ET TROJAN APT29 Implant8 - MAL_REFERER"

• "ET TROJAN SMSHoax Riskware checkin"

• "ET TROJAN Observed Malicious SSL Cert (Sidewinder CnC)"

• "ET TROJAN Phorpiex CnC Domain in DNS Query"

• "ET WEB_CLIENT pshell dl/execute primitives in wideb64 3"

• "ET CURRENT_EVENTS Google Drive Phishing Landing M2 July 24 2015"

• "ET TROJAN AppleJeus - Union Crypto CnC Activity"

• "ET CURRENT_EVENTS Successful O2 Phish 2018-03-12"

• "ET TROJAN W32/SpeedingUpMyPC.Rootkit CnC Beacon"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN Oilrig Stealer CnC Checkin"

• "ET TROJAN Download Request Containing Suspicious Filename - Crypted"

• "ET TROJAN Observed Malicious SSL Cert (MageCart Group 4 CnC)"

• "ET MALWARE Miva User-Agent (TPSystem)"

• "ET TROJAN Trojan.Verblecon User Agent Observed"

• "ET TROJAN W32/AntiBreach Possible Activation Attempt"

• "ET MOBILE_MALWARE Android Spy PREDATOR CnC Domain in DNS Lookup"

• "ET TROJAN Bredolab Downloader Communicating With Controller (1)"

• "ET TROJAN DNS Query to Raspberry Robin Domain (ubv5 .com)"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET CURRENT_EVENTS Inbound PowerShell Saving Base64 Decoded Payload to Temp M2 2018-11-29"

• "ET WEB_SERVER Possible Custom Content Type Manager WP Backdoor Access"

• "ET TROJAN TA444 Domain in DNS Lookup (docshared .col-link .linkpc .net)"

• "ET WORM TheMoon.linksys.router 2"

• "ET TROJAN Win32/Numando Banker CnC Activity"

• "ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed"

• "ET TROJAN MSIL/Modi RAT CnC Command Outbound (aw)"

• "ET TROJAN Magecart CnC Domain in DNS Lookup"

• "ET TROJAN OSX/LamePyre Screenshot Upload"

• "ET TROJAN AHK/BKDR_HTV.ZKGD-A Fake HTTP 500 Containing Encoded Commands Inbound"

• "ET MOBILE_MALWARE Android/Gigabud CnC Check-in M9"

• "ET TROJAN S400 RAT Server Response"

• "ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (viedechretien .org)"

• "ET TROJAN Gamaredon Domain in DNS Lookup (badarus .ru)"

• "ET TROJAN Observed Malicious SSL Cert (BrushaLoader CnC)"

• "ET CURRENT_EVENTS Successful Apple Suspended Account Phish M2 Aug 09 2016"

• "ET TROJAN PowerTrick Task Request"

• "ET TROJAN MacOS/XLOADER Domain in DNS Lookup (www .activ-ketodietakjsy620 .cloud)"

• "ET TROJAN APT28 CnC Domain DNS Lookup"

• "ET TROJAN Observed DonotGroup CnC in DNS Query"

• "ET TROJAN Observed StrongPity CnC Domain in TLS SNI"

• "ET TROJAN Ousaban Banker Server Response M2"

• "ET TROJAN Konni Stage 2 Payload Exfiltrating Data"

• "ET CURRENT_EVENTS Successful Dropbox Phish 2016-10-14"

• "ET TROJAN W32/Kazy User-Agent (Windows NT 5.1 v.) space infront of semi-colon"

• "ET TROJAN ESPecter Bootkit Initialization Activity (GET)"

• "ET TROJAN Malicious SSL Certificate detected (PyXie)"

• "ET TROJAN Observed Malicious SSL Cert (Baka Skimmer Staging CnC)"

• "ET SMTP Possible ComputerCop Log Transmitted via SMTP"

• "ET MOBILE_MALWARE GoldDigger CnC Domain in DNS Lookup (hzc5 .xyz)"

• "ET TROJAN DNS Query to MageCart Domain (ahedoob .shop)"

• "ET TROJAN Win32/IDAT Loader Related Activity"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (mwasro .com)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (greenfastline .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (jupyternotebookcollection .azurewebsites .net)"

• "ET TROJAN HailBot Server Response"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (integratedblognewsapi .azurewebsites .com)"

• "ET TROJAN Observed Malicious Domain (kakaoteam .site in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (javaruntime .azurewebsites .net in TLS SNI)"

• "ET TROJAN TA430/Andariel NukeSped Backdoor Variant Activity M1"

• "ET TROJAN Observed Fenix Botnet Domain (2repuvegobmx .com .mx in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (thre3)"

• "ET TROJAN DNS Query to DarkComet RAT Domain (dekabristiney .fvds .ru)"

• "ET TROJAN ScarCruft TA409 Domain in DNS Lookup (app .documentoffice .club)"

• "ET TROJAN Silverfox Payload Retrieval Attempt"

• "ET TROJAN DNS Query to MageCart Domain (vidbent .shop)"

• "ET CURRENT_EVENTS Fake Privnote Domain in DNS Lookup (privatemessage .net)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M5"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (respectabledpcs .shop)"

• "ET TROJAN Malvertising/Nitrogen Loader Domain (advanced-ip-scan .org) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (qaquestionapi .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sulphurhsum .shop)"

• "ET TROJAN ClickFix CnC Activity (POST)"

• "ET TROJAN Observed Lumma Stealer Related Domain (negotationpxczp .shop in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (2n8rd3zz1 .top)"

• "ET TROJAN Observed Magecart Domain (yanaloop .shop in TLS SNI)"

• "ET TROJAN Observed TA455 Domain in TLS SNI (teledyneflir.com .de)"

• "ET TROJAN Observed Lumma Stealer Related Domain (politefrightenpowoa .pw in TLS SNI)"

• "ET TROJAN Brosql Stealer Screenshot Exfil"

• "ET MOBILE_MALWARE Android Rafel RAT Checkin M2"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (benchillppwo .shop)"

• "ET TROJAN DNS Query to Magecart Domain (grutic .store)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (problemregardybuiwo .fun)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (paknavy .defpak .org)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (didsit .com)"

• "ET TROJAN Observed MageCart Domain (temninch .site in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (stingmisplacedelivrrw .shop) in TLS SNI"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pddbj .xyz)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (paradiso4 .fun)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (excavtaionps .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (asleepfulltytarrtw .shop in TLS SNI)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (e2sky .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (stiffraspyofkwsl .shop in TLS SNI)"

• "ET TROJAN Observed Malvertising Related Domain (hmgcyberschools .com) in TLS SNI"

• "ET WEB_SPECIFIC_APPS Server Response Containing search-ms URI With subquery Parameter - Possible NTLM Hash Leak Attempt"

• "ET TROJAN Cryptbot CnC DGA Domain (twel12)"

• "ET TROJAN Suspected Powershell Empire Activity M1"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain (mailchimp-addons .com) in TLS SNI"

• "ET TROJAN Globalshadow CnC Domain in DNS Lookup (portal .sharjahconnect .online)"

• "ET TROJAN Observed DonotGroup Related Domain (letentinfo .info in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (jupyternotebookcollections .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pedestriankodwu .xyz)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Onkods.A Downloader Checkin"

• "ET TROJAN DFKRAT CnC Checkin M1"

• "ET TROJAN DNS Query to MageCart Domain (mistlink .online)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (landdumpycolorwskfw .shop)"

• "ET TROJAN Observed Earth Krahang APT Domain (cdn-dev .helpkaspersky .top in TLS SNI)"

• "ET TROJAN Suspected UTA0178 Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (disappearsodsz .shop)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)"

• "ET TROJAN Observed FakeExt Domain (cdn .lll .yachts) in TLS SNI"

• "ET MOBILE_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus-cc .ru)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (playerofsunshine .com)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (withthreekitties .itsm-us1 .comodo .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (baketransparentadw .pics)"

• "ET CURRENT_EVENTS Generic Survey Credential Phish Landing Page 2024-06-12"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (bigdownload .xyz)"

• "ET CURRENT_EVENTS Parrot TDS NDSW Check M2"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (geo-4bfa49b2 .tbc-app .life) in TLS SNI"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (click4chatting .com)"

• "ET TROJAN Malvertising Related Domain in DNS Lookup (hmgcyberschools .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (publicitttyps .shop in TLS SNI)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Related Domain (vivaciousdqugilew .shop in TLS SNI)"

• "ET TROJAN UAC-0050 Domain (8161 .uk in TLS SNI)"

• "ET TROJAN Earth Kapre/RedCurl CnC Domain (unipreg .tumsun .com) in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cooperatecliqueobstac .site)"

• "ET TROJAN DFKRAT CnC Checkin M3"

• "ET TROJAN Observed Lumma Stealer Related Domain (periodicroytewrsn .shop in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (blacksaltys .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (directorryversionyju .shop)"

• "ET TROJAN DNS Query to Malicious Domain (steam-install .run)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (launch payload)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mailrta .mfagov .org in TLS SNI)"

• "ET TROJAN Possible SSload Interactive Shell whoami Output"

• "ET TROJAN Observed Lumma Stealer Related Domain (bannngwko .shop in TLS SNI)"

• "ET CURRENT_EVENTS [TW] Possible Crypto Wallet Drainer JS M1"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (chemsentinel .com)"

• "ET TROJAN Lazarus Group Domain in DNS Lookup (updating .dothome .co .kr)"

• "ET TROJAN Observed Amadey Domain (theclientisalwaysright .com in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (coffeeonlineshop .azurewebsites .net in TLS SNI)"

• "ET TROJAN Possible XWorm Payload Downloaded via Powershell"

• "ET TROJAN HailBot CnC Domain in DNS Lookup (asdsdfjsdfsd .indy)"

• "ET TROJAN JaskaGO Infrastructure Observed Inbound"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (occupytapsessijk .pw)"

• "ET TROJAN Win32/SSLoad Module Request (GET)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bouncedgowp .shop)"

• "ET TROJAN Ailurophile Infostealer CnC Server Response M1"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (questionconservawuts .shop)"

• "ET MOBILE_MALWARE Android Chameleon Banking Trojan Activity (POST)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (varitycookypowerw .xyz)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (load .memoryloader .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (birdpenallitysydw .shop in TLS SNI)"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (app .mobil-csob-cz .eu)"

• "ET TROJAN DeerStealer CnC Activity M1"

• "ET TROJAN Observed Malvertising Domain (doxy .icu in TLS SNI)"

• "ET TROJAN Win32/PackedFlyStudio.AA CnC Activity (GET)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (elamoto .com)"

• "ET TROJAN Win32/FireStealer Related Server Response"

• "ET TROJAN Win32/OfferCore Checkin M2"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M21"

• "ET TROJAN MacOS RustDoor Related Activity M1 (POST)"

• "ET TROJAN Observed UNC1549/TA455 Domain (audioservicetestapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Payload Downloader Domain (backpupcpa .blogspot .com in TLS SNI)"

• "ET TROJAN [ANY.RUN] WhiteSnake Stealer HTTP POST Report Exfiltration"

• "ET TROJAN Observed UNC1549/TA455 Domain (qaquestionsapijson .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (stalfbaclcalorieeis .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (zone02 .b-cdn .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (connectionhandlerapi .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Domain (myapt67 .s3 .amazonaws .com in TLS SNI)"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (dison .live)"

• "ET TROJAN Unknown Loader CnC Domain in DNS Lookup (scratchedcards .com)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (rdesktopconnect .com)"

• "ET TROJAN Daolpu Stealer Data Exfiltration Attempt"

• "ET TROJAN Suspected Fin7 Related Domain (cdn33 .space) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (abuselinenaidwjuew .shop in TLS SNI)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (ashleypuerner .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (browsercheckap .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Domain (stronggemateraislw .shop) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (changequestiontypes .azurewebsites .net in TLS SNI)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (pegasusdate .com)"

• "ET TROJAN DNS Query to Mispadu Domain (geradcontsad .pro)"

• "ET TROJAN UNK_ConsoleCollie Payload Retrieval Attempt"

• "ET TROJAN Allasenha/CarnavalHeist Related Domain (nf-e .pro) in DNS Lookup"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (tempesolarcompany .com)"

• "ET TROJAN Cryptbot CnC Domain in DNS Lookup (rzeight18pt .top)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (budgetttysnzm .shop)"

• "ET CURRENT_EVENTS [TW] Possible Crypto Wallet Drainer Domain Observed"

• "ET TROJAN BMANAGER CnC Domain in DNS Lookup (update-brower .com)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (jswebcache .com)"

• "ET TROJAN DNS Query to TinyTurla Domain (hanagram .jp)"

• "ET TROJAN MOONSTONE SLEET APT Payload Delivery Attempt"

• "ET TROJAN Observed Malicious Domain (taxservice .pe .kr in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (googlecloudstream .com)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (randaln .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Blister Loader Mythic C2 Profile M2"

• "ET TROJAN Malvertising Domain in DNS Lookup (reclaimmycredit .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (airconnectionsapi .azurewebsites .net)"

• "ET TROJAN Observed ClickFix Domain (x8f7a89 .pics in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (respectpitchadopwo .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (muggylasergaijynwjk .shop)"

• "ET TROJAN TrollAgent CnC Domain in DNS Lookup (ai .kostin .p-e .kr)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (daveiz .top)"

• "ET TROJAN Observed FakeExt Domain (cdn .jsassets .sbs) in TLS SNI"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain (cloudflareaddons .com) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (astronomicspace .com)"

• "ET CURRENT_EVENTS Observed DNS Query to Phishing Related Domain [Redacted - Vulgar]"

• "ET TROJAN SocGholish Domain in TLS SNI (nano .anygreaterways .tech)"

• "ET TROJAN Observed Lumma Stealer Domain (handsomelydicrwop .shop) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (torubleeodsmzo .shop in TLS SNI)"

• "ET CURRENT_EVENTS Generic Survey Credential Phish Landing Page 2024-06-11"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (mamore .live)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (graphlq .shop)"

• "ET INFO Suspicious Request for bd.log"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (ministryofforeignaffairs-mofa-gov-pk .dytt88 .org)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain in DNS Lookup (textsmsonline .com)"

• "ET TROJAN Observed Malicious Domain (naveralarm .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (refaeldevrssfeed .centralus .cloudapp .azure .com in TLS SNI)"

• "ET TROJAN DNS Query to Malvertising Domain (advnanced-ip-scanner .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (workersquestions .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (hunterstrawmersp .homes)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (jonmesserartwork .com)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (barebrilliancedkoso .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (secretionsuitcasenioise .shop)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (froytnewqowv .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Domain (human-verify02 .b-cdn .net in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (jswebcloud .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (birddogerc .com)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (agov-ch .com) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (imc1 .top)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (didsit .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (vesselcultiralkettlw .shop in TLS SNI)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (evotoforpc .net)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pqdrf .xyz)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (integratedblognewfeed .azurewebsites .net)"

• "ET TROJAN Observed Mint Stealer Domain (ashvgcgfxdfcgvcgfdcg .best) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (radiationnopp .shop)"

• "ET TROJAN Oyster Backdoor Domain in TLS SNI (dotnetisforchildren .com)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (moemaldives .pmd-office .com in TLS SNI)"

• "ET TROJAN DNS Query to Expiro Domain (napws .biz)"

• "ET TROJAN DNS Query to UAC-0177 Domain (passport2 .zip)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (novidadesfresquinhas .online)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (zippyfinickysofwps .shop)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (siii-chile .com)"

• "ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M2"

• "ET CURRENT_EVENTS Fake IRS Scam Domain (ustaxnumber .org in TLS SNI)"

• "ET TROJAN Malvertising Domain in DNS Lookup (parsic .org)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (eyesstore .store)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (estafetaofj .top)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (humanresourcesapiquiz .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (shootydowtqosm .shop in TLS SNI)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (gelatosg .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (happywave .shop)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (salary-cutting .session-out .com)"

• "ET TROJAN DNS Query to Lactrodectus Domain"

• "ET TROJAN Observed Lumma Stealer Related Domain (exertcreatedadnndjw .xyz in TLS SNI)"

• "ET TROJAN Amadey CnC Domain in DNS Lookup (theclientisalwaysright .com)"

• "ET TROJAN Observed Malvertising Domain (ciltrix .com in TLS SNI)"

• "ET TROJAN RubySleet APT TrollAgent CnC Domain in DNS Lookup (ol .negapa .p-e .kr)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (accountasifkwosov .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (testtesttes .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (uaeaircheckon .azurewebsites .net)"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (security-microsoft .net)"

• "ET TROJAN Observed UNC1549/TA455 Domain (audiomanagerapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (lyingchemicow .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (richardflorespoew .shop)"

• "ET TROJAN BunnyLoader 3.0 Echo Checkin"

• "ET TROJAN Observed Lumma Stealer Related Domain (communicationgenerwo .shop in TLS SNI)"

• "ET TROJAN Observed Malware Delivery Related Domain (maintenance-princess-musical-vocational .trycloudflare .com in TLS SNI)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (8r .ae)"

• "ET TROJAN Observed Lumma Stealer Related Domain (strainriskpropos .store in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (russiancl .top)"

• "ET TROJAN [ANY.RUN] MetaStealer v.5 CnC Activity (MC-NMF TLS SNI)"

• "ET TROJAN Observed Magecart Domain (clifolink .online in TLS SNI)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (centralizebd .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (effectivedoxzj .shop in TLS SNI)"

• "ET TROJAN Observed BMANAGER Domain (updatebrower .com in TLS SNI)"

• "ET TROJAN SocGholish Domain in TLS SNI (collar .agrcwv .org)"

• "ET WEB_SPECIFIC_APPS Fanwei eMobile File Upload Vulnerability"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (arritswpoewroso .shop)"

• "ET CURRENT_EVENTS Observed TOAD Domain (mvhelp .cc in TLS SNI)"

• "ET TROJAN OldGremlin/TA801 Domain in TLS SNI (1cbit .org)"

• "ET TROJAN Observed Lumma Stealer Related Domain (cancedhoeysopzv .shop in TLS SNI)"

• "ET TROJAN Observed Magecart Domain (znanielec .online in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (statistall .com)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (cabinet-division-pk .fia-gov .com in TLS SNI)"

• "ET TROJAN VersaMem Webshell Authentication Attempt M3"

• "ET TROJAN Quad7777 Botnet - Outbound Login Prompt from Compromised Endpoint"

• "ET TROJAN Observed Lumma Stealer Related Domain (upsettymsnqwk .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (selectchoise .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (saxymiss .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (checkapicountryquestions .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (diamonykeqpwm .shop in TLS SNI)"

• "ET TROJAN Cryptbot CnC Domain in DNS Lookup (rzfift15ht .top)"

• "ET TROJAN Observed Lumma Stealer Related Domain (triangleseasonbenchwj .shop in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (seven7)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Observed Malicious Domain (adblock2024 .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (constructgeneratisa .xyz in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (roleprofittypleasw .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sailorshelfquids .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (shellfyyousdjz .shop in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (salesguru .online)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (analytlx .shop)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (agov-access .net) in TLS SNI"

• "ET TROJAN Malvertising/Nitrogen Loader Domain (saltysour .com) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (museumtespaceorsp .shop)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (notoriousdcellkw .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (conformfucdioz .shop)"

• "ET TROJAN Observed TA417 Domain (gayionsd .com) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (eternosrelojeria .com)"

• "ET TROJAN Patchwork CnC Domain in DNS Lookup (centling .nihaoucloud .org)"

• "ET TROJAN Observed Lumma Stealer Related Domain (southedhiscuso .shop in TLS SNI)"

• "ET TROJAN Win32/ProcessKiller CnC - Client Side"

• "ET TROJAN DNS Query to Magecart Domain (avitech .site)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (www-moha-gov-lk .direct888 .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (facilitycoursedw .shop)"

• "ET TROJAN DuckTail APT CnC Activity (GET)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (edificedcampslzi .shop)"

• "ET TROJAN Observed Malicious Domain (nmail .navermail .online .korea in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (biginfo .xyz)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (mod-gov-bd .dowmload .co)"

• "ET TROJAN PlanetStealer CnC Checkin - Server Response"

• "ET TROJAN Observed MageCart Domain (reshnot .quest in TLS SNI)"

• "ET TROJAN Observed DarkComet RAT Domain (ultradelux .buzz in TLS SNI)"

• "ET TROJAN APT SideWinder / TA399 CnC Domain in DNS Lookup"

• "ET TROJAN APT42/TA453 Related Domain in DNS Lookup (worried-eastern-salto .glitch .me)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (oakgrovetraining .com)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (sync .webappclick .net)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (moitt-gov-pk .fia-gov .net)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (uhsee .com)"

• "ET CURRENT_EVENTS DNS Query to TA455 Domain (1stemployer .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (connectairapijson .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (hiringarabicregion .azurewebsites .net)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (conferencefreckewl .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (smallelementyjdui .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (localdominationsystems .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (coffeeonlineshoping .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (countora .shop)"

• "ET TROJAN TA421 Wineloader CnC Checkin"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (messageflowpro .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (desiqnia .shop)"

• "ET WEB_CLIENT Zimbra zauthtoken Exfil Domain in DNS Lookup (zimbrauser .me)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (majordatabases .lat)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (millyscroqwp .shop)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Domain (specialadventurousw .shop) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (broccoltisop .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (recordsbluemountain .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (cssmagic .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (darchrif .com)"

• "ET TROJAN SocGholish Domain in DNS Lookup (welcome .visionaryyouth .org)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (sl-navy .office-drive .live)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (register-agov .net) in TLS SNI"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (osgnhr9zv .top)"

• "ET TROJAN AnonymousRAT Payload Retrieval Attempt"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (mailarmylk .mods .email)"

• "ET TROJAN Observed Lumma Stealer Related Domain (healthproline .pro in TLS SNI)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (zoomzle .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (biggerfun .org)"

• "ET TROJAN Observed Transparent Tribe CnC Domain (mus09 .duckdns .org in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (citas-sat2023 .com .mx)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (refaeldevrssfeed .centralus .cloudapp .azure .com)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (bet89on .store)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (civilizzzationo .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (seilsmart .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (dealhunt .website)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authetificator-gogle .com)"

• "ET TROJAN JaskaGO CnC Activity (GET)"

• "ET TROJAN TA453 Related Domain in DNS Lookup"

• "ET TROJAN Earth Preta PUBLOAD Activity M2"

• "ET TROJAN DNS Query to Gamaredon Domain (plutoniumo .ru)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (dateyourlove .live in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (queryquestions .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (willingyhollowsk .shop)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (boy-such-icon-positive .trycloudflare .com)"

• "ET TROJAN BlackRain User-Agent Observed"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (suezcanal .portdedjibouti .live in TLS SNI)"

• "ET TROJAN DNS Query to AMOS Related Domain (rize .lat)"

• "ET TROJAN Observed Lumma Stealer Related Domain (exuberanttjdkwo .xyz in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (followcache .com)"

• "ET TROJAN Observed Ducktail Domain (dailyfasterauto .info in TLS SNI)"

• "ET TROJAN Observed MageCart Domain (mokamob .site in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (uttercarrigsno .shop)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (cabinet-gov-pk .ministry-pk .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (developmentalveiop .homes)"

• "ET TROJAN Observed Malicious Domain (nsvc .mail .server .korea in TLS SNI)"

• "ET TROJAN Suspected UTA0178 Domain in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (peasanthovecapspll .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (museumtespaceorsp .shop in TLS SNI)"

• "ET TROJAN Observed APT Related CR4T Dropper Domain (userfeedsync .com in TLS SNI)"

• "ET TROJAN Observed Malware Delivery Related Domain (bangkok-generally-ensemble-nfl .trycloudflare .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (interactiedovspm .shop in TLS SNI)"

• "ET TROJAN SocGholish Domain in DNS Lookup (event .coachgreb .com)"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn34 .space)"

• "ET TROJAN ACR Stealer CnC Checkin Attempt"

• "ET TROJAN Observed UNC1549/TA455 Domain (integratedblognewfeed .azurewebsites .net in TLS SNI)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M2"

• "ET TROJAN DNS Query to Lumma Stealer Domain (landdumpycolorwskfw .shop)"

• "ET TROJAN Possible Sniffthem/Tnaket User-Agent Observed M3"

• "ET TROJAN Observed ZharkBot Domain (solutionhub .cc in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sulphurhsum .shop in TLS SNI)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (secretiveonnicuw .shop)"

• "ET TROJAN Observed Iluria Stealer Domain (nikkistealer .shop) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bassizcellskz .shop)"

• "ET TROJAN Rust HackTool CnC Activity (Outbound)"

• "ET TROJAN APT Related CR4T Backdoor Activity"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (ccbaminumpot .ru (sinkholed))"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (mwasro .com)"

• "ET TROJAN DNS Query to Malvertising Domain (doxy .ws)"

• "ET TROJAN Xehook Stealer CnC Domain in DNS Lookup (nc1337 .online)"

• "ET TROJAN CloudAtlas APT Related Maldoc Activity M1 (GET)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (poseidon .cool) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (javaruntimetestapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Malvertising Loader User-Agent Observed (Magic Browser)"

• "ET TROJAN DNS Query to CCoreDoor Domain (message .ooguy .com)"

• "ET TROJAN DuckTail APT Payload Request"

• "ET TROJAN Observed Lumma Stealer Related Domain (appliedgrandyjuiw .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (compage .listwithstats .com)"

• "ET TROJAN Observed Xehook Stealer Domain (trecube .com) in TLS SNI"

• "ET TROJAN Observed Magecart Domain (vidkimob .quest in TLS SNI)"

• "ET TROJAN ClearFake CnC Domain in DNS Lookup (changelink .site)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (uhsee .com)"

• "ET TROJAN Earth Hundun Group Waterbear/Deuterbear CnC Domain in DNS Lookup (smartclouds .gelatosg .com)"

• "ET MOBILE_MALWARE Observed Android/Mandrake CnC Domain (ricinus .su) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (productivelookewr .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (conformfucdioz .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bravedreacisopm .shop)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mofa-gov-sa .direct888 .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (workersquestions .azurewebsites .net)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (coaching-the-boss .com)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (pnwc .bol-north .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (requestyex .shop in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (thirt13)"

• "ET TROJAN Observed Lumma Stealer Related Domain (braidfadefriendklypk .site in TLS SNI)"

• "ET TROJAN NGC2180/DFKRAT CnC Domain in DNS Lookup (windowscer .shop)"

• "ET TROJAN Observed Malvertising Related Domain (healthbeautycosmetics .com) in TLS SNI"

• "ET MOBILE_MALWARE Suspected APT Starry Addax CnC Domain in DNS Lookup 2"

• "ET TROJAN Polyfill Malicious Redirect Domain in DNS Lookup (www .googie-anaiytics .com)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pbpbj .xyz)"

• "ET TROJAN Transparent Tribe CnC Domain in DNS Lookup (mus09 .duckdns .org)"

• "ET TROJAN DNS Query to Payload Downloader Domain (capclean2024may .blogspot .com)"

• "ET TROJAN DNS Query to TA453 Domain"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (spoortsiso .shop)"

• "ET TROJAN Observed Winnti Domain (linuxrelease .org in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (demonstationfukewko .shop in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (paknavy-gov-pk .downld .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (outfittydadop .shop)"

• "ET TROJAN Malicious Typo Squatting Domain in DNS Lookup (puttyy .org)"

• "ET TROJAN Observed Lazarus Group Domain (sifucanva .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (pleasurenarrowsdla .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (tylmxvx .top)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stomachoverwis .shop)"

• "ET TROJAN DNS Query to Magecart Domain (nuinetec .store)"

• "ET TROJAN Observed Lumma Stealer Related Domain (culturesketchfinanciall .shop in TLS SNI)"

• "ET TROJAN Possible SSLoad Interactive Shell Connection"

• "ET TROJAN Allakore RAT CnC Domain in DNS Lookup (uperrunplay .com)"

• "ET CURRENT_EVENTS Parrot TDS Malicious Response M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (catlackjellyodwps .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (evoliutwoqm .shop)"

• "ET MOBILE_MALWARE Observed GoldDigger Domain (t8bc .xyz in TLS SNI)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (vscode .digital)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (swellfrrgwwos .xyz)"

• "ET MOBILE_MALWARE Observed GoldDigger Domain (ms2ve .cc in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (complaintsipzzx .shop in TLS SNI)"

• "ET TROJAN OldGremlin/TA801 Domain in DNS Lookup (1cbit .org)"

• "ET TROJAN UAC-0050 Domain (davinci-project .info in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (statisticscripts .com)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .guide .borden-carleton .ca)"

• "ET TROJAN Observed UNC1549/TA455 Domain (javaruntimeversionchecking .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (falseaudiencekd .shop)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pdddj .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (detectordiscusser .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (boattyownerwrv .shop)"

• "ET TROJAN Sharp Panda APT Related Activity M3"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (online-vip-dating .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ellaboratepwsz .xyz)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (utvj .com)"

• "ET TROJAN OrbitalBeam CnC Response (Info)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wisemassiveharmonious .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (arquestions .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (raiseboltskdlwpow .shop)"

• "ET TROJAN Malvertising Related Domain in DNS Lookup (legit .onelink .me)"

• "ET TROJAN DNS Query to MageCart Domain (antelec .click)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (daslkjfhi2 .pics)"

• "ET TROJAN Observed Social Media Malvertising Related Domain (support-team-account .fbb2024-20 .click) in TLS SNI"

• "ET TROJAN TA577 Payload Delivery Attempt"

• "ET INFO Observed Commonly Abused Link Agregating Service Domain (linkup .top in TLS SNI)"

• "ET TROJAN SocGholish Domain in TLS SNI (books .friendsofthefolsomlibrary .org)"

• "ET TROJAN [ANY.RUN] Meduza Stealer Exfiltration M2"

• "ET TROJAN DeerStealer CnC Activity M2"

• "ET TROJAN Kimsuky APT Related Win32/RftRAT Activity"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (lilygovert91 .top)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (chocolatedepressofw .fun)"

• "ET TROJAN Win32/Kryptik_AGen.DOP C2 Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (publicitttyps .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (supportyattraos .shop)"

• "ET TROJAN NewBot Loader CnC Checkin"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (dateyourlove .live)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (busbookingjbg .com)"

• "ET TROJAN Earth Hundun Group Waterbear/Deuterbear CnC Domain in DNS Lookup (rscvmogt .taishanlaw .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (altnametestapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN SocGholish CnC Domain in DNS (* .living .miraclesofeucharisticjesus .org)"

• "ET TROJAN Observed Cryptbot Domain (analforeverlove .top in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (tiappschecktest .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (benchillppwo .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (gybritanalytsesystem .com)"

• "ET TROJAN Observed ACR Stealer Domain (trxq .xyz) in TLS SNI"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (dais7nsa .pics)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (register-agov .com) in TLS SNI"

• "ET TROJAN Observed ACR Stealer Domain (trxu .xyz) in TLS SNI"

• "ET TROJAN Lazarus Group Comebacker Backdoor CnC Checkin"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (dgpr .paknvay-pk .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (restlesslifestyewlo .shop)"

• "ET TROJAN Suspected Fin7 Related Domain (cdn37 .space) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (workersquestionsapi .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (gemcreedarticulateod .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (piedsiggnycliquieaw .shop in TLS SNI)"

• "ET CURRENT_EVENTS Suspected APT Related Phish Domain in DNS Lookup (imfeurope-aml .org)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (vehicledropliberwls .shop)"

• "ET TROJAN Crimson RAT CnC Activity (Inbound) M1"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (invisibledovereats .shop)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (sb8 .co)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (face-your-dreams .com in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mailnavybd .govpk .net)"

• "ET TROJAN Observed MageCart Domain (tutic .click in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (grafoce .com)"

• "ET TROJAN Win32/Spyderv2 Related Activity (POST)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (obsceneclassyjuwks .shop)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (breaknlinks .s3 .amazonaws .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (holicisticscrarws .shop)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .donors .eucharisticjesus .net)"

• "ET TROJAN RubySleet APT TrollAgent CnC Domain in DNS Lookup (ai .kostin .p-e .kr)"

• "ET TROJAN Observed Allasenha/CarnavalHeist RAT Related Domain (nf-e .pro) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (darchrif .com)"

• "ET TROJAN Win32/SSLoad Registration Response"

• "ET TROJAN Observed Lumma Stealer Related Domain (applyzxcksdia .shop in TLS SNI)"

• "ET TROJAN Win32/Remcos RAT Loader Related Activity (GET)"

• "ET TROJAN Observed Lumma Stealer Related Domain (stripmarrystresew .shop in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (sre-curpmexico .com)"

• "ET TROJAN DNS Query to Remcos Related Domain (promote-diff-string-clerk .trycloudflare .com)"

• "ET TROJAN TA430/Andariel AndarLoader Related Activity M3"

• "ET TROJAN UNC1151 Related Domain in DNS Lookup (thevegan8 .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (establisheddisappearefe .site)"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (softupdate .xyz)"

• "ET CURRENT_EVENTS Fake IRS Scam Domain in DNS Lookup (ustaxnumber .org)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authenficatorgoogle .com)"

• "ET TROJAN ClickFix Obfuscated Payload Inbound"

• "ET TROJAN Observed UNC1549/TA455 Domain (exchtestcheckingapihealth .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (codemingle .shop)"

• "ET TROJAN DNS Query to MageCart Domain (mokamob .site)"

• "ET TROJAN Observed UNC1549/TA455 Domain (queryquestions .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Epsilon Stealer Domain (3ps1l0n .life) in TLS SNI"

• "ET TROJAN SocGholish Domain in DNS Lookup (premium .davidabostic .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (megabahis664 .com)"

• "ET TROJAN SocGholish Domain in DNS Lookup (collar .agrcwv .org)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (burnfamesoilratewo .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (manufactiredowreachhd .xyz)"

• "ET TROJAN DNS Query to Magecart Domain (feitec .online)"

• "ET TROJAN EvasivePanda/Daggerfly APT CnC Domain in DNS Lookup (devicebug .com)"

• "ET TROJAN DNS Query to Remcos Related Domain (bbhmeetre1ms .freeddns .org)"

• "ET TROJAN DNS Query to TinyTurla Domain (carleasingguru .com)"

• "ET TROJAN Observed Social Media Malvertising Related Domain (itstrq .itsm-us1 .comodo .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (paintercrutcheniw .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (composepayyersellew .shop in TLS SNI)"

• "ET TROJAN CloudAtlas APT Related Maldoc Activity M6 (GET)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (velellablue .com)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (taskscompletedlists .com)"

• "ET CURRENT_EVENTS Observed Generic Phish Redirector Domain (datatrail .xyz in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (nine9)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (injurypiggyoewirog .shop)"

• "ET TROJAN Observed ACR Stealer Domain (trxh .xyz) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (technologggisp .shop in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (nidnaver .info in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (villagemagneticcsa .fun)"

• "ET TROJAN Observed TA417 Domain (dailteeau .com) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (coffeeonlineshop .azurewebsites .net)"

• "ET TROJAN Observed ACR Stealer Domain (pcvcf .xyz) in TLS SNI"

• "ET TROJAN Oyster Backdoor Domain in DNS Lookup (wherehomebe .com)"

• "ET TROJAN Elusive Stealer CnC Exfil via Telegram"

• "ET TROJAN NUMOZYLOD CnC Checkin M2"

• "ET TROJAN Win32/AdAptertrAin CnC Server Response"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (happyllfe .online)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (edurestunningcrackyow .fun)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (msacn .ntcpk .net)"

• "ET TROJAN Observed Earth Hundun Group Waterbear/Deuterbear Domain (freeprous .bakhell .com) in TLS SNI"

• "ET TROJAN Observed Malvertising Domain (angryip .icu in TLS SNI)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (uninstall)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (promotionlist .comsats-net .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (civilizzzationo .shop in TLS SNI)"

• "ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1"

• "ET TROJAN Observed UNC1549/TA455 Domain (iaidevrssfeedp .cloudapp .azure .com in TLS SNI)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (xn--31-rha .me)"

• "ET TROJAN DNS Query to TA453 Domain (epibvgvoszemkwjnplyc .supabase .co)"

• "ET TROJAN DNS Query to ClearFake Domain (pchelprowizard .com)"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (politefrightenpowoa .pw)"

• "ET TROJAN Cobalt Strike Malleable C2 (MSNBC Video Profile)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Supply Chain Attack Related Domain (hostpdf .co)"

• "ET TROJAN Observed Lumma Stealer Related Domain (cinemaclinicttanwk .shop in TLS SNI)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (xmindcn .cc)"

• "ET TROJAN Oyster Backdoor Domain in TLS SNI (firstcountryours .eu)"

• "ET TROJAN Observed TinyTurla Domain (jeepcarlease .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (bochka-keitaro .space)"

• "ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M1"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (associationokeo .shop)"

• "ET TROJAN DNS Query to Malicious Domain (naveralert .com)"

• "ET TROJAN Observed ClearFake Domain (ghufal .answermedia .site in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (questionsapplicationapijson .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (eternosrelojeria .com)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mofa-gov .interior-pk .org)"

• "ET TROJAN Specula Framework CnC Activity (POST)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M9"

• "ET TROJAN Observed CloudAtlas APT Related Domain (network-list .com in TLS SNI)"

• "ET TROJAN Observed ACR Stealer Domain (frfk .xyz) in TLS SNI"

• "ET TROJAN Android Fintech Related Domain in DNS Lookup (app .truenaira .co)"

• "ET TROJAN Possible Cthulu Stealer URI Struct M2"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (clearrypalsidn .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (drmadhurao .com)"

• "ET TROJAN Observed BMANAGER Domain (boolka24 .tk in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (economicscreateojsu .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (metricsy .shop)"

• "ET TROJAN Pure Logs Stealer/Fenix Botnet CnC Activity (GET) M2"

• "ET TROJAN Trojanized Software Download Domain in DNS Lookup (macyy .cn)"

• "ET TROJAN Allasenha/CarnavalHeist Related Domain (nfe-digital .digital) in DNS Lookup"

• "ET TROJAN Unknown RAT CnC Checkin"

• "ET TROJAN Observed UNC1549/TA455 Domain (engineeringssfeed .azurewebsites .net in TLS SNI)"

• "ET WEB_SERVER Suspected HrServ Webshell Related Activity M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (sloganprogrevidefkso .shop in TLS SNI)"

• "ET TROJAN Win32/MarioLoader CnC Activity (POST) M1"

• "ET TROJAN Observed MageCart Domain (zakit .quest in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (assumptionflattyou .shop)"

• "ET TROJAN Pure Logs Stealer/Fenix Botnet CnC Activity (GET) M1"

• "ET TROJAN Vidar Stealer Form Exfil"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (agov-access .net)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (matchingsingles .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (roleprofittypleasw .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bleednumberrottern .homes)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (quialitsuzoxm .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (deadtrainingactioniw .xyz)"

• "ET TROJAN DNS Query to pcTattletale Spyware Domain (pctattletale .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (questionsurveyapp .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (articon .website)"

• "ET TROJAN CrimsonRAT Host Details Exfil"

• "ET TROJAN Xehook Stealer Data Exfiltration Attempt"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (moma .comsats-net .com)"

• "ET TROJAN Observed Earth Krahang APT Domain (data-dev .helpkaspersky .top in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)"

• "ET TROJAN DNS Query to Expiro Domain (cikivjto .biz)"

• "ET TROJAN Ducktail APT Certificate Observed Inbound (Waka Server CA)"

• "ET TROJAN Observed Malware Delivery Related Domain (loaded-swift-degrees-packages .trycloudflare .com in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (tramites-sat .com .mx)"

• "ET TROJAN Spyder Loader CnC Checkin"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Observed MageCart Domain (saponline .site in TLS SNI)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (get-verified .b-cdn .net)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (spoortsiso .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (adobefallshomes .com)"

• "ET TROJAN Hailbot CnC Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (averageaattractiionsl .shop)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (share .clickstat360 .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (hippieblissprovising .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (curtainjors .fun in TLS SNI)"

• "ET TROJAN Observed DNS Query to Unknown Malware Domain (qpps .site)"

• "ET TROJAN Observed Lumma Stealer Related Domain (patternapplauderw .shop) in TLS SNI"

• "ET TROJAN Observed Social Media Malvertising Related Domain (nigx2a-msp .itsm-us1 .comodo .com) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (roadmapselector .azurewebsites .net in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (dfwreds .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (customercareserviceapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Expiro Domain (napws .biz in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (startperfectsolutions .com)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (losttwister .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (warrantelespsz .shop)"

• "ET TROJAN Allakore RAT CnC Domain in DNS Lookup (hhplaytom .com)"

• "ET TROJAN RubySleet APT TrollAgent CnC Checkin"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (stamppreewntnq .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (boredimperissvieos .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (aestheticainteriors .com)"

• "ET TROJAN Observed Malicious SSL/TLS Certificate (UEFA 2024 Phish)"

• "ET TROJAN DNS Query to Magecart Domain (sewloot .click)"

• "ET TROJAN Observed UNC1549/TA455 Domain (blogvolleyballstatusapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (grandcommonyktsju .xyz)"

• "ET TROJAN Lazarus Group Combacker CnC Domain in DNS Lookup (fasttet .com)"

• "ET TROJAN Win32/ProcessKiller Payload Retrieval Attempt"

• "ET TROJAN Observed UNC1549/TA455 Domain (humanresourcesapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Fenix Botnet Domain (whatsapp .website in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (liabiliytshareodlkv .shop in TLS SNI)"

• "ET TROJAN Turla APT Kazuar Backdoor Related Activity"

• "ET TROJAN DNS Query to TA453 Domain (cloud-document-edit .onrender .com)"

• "ET TROJAN Observed Zloader Related Domain (mfsc .live in TLS SNI)"

• "ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability Check (CVE-2023-51467)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ballottynsjm .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (burnfamesoilratewo .shop in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (ryruhuu3 .xyz)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)"

• "ET TROJAN Win64/TrojanDownloader.Agent.AUO User Agent"

• "ET TROJAN DNS Query to Fenix Botnet Domain (citas-satmx .com)"

• "ET WEB_CLIENT Observed Zimbra zauthtoken Exfil Domain (zimbrauser .me in TLS SNI)"

• "ET TROJAN Observed HailBot Domain (jiggaboo .oss in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (contintnetksows .shop in TLS SNI)"

• "ET TROJAN Observed TA417 Domain (rchitecture .org) in TLS SNI"

• "ET TROJAN Observed Fenix Botnet Domain (mexico-curp .com in TLS SNI)"

• "ET TROJAN Allasenha/CarnavalHeist Related Domain (nfe-digital .top) in DNS Lookup"

• "ET MOBILE_MALWARE Android FastViewer Variant Check-In (GET)"

• "ET TROJAN Win32/AdAptertrAin CnC Server Checkin"

• "ET TROJAN DNS Query to Lumma Stealer Domain (get-verified2 .b-cdn .net)"

• "ET TROJAN Iluria Stealer CnC Domain in DNS Lookup (badgeshop .site)"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (jschecks .com)"

• "ET TROJAN CloudAtlas APT Related Maldoc Activity M7 (GET)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (roadmapselector .azurewebsites .net)"

• "ET TROJAN Possible Sniffthem/Tnaket Payload Retrieval Attempt"

• "ET TROJAN DonotGroup Related CnC Domain in DNS Lookup (geographiclocation .info)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (c08d .top)"

• "ET TROJAN Observed Lumma Stealer Related Domain (teentytinyjeo .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sweetcalcutangkdow .xyz in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (resergvearyinitiani .shop in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (fifteen15)"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (gtldgtld .store)"

• "ET TROJAN Win32/Unknown Loader Related Activity M1 (POST)"

• "ET TROJAN TA421 Wineloader CnC Checkin M2"

• "ET TROJAN Remcos CnC Domain in DNS Lookup (jesusgabrielahumadalora09 .con-ip .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (jupyternotebookcollection .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Fenix Botnet Domain (citas-satmx .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sensitivyitszv .shop in TLS SNI)"

• "ET TROJAN Winnti CnC Activity (Inbound)"

• "ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (sppc .moma-pk .org)"

• "ET TROJAN DNS Query to ClickFix Related Domain (ndas8m92 .lol)"

• "ET TROJAN Observed Malicious Domain (navecorps .com in TLS SNI)"

• "ET TROJAN SocGholish CnC Domain in DNS (* .team .jessicabarrett .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (onionoowzwqm .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (belvedereparkway .site)"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (raiffeisen-cz .eu)"

• "ET CURRENT_EVENTS Observed Phishing Related Domain [Redacted - Vulgar]"

• "ET TROJAN TA430/Andariel AndarLoader Related Activity M1"

• "ET TROJAN Qwerty Stealer C2 Response"

• "ET TROJAN Observed TA417 Domain (ccarden .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Domain (ch3 .dlvideosfre .click in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (freezetdopzx .shop in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (whatsapp .website)"

• "ET TROJAN Observed Lumma Stealer Related Domain (enthusiandsi .shop in TLS SNI)"

• "ET TROJAN DNS Query to Malicious Domain (navercafe .info)"

• "ET TROJAN Observed Lumma Stealer Related Domain (villagemagneticcsa .fun in TLS SNI)"

• "ET CURRENT_EVENTS Observed Fake Privnote Domain (pirvnota .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (contemplateodszsv .shop)"

• "ET TROJAN Win32/Bumblebee Loader Related Download Activity (GET)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pleasurenarrowsdla .shop)"

• "ET TROJAN ACR Stealer Data Exfiltration Attempt M2"

• "ET TROJAN Observed Latrodectus Domain (popfealt .one in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (flourhishdiscovrw .shop in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (aitcaid .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (guuynsqpwsima .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (qualificationjdwko .xyz in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (technewsblogapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN BMANAGER CnC Domain in DNS Lookup (boolka24 .tk)"

• "ET TROJAN Observed Lumma Stealer Related Domain (deallerospfosu .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (proffyrobharborye .xyz)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (connectairapijson .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sweetcalcutangkdow .xyz)"

• "ET TROJAN Observed Lumma Stealer Related Domain (plaintediousidowsko .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (mealplayerpreceodsju .shop)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (bynx .store)"

• "ET TROJAN Observed UNC1549/TA455 Domain (airconnectionapi .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (bestselllerservice .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (buttockdecarderwiso .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (occupytapsessijk .pw in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mofabn .ksewpk .com)"

• "ET TROJAN DNS Query to Malvertising Domain (advannced-ip-scanner .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (legislationdictater .mom)"

• "ET TROJAN Observed UNC1549/TA455 Domain (manpowerfeedapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Moonpeak RAT Related Domain (nsonlines .store) in TLS SNI"

• "ET CURRENT_EVENTS Lucy Security - Phishing to Awareness Landing Page"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (woodfeetumhblefepoj .shop)"

• "ET TROJAN APT Related URI in HTTP Request"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .living .miraclesofeucharisticjesus .org)"

• "ET TROJAN Observed Ducktail Domain (mountainseagroup3 .top in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI)"

• "ET TROJAN OldGremlin/TA801 Domain in TLS SNI (diadok-documentscdn .c688de .com)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .award .vuheritagefoundation .org)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (answerrsdo .shop)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (colorschemeas .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (despairphtsograpgp .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (ilengineeringrssfeed .azurewebsites .net in TLS SNI)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (2261992 .s3 .amazonaws .com)"

• "ET WEB_CLIENT Request for search-ms file extension - Possible NTLM Hash Leak Attempt Attempt"

• "ET TROJAN OrbitalBeam CnC Token Response"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (spliceszongsop .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (considerrycurrentyws .shop) in TLS SNI"

• "ET TROJAN DNS Query to Magecart Domain (beztech .site)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (oakgrovetraining .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (javaruntimeversioncheckingapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cakecoldsplurgrewe .pw)"

• "ET CURRENT_EVENTS Malicious SSL Certificate detected (Generic Phish Activity)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (kaminiasbbefow .shop)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (specialnewspaper .com)"

• "ET TROJAN TA427 Outlook Stealer Loader"

• "ET TROJAN Observed Lumma Stealer Related Domain (futureddospzmvq .shop in TLS SNI)"

• "ET MOBILE_MALWARE GoldDigger CnC Domain in DNS Lookup (ms2ve .cc)"

• "ET TROJAN Observed Magecart Domain (beztech .site in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (assumedtribsosp .shop)"

• "ET TROJAN Observed APT42/TA453 NICECURL Backdoor Related Domain (drive-file-share .site in TLS SNI)"

• "ET TROJAN Observed Ducktail Domain (mafiakorea .com in TLS SNI)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (moitt .paknavy-govpk .info)"

• "ET TROJAN Observed UNC1549/TA455 Domain (checkservicecustomerapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (penetratedpoopp .xyz)"

• "ET TROJAN Observed UNC1549/TA455 Domain (emiratescheckapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (berserkydosom .shop)"

• "ET TROJAN YoroTrooper APT Related Activty (GET)"

• "ET TROJAN Lumma Stealer Related Fake Captcha Page Inbound M2"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (srilankanavy .ksew .org)"

• "ET TROJAN Observed Lumma Stealer Related Domain (landownerryparaxodwo .xyz in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bordersoarmanusjuw .shop)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (propller .b-cdn .net)"

• "ET TROJAN DNS Query to Malicious Domain (naverscorp .shop)"

• "ET TROJAN Agrius Group Webshell Command Execution Attempt"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (distincttangyflippan .shop)"

• "ET TROJAN Mint Stealer CnC Server Response"

• "ET TROJAN Goldoon Botnet Payload Retrieval Attempt"

• "ET TROJAN DNS Query to Malicious Domain (kakaoteam .site)"

• "ET MOBILE_MALWARE Gigabud CnC Domain in DNS Lookup (re6s .xyz)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M10"

• "ET TROJAN DNS Query to Expiro Related Domain (knjghuig .biz)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (navy-lk .direct888 .net in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (testmanagementapi1 .azurewebsites .net in TLS SNI)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (upgrade backdoor)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (discussiowardder .website)"

• "ET TROJAN Fickle Stealer C2 Server Tasking"

• "ET CURRENT_EVENTS ClickFix Domain in TLS SNI (ajsdiaolke .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sailsystemeyeusjw .shop in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (biginfo .xyz)"

• "ET TROJAN DNS Query to Payload Downloader Domain (italy700 .blogspot .com)"

• "ET CURRENT_EVENTS Microsoft Phishing Domain in DNS Lookup (iapparel .top)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (exceptionwillapews .shop)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (ping .cachespace .net)"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (prod .jslibrary .sbs)"

• "ET TROJAN Clipboard Monitor Data Exfiltration Attempt"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (wilderglamour .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (worryfillvolcawoi .shop)"

• "ET TROJAN BMANAGER CnC Domain in DNS Lookup (updatebrower .com)"

• "ET TROJAN Allakore RAT CnC Domain in DNS Lookup (zulabra .com)"

• "ET TROJAN Observed Malvertising Related Domain (legit .onelink .me) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (marchsensedjurkey .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (countrybasedquestions .azurewebsites .net)"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (cdn .jsassets .sbs)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (artickon .shop)"

• "ET TROJAN Specula Framework CnC Activity (GET)"

• "ET TROJAN DNS Query to Malicious Domain (akites .site)"

• "ET TROJAN Patchwork APT Malformed HTTP Request CnC Response"

• "ET TROJAN APT42/TA453 NICECURL Backdoor Related CnC Domain in DNS Lookup (prism-west-candy .glitch .me)"

• "ET TROJAN Observed Kryptic Fake App Domain (cctvv2023 .9hlw .com in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (cejecuu4 .xyz)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (selloria .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (workersquestionsjson .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (tipsydulljaui .website in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (manpowerfeedapi .azurewebsites .net)"

• "ET TROJAN Observed Magecart Domain (defcleth .click in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (worryfillvolcawoi .shop in TLS SNI)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (nestnewhome .com)"

• "ET TROJAN UAC-0050 Domain in DNS Lookup (groupdavinci .online)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (optionalapplication .azurewebsites .net)"

• "ET TROJAN DNS Query to TA453 Domain"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (sherwoodhomeshow .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (tnlsowkis .westus3 .cloudapp .azure .com in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (eight8)"

• "ET TROJAN Observed Lumma Stealer Domain (lamentablegapingkwaq .shop) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (gg2024 .info)"

• "ET MALWARE Observed Android Fintech Related Domain (app .truenaira .co in TLS SNI)"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (register-agov .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (towerxxuytwi .xyz in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (deteriotraiwo .shop in TLS SNI)"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (agentsuperpupervinil .ru)"

• "ET TROJAN Observed Lumma Stealer Related Domain (polyctendizxcop .shop in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (webdataspace .com)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M15"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (roadmapselectorapi .azurewebsites .net)"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (picwalldoor .ru)"

• "ET MOBILE_MALWARE Android Vultur/brunhilda Related CnC Domain in DNS Lookup (cloudmiracle .store)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (ccarden .com)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (aweland .store)"

• "ET TROJAN Observed Payload Downloader Domain (pupuputu .blogspot .com in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (identifycheckapplication .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Magecart Domain (feigoton .store in TLS SNI)"

• "ET TROJAN BackConnect CnC Activity (Bot Task Request) M2"

• "ET TROJAN Observed Social Media Malvertising Related Domain (withthreekitties .itsm-us1 .comodo .com) in TLS SNI"

• "ET TROJAN DNS Query to Lumma Stealer Domain (myapt67 .s3 .amazonaws .com)"

• "ET TROJAN Observed KrustyLoader Domain (sysupdates .org) in TLS SNI"

• "ET TROJAN DNS Query to ClickFix Domain (test-1627838 .shop)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (dfwreds .com)"

• "ET TROJAN Observed Payload Downloader Domain (others500 .blogspot .com in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (webdatacache .com)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (itstrq .itsm-us1 .comodo .com)"

• "ET TROJAN DNS Query to Expiro Domain (kcyvxytog .biz)"

• "ET TROJAN APT Related CR4T Dropper Activity M2 (GET)"

• "ET TROJAN Observed FakeExt Domain (javascrip12 .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (peanutclutchlowwow .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (testquestionapplicationapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (annydesk .website)"

• "ET TROJAN Observed Expiro Domain (kcyvxytog .biz in TLS SNI)"

• "ET TROJAN Win32/Rhadamanthys CnC Activity (GET)"

• "ET TROJAN Observed Lumma Stealer Related Domain (cagedwifedsozm .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (officiallongberyw .shop in TLS SNI)"

• "ET TROJAN Observed Malware Delivery Related Domain (boy-such-icon-positive .trycloudflare .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (awardlandscareposiw .shop)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (farstream .org)"

• "ET TROJAN Observed Mispadu Domain (geradcontsad .pro in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (mennyudosirso .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (browsercheckjson .azurewebsites .net)"

• "ET TROJAN Observed HailBot Domain (sfdopospdofpsdo .dyn in TLS SNI)"

• "ET CURRENT_EVENTS Generic Phish Landing Page 2024-02-12"

• "ET TROJAN Possible Sniffthem/Tnaket User-Agent Observed M1"

• "ET TROJAN Observed Lumma Stealer Related Domain (pooreveningfuseor .pw in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (humanresourcesapi .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (excellentdiwdu .shop)"

• "ET EXPLOIT OpenTSDB RCE in HTTP Request M1 (CVE-2023-25826)"

• "ET TROJAN Observed TA417 Domain (gelatosg .com) in TLS SNI"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (marketro .shop)"

• "ET TROJAN Observed Earth Kapre/RedCurl Domain (preslive .cn .alphastoned .pro) in TLS SNI"

• "ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M2"

• "ET TROJAN Possible LINE DANCER Backdoor Connection Attempt"

• "ET TROJAN Observed Lumma Stealer Related Domain (accumulationeyerwos .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (flexibleagttypoceo .shop)"

• "ET TROJAN DNS Query to UAC-0177 Domain (authssl .site)"

• "ET TROJAN Synapse/Lambda Ransomware CnC Checkin"

• "ET TROJAN Observed Lumma Stealer Related Domain (varitycookypowerw .xyz in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (affordcharmcropwo .shop)"

• "ET TROJAN Win32/ObserverStealer Sending System Related Information (Thunderbird)"

• "ET TROJAN Anonymous RAT CnC Domain in DNS Lookup (anonymousrat8 .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (marchsensedjurkey .shop in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (kakaoaccouts .store in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (turkairline .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Magecart Domain (feitec .online in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (liernessfornicsa .shop)"

• "ET TROJAN Observed Malware Delivery Domain (a0917004 .xsph .ru in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (tendencyportionjsuk .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (rentyrooms .com)"

• "ET TROJAN Observed ClearFake Domain (pchelpsrwizardpro .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (recessionconceptjetwe .pw in TLS SNI)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (navy-lk .direct888 .net)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (localdominationsystems .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (surprisedscaledowp .xyz)"

• "ET TROJAN Observed UNC1549/TA455 Domain (quiztestapplication .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (defencelk .cvix .live in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (testtesttes .azurewebsites .net)"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (aerofly .live)"

• "ET TROJAN Observed Lumma Stealer Related Domain (disagreemenywyws .shop in TLS SNI)"

• "ET TROJAN Observed Earth Hundun Group Waterbear/Deuterbear Domain (cloudsrm .gelatosg .com) in TLS SNI"

• "ET TROJAN SocGholish CnC Domain in DNS (* .sponsor .printondemandagency .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (humanresourcesapiquiz .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lazarus Group Domain in DNS Lookup (rginfotechnology .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (constructgeneratisa .xyz)"

• "ET TROJAN Observed Magecart Domain (reftop .click in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (elmipardaz .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (workersquestionsjson .azurewebsites .net)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (mofa-gov-pk .directt888 .com)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .loyalty.hienphucuanhanloai .org)"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (vikompalion .ru (sinkholed))"

• "ET MOBILE_MALWARE GoldDigger CnC Domain in DNS Lookup (ks8cb .cc)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (9gp .cc)"

• "ET TROJAN Observed ACR Stealer Domain (iicc .fun) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (vscodeupdater .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pieddfreedinsu .shop)"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (browser .internalfiles .sbs)"

• "ET TROJAN Observed Expiro Domain (cikivjto .biz in TLS SNI)"

• "ET TROJAN Observed Panther Stealer Domain (api-lofy .xyz in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (purefinishonerbrothsjke .shop)"

• "ET TROJAN Win32/ProcessKiller CnC Initialization M2"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mofa-gov-pk .donwloaded .com in TLS SNI)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M16"

• "ET TROJAN Observed Lumma Stealer Related Domain (deprivedrinkyfaiir .shop) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Domain (get-verified2 .b-cdn .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (shortsvelventysjo .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (integratedblognewsapi .azurewebsites .net)"

• "ET TROJAN Observed Expiro Domain (tjtmovers .com in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (ping .cachespace .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (liabiliytshareodlkv .shop)"

• "ET CURRENT_EVENTS Suspected APT Related Phish Domain in DNS Lookup (mfa-office .org)"

• "ET TROJAN Arechclient2 Backdoor/SecTopRAT Related Activity"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (bestselllerservice .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (specialadventurousw .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (nobledpcowep .shop in TLS SNI)"

• "ET TROJAN Andariel/TA430 Related TigerRAT Client Checkin Response Activity"

• "ET TROJAN Blister Loader Mythic C2 Profile M3"

• "ET TROJAN Observed Social Media Malvertising Related Domain (metaverifybusiness .sp247 .click) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (radiationnopp .shop in TLS SNI)"

• "ET TROJAN Observed Fenix Botnet Domain (siii-chile .com in TLS SNI)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (silver-dates .com in TLS SNI)"

• "ET TROJAN Observed Magecart Domain (stabit .click in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (onequestionsapi .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (marketexpert .site)"

• "ET TROJAN Observed Lumma Stealer Related Domain (headraisepresidensu .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (iaidevrssfeed .cloudapp .azure .com)"

• "ET TROJAN DNS Query to Malicious Domain (upbit-service .pe .kr)"

• "ET TROJAN Observed HailBot Domain (yoursocuteong .dyn in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (graphize .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (matterrydamagedowkds .xyz in TLS SNI)"

• "ET TROJAN Observed TA453 Domain (cloud-document-edit .onrender .com in TLS SNI)"

• "ET TROJAN Unknown Malvertising Payload CnC Checkin (PSecWin)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (bakhell .com)"

• "ET TROJAN BackConnect CnC Activity (Start SOCKS) M2"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (leafcalfconflcitw .shop)"

• "ET TROJAN Win32/SSLoad Registration Activity (POST)"

• "ET TROJAN Observed Lumma Stealer Domain (landdumpycolorwskfw .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (economicscreateojsu .shop in TLS SNI)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (zone02 .b-cdn .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (suitcaseacanehalk .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (geneticsockkdwlsaw .shop)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (uttercarrigsno .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pearcyworkeronej .shop)"

• "ET TROJAN Observed DeerStealer Domain (authentificatorgoogle .com in TLS SNI)"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (client .nfcpay .workers .dev)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (interactiedovspm .shop)"

• "ET TROJAN Goldoon Botnet CnC Checkin (SystemInfo)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (anontech .shop)"

• "ET TROJAN Allasenha/CarnavalHeist RAT CnC Checkin"

• "ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability (CVE-2023-49070)"

• "ET TROJAN HailBot CnC Domain in DNS Lookup (wendykortiz .gopher)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (hrapplicationtest .azurewebsites .net)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (writeindia .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (luckycharm .website)"

• "ET TROJAN Observed ACR Stealer Domain (pbdbj .xyz) in TLS SNI"

• "ET TROJAN Observed Social Media Malvertising Related Domain (techsupportcenter1902 .click) in TLS SNI"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (happywave .shop)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (stagedchheiqwo .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (triallyforwhgh .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (punchtelephoneverdi .store)"

• "ET TROJAN Agrius Group ASPXSpy Webshell Connection Inbound M1"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shellfyyousdjz .shop)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (chromstore-authentificator .com)"

• "ET TROJAN Silverfox Related Domain in DNS Lookup (uiekjxw .net)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (lariatedzugspd .shop)"

• "ET TROJAN Unknown Loader CnC Domain in DNS Lookup (21centuryart .com)"

• "ET TROJAN Patchwork APT Victim Registration"

• "ET TROJAN DNS Query to Darkgate Domain (savoystocks .com)"

• "ET TROJAN Observed Malicious Domain (mofamail .shop in TLS SNI)"

• "ET MALWARE Observed Android Fintech Related Domain (api .yumicash .com in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (helicopterahtests .azurewebsites .net)"

• "ET TROJAN Latrodectus Related Activity (POST)"

• "ET TROJAN DNS Query to Ducktail APT Domain (mountainseagroup3 .top)"

• "ET TROJAN Observed Lumma Stealer Related Domain (illnesmunxkza .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (distincttangyflippan .shop) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (declaredczxi .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (mealplayerpreceodsju .shop in TLS SNI)"

• "ET TROJAN Observed Malvertising Domain (atssassian .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (writerospzm .shop in TLS SNI)"

• "ET TROJAN SocGholish Domain in DNS Lookup (books .friendsofthefolsomlibrary .org)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (tayakay .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (emiratescheckapijson .azurewebsites .net)"

• "ET TROJAN SocGholish CnC Domain in DNS (* .guide .borden-carleton .ca)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (exuberanttjdkwo .xyz)"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (support .helpkaspersky .top)"

• "ET MOBILE_MALWARE Android Rafel RAT Checkin M1"

• "ET TROJAN Observed UNC1549/TA455 Domain (registerinsurance .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Unknown Malware Domain (qpps .site) in TLS SNI"

• "ET TROJAN DNS Query to Magecart Domain (oitool .shop)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (flyspecialline .com)"

• "ET WEB_SERVER Suspected HrServ Webshell Related Activity M1"

• "ET TROJAN Observed Fenix Botnet Domain (zlvsiexj6d .d3vilsgg .xyz in TLS SNI)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (ch3 .dlvideosfre .click)"

• "ET TROJAN BMANAGER CnC Domain in DNS Lookup (beonlineboo .com)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (rchitecture .org)"

• "ET MOBILE_MALWARE Gigabud CnC Domain in DNS Lookup (nnzf1 .cc)"

• "ET TROJAN Observed Zloader Related Domain (mamore .live in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (browsercheckjson .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (sportblogs .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (definitonizmnx .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (queryfindquestions .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (linestoget .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (flyyedreplacodp .shop)"

• "ET TROJAN PyRation Variant - Action Sent to Client"

• "ET TROJAN Spyder Loader CnC Domain in DNS Lookup (firebaseupdater .com)"

• "ET CURRENT_EVENTS Telegram QR Code Login Landing Page 2024-06-10"

• "ET TROJAN Cryptbot CnC DGA Domain (six6)"

• "ET TROJAN Observed UNC1549/TA455 Domain (tiappschecktest .azurewebsites .net in TLS SNI)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (loaded-swift-degrees-packages .trycloudflare .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (vatleaflettrusteeooj .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (quotakickerrywos .shop)"

• "ET TROJAN Observed BMANAGER Domain (update-brower .com in TLS SNI)"

• "ET TROJAN HailBot CnC Domain in DNS Lookup (jiggaboo .oss)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (settisourchampion .site)"

• "ET TROJAN Observed UNC1549/TA455 Domain (connectionhandlerapi .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (elmipardaz .com)"

• "ET TROJAN DNS Query to Malicious Domain (ned .newnotification .server .korea)"

• "ET TROJAN Possible UPSTYLE Command Output Retrieval Attempt"

• "ET TROJAN Observed UNC1549/TA455 Domain (javaruntimestestapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Crimson RAT CnC Activity (Inbound) M2"

• "ET EXPLOIT Kingdee Cloud Star Deserialization Vulnerability"

• "ET CURRENT_EVENTS Balada JavaScript Inject"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (citizencenturygoodwk .shop)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (ptdrf .xyz)"

• "ET CURRENT_EVENTS MyGovAU Credential Phish Landing Page 2024-06-24"

• "ET TROJAN DNS Query to Cobalt Strike Domain (dnsspeedtest2022 .com)"

• "ET TROJAN Cryptbot CnC DGA Domain (ten10)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shatterbreathepsw .shop)"

• "ET TROJAN Mispadu Stealer CnC Checkin M1"

• "ET TROJAN Cryptbot CnC DGA Domain (fift15)"

• "ET TROJAN SilentCryptoMiner Agent Config Inbound"

• "ET TROJAN Observed Lumma Stealer Related Domain (grandcommonyktsju .xyz in TLS SNI)"

• "ET TROJAN Observed APT42/TA453 Related Domain (tinurls .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stationacutwo .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (miniaturefinerninewjs .shop)"

• "ET TROJAN Pikabot Related Activity M5 (POST)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (paradexjdoa .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (writeindia .com)"

• "ET TROJAN Qwerty Stealer CnC Domain in DNS Lookup (mailservicess .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (preocucupationssk .shop)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (unseaffarignsk .shop)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (ficinity .com)"

• "ET TROJAN DNS Query to TA399 SideWinder Domain (mofa-gov-pk .dowmload .info)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pooreveningfuseor .pw)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (stratosbody .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (searchgear .pro)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (chhimi .com)"

• "ET TROJAN Observed ClickFix Domain (test-1627838 .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (uaeairchecks .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (rdesktophub .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (luxurycaborental .com)"

• "ET TROJAN SocGholish Domain in TLS SNI (event .coachgreb .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (luckkystar .shop)"

• "ET TROJAN Qwerty Stealer Data Exfiltration Attempt M2"

• "ET TROJAN Observed PhantomNet C2 Domain (associate .freeonlinelearningtech .com in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (merchifly .shop)"

• "ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (kongtuke .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (rentyrooms .com)"

• "ET TROJAN Observed Malicious SSL Cert (VenomRAT)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Related Domain (hunterstrawmersp .homes in TLS SNI)"

• "ET TROJAN Observed TA417 Domain (lucashnancy .com) in TLS SNI"

• "ET TROJAN DNS Query to ClearFake Domain (pchelpsrwizardpro .com)"

• "ET TROJAN Observed Merlin C2 Domain (scancenter .trendrealtime .com in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (public .clickstat360 .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (airconnectionsapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Malicious VBS Loader Related Domain (pdfxml .org in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (artvislon .shop)"

• "ET TROJAN Cryptbot CnC DGA Domain (ninet19)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (vipchattingonline .com)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (gybritanalytsesystem .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stickyyummyskiwffe .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (fixturewordbakewos .shop in TLS SNI)"

• "ET MALWARE Observed Android Fintech Related Domain (cy .amorcash .com in TLS SNI)"

• "ET TROJAN Observed Payload Downloader Domain (800french .blogspot .com in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (helicopterahtest .azurewebsites .net)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (birddogerc .com)"

• "ET TROJAN DNS Query to Magecart Domain (jeitoon .quest)"

• "ET TROJAN DNS Query to Magecart Domain (intrgqc .site)"

• "ET TROJAN Observed Lumma Stealer Related Domain (creepydxzoxmj .shop in TLS SNI)"

• "ET TROJAN Observed Earth Krahang APT Domain (update .microsoft-setting .com in TLS SNI)"

• "ET TROJAN Observed ClickFix Domain (ndas8m92 .lol in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (hamaraneta .com)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .fans .smalladventureguide .com in TLS SNI)"

• "ET WEB_SPECIFIC_APPS ReCrystallize Server ViewReport.aspx Abuse"

• "ET TROJAN Malvertising Related Domain in DNS Lookup (healthbeautycosmetics .com)"

• "ET TROJAN DNS Query to AMOS Related Domain (aptonic .xyz)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (barelytherejewels .com)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (fictionnykwop .shop)"

• "ET CURRENT_EVENTS Meta Credential Phish Landing Page 2024-01-08"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (officiallongberyw .shop)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (shepherdlyopzc .shop)"

• "ET TROJAN Observed Lumma Stealer Domain (adstrra .b-cdn .net in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mora .pdfadobe .com in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (flighthelicopterahtest .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (potentioallykeos .shop)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (online-vip-dating .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (ellaboratepwsz .xyz in TLS SNI)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (sb8 .co in TLS SNI)"

• "ET TROJAN Observed TA426/Zebrocy Domain (enrollmentdm .com) in TLS SNI"

• "ET CURRENT_EVENTS ClickFix Domain in DNS Lookup (ajsdiaolke .shop)"

• "ET TROJAN Observed TA417 Domain (availitond .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (consciouosoepewmausj .site in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (callosallsaospz .shop)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (ndm2398asdlw .shop)"

• "ET TROJAN Goldoon Botnet CnC Response (Tasking)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (whispedwoodmoodsksl .shop)"

• "ET TROJAN Suspected TA401/AridViper APT Micropsia Variant Related Activity (POST)"

• "ET TROJAN Observed UNC1549/TA455 Domain (marineblogapi .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (daslkjfhi2 .pics)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (filesoftdownload .shop)"

• "ET TROJAN Observed UNK_ConsoleCollie Domain (conn .phmdbad .live in TLS SNI)"

• "ET WEB_CLIENT Zimbra zauthtoken Value Extraction Script Requested (Inbound)"

• "ET TROJAN Xehook stealer CnC Domain in DNS Lookup (trecube .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (apphrquizapi .azurewebsites .net in TLS SNI)"

• "ET MOBILE_MALWARE Android Vultur/brunhilda Related CnC Domain in DNS Lookup (safetyfactor .online)"

• "ET TROJAN Oyster Backdoor Domain in TLS SNI (postmastersoriginals .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (luckkystar .shop)"

• "ET CURRENT_EVENTS UEFA 2024 Tickets/Hospitality Landing Page"

• "ET TROJAN Observed Earth Krahang APT Domain (gtldgtld .store in TLS SNI)"

• "ET TROJAN DNS Query to MageCart Domain (temninch .site)"

• "ET TROJAN x64/Generic Red Team Activity CnC Response"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (berrebyre .com)"

• "ET TROJAN BackConnect CnC Activity (Bot Error) M2"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (paknavy .jmicc .xyz in TLS SNI)"

• "ET TROJAN Observed Malicious Typo Squatting Domain (puttyy .org) in TLS SNI"

• "ET TROJAN SocGholish Domain in TLS SNI (miner .eastestsite .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (reviveincapablewew .pw)"

• "ET TROJAN Observed Lumma Stealer Related CnC Domain (filmbondadminoswo .shop in TLS SNI)"

• "ET TROJAN SmartLoader CnC Activity"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (vivianstyler .ru)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (boylegmfg .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (www-moha-gov-lk .direct888 .net)"

• "ET TROJAN UNC1151 Payload Retrieval Attempt"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (qaquestionsapijson .azurewebsites .net)"

• "ET TROJAN Observed Gamaredon Domain (wilderness-activists-gazette-purse .trycloudflare .com in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mod-gov-bd .dowmload .co in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (miniaturefinerninewjs .shop in TLS SNI)"

• "ET TROJAN DNS Query to ClearFake Domain (ghufal .answermedia .site)"

• "ET TROJAN Observed UNC1549/TA455 Domain (qaquestionapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (resergvearyinitiani .shop)"

• "ET EXPLOIT Possible Malicious x-sharing-config-url SMTP header observed (CVE-2023-35636)"

• "ET TROJAN Observed UNC1549/TA455 Domain (logsapimanagement .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (brickabsorptiondullyi .site)"

• "ET TROJAN Oyster Backdoor Domain in TLS SNI (wherehomebe .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (jonmesserartwork .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (tolerateilusidjukl .shop in TLS SNI)"

• "ET CURRENT_EVENTS Fake Browser Update Domain in DNS Lookup (testdomen .xyz)"

• "ET TROJAN Observed Allasenha/CarnavalHeist RAT Related Domain (nfe-digital .top) in TLS SNI"

• "ET TROJAN Observed EvasivePanda/Daggerfly APT Domain (devicebug .com) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (sherwoodhomeshow .com)"

• "ET TROJAN Observed Malicious Domain (civilizations .store in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (indexterityszcoxp .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (strwawrunnygjwu .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (flydryszxo .shop)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (cabinet-gov-pk .ministry-pk .net)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (searchgear .pro)"

• "ET TROJAN APT Related CR4T Dropper Domain in DNS Lookup (userfeedsync .com)"

• "ET TROJAN UNK_ConsoleCollie CnC Checkin"

• "ET TROJAN [ANY.RUN] ZharkBOT HTTP CnC Checkin"

• "ET TROJAN Observed Lumma Stealer Related Domain (occurrmensipz .shop in TLS SNI)"

• "ET TROJAN DNS Query to AMOS Related Domain (pixelmator .us)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cancedhoeysopzv .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (canroura .com)"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (sephoraofficetz .ru)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (abuselinenaidwjuew .shop)"

• "ET TROJAN Observed APT42/TA453 Related Domain (shorturling .live in TLS SNI)"

• "ET TROJAN APT Related CR4T Dropper Domain in DNS Lookup (commonline .space)"

• "ET TROJAN Possible RAZR Ransomware User-Agent Observed"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn35 .space)"

• "ET TROJAN Observed Lumma Stealer Related Domain (muggylasergaijynwjk .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (parntorpkxzlp .shop in TLS SNI)"

• "ET TROJAN Allakore RAT CnC Checkin M2"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (notebooktextcheckings .azurewebsites .net)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (webdatacache .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (messageflowpro .com)"

• "ET TROJAN Earth Hundun Group Waterbear/Deuterbear CnC Domain in DNS Lookup (cloudsrm .gelatosg .com)"

• "ET TROJAN Patchwork APT Host Details Exfil"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (gitbrancher .com)"

• "ET TROJAN Observed Cobalt Strike Domain (dnsspeedtest2022 .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wagonglidemonkywo .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (rejectbettysmartws .shop in TLS SNI)"

• "ET TROJAN Oyster Backdoor Domain in DNS Lookup (retdirectyourman .eu)"

• "ET TROJAN BackConnect CnC Activity (Start VNC) M2"

• "ET TROJAN SocGholish Domain in DNS Lookup (africa .thesmalladventureguide .com)"

• "ET TROJAN BMANAGER CnC Domain in DNS Lookup (boolka .tk)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (southedhiscuso .shop)"

• "ET TROJAN Observed ClickFix Domain (oazevents .com in TLS SNI)"

• "ET TROJAN Malvertising Related Domain in DNS Lookup (darknetlinks .wiki)"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (jesko .live)"

• "ET TROJAN Observed Fenix Botnet Domain (consultacurp-gobmx .com .mx in TLS SNI)"

• "ET TROJAN Observed Cryptbot Domain (rzeight18pt .top in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (languagedscie .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (slamcopynammeks .shop in TLS SNI)"

• "ET TROJAN Patchwork CnC Domain in DNS Lookup (weibo .nihaoucloud .org)"

• "ET TROJAN DeerStealer Telegram Bot Response"

• "ET CURRENT_EVENTS Observed Fake Privnote Domain (privatemessage .net in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (nowordshere .org)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (luckycharm .website)"

• "ET TROJAN Observed Malvertising Related Domain (darknetlinks .wiki) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (weiggheticulop .shop)"

• "ET TROJAN DNS Query to Remcos Related Domain (myumysmeetr .ddns .net)"

• "ET TROJAN Observed Allasenha/CarnavalHeist RAT Related Domain (nfe-visualizer .app .br) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (airgadgetsolutions .azurewebsites .net)"

• "ET TROJAN Observed UNC1549/TA455 Domain (boeisurveyapplications .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Malware Delivery Domain (invoicetrycloudflare .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (sarahkatherinelewis .com)"

• "ET TROJAN Andariel/TA430 Related TigerRAT Client Checkin"

• "ET TROJAN Observed Lumma Stealer Related Domain (dancecmapleadsjwk .shop in TLS SNI)"

• "ET TROJAN Cobalt Strike Malleable C2 (Google Drive Profile)"

• "ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M2"

• "ET TROJAN BackConnect CnC Activity (Start File Manager) M1"

• "ET TROJAN DNS Query to Malicious Domain (navecorps .com)"

• "ET TROJAN Observed Lazarus Group Domain (thefrostery .co .uk) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (mamajekisrecording .com)"

• "ET TROJAN Malicious VBS Loader Related CnC Domain in DNS Lookup (pdfxml .org)"

• "ET TROJAN SmartLoader CnC Exfil (screen.bmp)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (javaruntimestestapi .azurewebsites .net)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (invitation-letter .govpk .info)"

• "ET TROJAN Observed Lumma Stealer Domain (sturdyregularrmsnhw .shop) in TLS SNI"

• "ET TROJAN Sea Turtle APT Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (diamonykeqpwm .shop)"

• "ET MOBILE_MALWARE GoldDigger CnC Domain in DNS Lookup (bv8k .xyz)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (utvj .com)"

• "ET TROJAN Observed TrollAgent Domain (ol .negapa .p-e .kr in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (statlstic .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pushjellysingeywus .shop)"

• "ET TROJAN DNS Query to Lactrodectus Domain"

• "ET TROJAN Observed Patchwork Domain (weibo .nihaoucloud .org in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (exitassumebangpastcone .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (mennyudosirso .shop)"

• "ET TROJAN DNS Query to ClearFake Domain (businessresources .ltd)"

• "ET TROJAN Cryptbot CnC DGA Domain (sevt17)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (questionsdatabases .azurewebsites .net)"

• "ET TROJAN Win32/FireStealer Related Activity M2 (POST)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (iredelltx .com)"

• "ET TROJAN Malvertising/Nitrogen Loader Domain in DNS Lookup (advanced-ip-scan .org)"

• "ET MOBILE_MALWARE Observed Gigabud Domain (re6s .xyz in TLS SNI)"

• "ET TROJAN Observed Fenix Botnet Domain (lbci-seguro .com in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mailaplf .cvix .live in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mailarmylk .mods .email in TLS SNI)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (metaverifybusiness .sp247 .click)"

• "ET TROJAN TA451 FalseFont Backdoor Related Domain in DNS Lookup (digitalcodecrafters .com)"

• "ET TROJAN Earth Hundun Group Waterbear/Deuterbear CnC Domain in DNS Lookup (showgyella .quadrantbd .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sideindexfollowragelrew .pw in TLS SNI)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M17"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (moitt-gov-pk .fia-gov .net in TLS SNI)"

• "ET TROJAN Polyfill Malicious Redirect Domain (www .googie-anaiytics .com) in TLS SNI"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (listwithstats .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (depositybounceddwk .xyz in TLS SNI)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M3"

• "ET TROJAN Suspected Fin7 Related Domain (cdn36 .space) in TLS SNI"

• "ET TROJAN x64/Generic Red Team CnC Activity (POST)"

• "ET TROJAN PshellBkdr C2 Traffic Known Authorization Bearer in HTTP Request (POST)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (aplointexhausdh .xyz)"

• "ET TROJAN Observed TinyTurla Domain (hanagram .jp in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (crisisrottenyjs .xyz in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mofa-gov .interior-pk .org in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (outpointsozp .shop)"

• "ET TROJAN HailBot CnC Domain in DNS Lookup (sfdopospdofpsdo .dyn)"

• "ET TROJAN Observed Lumma Stealer Related Domain (quialitsuzoxm .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bargainnygroandjwk .shop)"

• "ET TROJAN DNS Query to MageCart Domain (reshnot .quest)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (broccoltisop .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (helloehoes .com)"

• "ET TROJAN Epsilon Stealer Domain in DNS Lookup (3ps1l0n .life)"

• "ET TROJAN Observed UNC1549/TA455 Domain (humanresourcesapijson .azurewebsites .net in TLS SNI)"

• "ET WEB_SPECIFIC_APPS ShowDoc File Upload Vulnerability"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cagedwifedsozm .shop)"

• "ET TROJAN Observed Patchwork Domain (xinhuanet .nihaoucloud .org in TLS SNI)"

• "ET TROJAN Observed Earth Krahang APT Domain (update .centos-yum .com in TLS SNI)"

• "ET TROJAN SocGholish Domain in DNS Lookup (ebooks .ferrelljoe .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (whimiscallysmmzn .shop in TLS SNI)"

• "ET TROJAN Possible Sniffthem/Tnaket User-Agent Observed M2"

• "ET TROJAN Observed Malicious Domain (upbit2024 .re .kr in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (losttwister .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (fixturewordbakewos .shop)"

• "ET TROJAN Oyster Backdoor Domain in DNS Lookup (dotnetisforchildren .com)"

• "ET TROJAN Patchwork APT CnC Activity (uuiddsd)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (forecast .comsats-net .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (justifycanddidatewd .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (evokeoutlooklits .shop)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (onlinechatconnections .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (reports .dgps-govtpk .com)"

• "ET TROJAN Observed TA417 Domain (operatida .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (sweetsquarediaslw .shop in TLS SNI)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (face-your-dreams .com)"

• "ET TROJAN Observed DeerStealer Domain (authenticcator-descktop .com in TLS SNI)"

• "ET TROJAN Observed UNK_ConsoleCollie Domain (chemdl .gangtao .live in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (paknavy .jmicc .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (theoryapparatusjuko .fun)"

• "ET TROJAN Observed TA453 Domain in TLS SNI"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (register-agov .com)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (marvin-occentus .net)"

• "ET EXPLOIT OpenTSDB RCE in HTTP Request M3 (CVE-2023-25826)"

• "ET TROJAN Malicious Typo Squatting Domain in DNS Lookup (putyy .org)"

• "ET TROJAN DNS Query to Remcos Related Domain (mysweeterbk .ddns .net)"

• "ET TROJAN DNS Query to Malicious Domain (nidnaver .help)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (jsincloud .com)"

• "ET MOBILE_MALWARE GoldDigger CnC Domain in DNS Lookup (zu7kt .cc)"

• "ET TROJAN Observed DNS Query to FIN7/Carbanak Related Domain (sun876954 .space)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (salary-cutting .session-out .com in TLS SNI)"

• "ET TROJAN BlueNoroff APT Related Activity M2 (POST)"

• "ET TROJAN BunnyLoader Initial Connection (GET)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (carnivalsale .com)"

• "ET WEB_SPECIFIC_APPS Wordpress 3DPrint Lite Plugin Arbitrary File Upload Attempt - PHP webshell Payload (CVE-2021-4436)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (lbci-seguro .com)"

• "ET TROJAN Observed 9002 RAT Domain (themicrosoftnow .com in TLS SNI)"

• "ET TROJAN Ailurophile Infostealer CnC Server Response M2"

• "ET TROJAN DNS Query to Malvertising Domain (ciltrix .com)"

• "ET TROJAN Observed ACR Stealer Domain (pqdrf .xyz) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (personalizationsurvey .azurewebsites .net in TLS SNI)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M18"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (selloria .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (egorepetiiiosn .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (audiomanagerapi .azurewebsites .net)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M20"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (update .microsoft-setting .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (checkapicountryquestionsjson .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (voyagedprivillywk .xyz)"

• "ET TROJAN Observed Suspected APT Domain (idf .pics in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (barebrilliancedkoso .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (femininiespywageg .shop in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Server Response"

• "ET TROJAN Moonpeak RAT Related Domain in DNS Lookup (nsonlines .store)"

• "ET TROJAN DNS Query to Payload Downloader Domain (pupuputu .blogspot .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (exchtestcheckingapi .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (slamcopynammeks .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (snaillymarriaggew .shop in TLS SNI)"

• "ET TROJAN Observed DarkComet RAT Domain (servicescraft .buzz in TLS SNI)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain in DNS Lookup (mailchimp-addons .com)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (dirtdrawingjsi .shop)"

• "ET TROJAN Win32/Backdoor.Msupedge CnC Domain in DNS Lookup (ctl .msedgeapi .net)"

• "ET TROJAN Observed Earth Hundun Group Waterbear/Deuterbear Domain (cloudflaread .quadrantbd .com) in TLS SNI"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (googlecloudns .com)"

• "ET TROJAN BlankGrabber Stealer Exfiltration via Discord"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (conferencefreckewl .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (edurestunningcrackyow .fun in TLS SNI)"

• "ET TROJAN Observed Earth Krahang APT Domain (tfirstdaily .store in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (smallrabbitcrossing .site)"

• "ET TROJAN NBP Mac PUP User-Agent Observed"

• "ET TROJAN Observed Earth Hundun Group Waterbear/Deuterbear Domain (smartclouds .gelatosg .com) in TLS SNI"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (bestresulttostart .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (chocolatedepressofw .fun in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (fourteen14)"

• "ET TROJAN DNS Query to ClickFix Related Domain (flynews .us)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (javaninja .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sturdyregularrmsnhw .shop)"

• "ET TROJAN Win32/ProcessKiller CnC Initialization M1"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sofahuntingslidedine .shop)"

• "ET TROJAN TinyTurlaNG Turla APT Initial Client Beacon"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (computerexcudesp .shop)"

• "ET TROJAN PyRation Variant - Configuration Response"

• "ET TROJAN BlueNoroff APT Related Activity M1 (POST)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (identifycheckapplication .azurewebsites .net)"

• "ET TROJAN Observed UNC1549/TA455 Domain (homefurniture .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related Activity M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (wagonglidemonkywo .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (exchtestcheckingapihealth .azurewebsites .net)"

• "ET TROJAN Observed UNC1549/TA455 Domain (changequestionstypeapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (respectpitchadopwo .shop)"

• "ET CURRENT_EVENTS Savvy Seahorse CNAME TDS Related Domain in DNS Lookup (getyourapi .site)"

• "ET TROJAN Linux/Dinodas RAT CnC Checkin - TCP"

• "ET TROJAN Observed MageCart Domain (ctotech .store in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (specialcraftbox .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (surprisedscaledowp .xyz in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (notebooktextcheckings .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sessionannoucemenwj .shop in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (helpcenter .cyou)"

• "ET TROJAN Observed Lumma Stealer Related Domain (bleednumberrottern .homes in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (buttockdecarderwiso .shop)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (k1gkl25as .top)"

• "ET TROJAN DNS Query to Magecart Domain (stabit .click)"

• "ET TROJAN Observed DeerStealer Domain (updater-pro .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (discussiowardder .website in TLS SNI)"

• "ET TROJAN DNS Query to 9002 RAT Domain (meeting .equitaligaiustizia .it)"

• "ET TROJAN DNS Query to CoinMiner Proxy Domain (xmrminingproxy .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (mofa-gov-sa .direct888 .net)"

• "ET TROJAN Xehook Stealer CnC Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (palmeventeryjusk .shop)"

• "ET CURRENT_EVENTS ClickFix Domain in TLS SNI (peskpdfgif .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bindceasdiwozx .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (datawiz .shop)"

• "ET TROJAN SocGholish Domain in DNS Lookup (muse .krazzykriss .com)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authentificatorgogle .com)"

• "ET TROJAN UNK_HamsaHatef Related URI"

• "ET TROJAN LIGHTWIRE Web Shell Activity Observed"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (absolutecache .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (cashcloudservices .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (efes-mindef-gov-pk .dowmload .org)"

• "ET TROJAN Observed UNC1549/TA455 Domain (arquestions .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Payload Downloader Domain (capclean2024may .blogspot .com in TLS SNI)"

• "ET TROJAN Xehook Stealer CnC Checkin - Server Response"

• "ET TROJAN TrollAgent Checkin"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (luxurycaborental .com)"

• "ET TROJAN Bitter APT Activity - Secondary Payload Retrieval Attempt"

• "ET TROJAN UNC1151 Related Domain in DNS Lookup (goudieelectric .shop)"

• "ET TROJAN Observed ClearFake Domain (pchelprwizzards .com in TLS SNI)"

• "ET INFO CloudFlare Trace Site"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (depositybounceddwk .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (headraisepresidensu .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (minorittyeffeoos .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (snuggleapplicationswo .fun in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (dividenntyss .shop in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (srilanka-navy .lforvk .com in TLS SNI)"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (agovaccess-ch .com)"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (referralpublicationjk .pw)"

• "ET TROJAN Observed Zloader Related Domain (mafw .store in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (statisticsong .com)"

• "ET TROJAN Observed MuddyWater APT Related Domain (googleonlinee .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (secretionsuitcasenioise .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (flourhishdiscovrw .shop)"

• "ET TROJAN Mint Stealer Data Exfiltration Attempt"

• "ET TROJAN Observed UNC1151 Related Domain (thevegan8 .shop) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (buatywear .store)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (trendori .shop)"

• "ET TROJAN Win32/Hancitor Checkin"

• "ET TROJAN Observed Malicious Domain (mofamail .homes in TLS SNI)"

• "ET TROJAN BunnyLoader 3.0 Heartbeat Checkin"

• "ET TROJAN DNS Query to Lumma Stealer Domain (flourhishdiscovrw .shop)"

• "ET TROJAN Observed APT42/TA453 Related Domain (shorting-urling .live in TLS SNI)"

• "ET TROJAN Win32/BlackRain CnC Activity"

• "ET TROJAN Observed Fenix Botnet Domain (annydesk .website in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)"

• "ET TROJAN Suspected FIN7/Carbanak Related Payload C2 Downloader (GET)"

• "ET TROJAN Observed APT42/TA453 Related Domain (worried-eastern-salto .glitch .me in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (paradexjdoa .shop in TLS SNI)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (bangkok-generally-ensemble-nfl .trycloudflare .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (clerkpolicemandwusi .xyz)"

• "ET MOBILE_MALWARE Observed Android/Mandrake CnC Domain (ricinus-cc .ru) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (drmadhurao .com)"

• "ET TROJAN Mint Stealer Injection Server Response"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (empiredzmwnx .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (openapplicationcheck .azurewebsites .net)"

• "ET TROJAN BMANAGER CnC Domain in DNS Lookup (1-update-soft .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (freezetdopzx .shop)"

• "ET TROJAN Microsoft Word HTTP Request for .rtf Payload"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (claimconcessionrebe .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (acceptabledcooeprs .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (clickandanalytics .com)"

• "ET TROJAN Observed TinyTurla Domain (carleasingguru .com in TLS SNI)"

• "ET TROJAN BackConnect CnC Activity (Start File Manager) M2"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (chemsentinel .com)"

• "ET TROJAN Malvertising/Nitrogen Loader Domain in DNS Lookup (giaoanso .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (refundemobxyyeols .shop in TLS SNI)"

• "ET TROJAN Observed Moonpeak RAT Related Domain (pumaria .store) in TLS SNI"

• "ET TROJAN DNS Query to Malicious Domain (storagedsolutions .azurefd .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (modestessayevenmilwek .shop)"

• "ET TROJAN Observed Glupteba CnC Domain (alldatadump .org in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (parntorpkxzlp .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (aetherial .store)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (beetrootculture .com)"

• "ET TROJAN Allasenha/CarnavalHeist Related Domain (adobe-acrobat-visualizer .brazilsouth .cloudapp .azure .com) in DNS Lookup"

• "ET TROJAN DNS Query to Ducktail APT Domain (mafiakorea .com)"

• "ET TROJAN Android Fintech Related Domain in DNS Lookup (api .yumicash .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (obsceneclassyjuwks .shop in TLS SNI)"

• "ET TROJAN Observed Allasenha/CarnavalHeist RAT Related Domain (nfe-digital .site) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (iprotosample .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (theoryapparatusjuko .fun in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sessionannoucemenwj .shop)"

• "ET TROJAN Observed DeerStealer Domain (vaniloin .fun in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (racerecessionrestrai .site in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (jswebcloud .com)"

• "ET TROJAN Suspected Fin7 Related Domain (cdn31 .space) in TLS SNI"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (click4chatting .com in TLS SNI)"

• "ET TROJAN HailBot CnC Domain in DNS Lookup (pposdif .parody)"

• "ET TROJAN JaskaGO CnC Server Response"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (geo-4bfa49b2 .tbc-app .life)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (daslkjfhi2 .xyz)"

• "ET TROJAN Observed Fenix Botnet Domain (grafoce .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (grassytaisol .shop)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (cstc-spares-vip-163 .dowmload .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (ensureclackexcatwi .shop) in TLS SNI"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (share .clickstat360 .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (colorfulequalugliess .shop)"

• "ET TROJAN DNS Query to TA453 Domain (east-healthy-dress .glitch .me)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (registerinsurance .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (enthusiasimtitleow .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (advertiq .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (faceddullinhs .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sloganprogrevidefkso .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (democraticseekysiwo .shop in TLS SNI)"

• "ET TROJAN Polyfill Malicious Redirect Attempt M3"

• "ET TROJAN Suspected Trojan-Proxy Web Socket Connection Activity"

• "ET TROJAN Observed ACR Stealer Domain (pdddj .xyz) in TLS SNI"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (googlecloudstream .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (concessionofsellerwo .shop)"

• "ET TROJAN Observed Earth Krahang APT Domain (support .helpkaspersky .top in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (javaninja .shop)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (estafetaofj .top)"

• "ET TROJAN Observed Zloader Related Domain (aerofly .live in TLS SNI)"

• "ET TROJAN DNS Query to AMOS Related Domain (password-app .pro)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (chequedxmznp .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (diskretainvigorousiw .shop in TLS SNI)"

• "ET TROJAN UAC-0050 Domain in DNS Lookup (davinci-project .info)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (osgnhr9zv .top)"

• "ET TROJAN BackConnect CnC Activity (Start Reverse Shell) M2"

• "ET SMTP Message Containing search-ms URI With subquery Parameter In Message Body - Possible NTLM Hash Leak Attempt"

• "ET TROJAN DNS Query to CrimsonRAT Domain (waqers .duckdns .org)"

• "ET TROJAN APT42/TA453 NICECURL Backdoor Related CnC Domain in DNS Lookup (drive-file-share .site)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (lighterepisodeheighte .fun)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (queimaxofc .com)"

• "ET TROJAN Bitter APT Related Activity (GET)"

• "ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (happy .gitweb .cloudns .nz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (relevantvoicelesskw .shop)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mohgovsg .bahariafoundation .live in TLS SNI)"

• "ET TROJAN Observed Malicious Typo Squatting Domain (putyy .org) in TLS SNI"

• "ET TROJAN DNS Query to AMOS Related Domain (lightpillar .lat)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Suspected TA450 Activity"

• "ET TROJAN Win32/SSLoad Payload Request (GET)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shiverdreammyseaemw .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (testmanagementapi1 .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Domain (get-verified .b-cdn .net in TLS SNI)"

• "ET TROJAN Observed TA455 Domain in TLS SNI (1stemployer .com)"

• "ET TROJAN Observed Malware Delivery Related Domain (tired-shareholders-reservoir-talked .trycloudflare .com in TLS SNI)"

• "ET TROJAN Observed APT42/TA453 Related Domain (safeshortl .ink in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (asyncawaitapi .com)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (beatifulllhistory .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (aplointexhausdh .xyz in TLS SNI)"

• "ET TROJAN DaoDao Cloud Loader C2 Response"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (requestyex .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (nobledpcowep .shop)"

• "ET TROJAN Cheana Stealer Domain in DNS Lookup (warpvpn .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (understanndtytonyguw .shop) in TLS SNI"

• "ET TROJAN Lazarus Group Combacker CnC Domain in DNS Lookup (chaingrown .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (whimiscallysmmzn .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (warrantelespsz .shop in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (statmaster .shop)"

• "ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2"

• "ET TROJAN SocGholish Domain in DNS Lookup (nano .anygreaterways .tech)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (storage .webfiledata .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (civilianurinedtsraov .shop in TLS SNI)"

• "ET TROJAN Observed MageCart Domain (sudtech .online in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (elev11)"

• "ET CURRENT_EVENTS Successful My ADP Phish Feb 16 2017"

• "ET TROJAN DNS Query to Gamaredon Domain (raidla .ru)"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (george .tbc-app .life) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (integratedblognewsapi .azurewebsites .com in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (customercareservice .azurewebsites .net in TLS SNI)"

• "ET TROJAN CHAINLINE Web Shell Activity Observed"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mofadividion .ptcl-gov .com in TLS SNI)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (nigx2a-msp .itsm-us1 .comodo .com)"

• "ET TROJAN SocGholish Domain in TLS SNI (muse .krazzykriss .com)"

• "ET TROJAN DNS Query to PhantomNet C2 Domain (associate .freeonlinelearning .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (proffyrobharborye .xyz in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (helicopterahtest .azurewebsites .net in TLS SNI)"

• "ET TROJAN Suspected APT42/TA453 Related Domain in DNS Lookup (short-urling .live)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Observed UNC1549/TA455 Domain (questionsapplicationapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (cloudown .store in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (egorepetiiiosn .shop in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (nowordshere .org)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (apicachebot .com)"

• "ET TROJAN Observed FakeExt Domain (fastify .sbs) in TLS SNI"

• "ET TROJAN Observed Zloader Related Domain (jesko .live in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (logupdatemanagementapijson .azurewebsites .net in TLS SNI)"

• "ET TROJAN [ANY.RUN] WhiteSnake Stealer HTTP Request"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (selllify .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (identifycheckingapplications .azurewebsites .net)"

• "ET TROJAN Suspected TA430/Andariel AndarLoader Related Domain in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (horizonvxjis .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (mealroomrallpassiveer .shop in TLS SNI)"

• "ET TROJAN Allakore RAT CnC Domain in DNS Lookup (flapawer .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (apphrquestion .azurewebsites .net in TLS SNI)"

• "ET TROJAN Muzcat Media Player User-Agent Observed (muzcat)"

• "ET TROJAN DonotGroup Related CnC Domain in DNS Lookup (letentinfo .info)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (blueselectorpage .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (evokeoutlooklits .shop in TLS SNI)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (finallshell .cc)"

• "ET TROJAN MuddyWater APT Related CnC Domain in DNS Lookup (googleonlinee .com)"

• "ET CURRENT_EVENTS ClickFix Domain in DNS Lookup (skibidirizz .lol)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (efes-mindef-gov-pk .dowmload .org in TLS SNI)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain in DNS Lookup (oncloud-analytics .com)"

• "ET TROJAN Observed Lumma Stealer Domain (flourhishdiscovrw .shop in TLS SNI)"

• "ET TROJAN Suspected Parallax RAT Checkin"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (commerce-gov-pk .directt888 .com)"

• "ET SMTP Message Containing search-ms URI With crumb location Parameter In Message Body - Possible NTLM Hash Leak Attempt"

• "ET TROJAN [ANY.RUN] NjRat (tXRAT v.2.3R) Client Sends Check-in Packet"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (seilsmart .shop)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (opmcm-gov-np .fia-gov .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bakefirefighteossw .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (incredibleextedwj .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (princeaccessiblepo .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (denaumtz .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (iaidevrssfeedp .cloudapp .azure .com)"

• "ET TROJAN Observed Lumma Stealer Domain (human-check .b-cdn .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (artickon .shop)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (qu3 .cc)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (statisticscripts .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (creativeslim .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (airgadgetsolution .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (racerecessionrestrai .site)"

• "ET TROJAN Observed Zloader Related Domain (dison .live in TLS SNI)"

• "ET TROJAN Sniffthem/Tnaket Trojan CnC Domain in DNS Lookup (lsrael .today)"

• "ET TROJAN Observed Lumma Stealer Related Domain (thidrsorebahsufll .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (telephoneverdictyow .site)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (shepherdlyopzc .shop)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (foundit .asia)"

• "ET MOBILE_MALWARE Suspected APT Starry Addax DNS Lookup"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (forecast .comsats-net .com in TLS SNI)"

• "ET TROJAN UNK_ConsoleCollie URI Observed in HTTP Request"

• "ET TROJAN DOILoader Activity M2 (GET)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (modestessayevenmilwek .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (turkairline .azurewebsites .net)"

• "ET INFO PDQ Remote Management Agent HTTP Activity"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (specialtaskevents .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sailsystemeyeusjw .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (trollsburninginhell .com)"

• "ET CURRENT_EVENTS ClickFix Domain in TLS SNI (skibidirizz .lol)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (jupyternotebookscollection .azurewebsites .net)"

• "ET TROJAN UNK_ConsoleCollie CnC Domain in DNS Lookup (conn .phmdbad .live)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M1"

• "ET TROJAN Observed DarkComet RAT Domain (patrikbob100 .fvds .ru in TLS SNI)"

• "ET TROJAN DNS Query to TinyTurla Domain (buy-new-car .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (marineblogapi .azurewebsites .net)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (artistryhab .shop)"

• "ET MOBILE_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus .su)"

• "ET TROJAN Observed UNC1549/TA455 Domain (integratedblognewsapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (sysupdates .org)"

• "ET TROJAN Observed UNC1549/TA455 Domain (tnlsowki .westus3 .cloudapp .azure .com in TLS SNI)"

• "ET TROJAN Win32/Cobalt Strike CnC Activity M1"

• "ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M3"

• "ET TROJAN DNS Query to Malicious Domain (nsvc .mail .server .korea)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (lightsteper .com)"

• "ET TROJAN TinyTurlaNG Turla APT GetTask Request"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (luckipath .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (productivelookewr .shop in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (selllify .shop)"

• "ET MOBILE_MALWARE Observed Android/Mandrake CnC Domain (ricinus-ca .ru) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (vscodeupdater .azurewebsites .net)"

• "ET TROJAN Observed DeerStealer Domain (gg2024 .info in TLS SNI)"

• "ET TROJAN DinodasRAT Related CnC Domain in DNS Lookup (update .centos-yum .com)"

• "ET TROJAN Suspected DinodasRAT Related Activity (UDP)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (democraticseekysiwo .shop)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (mora .pdfadobe .com)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (president-gov-lk .donwloaded .net in TLS SNI)"

• "ET TROJAN DNS Query to Gamaredon Domain (koroglugo .shop)"

• "ET TROJAN Observed ClearFake Domain (changelink .site in TLS SNI)"

• "ET TROJAN Observed MageCart Domain (rijtech .shop in TLS SNI)"

• "ET TROJAN Moonpeak RAT Related Domain in DNS Lookup (nmailhostserver .store)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (sync .webappclick .net)"

• "ET TROJAN Observed DeerStealer Domain (paradiso4 .fun in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (propertyclosings .com)"

• "ET TROJAN SystemBC CnC Beacon"

• "ET TROJAN Allasenha/CarnavalHeist Related Domain (nfe-digital .site) in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Related Domain (detailbaconroollyws .shop) in TLS SNI"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .sponsor .printondemandagency .com)"

• "ET CURRENT_EVENTS Observed TOAD Domain (desktool .buzz in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (insistytriro .shop in TLS SNI)"

• "ET TROJAN SocGholish Domain in DNS Lookup (scada .paradizeconstruction .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (barelytherejewels .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (bravedreacisopm .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (questionsurveyappserver .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (akites .site in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (funnypots .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (declaredczxi .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (intergratedblognewsapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN DNS Query to DarkComet RAT Domain (servicescraft .buzz)"

• "ET TROJAN Observed Lumma Stealer Related Domain (messtimetabledkolvk .shop) in TLS SNI"

• "ET TROJAN Observed Expiro Domain (htwqzczce .biz in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (checkapicountryquestions .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (liabilityarrangemenyit .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (preocucupationssk .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (opposesicknessopw .pw)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (gitbrancher .com)"

• "ET TROJAN Observed ACR Stealer Domain (pddbj .xyz) in TLS SNI"

• "ET TROJAN Win/Ghostlocker Ransomware Activity M2 (POST)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (launch process)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (2repuvegobmx .com .mx)"

• "ET INFO Dropbox paper Document Request Observed"

• "ET TROJAN Observed Lumma Stealer Related Domain (berserkydosom .shop in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (consultacurp-gobmx .com .mx)"

• "ET TROJAN Observed Malicious SSL Cert (Pantegana Botnet RAT)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (changequestiontypes .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (raiseboltskdlwpow .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (megabahis664 .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (wisemassiveharmonious .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (effectivedoxzj .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (backcreammykiel .shop in TLS SNI)"

• "ET TROJAN Win32/MarioLoader CnC Activity (POST) M2"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pcvcf .xyz)"

• "ET TROJAN Agent Tesla Payload Request (GET)"

• "ET TROJAN Lazarus Group Domain in DNS Lookup (sifucanva .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (revivewronggykwos .xyz)"

• "ET TROJAN DNS Query to Payload Downloader Domain (800germany .blogspot .com)"

• "ET TROJAN Observed Malicious Domain (countrysvc .pe .kr in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (gogobad .fun in TLS SNI)"

• "ET TROJAN DNS Query to MageCart Domain (zarelec .quest)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (jupyternotebookcollections .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (claimconcessionrebe .shop in TLS SNI)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pcvvf .xyz)"

• "ET TROJAN Observed TA451 FalseFont Backdoor Related Domain (digitalcodecrafters .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (solutionpxmuzo .shop in TLS SNI)"

• "ET TROJAN Polyfill Malicious Redirect Domain in DNS Lookup (kuurza .com)"

• "ET TROJAN Observed APT42/TA453 Related Domain (short-urling .live in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (liabiliytshareodlkv .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (lariatedzugspd .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (intergratedblognewsapi .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (pieddfreedinsu .shop in TLS SNI)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (execute command)"

• "ET TROJAN Patchwork APT Malformed HTTP Request"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (divyjai2 .xyz)"

• "ET TROJAN Observed Lumma Stealer Related Domain (settlepresumerepeats .shop in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (dgmp-paknavy .mod-pk .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (methodgreenglassdatw .shop in TLS SNI)"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (fastify .sbs)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (negotationpxczp .shop)"

• "ET TROJAN Lazarus Group Domain in DNS Lookup (contact .rgssm .in)"

• "ET TROJAN Observed Malicious UNK_ConsoleCollie Related Certificate Observed (O=IGhnPoQvfb)"

• "ET TROJAN SocGholish Domain in TLS SNI (scada .paradizeconstruction .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (standingcomperewhitwo .shop)"

• "ET TROJAN Observed TA453 Domain (kwhfibejjyxregxmnpcs .supabase .co in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (iredelltx .com)"

• "ET CURRENT_EVENTS Parrot TDS Check 2024-06-17"

• "ET TROJAN ClearFake CnC Domain in DNS Lookup (cdnforfiles .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (acceptabledcooeprs .shop)"

• "ET TROJAN DNS Query to Magecart Domain (defcleth .click)"

• "ET TROJAN Win32/Neptune Loader Activity (GET)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (abcdefghijkzz123 .servicedesks .net)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (acuiplast .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (triangleseasonbenchwj .shop)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (drinnkysoapmzv .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (graphize .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (stimultaionsppzv .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (cafeespeciales .com)"

• "ET TROJAN Win32/SSLoad Payload Response"

• "ET TROJAN Observed Expiro Domain (eufxebus .biz in TLS SNI)"

• "ET TROJAN Observed Magecart Domain (teloom .site in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (financialinvestmentsgrp .com)"

• "ET TROJAN Observed FakeExt Domain (jschecks .com) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (diskretainvigorousiw .shop)"

• "ET TROJAN DNS Query to MageCart Domain (zakit .quest)"

• "ET TROJAN Observed Malvertising Domain (advnanced-ip-scanner .com in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mailnavybd .govpk .net in TLS SNI)"

• "ET TROJAN TitanStealer CnC Exfiltration - /sendlog (POST)"

• "ET TROJAN DNS Query to Expiro Domain (nextroundst .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (colorprioritytubbew .shop in TLS SNI)"

• "ET TROJAN JS/GootLoader Activity M2 (GET)"

• "ET TROJAN Cryptbot CnC Domain in DNS Lookup (analforeverlove .top)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Lucy Security Time Tracking - Phishing Simulation"

• "ET TROJAN Observed HailBot Domain (pposdif .parody in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (chequedxmznp .shop in TLS SNI)"

• "ET TROJAN SocGholish Domain in DNS Lookup (stake .libertariancounterpoint .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (voyagedprivillywk .xyz in TLS SNI)"

• "ET TROJAN BackConnect CnC Activity (Set Sleep Timer)"

• "ET CURRENT_EVENTS Fake Privnote Domain in DNS Lookup (pirvnota .com)"

• "ET TROJAN Observed DeerStealer Domain (authenficatorgoogle .com in TLS SNI)"

• "ET TROJAN Polyfill Malicious Redirect Attempt M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (contemplateodszsv .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (questionsdatabases .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (technewsblogapi .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (ohfantasyproclaiwlo .shop in TLS SNI)"

• "ET TROJAN Observed BMANAGER Domain (boolka .tk in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (optionalapplication .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (sl-navy .office-drive .live in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (funcallback .com)"

• "ET TROJAN Justice AV Solutions Viewer Backdoor CnC Checkin (CVE-2024-4978)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (hhic .top)"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (rb .2f1c0b7d .tbc-app .life) in TLS SNI"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (cdn .lll .yachts)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (paknavy .defpak .org in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (glisteniingwiw .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (lamentablegapingkwaq .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (hippieblissprovising .com)"

• "ET TROJAN Observed TA426/Zebrocy Domain (trust-certificate .net) in TLS SNI"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (edificedcampslzi .shop)"

• "ET TROJAN Ducktail APT Style Payload Request"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (answerssurveytest .azurewebsites .net)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (eyesstore .store)"

• "ET TROJAN Observed Zloader Related Domain (wesco .live in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (celosiapatroen .shop)"

• "ET TROJAN Observed Malicious Typo Squatting Domain (wnscp .net) in TLS SNI"

• "ET TROJAN TA417 Related Domain in DNS Lookup (quadrantbd .com)"

• "ET TROJAN Unknown Microsoft Office Document Malware Domain in DNS Lookup (sealingshop .click)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (ministryofforeignaffairs-mofa-gov-pk .dytt88 .org in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (definitonizmnx .shop)"

• "ET TROJAN GhostRat CnC Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (paintercrutcheniw .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (iaidevrssfeed .cloudapp .azure .com in TLS SNI)"

• "ET TROJAN CloudAtlas APT Related Maldoc Activity M3 (GET)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (culturesketchfinanciall .shop)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (pnwc .bol-north .com in TLS SNI)"

• "ET TROJAN Possible Sniffthem/Tnaket CnC Checkin"

• "ET TROJAN DNS Query to Magecart Domain (setmic .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (voicelighterrrepso .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (flexibleagttypoceo .shop in TLS SNI)"

• "ET TROJAN DinodasRAT Related CnC Domain in DNS Lookup (update .microsoft-settings .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (diagramfiremonkeyowwa .fun)"

• "ET TROJAN DNS Query to Malicious Domain (nmail .navermail .online .korea)"

• "ET TROJAN Observed Lumma Stealer Related Domain (parallelmercywksoffw .shop in TLS SNI)"

• "ET TROJAN Observed Moonpeak RAT Related Domain (nmailhostserver .store) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (reviveincapablewew .pw in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (customercareserviceapi .azurewebsites .net)"

• "ET TROJAN DNS Query to PhantomNet C2 Domain (associate .freeonlinelearningtech .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (abandonnyskop .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (dismissalcylinderhostw .shop in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (codcraft .shop)"

• "ET TROJAN Observed APT Related CR4T Dropper Domain (commonline .space in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (zippyfinickysofwps .shop in TLS SNI)"

• "ET TROJAN BackConnect CnC Activity (Bot Task Request) M1"

• "ET TROJAN Observed Win32/Koi Loader/Stealer Domain (podologie-werne .de) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (roadmapselectorapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN DNS Query to Expiro Domain (eufxebus .biz)"

• "ET TROJAN Cobalt Strike CnC Activity (GET)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (bdmil .alit .live)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (surveyappquery .azurewebsites .net)"

• "ET TROJAN Observed ACR Stealer Domain (frpk .xyz) in TLS SNI"

• "ET TROJAN Observed ClearFake Domain (drinkresources .rest in TLS SNI)"

• "ET TROJAN Mispadu Stealer CnC Checkin M2"

• "ET TROJAN Observed Lumma Stealer Domain (barebrilliancedkoso .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (pedestriankodwu .xyz in TLS SNI)"

• "ET TROJAN Win32/ObserverStealer Sending Browser Related Information (Google)"

• "ET CURRENT_EVENTS ClickFix Domain in DNS Lookup (dais7nsa .lol)"

• "ET TROJAN CloudAtlas APT Related Maldoc Activity M2 (GET)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (trust .resourcehost .net)"

• "ET TROJAN Observed UNC1549/TA455 Domain (surveyonlinetest .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (glisteniingwiw .shop)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authentificator-googl .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (artvislon .shop)"

• "ET TROJAN Observed DeerStealer Domain (authentifficatorgogle .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (answerrsdo .shop in TLS SNI)"

• "ET TROJAN SocGholish CnC Domain in DNS (* .loyalty .hienphucuanhanloai .org)"

• "ET TROJAN Observed Lumma Stealer Related Domain (faceddullinhs .shop in TLS SNI)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (matchingsingles .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (charecteristicdxp .shop)"

• "ET CURRENT_EVENTS Privnote Landing Page 2024-04-11"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stronggemateraislw .shop)"

• "ET TROJAN Atomic Stealer Related Activity (POST)"

• "ET TROJAN Observed Lumma Stealer Related Domain (tendencyportionjsuk .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (testmanagementapisjson .azurewebsites .net in TLS SNI)"

• "ET TROJAN DNS Query to Malvertising Domain (atssassian .com)"

• "ET TROJAN Observed Sniffthem/Tnaket Trojan Domain (lsrael .today) in TLS SNI"

• "ET TROJAN Observed Ducktail Domain (123online .uk in TLS SNI)"

• "ET TROJAN TA426/Zebrocy Related Domain in DNS Lookup (trust-certificate .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (speedparticipatewo .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (astronomicspace .com)"

• "ET TROJAN Win32/Unknown Loader Related Activity M2 (POST)"

• "ET TROJAN ClearFake CnC Domain in DNS Lookup (baqebei1 .online)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (onequestionsapi .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (horsedwollfedrwos .shop) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (personalitytestquestionapi .azurewebsites .net)"

• "ET TROJAN Cryptbot CnC DGA Domain (eight18)"

• "ET TROJAN DNS Query to TA455 Domain (xboxplayservice .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cleartotalfisherwo .shop)"

• "ET INFO PDQ Remote Management Agent Checkin"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (sppc .moma-pk .org in TLS SNI)"

• "ET TROJAN pcTattletale Software Installer Request (GET)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (getsmallcount .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (accumulationeyerwos .shop)"

• "ET TROJAN Anonymous RAT CnC Checkin"

• "ET TROJAN Observed Expiro Domain (przvgke .biz in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (celebratioopz .shop in TLS SNI)"

• "ET TROJAN DNS Query to TA453 Domain (kwhfibejjyxregxmnpcs .supabase .co)"

• "ET TROJAN Observed Lumma Stealer Related Domain (appetitesallooonsj .shop in TLS SNI)"

• "ET TROJAN Cobalt Strike Malleable C2 (Pandora Profile)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (macnavicat .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (thidrsorebahsufll .shop)"

• "ET TROJAN DNS Query to Malware Delivery Domain (a0917004 .xsph .ru)"

• "ET TROJAN Observed Globalshadow Domain (portal .sharjahconnect .online) in TLS SNI"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (deslgnpro .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (surveyonlinetestapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (revivewronggykwos .xyz in TLS SNI)"

• "ET TROJAN Magnet Goblin Linux Nerbian RAT Trigger Sequence from CnC Server"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (logupdatemanagementapijson .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (fictionnykwop .shop)"

• "ET TROJAN Win32/MarioLoader Payload Request (GET)"

• "ET TROJAN Mint Stealer CnC Checkin"

• "ET TROJAN Observed Lumma Stealer Related Domain (exceptionwillapews .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wagechaircoupessaywu .shop)"

• "ET TROJAN Observed FIN7/Carbanak Related Domain (sun876954 .space in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (boattyownerwrv .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (parallelmercywksoffw .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (notebooktextchecking .azurewebsites .net in TLS SNI)"

• "ET TROJAN DNS Query to Expiro Domain (htwqzczce .biz)"

• "ET TROJAN ZharkBot User-Agent Observed"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (rb .2f1c0b7d .tbc-app .life)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wifeplasterbakewis .shop)"

• "ET TROJAN Win32/Sfuzuan Variant Payload Fetch"

• "ET TROJAN SocGholish Domain in TLS SNI (welcome .visionaryyouth .org)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (kirklareliliste .cfd)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (homefurniture .azurewebsites .net)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain in DNS Lookup (prorecieve .com)"

• "ET TROJAN Observed Lumma Stealer Domain (ohfantasyproclaiwlo .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (assumedtribsosp .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (kirklareliliste .cfd)"

• "ET TROJAN Observed Earth Krahang APT Domain (update .windows .server-microsoft .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (minorittyeffeoos .shop)"

• "ET TROJAN Win32/SSLoad Tasking Response"

• "ET TROJAN BackConnect CnC Activity (Start SOCKS) M1"

• "ET TROJAN Observed Lumma Stealer Related Domain (demandlinzei .shop in TLS SNI)"

• "ET TROJAN Observed ZharkBot Domain (warzone-meta .net in TLS SNI)"

• "ET CURRENT_EVENTS PigButcher Credential Phish Landing Page M2 2024-08-05"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (creepydxzoxmj .shop)"

• "ET TROJAN Observed Patchwork Domain (hengtian .nihaoucloud .org in TLS SNI)"

• "ET TROJAN Suspected Fin7 Related Domain (cdn34 .space) in TLS SNI"

• "ET TROJAN DNS Query to Lumma Stealer Domain (human-verify02 .b-cdn .net)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (tnlsowki .westus3 .cloudapp .azure .com)"

• "ET TROJAN BunnyLoader 3.0 Tasking Response"

• "ET TROJAN W32/Badspace.Backdoor CnC Activity (POST)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M7"

• "ET TROJAN Observed Lumma Stealer Related Domain (chippyfroggsyhz .shop in TLS SNI)"

• "ET TROJAN OrbitalBeam CnC Activity (Info)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (performanscore .com)"

• "ET TROJAN Observed ClickFix Domain (flynews .us in TLS SNI)"

• "ET TROJAN Observed ClearFake Domain (businessresources .ltd in TLS SNI)"

• "ET TROJAN OrbitalBeam CnC Activity (Debug)"

• "ET TROJAN SocGholish Domain in TLS SNI (premium .davidabostic .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (arriveoxpzxo .shop)"

• "ET TROJAN Observed Glupteba CnC Domain (theupdatetime .org in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (consciousourwi .shop in TLS SNI)"

• "ET TROJAN PrivateLoader CnC Activity (POST)"

• "ET TROJAN Possible Cthulu Stealer URI Struct M1"

• "ET TROJAN DNS Query to Fenix Botnet Domain (fja .com .mx)"

• "ET TROJAN Observed Lumma Stealer Related Domain (deicedosmzj .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer CnC Host Checkin"

• "ET TROJAN Observed UNC1549/TA455 Domain (surveyappquery .azurewebsites .net in TLS SNI)"

• "ET TROJAN SocGholish Domain in TLS SNI (camps .topgunnbaseball .com)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (support-team-account .fbb2024-20 .click)"

• "ET WEB_SPECIFIC_APPS Fortigate FortiOS Invalid HTTP Chunk Length (CVE-2024-21762) Vulnerability Scan Attempt"

• "ET TROJAN Observed Latrodectus Domain (aytobusesre .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (carnivalsale .com)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (marvin-occentus .net)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (megasena777 .top)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (visitscloud .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (liabilitynighstjsko .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (statisticplatform .com)"

• "ET TROJAN OrbitalBeam CnC Token Request"

• "ET TROJAN DNS Query to MageCart Domain (sudtech .online)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (testmanagementapis .azurewebsites .net)"

• "ET MOBILE_MALWARE Android Kamran Malware Related CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS Successful Generic 000webhost Phish 2018-09-27"

• "ET TROJAN Poseidon Stealer Data Exfiltration Attempt"

• "ET TROJAN Observed Lumma Stealer Related Domain (charecteristicdxp .shop in TLS SNI)"

• "ET TROJAN Possible GIFTEDVISITOR Activity - Ivanti Connect Secure"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (tnlsowkis .westus3 .cloudapp .azure .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (blogvolleyballstatus .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (testmanagementapisjson .azurewebsites .net)"

• "ET TROJAN Polyfill Malicious Redirect Attempt M1"

• "ET TROJAN Observed pcTattletale Spyware Domain (pctattletale .com in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (storage .webfiledata .com)"

• "ET TROJAN Cryptbot CnC DGA Domain (one1)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (prideconstituiiosjk .shop)"

• "ET TROJAN Possible PikaBot Java Loader CnC Checkin"

• "ET TROJAN Suspected Smokeloader Payload Related Activity (POST)"

• "ET TROJAN Observed Allasenha/CarnavalHeist RAT Related Domain (adobe-acrobat-visualizer .brazilsouth .cloudapp .azure .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (destructionloserods .shop in TLS SNI)"

• "ET MOBILE_MALWARE Gigabud CnC Domain in DNS Lookup (blsdk5 .cc)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (caffegclasiqwp .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (panameradovkews .xyz in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (notoriousdcellkw .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (insistytriro .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (deadtrainingactioniw .xyz in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (standingcomperewhitwo .shop) in TLS SNI"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (apidevwa .com)"

• "ET MOBILE_MALWARE Observed GoldDigger Domain (bv8k .xyz in TLS SNI)"

• "ET TROJAN JaskaGO CnC Host Profile Exfil"

• "ET TROJAN Observed Lumma Stealer Related Domain (accountasifkwosov .shop in TLS SNI)"

• "ET TROJAN Observed ACR Stealer Domain (frjk .xyz) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (technologyenterdo .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (mercyaloofprincipleo .pics)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (absolutecache .com)"

• "ET TROJAN [ANY.RUN] DarkGate HTTP POST Activity (TA577)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (bdmil .alit .live in TLS SNI)"

• "ET TROJAN Mint Stealer Data Exfiltration Server Response"

• "ET TROJAN Observed Lazarus Group Domain (chrysalisc .com) in TLS SNI"

• "ET TROJAN Gamaredon CnC Checkin (POST)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (belvedereparkway .site)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (strainriskpropos .store)"

• "ET TROJAN Blister Loader Mythic C2 Profile M4"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (securecrt .cc)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (qualificationjdwko .xyz)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (gametuners .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (bochka-keitaro .space)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (customercareservice .azurewebsites .net)"

• "ET TROJAN SocGholish CnC Domain in DNS (* .award .vuheritagefoundation .org)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stalfbaclcalorieeis .shop)"

• "ET TROJAN DNS Query to Latrodectus Domain (aytobusesre .com)"

• "ET TROJAN Observed DeerStealer Domain (authentificator-gogle .com in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (training .detru .info in TLS SNI)"

• "ET TROJAN Observed Malware Delivery Related Domain (invoice .trycloudflare .com in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (citasatmx2023 .lat)"

• "ET TROJAN Observed Lumma Stealer Related Domain (spitechallengddwlsv .xyz in TLS SNI)"

• "ET TROJAN Lazarus Group Combacker CnC Domain in DNS Lookup (blockchain-newtech .com)"

• "ET MOBILE_MALWARE Gigabud CnC Domain in DNS Lookup (js6kk .xyz)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (intengineeringrssfeed .azurewebsites .net)"

• "ET TROJAN Observed PhantomNet C2 Domain (associate .freeonlinelearning .com in TLS SNI)"

• "ET TROJAN [ANY.RUN] MetaStealer v.5 (MC-NMF TLS Server Certificate)"

• "ET TROJAN Observed Lumma Stealer Related Domain (cooperatvassquaidmew .xyz in TLS SNI)"

• "ET TROJAN ASYNC RAT Payload Inbound"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (fiondationkvowos .xyz)"

• "ET TROJAN Observed MageCart Domain (zarelec .quest in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to Lumma Stealer Domain (human-check .b-cdn .net)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (onlinechatconnections .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (tempesolarcompany .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (trendset .website)"

• "ET CURRENT_EVENTS PigButcher Credential Phish Landing Page M4 2024-08-05"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (codemingle .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (surprisemakedjukenw .shop in TLS SNI)"

• "ET TROJAN Oyster Backdoor Domain in DNS Lookup (supfoundrysettlers .us)"

• "ET TROJAN Observed UNC1549/TA455 Domain (airgadgetsolutions .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed CrimsonRAT Domain (waqers .duckdns .org in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (miracledzmnqwui .shop)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (jswebcache .com)"

• "ET TROJAN Observed Social Media Malvertising Related Domain (evotoforpc .net) in TLS SNI"

• "ET TROJAN Agrius Group ASPXSpy Webshell Connection Inbound M2"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (upknittsoappz .shop)"

• "ET TROJAN Observed MageCart Domain (cvyatop .online in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (polyctendizxcop .shop)"

• "ET TROJAN DNS Query to ClickFix Domain (cleanway .5asec .fr)"

• "ET TROJAN HailBot CnC Domain in DNS Lookup (yoursocuteong .dyn)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (cstc-spares-vip-163 .dowmload .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (marketro .shop)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (apifunctioncall .com)"

• "ET TROJAN Observed Earth Krahang APT Domain (security-microsoft .net in TLS SNI)"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn37 .space)"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (csob-93ef49e7a .tbc-app .life) in TLS SNI"

• "ET TROJAN OldGremlin/TA801 Domain in DNS Lookup (diadok-documentscdn .c688de .com)"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (tfirstdaily .store)"

• "ET TROJAN Koadic Framework Requesting Payload (GET) M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (pillowbrocccolipe .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (emiratescheckapi .azurewebsites .net)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (operatida .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (averageaattractiionsl .shop in TLS SNI)"

• "ET TROJAN Observed ClickFix Domain (cleanway .5asec .fr in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (deicedosmzj .shop)"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn36 .space)"

• "ET TROJAN Observed Lumma Stealer Related Domain (catchddkxozvp .shop in TLS SNI)"

• "ET TROJAN Observed WaveStealer Related Domain (wave-assistant .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (buatywear .store)"

• "ET TROJAN Observed FakeExt Domain (screen-security .com) in TLS SNI"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (recordsbluemountain .com)"

• "ET TROJAN Observed ACR Stealer Domain (pdddk .xyz) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (innerverdanytiresw .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (answerssurveytest .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (questionsurveyapp .azurewebsites .net)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN DNS Query to MageCart Domain (drgibit .click)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (deteriotraiwo .shop)"

• "ET TROJAN Observed TA453 Domain (east-healthy-dress .glitch .me in TLS SNI)"

• "ET TROJAN ClearFake CnC Checkin (POST)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (humanresourcesapijson .azurewebsites .net)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mofa-gov-pk .directt888 .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (greentastellesqwm .shop) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (qaquestionsapi .azurewebsites .net)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (luckipath .shop)"

• "ET TROJAN TA430/Andariel Related Domain in DNS Lookup"

• "ET TROJAN BackConnect CnC Activity (Bot Error) M1"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (catlackjellyodwps .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (conferencefreckewl .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (dataofpages .com)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (selectofmychoices .com)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (investigation04 .session-out .com in TLS SNI)"

• "ET TROJAN DNS Query to ClickFix Related Domain (x8f7a89 .pics)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (quiztestapplication .azurewebsites .net)"

• "ET TROJAN Observed ClearFake Domain (baqebei1 .online in TLS SNI)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (cabinet-division-pk .fia-gov .com)"

• "ET TROJAN Observed Magecart Domain (setmic .shop in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (libjs .xyz in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (linestoget .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (engineeringrssfeed .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Fenix Botnet Domain (citas-sat2023 .com .mx in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (leafcalfconflcitw .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (desktool .buzz)"

• "ET TROJAN DNS Query to Merlin C2 Domain (scancenter .trendrealtime .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (suezcanal .portdedjibouti .live)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (justifycanddidatewd .shop)"

• "ET TROJAN Agrius Group Webshell File Upload Attempt"

• "ET TROJAN FRAMEREST Web Shell Activity Observed"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (stckeringdkzpx .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (wordingnatturedowo .xyz in TLS SNI)"

• "ET TROJAN SimpleHelp Remote Access Software Activity"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (stagedchheiqwo .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (wagechaircoupessaywu .shop in TLS SNI)"

• "ET TROJAN Globalshadow Trojan CnC Checkin M2"

• "ET MOBILE_MALWARE Observed Gigabud Domain (js6kk .xyz in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (airconnectionsapijson .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (tipsydulljaui .website)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (colorschemeas .com)"

• "ET TROJAN Suspected Kimsuky APT Related ToddlerShark Activity (POST)"

• "ET TROJAN DNS Query to Malicious Domain (nidnaver .info)"

• "ET TROJAN Observed Lumma Stealer Related Domain (industrybuttonyoferwa .fun in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (celosiapatroen .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (dividenntyss .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (changequestionstypeapi .azurewebsites .net)"

• "ET CURRENT_EVENTS Generic Phish Landing Page 2024-03-18"

• "ET TROJAN CloudAtlas APT Related Maldoc Activity M4 (GET)"

• "ET TROJAN Lumma Stealer Related Fake Captcha Page Inbound M1"

• "ET TROJAN Observed Fenix Botnet Domain (citasatmx2023 .lat in TLS SNI)"

• "ET TROJAN Observed TA417 Domain (taishanlaw .com) in TLS SNI"

• "ET MOBILE_MALWARE Observed GoldDigger Domain (zu7kt .cc in TLS SNI)"

• "ET TROJAN Observed TA417 Domain (bakhell .com) in TLS SNI"

• "ET MOBILE_MALWARE Observed Gigabud Domain (bweri6 .cc in TLS SNI)"

• "ET TROJAN Observed DeerStealer Domain (authetificator-gogle .com in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (onequestionsapicheck .azurewebsites .net in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (helpcenter .cyou)"

• "ET TROJAN Observed UNC1549/TA455 Domain (hrapplicationtest .azurewebsites .net in TLS SNI)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (write to file)"

• "ET TROJAN Observed DonotGroup Related Domain (geographiclocation .info in TLS SNI)"

• "ET TROJAN DNS Query to MageCart Domain (neznlink .store)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (expertcloud .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (entitlementappwo .shop)"

• "ET TROJAN DNS Query to AMOS Related Domain (setapp .ink)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (selectofmychoices .com)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (defencelk .cvix .live)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (communicationgenerwo .shop)"

• "ET TROJAN DNS Query to Malicious Domain (pdfmicrosoft .ddns .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (cleartotalfisherwo .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (identifycheckapplications .azurewebsites .net)"

• "ET CURRENT_EVENTS PigButcher Credential Phish Landing Page M1 2024-08-05"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (surveyonlinetest .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (lyingchemicow .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (establisheddisappearefe .site in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (dealhunt .website)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (filesoftdownload .shop)"

• "ET TROJAN Suspected TA430/Andariel AndarLoader Related CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Related Domain (strollheavengwu .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (countrybasedquestions .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (public .clickstat360 .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (moemaldives .pmd-office .com)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (sarabanmithnavy .tni-mil .com in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (workersquestionsapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (birngthemhomenow .co .il in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (excavtaionps .shop in TLS SNI)"

• "ET TROJAN Oyster Backdoor Domain in TLS SNI (supfoundrysettlers .us)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (aestheticainteriors .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (blognewsalphaapijson .azurewebsites .net)"

• "ET TROJAN Observed UNC1549/TA455 Domain (emiratescheckapijson .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (questionsapplicationapijson .azurewebsites .net)"

• "ET TROJAN EncryptHub Stealer Host Details Exfil via Telegram (POST)"

• "ET TROJAN DNS Query to TinyTurla Domain (caduff-sa .ch)"

• "ET CURRENT_EVENTS Fake IRS Scam Domain in DNS Lookup (ustaxnumber .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (legderlivesapp .online)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M14"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (jewelassertivebop .fun)"

• "ET TROJAN DNS Query to Malware Delivery Domain (invoicetrycloudflare .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (logsapimanagement .azurewebsites .net)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (browsercheckingapi .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (turkeyunlikelyofw .shop)"

• "ET TROJAN Observed ACR Stealer Domain (frsk .xyz) in TLS SNI"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (statistall .com)"

• "ET TROJAN DNS Query to ClearFake Domain (zerosoftware .tech)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (coaching-the-boss .com)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (moitt .paknavy-govpk .info in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (interactiveuidevelopment .com)"

• "ET TROJAN Allakore RAT CnC Domain in DNS Lookup (uplayground .online)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (engineeringssfeed .azurewebsites .net)"

• "ET TROJAN DNS Query to MageCart Domain (tutic .click)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (8r .ae in TLS SNI)"

• "ET TROJAN Observed TA399/SideWinder Domain (mofa-gov-pk .dowmload .info in TLS SNI)"

• "ET TROJAN DNS Query to XWORM Domain (sponsored-ate .gl .at .ply .gg)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (heatwave .paknavy .store in TLS SNI)"

• "ET TROJAN Observed Lazarus Group Domain (contact .rgssm .in) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (spliceszongsop .shop in TLS SNI)"

• "ET TROJAN Cheana Stealer Domain in DNS Lookup (ganache .live)"

• "ET TROJAN DNS Query to Malicious Domain (taxservice .pe .kr)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (catchddkxozvp .shop)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (rdntocdns .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (weaknessmznxo .shop)"

• "ET TROJAN Win32/OfferCore Checkin M1"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M6"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (mamajekisrecording .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (sportblogs .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (settlepresumerepeats .shop)"

• "ET TROJAN DNS Query to Winnti Domain (linuxrelease .org)"

• "ET MOBILE_MALWARE Observed Gigabud Domain (blsdk5 .cc in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (getmygateway .com)"

• "ET TROJAN Suspected PrivateLoader Activity (POST)"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (client .nfcpay .workers .dev) in TLS SNI"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (data-dev .helpkaspersky .top)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (moma .comsats-net .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (consciousourwi .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (triallyforwhgh .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (novidadesfresquinhas .online)"

• "ET TROJAN Suspected Sidewinder APT Related Activity (GET)"

• "ET TROJAN Observed Lumma Stealer Related Domain (questionconservawuts .shop in TLS SNI)"

• "ET TROJAN Observed TA453 Domain (ndrrftqrlblfecpupppp .supabase .co in TLS SNI)"

• "ET TROJAN Observed Gamaredon Domain (koroglugo .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (statisticsplatform .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (clouddycuiomsnz .shop in TLS SNI)"

• "ET TROJAN UAC-0050 Domain (groupdavinci .online in TLS SNI)"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (msfw .store)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (wilderglamour .com)"

• "ET TROJAN Possible UNK_ConsoleCollie CnC Activity (GET)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (compilecoppydkewsw .xyz)"

• "ET TROJAN Win32/Sfuzuan Variant Payload Fetch"

• "ET TROJAN Observed Lumma Stealer Related Domain (arritswpoewroso .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (exchtestcheckingapi .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (merchifly .shop)"

• "ET TROJAN Cryptbot CnC DGA Domain (sev7)"

• "ET TROJAN Observed Lumma Stealer Related Domain (hookybeamngwskow .xyz in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (snuggleapplicationswo .fun)"

• "ET TROJAN Observed Xehook Stealer Domain (nc1337 .online) in TLS SNI"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (promotionlist .comsats-net .com)"

• "ET CURRENT_EVENTS Fake Browser Update Domain in DNS Lookup (bestdoctornearme .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (blockbeerman .fun)"

• "ET TROJAN APT42/TA453 Related CnC Domain in DNS Lookup (wulpfsrqupnuqorhexiw .supabase .co)"

• "ET TROJAN Xworm CnC Domain in DNS Lookup (223 .ip .ply .gg)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (nail-lists-compact-project .trycloudflare .com)"

• "ET TROJAN Observed Fenix Botnet Domain (fja .com .mx in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (k1gkl25as .top)"

• "ET TROJAN Observed Malicious Domain (storagedsolutions .azurefd .net in TLS SNI)"

• "ET TROJAN DNS Query to Payload Downloader Domain (800french .blogspot .com)"

• "ET TROJAN Observed ACR Stealer Domain (veronicabal .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (empiredzmwnx .shop in TLS SNI)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (availitond .com)"

• "ET TROJAN Win32/ObserverStealer Related Activity (POST)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain in DNS Lookup (cloudflareaddons .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ablesulkyfirstyews .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (purefinishonerbrothsjke .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (blognewsalphaapijson .azurewebsites .net in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (hamaraneta .com)"

• "ET TROJAN BunnyLoader 3.0 Initial Checkin Response"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (ficinity .com)"

• "ET TROJAN Observed Remcos Related Domain (bbhmeetre1ms .freeddns .org in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (sofaprivateawarderysj .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (upknittsoappz .shop)"

• "ET TROJAN Patchwork APT CnC Activity (starget)"

• "ET TROJAN Suspicious Domain (webvideoshareonline .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Domain (verif .dlvideosfre .click in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sailorshelfquids .shop)"

• "ET TROJAN Observed MageCart Domain (drgibit .click in TLS SNI)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (undjsj .duckdns .org)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (reports .dgps-govtpk .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (solutionpxmuzo .shop)"

• "ET TROJAN Brosql Stealer Browser Login Exfil"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (stratosbody .com)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (oral-career-renewable-bacterial .trycloudflare .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (developmentalveiop .homes in TLS SNI)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (airconnectionapi .azurewebsites .net)"

• "ET TROJAN Observed DeerStealer Domain (authenticattor-googl .com in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (javaruntimetestapi .azurewebsites .net)"

• "ET TROJAN Win32/Koi Stealer CnC Checkin (POST) M1"

• "ET MOBILE_MALWARE Observed Gigabud Domain (bc2k .xyz in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (ewbjr2h375tjz5fh3wvohsetk .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (lineagelasserytailsd .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (roomabolishsnifftwk .shop)"

• "ET TROJAN Observed Magecart Domain (grutic .store in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (clouddycuiomsnz .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (deslgnpro .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cooperatvassquaidmew .xyz)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (invitation-letter .govpk .info in TLS SNI)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (businesscenter .fbb16 .click)"

• "ET TROJAN Observed Zloader Related Domain (msfw .store in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (bet89on .store)"

• "ET TROJAN Earth Hundun Group Waterbear/Deuterbear CnC Domain in DNS Lookup (suitsvm003 .rchitecture .org)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (offerimagefancine .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (cashcloudservices .com in TLS SNI)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authentificcatorgoolgle .com)"

• "ET TROJAN Observed PocoProxy C2 Domain (googlespeedtest33 .com in TLS SNI)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (agovaccess-ch .com) in TLS SNI"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (apifunctioncall .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (apidevst .com)"

• "ET TROJAN Observed Lumma Stealer Domain (poko .b-cdn .net in TLS SNI)"

• "ET TROJAN Win32/Unknown Stealer CnC Domain in DNS Lookup (webvideoshareonline .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (stomachoverwis .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (stablelightway .com)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (8t .ae in TLS SNI)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (citas-sregob-mexico .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (megasena777 .top)"

• "ET TROJAN DNS Query to TinyTurla Domain (thefinetreats .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (sarahkatherinelewis .com)"

• "ET TROJAN Allasenha/CarnavalHeist Related Domain (nfe-digital .online) in DNS Lookup"

• "ET TROJAN Linux/Dinodas RAT CnC Checkin - UDP"

• "ET TROJAN Observed Lumma Stealer Related Domain (sofahuntingslidedine .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (theonlyreasonwhywe .pro in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (gxsicmj3l .top)"

• "ET TROJAN FakeEXT Data Exfiltration Attempt"

• "ET TROJAN UTA0178 Domain in DNS Lookup"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M12"

• "ET TROJAN Observed MageCart Domain (antelec .click in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (ryruhuu3 .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pollutiofactwoijk .shop)"

• "ET TROJAN Observed ClickFix Fake Update iframe Injection Attempt"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (binder-sa .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (languagedscie .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (absentconvicsjawun .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (apphrquestion .azurewebsites .net)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (adstrra .b-cdn .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (boredimperissvieos .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (knoxvillevideoproductions .com)"

• "ET TROJAN TA426/Zebrocy Related Domain in DNS Lookup (enrollmentdm .com)"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (csob-93ef49e7a .tbc-app .life)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wordingnatturedowo .xyz)"

• "ET TROJAN Win32/Rust Miner CnC Activity"

• "ET TROJAN Observed DNS Query to EncryptHub Stealer Payload Domain (win-rar .co)"

• "ET TROJAN Observed Lumma Stealer Related Domain (punchtelephoneverdi .store in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (chippyfroggsyhz .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (copyrightspareddcitwew .site in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (helicoptersahtests .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (apicachebot .com)"

• "ET WEB_SPECIFIC_APPS Server Response Containing search-ms URI With crumb location Parameter - Possible NTLM Hash Leak Attempt"

• "ET TROJAN DNS Query to AMOS Related Domain (cleanshot .ink)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (followcache .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (jupyternotebookscollection .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed DeerStealer Domain (authentificatorgogle .com in TLS SNI)"

• "ET TROJAN Win32/Sync-Scheduler Stealer Activity (POST)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (poko .b-cdn .net)"

• "ET TROJAN DNS Query to Magecart Domain (feigoton .store)"

• "ET TROJAN Observed Lumma Stealer Related Domain (roundpleaddso .shop in TLS SNI)"

• "ET TROJAN TrollAgent CnC Domain in DNS Lookup (winters .r-e .kr)"

• "ET TROJAN Mint Stealer CnC Domain in DNS Lookup (mint-c2 .top)"

• "ET TROJAN SocGholish Domain in DNS Lookup (miner .eastestsite .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (tylmxvx .top)"

• "ET TROJAN Observed Lumma Stealer Domain (notoriousdcellkw .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (imc1 .top)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (analytlx .shop)"

• "ET TROJAN Suspected Powershell Empire Activity M2"

• "ET TROJAN Globalshadow Trojan CnC Checkin M1"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authenticator-googl .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (hiringarabicregion .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (swellfrrgwwos .xyz in TLS SNI)"

• "ET TROJAN TA416 Related PUBLOAD Variant Checkin Activity M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (roomabolishsnifftwk .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (jupyternotebookcollections .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (ultraedit .vip)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (horizonvxjis .shop)"

• "ET MALWARE Observed Android Fintech Related Domain (apitai .coccash .com in TLS SNI)"

• "ET TROJAN Ailurophile Infostealer Data Exfiltration Attempt M1"

• "ET TROJAN Observed Glupteba CnC Domain (statscreate .org in TLS SNI)"

• "ET TROJAN HTTP POST with Suspicious User-Agent Observed - Possible ZLoader Activity M1"

• "ET TROJAN Lumma Stealer Related Activity"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (decentralappps .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (identifycheckingapplications .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed TinyTurla Domain (buy-new-car .com in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (arquestionsapi .azurewebsites .net)"

• "ET TROJAN Observed Magecart Domain (nuinetec .store in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (divyjai2 .xyz)"

• "ET TROJAN Malicious Domain Observed in DNS Lookup (jslibc .com)"

• "ET WEB_SPECIFIC_APPS AVTECH IP Camera LED Brightness Parameter Command Injection Attempt (CVE-2024-7029)"

• "ET TROJAN Observed Malicious Domain (jslibc .com in TLS SNI)"

• "ET MOBILE_MALWARE Android Botnet CnC Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (liernessfornicsa .shop)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (evoliutwoqm .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (rainbowmynsjn .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)"

• "ET TROJAN nspx30 Backdoor Trigger Response Observed"

• "ET TROJAN Observed Gamaredon Domain (raidla .ru in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (psk777 .casa)"

• "ET TROJAN Possible UPSTYLE Payload Retrieval Attempt"

• "ET TROJAN UAC-0050 Domain (davincigroup .online in TLS SNI)"

• "ET TROJAN DNS Query to Magecart Domain (teloom .site)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (decentralappps .com)"

• "ET TROJAN Observed Malicious SSL Cert (VenomRAT)"

• "ET TROJAN AMOS CnC Exfiltration - /p2p (POST) M2"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (cdn-dev .helpkaspersky .top)"

• "ET TROJAN TrollAgent CnC Domain in DNS Lookup (ol .negapa .p-e .kr)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (invoice .trycloudflare .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (concessionofsellerwo .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (financialinvestmentsgrp .com)"

• "ET TROJAN Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (appetitesallooonsj .shop)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (acapros-app .s3-us-west-2 .amazonaws .com)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (xn--31-rha .me in TLS SNI)"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (sideindexfollowragelrew .pw)"

• "ET TROJAN Observed Lumma Stealer Related Domain (slammyslideplanntywks .xyz in TLS SNI)"

• "ET TROJAN Observed Earth Hundun Group Waterbear/Deuterbear Domain (suitsvm003 .rchitecture .org) in TLS SNI"

• "ET TROJAN Win32/Cryptbotv2 CnC Activity (POST) M4"

• "ET WEB_SPECIFIC_APPS Fortigate FortiOS Invalid HTTP Chunk Length Out of Bounds Write Remote Code Execution Attempt (CVE-2024-21762) - Heap Manipulation"

• "ET TROJAN Observed Payload Downloader Domain (italy700 .blogspot .com in TLS SNI)"

• "ET TROJAN PlanetStealer Data Exfiltration Attempt"

• "ET TROJAN Dora RAT CnC Domain in DNS Lookup (kmobile .bestunif .com)"

• "ET CURRENT_EVENTS Generic Phish Redirector Domain in DNS Lookup (datatrail .xyz)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authenticattor-googl .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (funnypots .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (magaanthem .com)"

• "ET TROJAN DNS Query to 9002 RAT Domain (themicrosoftnow .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (onequestions .azurewebsites .net)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (graphlq .shop)"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (mfsc .live)"

• "ET TROJAN DNS Query to Suspected APT Domain (idfleaks .info)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (elamoto .com)"

• "ET TROJAN TA430/Andariel NukeSped Backdoor Variant Server Response M1"

• "ET TROJAN BadSpace/WarmCookie CnC Activity (GET)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (cafeespeciales .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (propertyclosings .com)"

• "ET TROJAN [ANY.RUN] NjRat (tXRAT v.2.3R) Client Sends State Active Window"

• "ET TROJAN Observed Remcos Related Domain (promote-diff-string-clerk .trycloudflare .com in TLS SNI)"

• "ET TROJAN Win32/AsyncRAT CnC Checkin (GET)"

• "ET TROJAN Observed TrollAgent Domain (ar .kostin .p-e .kr in TLS SNI)"

• "ET CURRENT_EVENTS ClickFix Domain in TLS SNI (dais7nsa .lol)"

• "ET TROJAN Observed Social Media Malvertising Related Domain (businesscenter .fbb16 .click) in TLS SNI"

• "ET TROJAN Lazarus Group Domain in DNS Lookup (thefrostery .co .uk)"

• "ET TROJAN Win32/Powershell Loader Related Activity (GET)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (tolerateilusidjukl .shop)"

• "ET TROJAN Observed Remcos Related Domain (mysweeterbk .ddns .net in TLS SNI)"

• "ET TROJAN Observed Remcos Related Domain (myumysmeetr .ddns .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (rankrandomotherwjsui .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (associationokeo .shop in TLS SNI)"

• "ET TROJAN UAC-0050 Domain in DNS Lookup (8161 .uk)"

• "ET TROJAN DNS Query to Fenix Botnet Domain (zlvsiexj6d .d3vilsgg .xyz)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (be-at-home .s3 .ap-northeast-2 .amazonaws .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (singerreasonnbasldd .xyz)"

• "ET INFO Redirect to Wikipedia with Hackernoon GIF"

• "ET TROJAN Observed UNC1549/TA455 Domain (apphrquestions .azurewebsites .net in TLS SNI)"

• "ET TROJAN DarkGate Payload Inbound"

• "ET TROJAN Observed Lumma Stealer Related Domain (enthusiasimtitleow .shop in TLS SNI)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (iimjobs .asia)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sensitivyitszv .shop)"

• "ET INFO External SMB ANDX Request for Outlook Calendar Invite File (.ics) - Possible NTLM Hash Leak Attempt"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (checkservicecustomerapi .azurewebsites .net)"

• "ET TROJAN DNS Query to Expiro Domain (tjtmovers .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (foodypannyjsud .shop)"

• "ET TROJAN Observed Earth Hundun Group Waterbear/Deuterbear Domain (rscvmogt .taishanlaw .com) in TLS SNI"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (designlq .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (dismissalcylinderhostw .shop)"

• "ET TROJAN Unknown Powershell Malvertising Payload CnC Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (appliedgrandyjuiw .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (crisisrottenyjs .xyz)"

• "ET CURRENT_EVENTS Successful Metamask PassPhrase Phish 2024-01-24"

• "ET TROJAN Observed Lumma Stealer Related Domain (publicitycharetew .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (replacedoxcjzp .shop)"

• "ET TROJAN DNS Query to Payload Downloader Domain (others500 .blogspot .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (speedchaoptimise .com)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (3hhr8h2hx .top)"

• "ET MOBILE_MALWARE Observed Android Vultur/brunhilda Related Domain (safetyfactor .online in TLS SNI)"

• "ET WEB_SPECIFIC_APPS Palo Alto GlobalProtect Session Cookie Command Injection Attempt (CVE-2024-3400)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (performanscore .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (checkapicountryquestionsjson .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (cloudnetsofe .com in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (daslkjfhi2 .xyz)"

• "ET TROJAN Observed Lumma Stealer Related Domain (telephoneverdictyow .site in TLS SNI)"

• "ET TROJAN DNS Query to Remcos Related Domain (meetre1ms .freeddns .org)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (bringthenoiseappnew .s3 .amazonaws .com)"

• "ET TROJAN Observed Remcos Domain (jesusgabrielahumadalora09 .con-ip .com in TLS SNI)"

• "ET TROJAN Splinter Red Team Tool Activity"

• "ET TROJAN Observed Malware Delivery Related Domain (oral-career-renewable-bacterial .trycloudflare .com in TLS SNI)"

• "ET TROJAN DNS Query to Malicious Domain (mofamail .shop)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .contest .printondemandmerchandise .com)"

• "ET TROJAN BunnyLoader 3.0 Heartbeat Response"

• "ET TROJAN Suspected Fin7 Related Domain (cdn38 .space) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (queimaxofc .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ammycanedpors .shop)"

• "ET TROJAN Observed Fenix Botnet Domain (sre-curpmexico .com in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (clerkpolicemandwusi .xyz in TLS SNI)"

• "ET TROJAN VersaMem Webshell Authentication Attempt M2"

• "ET INFO vk .com API Usage Observed"

• "ET TROJAN Moonpeak RAT Related Domain in DNS Lookup (pumaria .store)"

• "ET TROJAN Observed Malware Delivery Related Domain (snap-guide-leeds-des .trycloudflare .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (grandmuseimhalltso .shop)"

• "ET TROJAN CHM Stealer CnC Host Profile Exfil (POST)"

• "ET TROJAN DNS Query to DarkComet RAT Domain (ultradelux .buzz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (occurrmensipz .shop)"

• "ET TROJAN Observed UNK_ConsoleCollie Malicious SSL Cert"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (dayfarrichjwclik .fun)"

• "ET TROJAN Cheana Stealer CnC Checkin"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (heatwave .paknavy .store)"

• "ET TROJAN Observed TrollAgent Domain (ai .kostin .p-e .kr in TLS SNI)"

• "ET TROJAN Observed TA417 Domain (randaln .com) in TLS SNI"

• "ET TROJAN Malicious Typo Squatting Domain in DNS Lookup (wnscp .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (oventoolyeditiiow .xyz)"

• "ET WEB_SPECIFIC_APPS Possible Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt M2 (CVE-2023-46805, CVE-2024-21887)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (packedbrick .com)"

• "ET TROJAN DNS Query to Malicious Domain (civilizations .store)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (daveiz .top)"

• "ET TROJAN 3proxy Backdoor Domain (catalog .micrisoftdrivers .com) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (nijanse .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (feighminoritsjda .shop in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mailaplf .cvix .live)"

• "ET TROJAN DNS Query to Malicious Domain (naveralarm .com)"

• "ET TROJAN Observed APT42/TA453 NICECURL Backdoor Related Domain (prism-west-candy .glitch .me in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (iaidevrssfeed .centralus .cloudapp .azure .com)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (lucashnancy .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (towerxxuytwi .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (snaillymarriaggew .shop)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (7o .ae in TLS SNI)"

• "ET TROJAN [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)"

• "ET TROJAN ClearFake CnC Activity Outbound (source_id)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (saratu .com)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (load .memoryloader .com)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (germanclics .com)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (lineferaline .com)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (updater-pro .com)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (careitservices .paknvay-pk .net)"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (rb-62d3a .tbc-app .life)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (mailmofagovmm .mofa .email)"

• "ET TROJAN DNS Query to AMOS Related Domain (macbartender .lat)"

• "ET TROJAN SocGholish Domain in TLS SNI (africa .thesmalladventureguide .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (velellablue .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (grazeinnocenttyyek .shop in TLS SNI)"

• "ET TROJAN UNK_ConsoleCollie Go Backdoor CnC Checkin"

• "ET TROJAN Observed Office Document Malware Domain (sealingshop .click) in TLS SNI"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mohgovsg .bahariafoundation .live)"

• "ET TROJAN Observed Lumma Stealer Related Domain (manufactiredowreachhd .xyz in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (selectchoise .com)"

• "ET TROJAN Cheana Stealer Data Exfiltration Attempt"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (gemcreedarticulateod .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (notebooktextchecking .azurewebsites .net)"

• "ET TROJAN Observed Malicious Domain (navercafe .info in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (daslkjfhi2 .lol)"

• "ET TROJAN Observed Lumma Stealer Related Domain (problemregardybuiwo .fun in TLS SNI)"

• "ET TROJAN Snake Keylogger HTTP Exfil"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bannngwko .shop)"

• "ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M5"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (backcreammykiel .shop)"

• "ET TROJAN [ANY.RUN] SilentCryptoMiner Check-in POST Request"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (gogobad .fun)"

• "ET TROJAN Observed Lumma Stealer Domain (conferencefreckewl .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (methodgreenglassdatw .shop)"

• "ET TROJAN Rezlt RDP Grabber - This is Not RDP"

• "ET TROJAN NUMOZYLOD CnC Checkin M1"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (brickedpack .com)"

• "ET TROJAN DNS Query to Magecart Domain (clifolink .online)"

• "ET TROJAN Observed TA455 Domain in TLS SNI (xboxplayservice .com)"

• "ET TROJAN Lazarus Group Domain in DNS Lookup (chrysalisc .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (turkeyunlikelyofw .shop in TLS SNI)"

• "ET TROJAN SocGholish CnC Domain in DNS (* .parish .chuathuongxot .org)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (snap-guide-leeds-des .trycloudflare .com)"

• "ET TROJAN Observed Glupteba CnC Domain (localstats .org in TLS SNI)"

• "ET TROJAN DNS Query to MageCart Domain (saponline .site)"

• "ET TROJAN Observed Lumma Stealer Related Domain (kaminiasbbefow .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (flydryszxo .shop)"

• "ET TROJAN Mint Stealer Injection Request"

• "ET TROJAN Suspected UTA0178 Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pillowbrocccolipe .shop)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (techsupportcenter1902 .click)"

• "ET CURRENT_EVENTS Fake Crypto Investing Domain (cryptowave .capital in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (integratedblognews .azurewebsites .net in TLS SNI)"

• "ET TROJAN BackConnect CnC Activity (Start VNC) M4"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (caffegclasiqwp .shop)"

• "ET TROJAN DNS Query to Suspected APT Domain (idf .pics)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (logsapimanagements .azurewebsites .net)"

• "ET TROJAN Koadic RC4 Encrypted Payload Inbound M2"

• "ET TROJAN Observed ACR Stealer Domain (frck .xyz) in TLS SNI"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (webdataspace .com)"

• "ET INFO External IP Check (checkip .amazonaws .com)"

• "ET TROJAN DNS Query to Wordpress Social Warfare Plugin Exploit Related Domain (silver-dates .com)"

• "ET TROJAN BackConnect CnC Activity (Start Reverse Shell) M1"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (lightsteper .com)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (indexterityszcoxp .shop)"

• "ET TROJAN Earth Kapre/RedCurl CnC Domain (preston .melaniebest .com) in DNS Lookup"

• "ET TROJAN Observed UNC1549/TA455 Domain (browsercheckingapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (bakefirefighteossw .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (iprotosample .com)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (settisourchampion .site)"

• "ET TROJAN DNS Query to pcTattletale Spyware Domain (pctattletalev2 .s3 .amazonaws .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (mealroomrallpassiveer .shop)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (unseaffarignsk .shop)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (kongtuke .com)"

• "ET TROJAN Observed Async RAT Related Domain (undjsj .duckdns .org in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (notebooktextcheckings .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Payload Downloader Domain (800germany .blogspot .com in TLS SNI)"

• "ET TROJAN Win32/ObserverStealer CnC Activity M2 (Screenshot)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (vodog .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (questionsapplicationbackup .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed 9002 RAT Domain (meeting .equitaligaiustizia .it in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (airconnectionsapijson .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (torubleeodsmzo .shop)"

• "ET CURRENT_EVENTS PigButcher Credential Phish Landing Page M5 2024-08-05"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authentifficatorgogle .com)"

• "ET TROJAN DNS Query to Malvertising Domain (doxy .icu)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (jswebcloud .net)"

• "ET TROJAN Nitrogen Loader Activity"

• "ET MOBILE_MALWARE Android/Mandrake CnC Domain in DNS Lookup (toxicodendron .ru)"

• "ET TROJAN Observed Cobalt Strike Domain (abcdefghijkzz123 .servicedesks .net) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (stationacutwo .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (startperfectsolutions .com)"

• "ET MOBILE_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus-cb .ru)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (industrybuttonyoferwa .fun)"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (7o .ae)"

• "ET CURRENT_EVENTS DNS Query to TOAD Domain (mvhelp .cc)"

• "ET TROJAN Observed DarkComet RAT Domain (dekabristiney .fvds .ru in TLS SNI)"

• "ET TROJAN Android Fintech Related Domain in DNS Lookup (apitai .coccash .com)"

• "ET TROJAN Observed TA453 Domain (epibvgvoszemkwjnplyc .supabase .co in TLS SNI)"

• "ET TROJAN Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI)"

• "ET MOBILE_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus .ru)"

• "ET TROJAN Observed TA417 Domain (nestnewhome .com) in TLS SNI"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (dais7nsa .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (questionsapplicationbackup .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (writerospzm .shop)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (stckeringdkzpx .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (lineagelasserytailsd .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (importancedopz .shop in TLS SNI)"

• "ET TROJAN TA430/Andariel AndarLoader Related Activity M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (beatablydoxzcop .shop in TLS SNI)"

• "ET TROJAN Oyster Backdoor Domain in TLS SNI (retdirectyourman .eu)"

• "ET TROJAN Observed HailBot Domain (asdsdfjsdfsd .indy in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (blogvolleyballstatus .azurewebsites .net)"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn32 .space)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (curtainjors .fun)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (chhimi .com)"

• "ET TROJAN DarkGate CnC Activity (GET) M2"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (abandonnyskop .shop)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (lineferaline .com)"

• "ET TROJAN DNS Query to Lumma Domain (auctiondecadecontaii .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (changequestionstypejsonapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (richardflorespoew .shop in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (pixelsmith .shop)"

• "ET TROJAN Win32/Unknown Stealer Data Exfiltration Attempt"

• "ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2"

• "ET TROJAN SocGholish CnC Domain in DNS (* .donors .eucharisticjesus .net)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (frontendcodingtips .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (birngthemhomenow .co .il)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (demandlinzei .shop)"

• "ET TROJAN MacOS RustDoor Related CnC Domain in DNS Lookup (serviceicloud .com)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (r6pedihosi .website)"

• "ET CURRENT_EVENTS Fake Crypto Investing Domain in DNS Lookup (cryptowave .capital)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ndapromovideoslittle .pro)"

• "ET TROJAN Observed Magecart Domain (jeitoon .quest in TLS SNI)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (president-gov-lk .donwloaded .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (disappearsodsz .shop in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (iaidevrssfeed .centrualus .cloudapp .azure .com in TLS SNI)"

• "ET CURRENT_EVENTS Lucy Security - Credential Submission (set)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (metricsy .shop)"

• "ET TROJAN Possible Royal Road Payload Retrieval Attempt"

• "ET TROJAN Observed BMANAGER Domain (beonlineboo .com in TLS SNI)"

• "ET CURRENT_EVENTS Fake IRS Scam Domain in DNS Lookup (irs-ein-gov .us)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (juniirsoow .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (myanswerpronto .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (advertiq .shop)"

• "ET TROJAN TA430/Andariel NukeSped Backdoor Variant Server Response M2"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (3hhr8h2hx .top)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (specialnewspaper .com)"

• "ET CURRENT_EVENTS Successful Generic Phish 2024-02-12"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mofadividion .ptcl-gov .com)"

• "ET TROJAN Observed Lumma Stealer Domain (secretiveonnicuw .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (stablelightway .com)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (statisticsong .com)"

• "ET TROJAN BackConnect CnC Activity (Start VNC) M3"

• "ET TROJAN Observed Earth Krahang APT Domain (softupdate .xyz in TLS SNI)"

• "ET TROJAN OldGremlin/TA801 Domain in DNS Lookup (diadok .net)"

• "ET TROJAN Win32/saolei CnC Host Checkin"

• "ET WEB_SPECIFIC_APPS Possible Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt (CVE-2023-46805, CVE-2024-21887) M1"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (gxsicmj3l .top)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ratefacilityframw .fun)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (feighminoritsjda .shop)"

• "ET TROJAN Observed Allasenha/CarnavalHeist RAT Related Domain (nfe-digital .online) in TLS SNI"

• "ET TROJAN Cryptbot CnC DGA Domain (five5)"

• "ET TROJAN Observed Lumma Stealer Related Domain (palmeventeryjusk .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop)"

• "ET TROJAN Observed Suspected APT Domain (idfinfo .pw in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (myoptimasunlab .com)"

• "ET TROJAN DNS Query to Malicious Domain (upbit2024 .re .kr)"

• "ET TROJAN Observed Lumma Stealer Related Domain (willpoweragreebokkskiew .site in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (rdntocdns .com)"

• "ET TROJAN Observed Lumma Stealer Domain (parallelmercywksoffw .shop in TLS SNI)"

• "ET TROJAN PrivateLoader CnC Activity (GET)"

• "ET TROJAN Observed UNK_ConsoleCollie Domain (chemdl .ioskaishi .live) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (plaintediousidowsko .shop)"

• "ET TROJAN DNS Query to TA453 Domain (ndrrftqrlblfecpupppp .supabase .co)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (outpointsozp .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (woodfeetumhblefepoj .shop in TLS SNI)"

• "ET TROJAN Observed ACR Stealer Domain (pcvvf .xyz) in TLS SNI"

• "ET WEB_SPECIFIC_APPS Openmediavault Crontab Manipulation Remote Code Execution/Privilege Escalation (CVE-2013-3652)"

• "ET TROJAN Observed Lactrodectus Domain in TLS SNI"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (raiffeisen-cz .eu) in TLS SNI"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (vatleaflettrusteeooj .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (legderlivesapp .online)"

• "ET EXPLOIT OpenTSDB RCE in HTTP Request M1 (CVE-2023-25827)"

• "ET TROJAN VersaMem Webshell Authentication Attempt M1"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (strwawrunnygjwu .shop)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M4"

• "ET TROJAN Observed Lumma Stealer Related Domain (weiggheticulop .shop in TLS SNI)"

• "ET TROJAN DNS Query to Suspected APT Domain (idfinfo .pw)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (testquestionapplicationapi .azurewebsites .net)"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (poseidon .cool)"

• "ET TROJAN UTA0178 Domain in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (pollutiofactwoijk .shop in TLS SNI)"

• "ET TROJAN Suspected APT42/TA453 Related Domain in DNS Lookup (shorturling .live)"

• "ET MOBILE_MALWARE Observed Android/Mandrake CnC Domain (ricinus-cb .ru) in TLS SNI"

• "ET MOBILE_MALWARE Gigabud CnC Domain in DNS Lookup (bweri6 .cc)"

• "ET TROJAN Observed Lumma Stealer Related Domain (offerimagefancine .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (grassytaisol .shop in TLS SNI)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (ultraedit .info)"

• "ET TROJAN DNS Query to Kryptic Fake App Domain (cctvv2023 .9hlw .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (busbookingjbg .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (saratu .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (dancecmapleadsjwk .shop)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (execute shell command)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (deallerospfosu .shop)"

• "ET TROJAN SocGholish Domain in DNS Lookup (camps .topgunnbaseball .com)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (vaniloin .fun)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (specialtaskevents .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (qaquestions .azurewebsites .net)"

• "ET TROJAN ELF/crond CnC Request (GET)"

• "ET TROJAN Observed UNC1549/TA455 Domain (qaquestions .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (onionoowzwqm .shop)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (bestresulttostart .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (potentioallykeos .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (beatifulllhistory .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (technologyenterdo .shop in TLS SNI)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mofabn .ksewpk .com in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (sixt16)"

• "ET TROJAN Observed Lactrodectus Domain in TLS SNI"

• "ET TROJAN Observed DeerStealer Domain (gg2024 .com in TLS SNI)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (dailteeau .com)"

• "ET TROJAN Win32/ObserverStealer Sending Browser Related Information (Firefox)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (ndm2398asdlw .shop)"

• "ET TROJAN Observed TinyTurla Domain (caduff-sa .ch in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (prideconstituiiosjk .shop in TLS SNI)"

• "ET TROJAN DNS Query to Darkgate Domain (rockcreekdds .com)"

• "ET CURRENT_EVENTS ClickFix Domain in TLS SNI (daslkjfhi2 .shop)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (drinnkysoapmzv .shop)"

• "ET CURRENT_EVENTS Lucy Security - Phishing Landing Page M3"

• "ET TROJAN ZharkBot CnC Domain in DNS Lookup (warzone-meta .net)"

• "ET TROJAN DNS Query to TinyTurla Domain (jeepcarlease .com)"

• "ET MOBILE_MALWARE Observed Android Vultur/brunhilda Related Domain (cloudmiracle .store in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (civilianurinedtsraov .shop)"

• "ET TROJAN Unknown Loader CnC Domain in DNS Lookup (answerrsdo .shop)"

• "ET TROJAN Possible KV Botnet CnC Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (vivaciousdqugilew .shop)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (zoomzle .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (cooperatecliqueobstac .site in TLS SNI)"

• "ET TROJAN Win64/FakeUnity CnC Activity (POST)"

• "ET TROJAN PyRation Variant - Configuration Request"

• "ET TROJAN Observed Lumma Stealer Related Domain (detectordiscusser .shop in TLS SNI)"

• "ET TROJAN Observed DeerStealer Domain (authentificcatorgoolgle .com in TLS SNI)"

• "ET TROJAN Observed TA455 Domain in TLS SNI (vsliveagent .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (openapplicationcheck .azurewebsites .net in TLS SNI)"

• "ET TROJAN Sidewinder APT Related Backdoor Activity"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (cloudnetsofe .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (replacedoxcjzp .shop in TLS SNI)"

• "ET TROJAN Observed DeerStealer Domain (authenticator-googl .com in TLS SNI)"

• "ET TROJAN Observed EncryptHub Stealer Domain (win-rar .co in TLS SNI)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (mofa-gov-pk .donwloaded .com)"

• "ET TROJAN DNS Query to Magecart Domain (vidkimob .quest)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greentastellesqwm .shop)"

• "ET WEB_SPECIFIC_APPS QNAP quick.cgi uploaf_firmware_image Command Injection Attempt (CVE-2023-47218)"

• "ET TROJAN ClearFake CnC Domain in DNS Lookup (artservice .online)"

• "ET TROJAN Observed Lumma Stealer Related Domain (voicelighterrrepso .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (promsmotion .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (slammyslideplanntywks .xyz)"

• "ET TROJAN Malvertising/Nitrogen Loader Domain in DNS Lookup (saltysour .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (bargainnygroandjwk .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (smallrabbitcrossing .site in TLS SNI)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (googlecloudns .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (landdumpycolorwskfw .shop in TLS SNI)"

• "ET TROJAN AMOS CnC Exfiltration - /joinsystem (POST)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stripmarrystresew .shop)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (lilygovert91 .top)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (getsmallcount .com)"

• "ET MOBILE_MALWARE Observed Gigabud Domain (nnzf1 .cc in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (contintnetksows .shop)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (opmcm-gov-np .fia-gov .net in TLS SNI)"

• "ET TROJAN DNS Query to Magecart Domain (yanaloop .shop)"

• "ET TROJAN nspx30 Orchestrator CnC Checkin"

• "ET TROJAN [ANY.RUN] PlanetStealer CnC Checkin"

• "ET TROJAN Observed UNC1549/TA455 Domain (flighthelicopterahtest .azurewebsites .net in TLS SNI)"

• "ET TROJAN UAC-0050 Domain in DNS Lookup (davincigroup .online)"

• "ET TROJAN DNS Query to Malicious Domain (countrysvc .pe .kr)"

• "ET TROJAN Observed UNC1549/TA455 Domain (iaidevrssfeed .centralus .cloudapp .azure .com in TLS SNI)"

• "ET TROJAN Win32/Imposter 360 Internet Protection Activity (GET)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (binder-sa .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (supportyattraos .shop in TLS SNI)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (9gp .cc in TLS SNI)"

• "ET TROJAN Observed Merlin C2 Domain (cloud .keepasses .com in TLS SNI)"

• "ET TROJAN Observed DNS Query to Observed DNS Query to Malicious Domain (adblock2024 .shop) Domain"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (shawns-landscaping .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (awardlandscareposiw .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sweetsquarediaslw .shop)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (informupdate .uno)"

• "ET CURRENT_EVENTS Fake IRS Scam Domain (irs-ein-gov .us in TLS SNI)"

• "ET TROJAN Observed BMANAGER Domain (1-update-soft .com in TLS SNI)"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (monopoliafromyou .ru)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (javaruntime .azurewebsites .net)"

• "ET MOBILE_MALWARE Gigabud CnC Domain in DNS Lookup (bc2k .xyz)"

• "ET TROJAN Observed ClearFake Domain (cdnforfiles .xyz in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (javaruntimeversioncheckingapi .azurewebsites .net)"

• "ET TROJAN DNS Query to Latrodectus Domain (popfealt .one)"

• "ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M3"

• "ET TROJAN Observed UNC1549/TA455 Domain (testmanagementapis .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (femininiespywageg .shop)"

• "ET TROJAN Lazarus Group Domain in DNS Lookup (job4writers .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (directorryversionyju .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)"

• "ET TROJAN Allasenha/CarnavalHeist Related Domain (nfe-visualizer .app .br) in DNS Lookup"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (2n8rd3zz1 .top)"

• "ET TROJAN Observed DeerStealer Domain (authentificator-googl .com in TLS SNI)"

• "ET TROJAN Win32/SSLoad Tasking Request (POST)"

• "ET TROJAN ClearFake CnC Domain in DNS Lookup (drinkresources .rest)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (froytnewqowv .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (filmbondadminoswo .shop)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M13"

• "ET TROJAN Suspected TA401/AridViper APT BarbWire Backdoor Related Activity M1 (POST)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (blueselectorpage .com)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (dirtdrawingjsi .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (weaknessmznxo .shop in TLS SNI)"

• "ET TROJAN ZharkBot CnC Exfil in HTTP URI"

• "ET TROJAN RAZR Ransomware CnC Checkin"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pdddk .xyz)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (apphrquestions .azurewebsites .net)"

• "ET TROJAN Observed Magecart Domain (sewloot .click in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (informupdate .uno)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Supply Chain Attack Related Domain (hostpdf .co in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (onequestionsapicheck .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (princeaccessiblepo .shop in TLS SNI)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authentificatorgoogle .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (vodog .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (deadpanstupiddyjjuwk .shop in TLS SNI)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (dais7nsa .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (rejectbettysmartws .shop)"

• "ET TROJAN Observed ACR Stealer Domain (dervinko .biz) in TLS SNI"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (tired-shareholders-reservoir-talked .trycloudflare .com)"

• "ET TROJAN Observed ClearFake Domain (artservice .online in TLS SNI)"

• "ET TROJAN Suspected Fin7 Related Domain (cdn35 .space) in TLS SNI"

• "ET TROJAN Observed UNC1151 Related Domain (goudieelectric .shop) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (singerreasonnbasldd .xyz in TLS SNI)"

• "ET TROJAN Patchwork APT CnC Activity (umnome)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (visitscloud .com)"

• "ET TROJAN Observed TA453 Domain in TLS SNI"

• "ET CURRENT_EVENTS PigButcher Credential Phish Landing Page M3 2024-08-05"

• "ET TROJAN Cryptbot CnC DGA Domain (fourt14)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (callosallsaospz .shop)"

• "ET TROJAN Observed Moonpeak RAT Related Domain (yoiroyse .store) in TLS SNI"

• "ET TROJAN Observed DeerStealer Domain (chromstore-authentificator .com in TLS SNI)"

• "ET TROJAN Observed Fenix Botnet Domain (tramites-sat .com .mx in TLS SNI)"

• "ET TROJAN Win32/SSLoad Tasking Result"

• "ET TROJAN DNS Query to Ducktail APT Domain (123online .uk)"

• "ET TROJAN [ANY.RUN] RadX RAT Keep-Alive Activity (POST)"

• "ET TROJAN Win32/Generic Loader Activity (GET)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain (prorecieve .com) in TLS SNI"

• "ET CURRENT_EVENTS ResumeLooter Domain in DNS Lookup (8t .ae)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (integratedblognews .azurewebsites .net)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (paknavy .paknavy .live in TLS SNI)"

• "ET TROJAN Malicious Typo Squatting Domain in DNS Lookup (puutty .org)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mtss .bol-south .org in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (identifycheckapplications .azurewebsites .net in TLS SNI)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (securecrt .vip)"

• "ET TROJAN DNS Query to Malware Delivery Related Domain (maintenance-princess-musical-vocational .trycloudflare .com)"

• "ET TROJAN Observed MageCart Domain (neznlink .store in TLS SNI)"

• "ET TROJAN DNS Query to ClickFix Domain (oazevents .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (logsapimanagements .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (tayakay .com)"

• "ET TROJAN Panther Stealer CnC Domain in DNS Lookup (api-lofy .xyz)"

• "ET TROJAN Win32/Koi Loader/Stealer CnC Domain in DNS Lookup (podologie-werne .de)"

• "ET TROJAN Lazarus Group Backdoor CnC Checkin M1"

• "ET CURRENT_EVENTS Generic Credential Phish Landing Page 2024-06-13"

• "ET TROJAN Observed Malicious Domain (pdfmicrosoft .ddns .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (notebooktexts .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (marathonbeedksow .shop in TLS SNI)"

• "ET TROJAN Ailurophile Infostealer Data Exfiltration Attempt M2"

• "ET TROJAN BunnyLoader 3.0 Tasking Checkin"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (disagreemenywyws .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (composepayyersellew .shop)"

• "ET TROJAN Win32/Koi Loader CnC Checkin M2"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (trollsburninginhell .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (ohfantasyproclaiwlo .shop)"

• "ET TROJAN DNS Query to Magecart Domain (znanielec .online)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (riffledopspzio .shop)"

• "ET TROJAN Winnti CnC Activity (Outbound)"

• "ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M3"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (daslkjfhi2 .lol)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (trendset .website)"

• "ET TROJAN Observed Lumma Stealer Related Domain (disappointcredisotw .shop in TLS SNI)"

• "ET TROJAN Android Fintech Related Domain in DNS Lookup (qt .qtzhreop .com)"

• "ET SMTP Message Containing Windows Performance Analyzer URI In Message Body - Possible NTLM Hash Leak Attempt"

• "ET TROJAN SocGholish CnC Domain in DNS (* .fans .smalladventureguide .com)"

• "ET TROJAN DNS Query to AMOS Related Domain (figma .lat)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (iaidevrssfeed .centrualus .cloudapp .azure .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (logupdatemanagementapi .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (designlq .com)"

• "ET TROJAN AMOS CnC Exfiltration - /p2p (POST) M1"

• "ET CURRENT_EVENTS DNS Query to TA455 Domain (vsliveagent .com)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (cejecuu4 .xyz)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (speedchaoptimise .com)"

• "ET TROJAN Possible TA399/SideWinder Related Empty .rtf Inbound"

• "ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M1"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (careitservices .paknvay-pk .net in TLS SNI)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (foundit .asia in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (uaeaircheckon .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (macabrecondfucews .shop) in TLS SNI"

• "ET CURRENT_EVENTS ClickFIx Domain in DNS Lookup (peskpdfgif .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (foodypannyjsud .shop in TLS SNI)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET CURRENT_EVENTS [TW] Possible Crypto Wallet Drainer JS M2"

• "ET TROJAN Win32/ProcessKiller CnC - Server Side"

• "ET TROJAN Observed Lazarus Group Domain (rginfotechnology .com) in TLS SNI"

• "ET TROJAN Observed Magecart Domain (intrgqc .site in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (aitcaid .com)"

• "ET TROJAN Observed Xworm Domain (223 .ip .ply .gg in TLS SNI)"

• "ET TROJAN Suspected Turla APT Kazuar Backdoor Related Activity"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (alcojoldwograpciw .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (gloomopiniosnforuw .xyz in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (flockkydwos .shop)"

• "ET MOBILE_MALWARE Android/Ngate Domain in DNS Lookup (george .tbc-app .life)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (vipchattingonline .com in TLS SNI)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (c08d .top)"

• "ET TROJAN Moonpeak RAT Related Domain in DNS Lookup (yoiroyse .store)"

• "ET TROJAN WaveStealer Related CnC Domain in DNS Lookup (wave-assistant .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (arquestionsapi .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (personalizationsurvey .azurewebsites .net)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (clickandanalytics .com)"

• "ET TROJAN Suspected Kapeka/ICYWELL Backdoor Server Response (read from file)"

• "ET TROJAN Observed APT42/TA453 Related Domain (wulpfsrqupnuqorhexiw .supabase .co in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (personalitytestquestionapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Possible LINE RUNNER Backdoor Connection Attempt"

• "ET TROJAN Observed Lumma Stealer Domain (innerverdanytiresw .shop) in TLS SNI"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (jupyternotebookcollections .azurewebsites .net)"

• "ET TROJAN DNS Query to MageCart Domain (rijtech .shop)"

• "ET TROJAN Observed Magecart Domain (avitech .site in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (cssmagic .shop)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (germanclics .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (investigation04 .session-out .com)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (stamppreewntnq .shop)"

• "ET TROJAN Crimson RAT CnC Victim Details Exfil"

• "ET TROJAN Observed Social Media Malvertising Related Domain (evotophoto .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (herdbescuitinjurywu .shop in TLS SNI)"

• "ET CURRENT_EVENTS Successful Apple iCloud Phish May 08 2017"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Observed Android Fintech Related Domain (qt .qtzhreop .com in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (helloehoes .com)"

• "ET TROJAN Polyfill Malicious Redirect Domain (kuurza .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (citizencenturygoodwk .shop in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (srilanka-navy .lforvk .com)"

• "ET TROJAN Observed Malvertising Domain (doxy .ws in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (questionsurveyappserver .azurewebsites .net)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (flyspecialline .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (compilecoppydkewsw .xyz in TLS SNI)"

• "ET TROJAN DNS Query to PocoProxy C2 Domain (googlespeedtest33 .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (statmaster .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (illnesmunxkza .shop)"

• "ET TROJAN MacOS RustDoor Related Activity M2 (POST)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M11"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (egisela .com)"

• "ET CURRENT_EVENTS Parrot TDS Cleared Response M2"

• "ET TROJAN Observed Malicious Typo Squatting Domain (puutty .org) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (uaeairchecks .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lazarus Group Domain (job4writers .com) in TLS SNI"

• "ET TROJAN Lumma Stealer Related Domain in DNS Lookup (carstirgapcheatdeposwte .pw)"

• "ET TROJAN Imposter Interpol Stealer CnC Checkin"

• "ET TROJAN Suspected TA401/AridViper APT BarbWire Backdoor Related Activity M2 (POST)"

• "ET TROJAN BunnyLoader 3.0 Initial Checkin"

• "ET TROJAN Observed Lumma Stealer Related Domain (quotakickerrywos .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (consciouosoepewmausj .site)"

• "ET TROJAN Pure Logs Stealer/Fenix Botnet CnC Activity (GET) M3"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (dgms .paknavy-gov .com in TLS SNI)"

• "ET TROJAN BunnyLoader Stealer Module Activity (POST)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (futureddospzmvq .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (statlstic .shop)"

• "ET TROJAN Observed Malicious Domain (nidnaver .help in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (apidevst .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (flockkydwos .shop in TLS SNI)"

• "ET TROJAN Khepri CnC Domain in DNS Lookup (finalshell .me)"

• "ET TROJAN Observed Lumma Stealer Related Domain (liabilityarrangemenyit .shop in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (paknavy .paknavy .live)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (blogvolleyballstatusapi .azurewebsites .net)"

• "ET TROJAN Observed Wordpress Social Warfare Plugin Exploit Related Domain (pegasusdate .com in TLS SNI)"

• "ET TROJAN Observed HailBot Domain (wendykortiz .gopher in TLS SNI)"

• "ET TROJAN Qwerty Stealer Data Exfiltration Attempt M1"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (notice .portdedjibouti .live in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (regionuaequestions .azurewebsites .net)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (blacksaltys .com)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (beansdeals-static .s3 .amazonaws .com)"

• "ET TROJAN JS/UnkRAT RC4 Encrypted Payload Inbound"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (playerofsunshine .com)"

• "ET TROJAN SocGholish Domain in TLS SNI (ebooks .ferrelljoe .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (questionsapplicationapi .azurewebsites .net)"

• "ET TROJAN Observed TrollAgent Domain (winters .r-e .kr in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (destructionloserods .shop)"

• "ET TROJAN Private Loader Related Activity (GET)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (training .detru .info)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (magaanthem .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (guuynsqpwsima .shop)"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (mafw .store)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (mailmofagovmm .mofa .email in TLS SNI)"

• "ET TROJAN Suspected APT42/TA453 TAMECAT Loader Related Activity (POST)"

• "ET TROJAN Observed Remcos Related Domain (meetre1ms .freeddns .org in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (theonlyreasonwhywe .pro)"

• "ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (javaruntimeversionchecking .azurewebsites .net)"

• "ET TROJAN Observed CCoreDoor C2 Domain (message .ooguy .com in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (joyfullday .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (suitcaseacanehalk .shop in TLS SNI)"

• "ET TROJAN Allakore RAT CnC Domain in DNS Lookup (chaucheneguer .com)"

• "ET TROJAN PyRation Variant - Command Sent to Client"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (absentconvicsjawun .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (logupdatemanagementapi .azurewebsites .net)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (parallelmercywksoffw .shop)"

• "ET TROJAN Suspected Fin7 Related Domain (cdn32 .space) in TLS SNI"

• "ET TROJAN Win32/ObserverStealer Sending System Related Information"

• "ET TROJAN TA430/Andariel NukeSped Backdoor Variant Activity M2"

• "ET TROJAN DNS Query to TA453 Domain (coral-polydactyl-dragonfruit .glitch .me)"

• "ET TROJAN Observed Lumma Stealer Related Domain (computerexcudesp .shop in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (packedbrick .com)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (notice .portdedjibouti .live)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (beatablydoxzcop .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (episodepspzmp .shop)"

• "ET TROJAN Hello2Malware (H2MLoader) get_base64 Payload Retrieval Attempt"

• "ET TROJAN Observed Lumma Stealer Related Domain (doughtdrillyksow .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (bargainnykwo .shop in TLS SNI)"

• "ET TROJAN SocGholish CnC Domain in DNS Lookup (* .contest .printondemandmerchandise .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (holicisticscrarws .shop in TLS SNI)"

• "ET TROJAN Patchwork CnC Domain in DNS Lookup (hengtian .nihaoucloud .org)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (promsmotion .com)"

• "ET TROJAN Observed Malicious Domain (naverscorp .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (berrebyre .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (handsomelydicrwop .shop)"

• "ET TROJAN DNS Query to Payload Downloader Domain (900cap .blogspot .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (anontech .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (smallelementyjdui .shop in TLS SNI)"

• "ET TROJAN APT Related CR4T Dropper Activity M1 (GET)"

• "ET TROJAN Observed Lumma Stealer Related Domain (handyxczos .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (handyxczos .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (chartismart .com)"

• "ET TROJAN HTTP Request to URL Ending in Payload .bin"

• "ET TROJAN Observed Lumma Stealer Related Domain (unwielldyzpwo .shop in TLS SNI)"

• "ET TROJAN DNS Query to Expiro Related Domain (przvgke .biz)"

• "ET TROJAN Observed FakeExt Domain (prod .jslibrary .sbs) in TLS SNI"

• "ET TROJAN Earth Kapre/RedCurl CnC Domain (preslive .cn .alphastoned .pro) in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Related Domain (barebrilliancedkoso .shop in TLS SNI)"

• "ET TROJAN Observed Observed pcTattletale Spyware Domain (pctattletalev2 .s3 .amazonaws .com in TLS SNI)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M19"

• "ET TROJAN Observed Lumma Stealer Related Domain (bassizcellskz .shop in TLS SNI)"

• "ET TROJAN Observed TA453 Domain (coral-polydactyl-dragonfruit .glitch .me in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (bindceasdiwozx .shop in TLS SNI)"

• "ET TROJAN Observed TA453 Related Domain in TLS SNI"

• "ET TROJAN TheMoon CnC Checkin"

• "ET TROJAN Observed Lumma Stealer Related Domain (fiondationkvowos .xyz in TLS SNI)"

• "ET TROJAN CloudAtlas APT Related Maldoc Activity M5 (GET)"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup"

• "ET TROJAN Observed Lumma Stealer Related Domain (restlesslifestyewlo .shop in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (dgmp-paknavy .mod-pk .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (salesguru .online)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (bbr-promo .s3 .amazonaws .com)"

• "ET TROJAN Win32/Cobalt Strike CnC Activity M2"

• "ET TROJAN Observed Lumma Stealer Related Domain (ballottynsjm .shop in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in DNS Lookup (egisela .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (advertisedszp .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (respectabledpcs .shop in TLS SNI)"

• "ET TROJAN Observed Magecart Domain (oitool .shop in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (ned .newnotification .server .korea in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (shelterryujxo .shop in TLS SNI)"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (brickedpack .com)"

• "ET CURRENT_EVENTS Savvy Seahorse CNAME TDS Related Domain in DNS Lookup (b36cname .site)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (advertisedszp .shop)"

• "ET TROJAN Social Media Malvertising Related Domain in DNS Lookup (evotophoto .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (countora .shop)"

• "ET TROJAN Possible HijackLoader Second Stage PNG Retrieval"

• "ET TROJAN Observed Lumma Stealer Related Domain (bouncedgowp .shop in TLS SNI)"

• "ET TROJAN Zloader Related CnC Domain in DNS Lookup (wesco .live)"

• "ET TROJAN Observed Lumma Stealer Related Domain (speedparticipatewo .shop in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (trendori .shop)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (desiqnia .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (rainbowmynsjn .shop)"

• "ET TROJAN DonotGroup Pult Downloader Activity (POST) M7"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (jsincloud .com)"

• "ET INFO PDQ Remote Management HTTP Header Observed (x-pdq-key-ids)"

• "ET CURRENT_EVENTS Parrot TDS Domain in TLS SNI (trust .resourcehost .net)"

• "ET TROJAN Observed TA417 Domain (centralizebd .com) in TLS SNI"

• "ET TROJAN Possible W4SP Stealer CnC Checkin"

• "ET TROJAN Observed Dora RAT Domain (kmobile .bestunif .com) in TLS SNI"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (denaumtz .com)"

• "ET TROJAN Lazarus Group Backdoor CnC Checkin M2"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (hookybeamngwskow .xyz)"

• "ET TROJAN Iluria Stealer CnC Domain in DNS Lookup (nikkistealer .shop)"

• "ET TROJAN DNS Query to Earth Krahang APT Domain (update .windows .server-microsoft .com)"

• "ET TROJAN Cobalt Strike Malleable C2 (Amazon Profile)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain (allsecurehosting .com) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (roundpleaddso .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (cottageaskyflolewk .shop in TLS SNI)"

• "ET CURRENT_EVENTS Observed Microsoft Phishing Domain (iapparel .top) in TLS SNI"

• "ET TROJAN Observed UNC1549/TA455 Domain (browsercheckap .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (beetrootculture .com)"

• "ET CURRENT_EVENTS Metamask Credential Phish Landing Page 2024-01-24"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (biggerfun .org)"

• "ET TROJAN DNS Query to Payload Downloader Domain (backpupcpa .blogspot .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shortsvelventysjo .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (peanutclutchlowwow .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shootydowtqosm .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (engineeringrssfeed .azurewebsites .net)"

• "ET MOBILE_MALWARE Observed GoldDigger Domain (ks8cb .cc in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (regionuaequestions .azurewebsites .net in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (taskscompletedlists .com)"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (javascrip12 .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (flimsybrieffykmew .shop in TLS SNI)"

• "ET MOBILE_MALWARE Observed Android/Mandrake CnC Domain (toxicodendron .ru) in TLS SNI"

• "ET TROJAN DNS Query to AMOS Related Domain (iina-app .lat)"

• "ET TROJAN Observed Lumma Stealer Related Domain (invisibledovereats .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (jaipurstylo .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (onequestions .azurewebsites .net in TLS SNI)"

• "ET WEB_SPECIFIC_APPS Server Response Containing Windows Performance Analyzer URI - Possible NTLM Hash Leak Attempt"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (canroura .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (coffeeonlineshoping .azurewebsites .net)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .team .jessicabarrett .com)"

• "ET TROJAN Observed Malvertising Domain (parsic .org) in TLS SNI"

• "ET TROJAN Suspected APT42/TA453 Related Domain in DNS Lookup (shorting-urling .live)"

• "ET TROJAN Observed Earth Hundun Group Waterbear/Deuterbear Domain (showgyella .quadrantbd .com) in TLS SNI"

• "ET TROJAN [ANY.RUN] Gh0stRAT.Gen Server Response (SweetSpecter)"

• "ET TROJAN Observed Gamaredon Domain (plutoniumo .ru in TLS SNI)"

• "ET TROJAN Observed Malware Delivery Related Domain (nail-lists-compact-project .trycloudflare .com in TLS SNI)"

• "ET TROJAN Observed ACR Stealer Domain (ptdrf .xyz) in TLS SNI"

• "ET TROJAN Observed Lumma Domain (auctiondecadecontaii .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (upsettymsnqwk .shop)"

• "ET EXPLOIT OpenTSDB RCE in HTTP Request M2 (CVE-2023-25827)"

• "ET TROJAN Cryptbot CnC DGA Domain (two2)"

• "ET CURRENT_EVENTS ClearFake Domain in TLS SNI (bigdownload .xyz)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (gayionsd .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (queryfindquestions .azurewebsites .net)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (marathonbeedksow .shop)"

• "ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M1"

• "ET TROJAN Generic Stealer Checkin"

• "ET MOBILE_MALWARE Observed GoldDigger Domain (hzc5 .xyz in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (dgpr .paknvay-pk .net)"

• "ET TROJAN Observed MageCart Domain (vidbent .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (blockbeerman .fun in TLS SNI)"

• "ET TROJAN Brosql Stealer Browser Cookie Exfil"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (myoptimasunlab .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (alcojoldwograpciw .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (aetherial .store)"

• "ET TROJAN Observed Lumma Stealer Related Domain (rankrandomotherwjsui .shop in TLS SNI)"

• "ET CURRENT_EVENTS Observed Suspected APT Related Phish Domain (imfeurope-aml .org in TLS SNI)"

• "ET TROJAN DNS Query to Magecart Domain (reftop .click)"

• "ET TROJAN FakeExt CnC Domain in DNS Lookup (fastify .elfaker .workers .dev)"

• "ET TROJAN DNS Query to DarkComet RAT Domain (patrikbob100 .fvds .ru)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (healthproline .pro)"

• "ET TROJAN Observed Lumma Stealer Related Domain (vehicledropliberwls .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (spitechallengddwlsv .xyz)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (saxymiss .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (qaquestionsapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (budgetttysnzm .shop in TLS SNI)"

• "ET TROJAN DNS Query to Lumma Stealer Domain (liabiliytshareodlkv .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (flimsybrieffykmew .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (relaxtionflouwerwi .shop) in TLS SNI"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (acuiplast .com)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (edveha .com)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (apidevwa .com)"

• "ET TROJAN Win32/Neshta Variant Related Activity (POST)"

• "ET TROJAN BunnyLoader 3.0 DBID Checkin"

• "ET TROJAN Possible UPSTYLE Command Attempt"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cinemaclinicttanwk .shop)"

• "ET TROJAN DNS Query to Merlin C2 Domain (cloud .keepasses .com)"

• "ET TROJAN Suspected UTA0178 Domain in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (birdpenallitysydw .shop)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (sarabanmithnavy .tni-mil .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (importancedopz .shop)"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (agov-ch .net)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (expertcloud .xyz)"

• "ET TROJAN Observed Allasenha/CarnavalHeist RAT Related Domain (nfe-digital .digital) in TLS SNI"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (greenfastline .com)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in DNS Lookup (edveha .com)"

• "ET TROJAN Win32/Unknown InfoStealer CnC Checkin"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mtss .bol-south .org)"

• "ET CURRENT_EVENTS Observed Suspected APT Related Phish Domain (mfa-office .org in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (surveyonlinetestapi .azurewebsites .net)"

• "ET TROJAN [ANY.RUN] NjRat (tXRAT v.2.3R) Server Sends Plugin to Client"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn31 .space)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (changequestiontypesapi .azurewebsites .net)"

• "ET CURRENT_EVENTS Fake IRS Scam Domain (ustaxnumber .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (demonstationfukewko .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (exertcreatedadnndjw .xyz)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (boeisurveyapplications .azurewebsites .net)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (articon .website)"

• "ET TROJAN Rust HackTool CnC Activity (Inbound)"

• "ET TROJAN Koadic CnC Exfiltration (POST)"

• "ET WEB_SPECIFIC_APPS Joomla Improper Access Control to Webservice Endpoints (CVE-2023-23752)"

• "ET TROJAN Observed ClearFake Domain (pchelprowizard .com in TLS SNI)"

• "ET TROJAN DNS Query to Malicious Domain (kakaoaccouts .store)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (commerce-gov-pk .directt888 .com in TLS SNI)"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (agov-ch .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (datawiz .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (episodepspzmp .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (surprisemakedjukenw .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (peasanthovecapspll .shop in TLS SNI)"

• "ET TROJAN 9002 RAT CnC Activity (POST)"

• "ET TROJAN Oyster Backdoor Domain in TLS SNI (codeforprofessionalusers .com)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authenticcator-descktop .com)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (mailrta .mfagov .org)"

• "ET TROJAN TA399 SideWinder APT CnC Domain in DNS Lookup (www-army-mil-bd .dirctt88 .co)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (ashleypuerner .com)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (majordatabases .lat)"

• "ET INFO PDQ Remote Management User-Agent Observed (PDQ rover)"

• "ET TROJAN Observed MageCart Domain (mistlink .online in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (whispedwoodmoodsksl .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (audioservicetestapi .azurewebsites .net)"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (qu3 .cc in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in DNS Lookup (millyscroqwp .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (jewelassertivebop .fun in TLS SNI)"

• "ET TROJAN Observed KrustyLoader Domain (farstream .org) in TLS SNI"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain (oncloud-analytics .com) in TLS SNI"

• "ET TROJAN Observed Malicious Domain (navigation .cc in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (statisticplatform .com)"

• "ET TROJAN Observed UNC1549/TA455 Domain (manpowerfeedapijson .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Konni APT Domain (settlores .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (panameradovkews .xyz)"

• "ET TROJAN Observed Lumma Stealer Related Domain (miracledzmnqwui .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stiffraspyofkwsl .shop)"

• "ET TROJAN Gamaredon CnC Domain in DNS Lookup (wilderness-activists-gazette-purse .trycloudflare .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (macabrecondfucews .shop)"

• "ET TROJAN Win32/Koi Loader CnC Checkin M3"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (frontendcodingtips .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (gametuners .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (codcraft .shop)"

• "ET TROJAN Observed Iluria Stealer Domain (badgeshop .site) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (varianntyfeecterd .shop in TLS SNI)"

• "ET CURRENT_EVENTS LandUpdate808 Inject Inbound"

• "ET TROJAN Observed Lumma Stealer Related Domain (willingyhollowsk .shop in TLS SNI)"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (rb-62d3a .tbc-app .life) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (varianntyfeecterd .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (enthusiandsi .shop)"

• "ET CURRENT_EVENTS Fake Browser Update Domain in TLS SNI (bestdoctornearme .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (assumptionflattyou .shop in TLS SNI)"

• "ET TROJAN Async RAT CnC Activity (GET)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (knoxvillevideoproductions .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (oventoolyeditiiow .xyz in TLS SNI)"

• "ET TROJAN Observed ACR Stealer Domain (frgk .xyz) in TLS SNI"

• "ET TROJAN DNS Query to Konni APT Domain (settlores .com)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (www-army-mil-bd .dirctt88 .co in TLS SNI)"

• "ET TROJAN Observed Expiro Domain (nextroundst .com in TLS SNI)"

• "ET TROJAN Observed UNC1549/TA455 Domain (changequestiontypesapi .azurewebsites .net in TLS SNI)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain in DNS Lookup (dev-clientservice .com)"

• "ET TROJAN SocGholish CnC Domain in DNS (* .partners .gloriadeicr .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (unhappytidydryypwto .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (entitlementappwo .shop in TLS SNI)"

• "ET TROJAN Cryptbot CnC DGA Domain (for4)"

• "ET EXPLOIT OpenTSDB RCE in HTTP Request M2 (CVE-2023-25826)"

• "ET TROJAN Observed ClearFake Domain (zerosoftware .tech in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (arriveoxpzxo .shop in TLS SNI)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (dataofpages .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (grandmuseimhalltso .shop in TLS SNI)"

• "ET TROJAN DNS Query to MageCart Domain (ctotech .store)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (doughtdrillyksow .shop)"

• "ET TROJAN Observed UNC1549/TA455 Domain (notebooktexts .azurewebsites .net in TLS SNI)"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn38 .space)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (altnametestapi .azurewebsites .net)"

• "ET TROJAN DNS Query to AMOS Related Domain (sipapp .lat)"

• "ET TROJAN Observed Mint Stealer Domain (mint-c2 .top) in TLS SNI"

• "ET TROJAN DFKRAT CnC Checkin M2"

• "ET TROJAN UNK_ConsoleCollie CnC Domain in DNS Lookup (chemdl .gangtao .live)"

• "ET TROJAN Observed Lumma Stealer Related Domain (geneticsockkdwlsaw .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bargainnykwo .shop)"

• "ET TROJAN Observed Expiro Domain (knjghuig .biz in TLS SNI)"

• "ET TROJAN Lumma Stealer Domain in TLS SNI (juniirsoow .shop)"

• "ET TROJAN Observed Cheana Stealer Domain (warpvpn .net) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (braidfadefriendklypk .site)"

• "ET TROJAN Observed Lumma Stealer Related Domain (riffledopspzio .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (wifeplasterbakewis .shop in TLS SNI)"

• "ET TROJAN Malicious Loader Related Activity (GET)"

• "ET CURRENT_EVENTS DNS Query to TA455 Domain (teledyneflir.com .de)"

• "ET TROJAN Earth Preta PUBLOAD Activity M3"

• "ET TROJAN Observed Malicious Domain (upbit-service .pe .kr in TLS SNI)"

• "ET TROJAN DNS Query to Malicious Domain (navigation .cc)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (affecthorsedpo .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (disappointcredisotw .shop)"

• "ET TROJAN Malicious Loader Related Activity Response"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (chartismart .com)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain (dev-clientservice .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (ablesulkyfirstyews .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (paperryszjxuo .shop)"

• "ET TROJAN Android Fintech Related Domain in DNS Lookup (cy .amorcash .com)"

• "ET TROJAN Oyster Backdoor Domain in DNS Lookup (postmastersoriginals .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (shawns-landscaping .com)"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (ahha-asset .s3 .ap-northeast-2 .amazonaws .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (jaipurstylo .com)"

• "ET TROJAN Observed Cheana Stealer Domain (ganache .live) in TLS SNI"

• "ET TROJAN Malvertising/Nitrogen Loader Domain (giaoanso .com) in TLS SNI"

• "ET TROJAN WaveStealer Related CnC Domain in DNS Lookup (wavebysudryez .fr)"

• "ET TROJAN Python Typosquatting Domain (files .pypihosted .org) in TLS SNI"

• "ET TROJAN Observed Malvertising Domain (advannced-ip-scanner .com in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (landownerryparaxodwo .xyz)"

• "ET TROJAN Observed Lumma Stealer Related Domain (ndapromovideoslittle .pro in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (notoriousdcellkw .shop in TLS SNI)"

• "ET TROJAN Observed Cryptbot Domain (rzfift15ht .top in TLS SNI)"

• "ET TROJAN UAC-0006 Related Domain in DNS Lookup (rafraystore .ru)"

• "ET CURRENT_EVENTS Balada Domain in TLS SNI (statisticsplatform .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (tlymxvx .top)"

• "ET TROJAN Win32/MarioLoader Login Panel"

• "ET TROJAN Observed Lumma Stealer Related Domain (ammycanedpors .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (deadpanstupiddyjjuwk .shop)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (manpowerfeedapijson .azurewebsites .net)"

• "ET TROJAN Observed Lumma Stealer Related Domain (injurypiggyoewirog .shop in TLS SNI)"

• "ET TROJAN Mint Stealer CnC Domain in DNS Lookup (ashvgcgfxdfcgvcgfdcg .best)"

• "ET TROJAN Earth Hundun Group Waterbear/Deuterbear CnC Domain in DNS Lookup (cloudflaread .quadrantbd .com)"

• "ET TROJAN ZharkBot CnC Domain in DNS Lookup (solutionhub .cc)"

• "ET TROJAN DNS Query to ClearFake Domain (pchelprwizzards .com)"

• "ET MOBILE_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus-ca .ru)"

• "ET TROJAN TA417 Related Domain in DNS Lookup (taishanlaw .com)"

• "ET TROJAN HTTP POST with Suspicious User-Agent Observed - Possible ZLoader Activity M2"

• "ET TROJAN 3proxy Backdoor CnC Domain in DNS Lookup (catalog .micrisoftdrivers .com)"

• "ET CURRENT_EVENTS Possible Microsoft Phishing HTML Class Tag"

• "ET MOBILE_MALWARE Observed Android/Ngate Domain (app .mobil-csob-cz .eu) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain (facilitycoursedw .shop in TLS SNI)"

• "ET TROJAN Observed Malicious Domain (naveralert .com in TLS SNI)"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .partners .gloriadeicr .com in TLS SNI)"

• "ET TROJAN Observed Suspected APT Domain (idfleaks .info in TLS SNI)"

• "ET TROJAN Win32/Koi Loader CnC Checkin M1"

• "ET TROJAN ACR Stealer CnC Domain in DNS Lookup (pbdbj .xyz)"

• "ET TROJAN Suspected FIN7 Related domain in DNS Lookup (cdn33 .space)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (notebooktextcheckings .com)"

• "ET TROJAN Observed Patchwork Domain (centling .nihaoucloud .org in TLS SNI)"

• "ET TROJAN OldGremlin/TA801 Domain in TLS SNI (diadok .net)"

• "ET TROJAN Oyster Backdoor Domain in DNS Lookup (codeforprofessionalusers .com)"

• "ET TROJAN TrollAgent CnC Domain in DNS Lookup (ar .kostin .p-e .kr)"

• "ET TROJAN DNS Query to Malicious Domain (cloudown .store)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (specialcraftbox .com)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (technologggisp .shop)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (r6pedihosi .website)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (vesselcultiralkettlw .shop)"

• "ET WEB_SPECIFIC_APPS ReCrystallize Server DownloadFile.aspx Abuse"

• "ET TROJAN Observed Lumma Stealer Related Domain (incredibleextedwj .shop in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shelterryujxo .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (affordcharmcropwo .shop in TLS SNI)"

• "ET TROJAN Horabot Payload Inbound"

• "ET CURRENT_EVENTS Observed ResumeLooter Domain (iimjobs .asia in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (affecthorsedpo .shop in TLS SNI)"

• "ET TROJAN Patchwork CnC Domain in DNS Lookup (xinhuanet .nihaoucloud .org)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (srilankanavy .ksew .org in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (teentytinyjeo .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (stimultaionsppzv .shop)"

• "ET CURRENT_EVENTS UEFA EURO 2024 Survey Landing Page 2024-06-11"

• "ET TROJAN Observed UNC1549/TA455 Domain (helicopterahtests .azurewebsites .net in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Domain (propller .b-cdn .net in TLS SNI)"

• "ET TROJAN Poseidon Stealer Related Domain in DNS Lookup (agov-access .com)"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain in DNS Lookup (allsecurehosting .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (colorfulequalugliess .shop in TLS SNI)"

• "ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)"

• "ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M2"

• "ET TROJAN DNS Query to Lumma Stealer Domain (ohfantasyproclaiwlo .shop)"

• "ET TROJAN Observed Earth Krahang APT Domain (happy .gitweb .cloudns .nz in TLS SNI)"

• "ET TROJAN Blister Loader Cobalt Strike C2 Profile M8"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (gloomopiniosnforuw .xyz)"

• "ET TROJAN Observed Payload Downloader Domain (900cap .blogspot .com in TLS SNI)"

• "ET TROJAN Observed TinyTurla Domain (thefinetreats .com in TLS SNI)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (dgms .paknavy-gov .com)"

• "ET TROJAN Observed Fenix Botnet Domain (citas-sregob-mexico .com in TLS SNI)"

• "ET TROJAN BunnyLoader 3.0 CID Checkin"

• "ET TROJAN DNS Query to Lumma Stealer Domain (verif .dlvideosfre .click)"

• "ET TROJAN Observed Lumma Stealer Domain (stickyyummyskiwffe .shop) in TLS SNI"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (hhic .top)"

• "ET TROJAN Sharp Panda APT Related Domain in DNS Lookup (openxmlformats .shop)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (interactiveuidevelopment .com)"

• "ET TROJAN Observed Qwerty Stealer Domain (mailservicess .com) in TLS SNI"

• "ET TROJAN Observed Lumma Stealer Related Domain in TLS SNI (referralpublicationjk .pw)"

• "ET TROJAN Observed Lumma Stealer Related Domain (excellentdiwdu .shop in TLS SNI)"

• "ET TROJAN DNS Query to AMOS Related Domain (skylum .store)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (nijanse .com)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (helicoptersahtests .azurewebsites .net)"

• "ET TROJAN Observed FakeExt Domain (fastify .elfaker .workers .dev) in TLS SNI"

• "ET TROJAN Microsoft Outlook Requesting .rtf"

• "ET TROJAN Observed Malvertising Domain (reclaimmycredit .com) in TLS SNI"

• "ET TROJAN KrustyLoader CnC Domain in DNS Lookup (bigtimeassets .s3 .amazonaws .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (lighterepisodeheighte .fun in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (piedsiggnycliquieaw .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (unhappytidydryypwto .shop)"

• "ET CURRENT_EVENTS LandUpdate808 Domain in TLS SNI (e2sky .com)"

• "ET CURRENT_EVENTS ClickFix Domain in DNS Lookup (daslkjfhi2 .shop)"

• "ET TROJAN DNS Query to Malicious Domain (mofamail .homes)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (unwielldyzpwo .shop)"

• "ET CURRENT_EVENTS ClearFake Domain in DNS Lookup (dais7nsa .pics)"

• "ET TROJAN Observed ACR Stealer Domain (frdk .xyz) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (matterrydamagedowkds .xyz)"

• "ET CURRENT_EVENTS Balada Domain in DNS Lookup (getmygateway .com)"

• "ET TROJAN Python Typo Squatting Domain in DNS Lookup (files .pypihosted .org)"

• "ET TROJAN Rodmacer Stealer Data Exfiltration Attempt"

• "ET TROJAN Koadic Framework Requesting Payload (GET) M2"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (liabilitynighstjsko .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (applyzxcksdia .shop)"

• "ET TROJAN Oyster Backdoor Domain in DNS Lookup (firstcountryours .eu)"

• "ET TROJAN SocGholish Domain in TLS SNI (stake .libertariancounterpoint .com)"

• "ET TROJAN Observed Lumma Stealer Related Domain (flyyedreplacodp .shop in TLS SNI)"

• "ET TROJAN Observed WaveStealer Related Domain (wavebysudryez .fr in TLS SNI)"

• "ET TROJAN UNK_ConsoleCollie CnC Domain in DNS Lookup (chemdl .ioskaishi .live)"

• "ET TROJAN Observed Lumma Stealer Related Domain (shiverdreammyseaemw .shop in TLS SNI)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (ilengineeringrssfeed .azurewebsites .net)"

• "ET TROJAN Observed TA417 Domain (quadrantbd .com) in TLS SNI"

• "ET TROJAN Observed NGC2180/DFKRAT CnC Domain (windowscer .shop) in TLS SNI"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (celebratioopz .shop)"

• "ET TROJAN Observed TA399/Sidewinder APT Domain (msacn .ntcpk .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (grazeinnocenttyyek .shop)"

• "ET TROJAN Observed Lumma Stealer Related Domain (falseaudiencekd .shop in TLS SNI)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (marketexpert .site)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (creativeslim .com)"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (psk777 .casa)"

• "ET TROJAN DNS Query to MageCart Domain (cvyatop .online)"

• "ET TROJAN Observed Lumma Stealer Related Domain (vesselspeedcrosswakew .site in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (colorprioritytubbew .shop)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (agov-access .com) in TLS SNI"

• "ET TROJAN Observed ACR Stealer Domain (pbpbj .xyz) in TLS SNI"

• "ET INFO Suspicious Request for fs.log"

• "ET TROJAN SocGholish CnC Domain in TLS SNI (* .parish .chuathuongxot .org)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (publicitycharetew .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (boylegmfg .com)"

• "ET TROJAN Malicious Domain Observed in DNS Lookup (libjs .xyz)"

• "ET TROJAN Observed Lumma Stealer Related Domain (outfittydadop .shop in TLS SNI)"

• "ET TROJAN Blister Loader Mythic C2 Profile M1"

• "ET TROJAN Observed Lumma Stealer Related Domain (clearrypalsidn .shop in TLS SNI)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (adobefallshomes .com)"

• "ET TROJAN DNS Query to Malvertising Domain (angryip .icu)"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (apphrquizapi .azurewebsites .net)"

• "ET TROJAN TA399/Sidewinder APT CnC Domain in DNS Lookup (paknavy-gov-pk .downld .net)"

• "ET TROJAN Observed UNC1549/TA455 Domain (airgadgetsolution .azurewebsites .net in TLS SNI)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (refundemobxyyeols .shop)"

• "ET TROJAN ZPHP CnC Domain in DNS Lookup (bynx .store)"

• "ET TROJAN Observed Lumma Stealer Related Domain (paperryszjxuo .shop in TLS SNI)"

• "ET TROJAN Observed Poseidon Stealer Related Domain (agov-ch .net) in TLS SNI"

• "ET TROJAN DNS Query to Fenix Botnet Domain (mexico-curp .com)"

• "ET TROJAN ACR Stealer Data Exfiltration Attempt M1"

• "ET TROJAN Magnet Goblin MiniNerbian CnC Domain (textsmsonline .com) in TLS SNI"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (happyllfe .online)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (strollheavengwu .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (complaintsipzzx .shop)"

• "ET TROJAN Unknown Loader CnC Domain in DNS Lookup (proffyrobharborye .xyz)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in TLS SNI (artistryhab .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (potterryisiw .shop)"

• "ET CURRENT_EVENTS Parrot TDS Domain in DNS Lookup (jswebcloud .net)"

• "ET TROJAN Suspected Powershell Empire Activity M3"

• "ET MOBILE_MALWARE Observed Android/Mandrake CnC Domain (ricinus .ru) in TLS SNI"

• "ET TROJAN BackConnect CnC Activity (Start VNC) M1"

• "ET CURRENT_EVENTS DNS Query to UNC1549/TA455 Domain (changequestionstypejsonapi .azurewebsites .net)"

• "ET TROJAN Observed Fenix Botnet Domain (russiancl .top in TLS SNI)"

• "ET MOBILE_MALWARE GoldDigger CnC Domain in DNS Lookup (t8bc .xyz)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (periodicroytewrsn .shop)"

• "ET TROJAN Horabot CnC Host Details Exfil"

• "ET CURRENT_EVENTS TA569 Middleware Domain in TLS SNI (asyncawaitapi .com)"

• "ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (pixelsmith .shop)"

• "ET INFO Commonly Abused Link Agregating Service Domain in DNS Lookup (linkup .top)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (sofaprivateawarderysj .shop)"

• "ET TROJAN DNS Query to Ducktail APT Domain (dailyfasterauto .info)"

• "ET TROJAN Observed Lumma Stealer Related Domain (penetratedpoopp .xyz in TLS SNI)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (authentificator-gogle .com)"

• "ET TROJAN DeerStealer CnC Domain in DNS Lookup (gg2024 .com)"

• "ET TROJAN Suspected APT42/TA453 Related Domain in DNS Lookup (tinurls .com)"

• "ET CURRENT_EVENTS Credit Card Skimmer Domain in DNS Lookup (joyfullday .shop)"

• "ET TROJAN Win/Ghostlocker Ransomware Activity M1 (POST)"

• "ET TROJAN PikaBot Java Loader CnC Checkin"

• "ET TROJAN ZPHP CnC Domain in TLS SNI (aweland .store)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (asleepfulltytarrtw .shop)"

• "ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (cottageaskyflolewk .shop)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (alphawatchrmf .com)"

• "ET CURRENT_EVENTS ZPHP Domain in TLS SNI (alphawatchrmf .com)"

• "ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (myanswerpronto .com)"

attempted-admin

• "ET EXPLOIT CVE-2016-3210 Exploit Observed ITW M1 Nov 30"

• "ET WEB_SERVER BlackSquid JSP Webshell Outbound"

• "ET EXPLOIT Cisco RV320/RV325 Command Injection Attempt Inbound (CVE-2019-1652)"

• "ET EXPLOIT SEOWON INTECH SLC-130 RCE Inbound (No CVE)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections5/MozillaRhino1/Vaadin) M2"

• "ET WEB_SERVER Possible SQL Injection Attempt char() Danmec related in HTTP URI"

• "ET INFO F5 BIG-IP - Command Execution via util/bash"

• "ET EXPLOIT TP-LINK TL-WR841N Router DNS Change GET Request"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)"

• "ET EXPLOIT Redis RCE Attempt (CVE-2022-0543) M1"

• "ET EXPLOIT Jenkins Plugin Script RCE Exploit Attempt (CVE-2019-1003001)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections6) M2"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (7)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (tcp corba) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Exploit Success"

• "ET EXPLOIT Cisco Data Center Network Manager Directory Traversal Inbound (CVE-2019-15980)"

• "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound"

• "ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound"

• "ET WEB_SERVER Access to /phppath/php Possible Plesk 0-day Exploit June 05 2013"

• "ET EXPLOIT TP-LINK Archer C5 v4 (CVE-2019-7405)"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode andx overflow attempt"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JBossInterceptors1) M2"

• "GPL NETBIOS SMB-DS OpenKey little endian overflow attempt"

• "ET EXPLOIT Zyxel NWA-1100-NH Command Injection Attempt (CVE-2021-4039)"

• "ET EXPLOIT Realtek SDK - Command Execution/Backdoor Access Inbound (CVE-2021-35394)"

• "ET TROJAN Observed Elysium Stealer Domain in TLS SNI (download-serv-234116 .xyz)"

• "ET EXPLOIT Netgear Seventh Inferno Vulnerability (post-auth shell injection)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections1/CommonsCollections3) M1"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M8 (CVE-2023-23397)"

• "ET EXPLOIT Possible Saltstack Authentication Bypass CVE-2020-11651 M1"

• "ET EXPLOIT Netgear DGN Remote Code Execution"

• "ET WEB_SERVER WGET Command Specifying Output in HTTP Headers"

• "ET EXPLOIT TOTOLINK Realtek SDK RCE (CVE-2019-19824)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (Outbound) (CVE-2021-44228)"

• "GPL POP3 LIST overflow attempt"

• "ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Cookie"

• "ET EXPLOIT Possible NSDP (Netgear) Remote Authentication Bypass with Factory Reset (CVE-2020-35231)"

• "ET EXPLOIT Oracle Weblogic Server Deserialization RCE T3 (CVE-2015-4852)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Jdk7u21) M1"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - HTTP URI Obfuscation (CVE-2021-44228) (Inbound)"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode little endian andx overflow attempt"

• "ET EXPLOIT Cisco IOS XE Web Server Possible Authentication Bypass Attempt (CVE-2023-20198) (Outbound)"

• "ET EXPLOIT Possible Zend Framework Exploit (CVE-2021-3007)"

• "ET EXPLOIT Possible vRealize Operations Manager API SSRF Attempt (CVE-2021-21975)"

• "ET EXPLOIT F5 BIG-IP rsync cmi authorized_keys successful upload"

• "ET EXPLOIT Netis E1+ 1.2.32533 - Unauthenticated WiFi Password Leak"

• "GPL EXPLOIT login buffer non-evasive overflow attempt"

• "GPL NETBIOS SMB llsrconnect unicode andx overflow attempt"

• "ET EXPLOIT D-Link and TRENDnet ncc2 Service Vulnerability (ping.ccp) 2015-1187"

• "ET WEB_SPECIFIC_APPS Adobe Coldfusion Local File Inclusion Attempt (CVE-2023-26360, CVE-2023-26359) M2"

• "ET TROJAN Likely Arid Viper APT Advtravel Campaign POST"

• "ET WEB_SERVER Possible CVE-2014-6271 Attempt"

• "ET EXPLOIT Possible Zavio IP Camera OS Command Injection Attempt Inbound (CVE-2013-2568)"

• "ET EXPLOIT ASUS RT N56U Router DNS Change GET Request 1"

• "ET EXPLOIT Potentially Malicious .cab Inbound (CVE-2020-1300)"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode andx overflow attempt"

• "ET EXPLOIT Paypal Pro < 1.1.65 SQLi (CVE-2020-14092)"

• "ET EXPLOIT Geutebruck Attempted Remote Command Injection Outbound"

• "ET TROJAN Suspected PULSECHECK Webshell Access Inbound"

• "ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781) M2"

• "ET EXPLOIT Klog Server Command Injection Inbound (CVE-2021-3317)"

• "ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis"

• "ET EXPLOIT Possible SolarWinds Orion RCE Inbound (CVE-2021-31474)"

• "ET EXPLOIT QNAP PhotoStation Authenticated Session Tampering Attempt"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Spring1/Spring2) M3"

• "ET EXPLOIT Zhone ZNID GPON 2426A < S3.0.501 RCE (CVE-2014-9118) M1"

• "GPL NETBIOS SMB DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt"

• "ET WEB_SPECIFIC_APPS Adobe Coldfusion Local File Inclusion Attempt (CVE-2023-26360, CVE-2023-26359) M1"

• "ET TROJAN Likely Arid Viper APT Advtravel Campaign GET Keepalive"

• "GPL NETBIOS SMB llsrconnect little endian andx overflow attempt"

• "ET EXPLOIT Samba Arbitrary Module Loading Vulnerability (NT Create AndX .so) (CVE-2017-7494)"

• "ET EXPLOIT Tenda OS Command Injection (CVE-2020-10987) (GET)"

• "ET EXPLOIT Cisco HyperFlex HX Data Platform Pre-Auth RCE Inbound (CVE-2021-1499)"

• "ET EXPLOIT Possible Zerologon Phase 1/3 - NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472)"

• "ET EXPLOIT Online Scheduling System 1.0 - Authentication Bypass Attempt"

• "ET EXPLOIT Linksys WRT54GL DNS Change GET Request"

• "ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M2 (CVE-2022-21587)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Citrix SD-WAN Unauthenticated RCE (CVE-2020-8271)"

• "GPL FTP CWD overflow attempt"

• "ET MALWARE AllaKore RAT Set Keep-Alive Observed"

• "ET EXPLOIT VMware VeloCloud Authorization Bypass (CVE-2019-5533)"

• "ET EXPLOIT [NCC/FOX-IT] Possible F5 BIG-IP/BIG-IQ iControl REST RCE Attempt (CVE-2021-22986)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Spring1/Spring2) M2"

• "ET EXPLOIT Possible JNBridge Java Deserialization Attempt (Wide) M3"

• "ET EXPLOIT Possible Cacti Unauthenticated RCE Inbound M2 (CVE-2022-46169)"

• "ET EXPLOIT TP-LINK TL-WR840N RCE Inbound (CVE-2022-25064)"

• "ET EXPLOIT Korenix JetWave formSysCmd Command Injection Attempt (CVE-2016-20017)"

• "ET EXPLOIT Yealink RCE Attempt (CVE-2021-27561)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Trenda Router AC11 RCE Inbound (CVE-2021-31755)"

• "ET TROJAN Observed Elysium Stealer Domain in TLS SNI (manholi .xyz)"

• "GPL NETBIOS SMB llsrconnect overflow attempt"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections6) M1"

• "ET EXPLOIT EyesOfNetwork Autodiscover Command Injection (CVE-2020-8654)"

• "ET EXPLOIT Possible ManageEngine ADAudit Plus XXE (CVE-2022-28219)"

• "ET WEB_SPECIFIC_APPS Possible MobileIron MDM RCE Inbound (CVE-2020-15505)"

• "ET EXPLOIT Microsoft Exchange Pre-Auth Path Confusion M1 (CVE-2021-31207)"

• "ET EXPLOIT MVPower DVR Shell UCE"

• "GPL FTP RNFR overflow attempt"

• "ET EXPLOIT Possible Cacti Unauthenticated RCE Inbound M1 (CVE-2022-46169)"

• "ET EXPLOIT Cisco Data Center Network Manager Authentication Bypass Inbound (CVE-2019-15976)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (juantech)"

• "ET EXPLOIT Possible JNBridge Java Deserialization Attempt M1"

• "ET EXPLOIT FritzBox RCE GET Request"

• "ET EXPLOIT Possible Cisco Data Center Network Manager - Unauthenticated File Upload (CVE-2019-1620)"

• "ET ATTACK_RESPONSE FightAgent WebShell Response Outbound"

• "ET EXPLOIT Razer Sila Router - LFI Attempt Inbound (passwd) (No CVE)"

• "ET EXPLOIT TerraMaster TOS Unauthenticated Command Injection Inbound M2 (CVE-2022-24989)"

• "ET EXPLOIT Possible JNBridge Java Deserialization Attempt (Wide) M2"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M6 (CVE-2023-23397)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/13 Obfuscation Observed (tcp) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - Base64 jndi (tcp) (Outbound) (CVE-2021-44228)"

• "ET WEB_SPECIFIC_APPS WHMCS lt 5.2.8 SQL Injection"

• "ET EXPLOIT Inbound VMware vCenter RCE Attempt with Untrusted SSH Key Upload (CVE-2021-21972)"

• "ET EXPLOIT TP-Link TL-WR840N EU v5 RCE Attempt (CVE-2021-41653)"

• "ET EXPLOIT Redis RCE Attempt (CVE-2022-0543) M2"

• "ET SCAN Tomato Router Default Credentials (root:admin)"

• "ET WEB_SPECIFIC_APPS MediaWiki thumb.php RCE"

• "ET EXPLOIT WatchGuard CVE-2022-26318 RCE Attempt M1"

• "ET EXPLOIT [401TRG] HPDM Backdoor Login"

• "ET EXPLOIT Attempted Netgear Buffer Overflow into RCE Inbound M1"

• "ET EXPLOIT [PwnedPiper] Exploitation Attempt - Small Malformed Translogic Packet (Multiple CVEs)"

• "ET EXPLOIT Microsoft Exchange Server Exploitation Inbound (CVE-2020-17132)"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228)"

• "ET EXPLOIT Attempted HiSilicon DVR/NVR/IPCam RCE (Outbound)"

• "ET WEB_SPECIFIC_APPS MinIO Information Disclosure Attempt (CVE-2023-28432)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JBossInterceptors1) M3"

• "ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -2 Health Check User Delete Request - Observed in MOVEit File Transfer - INBOUND"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections1/CommonsCollections3) M2"

• "ET EXPLOIT TP-LINK Password Change GET Request (DNSChanger EK)"

• "ET EXPLOIT Windows HTTP Protocol Stack UAF/RCE (CVE-2021-31166), http.sys DOS (CVE-2022-21907) Inbound"

• "ET EXPLOIT Possible WePresent WIPG1000 OS Command Injection"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JavassistWeld1) M3"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections6) M2"

• "ET INFO Suspicious Chmod Usage in URI (Outbound)"

• "ET EXPLOIT Dameware DMRC Buffer Overflow Attempt (CVE-2016-2345)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (1111111)"

• "ET EXPLOIT NodeJS System Information Library Command Injection Attempt (CVE-2021-21315)"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228)"

• "ET WEB_SERVER Possible WebLogic Admin Login With Default Creds"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Clojure1) M1"

• "ET EXPLOIT Linksys WRT54GL Router DNS Change POST Request"

• "ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy"

• "ET EXPLOIT Possible Microsoft Exchange RCE Inbound M2 (CVE-2021-34473)"

• "ET EXPLOIT ManageEngine AdSelfService Plus - Possible Code Execution via openSSLTool (CVE-2021-40539)"

• "ET EXPLOIT dotCMS Arbitrary File Upload Attempt (CVE-2022-26352) M1"

• "ET EXPLOIT Possible Apache ShardingSphere RCE Attempt (CVE-2020-1947) (PoC Based)"

• "GPL NETBIOS SMB Session Setup AndX request username overflow attempt"

• "ET EXPLOIT Extensis Portfolio Unrestricted File Upload (CVE-2022-24252)"

• "ET EXPLOIT QNAP MusicStation Pre-Auth RCE Inbound (CVE-2020-36197)"

• "ET EXPLOIT Possible Citrix Information Disclosure Attempt Inbound (CVE-2020-8195)"

• "ET EXPLOIT 3Com Office Connect Remote Code Execution (Outbound)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (14)"

• "GPL NETBIOS SMB-DS llsrconnect little endian andx overflow attempt"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Spring1/Spring2) M1"

• "ET EXPLOIT Apache log4j RCE Attempt (http) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT D-Link TRENDnet NCC Service Command Injection Attempt (CVE-2015-1187)"

• "GPL NETBIOS SMB-DS OpenKey unicode overflow attempt"

• "ET SCAN Possible WordPress xmlrpc.php BruteForce in Progress - Response"

• "ET EXPLOIT Bonitasoft Authorization Bypass and RCE Upload M1 (CVE-2022-25237)"

• "ET EXPLOIT Possible Microsoft Exchange RCE Inbound M1 (CVE-2021-34473)"

• "ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965)"

• "ET EXPLOIT ManageEngine Unauthenticated RCE Attempt M1 (CVE-2022-47966)"

• "ET EXPLOIT ASUS RT N56U Router DNS Change GET Request 3"

• "ET EXPLOIT Suspected Exim External Auth Overflow (CVE-2023-42115)"

• "ET EXPLOIT D-Link Related Command Injection Attempt Inbound (CVE-2013-7471)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections7) M2"

• "ET EXPLOIT Possible MobileIron RCE Attempt Inbound (CVE-2020-15505)"

• "ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Actiontec C1000A backdoor account M1"

• "ET TROJAN Andariel Backdoor Activity (Checkin)"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - factory.cgi RCE via Command Injection Attempt Inbound (CVE-2021-33544)"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC WebUI RCE ADD Attempt"

• "ET EXPLOIT Suspected WordPress Plugin Royal Elementor RCE (CVE-2023-5360)"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M2"

• "ET EXPLOIT [FIREEYE] Suspicious Pulse Secure HTTP Request (CVE-2021-22893) M1"

• "ET EXPLOIT Discourse SNS Webhook RCE Inbound (CVE-2021-41163)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Jdk7u21) M3"

• "ET EXPLOIT OpenMRS Deserialization Vulnerability CVE-2018-19276 M2"

• "ET EXPLOIT Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution"

• "ET WEB_SPECIFIC_APPS Possible Weblogic RCE Inbound (CVE-2017-3506)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JavassistWeld1) M2"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Spring1/Spring2) M2"

• "ET EXPLOIT Totolink - Command Injection Attempt Inbound (CVE-2022-26186)"

• "ET EXPLOIT NETGEAR WNR2000v5 hidden_lang_avi Stack Overflow (CVE-2016-10174)"

• "ET EXPLOIT F5 BIG-IP rsync cmi authorized_keys access attempt"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M1"

• "ET EXPLOIT Guangzhou 1GE ONU OS Command Execution (CVE-2020-8958)"

• "ET WEB_SPECIFIC_APPS Citrix/Netscaler ADC and NetScaler Gateway RCE Attempt CVE-2023-3519"

• "ET EXPLOIT Fortigate VPN - Request to /remote/info - Possible CVE-2023-27997 Exploit Attempt"

• "ET EXPLOIT TeamViewer .tvs iFrame Observed (CVE-2020-13699)"

• "ET WEB_SPECIFIC_APPS Kibana Path Traversal Inbound (CVE-2018-17246)"

• "ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JavassistWeld1) M2"

• "ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toclient M2"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M1 (CVE-2021-44228)"

• "ET WEB_SERVER Possible CVE-2014-6271 Attempt in URI"

• "ET EXPLOIT Possible Palo Alto SSL VPN sslmgr Format String Vulnerability (Inbound) (CVE-2019-1579)"

• "ET EXPLOIT QNAP Photo Station Path Traversal Attempt Inbound (CVE-2019-7195)"

• "ET EXPLOIT Possible Atlassian Confluence Pre-Authorization Arbitrary File Read Attempt (seraph-config.xml) (CVE-2021-26085)"

• "ET EXPLOIT Linear eMerge E3 Unauthenticated Command Injection Inbound (CVE-2019-7256)"

• "ET EXPLOIT Possible WatchGuard CVE-2022-26318 RCE Attempt M3"

• "ET EXPLOIT Possible NSDP (Netgear) Write Command Buffer Overflow Attempt - 0x000a (CVE-2020-35225)"

• "GPL POP3 x86 Linux overflow"

• "ET EXPLOIT ZKBioSecurity SQL Injection Attempt (CVE-2022-36635)"

• "ET EXPLOIT Apache Solr RCE via Velocity Template M1 (CVE-2019-17558)"

• "ET EXPLOIT D-Link and TRENDnet ncc2 Service Vulnerability (fwupdate.cpp) 2015-1187"

• "ET EXPLOIT Apache Ambari Default Credentials Attempt"

• "ET EXPLOIT Possible CVE-2018-0171 Exploit (PoC based)"

• "ET EXPLOIT Microsoft Exchange Pre-Auth Path Confusion M2 (CVE-2021-31207)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Jdk7u21) M2"

• "ET WEB_SPECIFIC_APPS SAP Possible CTC Auth/HTTP Verb Bypass Attempt"

• "ET EXPLOIT Nexus Repository Manager EL Injection to RCE Inbound (CVE-2020-10204)"

• "ET EXPLOIT Possible AVCON6 Video Conferencing System RCE (Inbound)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections5/MozillaRhino1/Vaadin) M3"

• "ET EXPLOIT Silver Peak Unity Orchestrator Exploitation Inbound (CVE-2020-12146)"

• "ET EXPLOIT Possible SolarWinds Serv-U SSH RCE Inbound M2 (CVE-2021-35211)"

• "ET EXPLOIT HiSilicon DVR - Buffer Overflow in Builtin Web Server"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - simple_reclistjs.cgi RCE via Command Injection Attempt Inbound (CVE-2021-33544)"

• "ET INFO Suspicious PHP Code in HTTP POST (Outbound)"

• "ET EXPLOIT Possible Atlassian Confluence Pre-Authorization Arbitrary File Read Attempt (pom.xml) (CVE-2021-26085)"

• "ET EXPLOIT Possible JNBridge Java Deserialization Attempt (Wide) M1"

• "ET EXPLOIT UPnP UUID Password Change Exploit Attempt Inbound - XR300 PoC Gadgets (CVE-2021-34991)"

• "ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap Overflow Exploit Email (Inbound)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JRMPClient) M3"

• "ET TROJAN Possible Linux.Mirai Login Attempt (realtek)"

• "ET EXPLOIT Possible Windows DNS Integer Overflow Attempt M2 (CVE-2020-1350)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JRMPClient) M2"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (1)"

• "ET EXPLOIT Actiontec C1000A backdoor account M2"

• "ET EXPLOIT TP-LINK Known Malicious Router DNS Change GET Request"

• "ET EXPLOIT Fortinet FortiOS/FortiProxy SSL VPN Web Portal Path Traversal (CVE-2018-13379)"

• "ET EXPLOIT Cisco AnyConnect Path Traversal Priv Esc (CVE-2020-3153)"

• "ET EXPLOIT VMware vCenter SSRF Inbound"

• "ET SCAN ELF/Mirai User-Agent Observed (Inbound)"

• "ET EXPLOIT Attempted Remote Command Injection Outbound (CVE-2019-3929)"

• "GPL NETBIOS SMB NDdeSetTrustedShareW unicode andx overflow attempt"

• "ET EXPLOIT ACTi ASOC 2200 Web Configurators versions <2.6 RCE (Inbound)"

• "ET EXPLOIT Possible F5 BIG-IP Infoleak and Out-of-Bounds Write Inbound (CVE-2021-22991)"

• "ET EXPLOIT Fortigate VPN - Repeated POST Requests to /remote/error (CVE-2023-27997)"

• "ET WEB_SPECIFIC_APPS Chamilo CMS wsConvertPpt Command Injection Attempt (CVE-2023-34960)"

• "ET EXPLOIT Multiple DLink Routers Remote Code Execution CVE-2019-16920"

• "ET EXPLOIT WebSVN 2.6.0 OS Command Injection Inbound (CVE-2021-32305)"

• "ET EXPLOIT Sophos Firewall Authentication Bypass (CVE-2022-1040)"

• "ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Outbound"

• "ET EXPLOIT AjaxPro RCE Attempt (CVE-2021-23758)"

• "ET EXPLOIT HackingTrio UA (Hello, World)"

• "ET EXPLOIT Possible Engineers Online Portal System Webshell Upload (CVE-2021-42669)"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested upper (tcp) (Outbound) (CVE-2021-44228)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (20)"

• "ET EXPLOIT Microsoft Edge Chakra - InjectJsBuiltInLibraryCode Use-After-Free Inbound (CVE-2019-0568)"

• "GPL FTP ALLO overflow attempt"

• "ET CURRENT_EVENTS Netgear Multiple Router Auth Bypass"

• "GPL FTP RMD overflow attempt"

• "ET EXPLOIT Citrix ADC and NetScaler Gateway Information Disclosure Attempt (CVE-2023-4966)"

• "GPL RPC STATD UDP monitor mon_name format string exploit attempt"

• "ET EXPLOIT Quanta LTE Router UDP Backdoor Activation Attempt"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode overflow attempt"

• "GPL NETBIOS SMB llsrconnect unicode overflow attempt"

• "ET EXPLOIT Possible SaltStack Authentication Bypass CVE-2020-11651 M2"

• "ET WEB_CLIENT Exchange Webshell CnC Domain in DNS Lookup"

• "GPL FTP XMKD overflow attempt"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections1/CommonsCollections3) M2"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - factory.cgi RCE via Command Injection Attempt Outbound (CVE-2021-33544)"

• "ET WEB_SPECIFIC_APPS rConfig search.crud.php Command Injection (CVE-2019-16663)"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (13)"

• "ET EXPLOIT Apache2 Memory Corruption Inbound (CVE-2020-9490)"

• "ET EXPLOIT Attempted Mitel MiVoice Connect Data Validation RCE Inbound (CVE-2022-29499)"

• "ET EXPLOIT Microsoft Exchange - Successful msExchEcpCanary Disclosure (CVE-2021-33766)"

• "ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M3"

• "ET EXPLOIT SonicWall SMA Stack-Based Buffer Overflow CVE-2021-20038 M2"

• "ET EXPLOIT Inbound VMware vCenter RCE Attempt M1 (CVE-2021-21972)"

• "ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (CVE-2021-42013) M1"

• "ET EXPLOIT Microsoft OMI RCE Exploit Attempt (CVE-2021-38647) M1"

• "ET EXPLOIT WatchGuard CVE-2022-26318 RCE Attempt M2"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Clojure1) M3"

• "ET EXPLOIT Xiongmai/HiSilicon DVR - RTSP Buffer Overflow Attempt - CVE-2022-26259"

• "ET EXPLOIT DSLink 260E Router DNS Changer Exploit Attempt"

• "ET EXPLOIT PaperCut MF/NG SetupCompleted Authentication Bypass (CVE-2023-27350)"

• "ET WEB_SPECIFIC_APPS Oracle Fusion Middleware BPEL Console Cross Site Scripting"

• "ET EXPLOIT ysoserial Payload in HTTP Header (MozillaRhino2) M1"

• "ET EXPLOIT Possible Sar2HTML plotting tool for Linux servers v3.2.1 (Inbound)"

• "ET EXPLOIT Jira Server/Data Center 8.4.0 Remote File Read Attempt (CVE-2021-26086) M1"

• "ET EXPLOIT Zoho ManageEngine Desktop Central RCE Inbound (CVE-2020-10189)"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW little endian overflow attempt"

• "ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toserver M4"

• "ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2"

• "ET WEB_SPECIFIC_APPS Inductive Automation remoteSystemID Check (CVE-2023-39476)"

• "ET TROJAN Possibly SLIGHTPULSE Related - Suspicious POST to Specific URI Path"

• "ET EXPLOIT VisualDoor Sonicwall SSL VPN Exploit Attempt"

• "GPL NETBIOS SMB NDdeSetTrustedShareW andx overflow attempt"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M3"

• "ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M3 (CVE-2022-21587)"

• "ET EXPLOIT OpenMRS Deserialization Vulnerability CVE-2018-19276"

• "ET WEB_SPECIFIC_APPS Apache Struts2 uploadFileName Directory Traversal Attempt (CVE-2023-50164) M1"

• "ET EXPLOIT Kaseya VSA ManagedITSync SQL Injection (CVE-2017-18362)"

• "ET EXPLOIT vBulletin 5.x Unauthenticated Remote Code Execution (CVE-2019-16759) M3"

• "ET EXPLOIT VMware SD-WAN Orchestrator SQL Injection (CVE-2020-3984)"

• "ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate2 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M2"

• "ET EXPLOIT Cisco HyperFlex HX RCE Inbound (CVE-2021-1498)"

• "ET WEB_SPECIFIC_APPS Bonitasoft Default User Login Attempt M2 (Possible Staging for CVE-2022-25237)"

• "ET EXPLOIT Possible Zimbra Autodiscover Servlet XXE (CVE-2019-9670)"

• "ET EXPLOIT Netgear WNDR Router DNS Change POST Request"

• "GPL FTP REST overflow attempt"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (11)"

• "ET WEB_SERVER Suspicious Chmod Usage in URI (Inbound)"

• "GPL NETBIOS SMB OpenKey little endian andx overflow attempt"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested upper (udp) (Outbound) (CVE-2021-44228)"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian andx overflow attempt"

• "GPL FTP NLST overflow attempt"

• "ET EXPLOIT XXL-Job RCE"

• "GPL NETBIOS SMB NDdeSetTrustedShareW little endian andx overflow attempt"

• "ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)"

• "ET EXPLOIT Fortigate VPN - Repeated POST Requests to /remote/hostcheck_validate (CVE-2023-27997) M2"

• "ET EXPLOIT Redfish Exploitation Attempt (CVE-2022-40259)"

• "ET WEB_SPECIFIC_APPS Metabase Local File Inclusion Inbound (CVE-2021-41277)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (anko)"

• "ET EXPLOIT QNAP Shellshock CVE-2014-6271"

• "ET TROJAN Possible Linux.Mirai Login Attempt (vizxv)"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - Auth Bypass Attempt Outbound (CVE-2021-33543)"

• "ET EXPLOIT Attempted Remote Command Injection Inbound (CVE-2018-7841)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (xmhdipc)"

• "ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap Overflow Exploit Email (Inbound)"

• "ET EXPLOIT Possible MySQL cnf overwrite CVE-2016-6662 Attempt"

• "ET EXPLOIT Possible OpenVPN CVE-2014-6271 attempt"

• "ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt"

• "ET TROJAN ELF/FontOnLake Related CnC Domain in DNS Lookup (hm2 .yrnykx .com)"

• "ET EXPLOIT Fortigate VPN - Repeated POST Requests to /remote/hostcheck_validate (CVE-2023-27997) M1"

• "GPL FTP RMDIR overflow attempt"

• "ET EXPLOIT Ruckus Wireless Admin Remote Code Execution Attempt (CVE 2023-25717)"

• "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1"

• "ET EXPLOIT Realtek eCos RSDK/MSDK Stack-based Buffer Overflow Attempt Inbound (CVE-2022-27255)"

• "ET EXPLOIT Juniper ScreenOS telnet Backdoor Default Password Attempt"

• "ET EXPLOIT Mongo-Express RCE Inbound (CVE-2019-10758)"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper UDP Bypass M1 (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Cisco RV320/RV325 RCE (CVE-2019-1653)"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp iiop) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT D-link DI604 Known Malicious Router DNS Change GET Request"

• "ET EXPLOIT Tenda ADSL2/2+ Router DNS Change GET Request"

• "ET EXPLOIT WS_FTP .NET Deserialization Exploit Attempt (CVE-2023-40044)"

• "ET EXPLOIT Exim4 UAF Attempt (BDAT with non-printable chars)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (7ujMko0vizxv)"

• "ET EXPLOIT D-Link webupg Remote Code Execution Attempt Inbound (CVE 2021-46441, 2021-46442)"

• "ET EXPLOIT ManageEngine AdSelfService Plus - .jsp WebShell Upload Attempt (CVE-2021-40539)"

• "ET EXPLOIT Supermicro BMC Password Disclosure 3"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M1 (CVE-2023-23397)"

• "ET EXPLOIT Metasploit 2013-3346"

• "ET EXPLOIT ManageEngine AdSelfService Plus - Arbritrary File Upload Attempt (CVE-2021-40539)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toclient M4"

• "ET WEB_SPECIFIC_APPS Possible Apache Unomi OGNL Eval RCE Inbound M2 (CVE-2020-13942)"

• "ET EXPLOIT Technicolor TD5130v2/TD5336 Router RCE CVE-2019-118396/CVE-2017-14127 (Outbound)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Spring1/Spring2) M2"

• "ET EXPLOIT Equation Group ExtraBacon Cisco ASA AAAADMINAUTH Disable"

• "ET EXPLOIT Possible WebShell JPEG Upload"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 - Known Exploit Instance (2)"

• "ET EXPLOIT Possible ImageMagick Malformed SVG Upload Leading to RCE"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (3)"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp dns) (CVE-2021-44228)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (udp corba) (CVE-2021-44228)"

• "ET EXPLOIT QNAP Shellshock script retrieval"

• "ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M1"

• "ET EXPLOIT HP Printer Attempted Path Traversal via PJL"

• "GPL IMAP Overflow Attempt"

• "ET EXPLOIT JBOSS Deserialization Attempt Inbound (CVE-2017-7504)"

• "ET EXPLOIT vBulletin 5.x Unauthenticated Remote Code Execution (CVE-2019-16759) M2"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Spring1/Spring2) M3"

• "ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M2"

• "ET SCAN SQLNinja Attempt To Recreate xp_cmdshell Using sp_configure"

• "GPL NETBIOS SMB CoGetInstanceFromFile little endian andx overflow attempt"

• "ET WEB_SPECIFIC_APPS FancyBox Remote Code Inclusion POST Request"

• "ET WEB_SPECIFIC_APPS e107 CMS backdoor access admin-access cookie and HTTP POST"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JBossInterceptors1) M1"

• "ET EXPLOIT Thomson Reuters Velocity Analytics Vhayu Analytic Servers 6.94 build 2995 CVE-2013-5912 (Inbound)"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt"

• "ET EXPLOIT Possible Atlassian Confluence Pre-Authorization Arbitrary File Read Attempt (pom.properties) (CVE-2021-26085)"

• "ET EXPLOIT Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine (LFI) (CVE-2020-16152) M2"

• "ET EXPLOIT Apache log4j RCE Attempt (udp ldap) (CVE-2021-44228)"

• "GPL NETBIOS SMB CoGetInstanceFromFile andx overflow attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian overflow attempt"

• "ET EXPLOIT NetGear R6700v3 upnpd Buffer Overflow Inbound (CVE-2022-27643)"

• "ET WEB_SERVER Possible CVE-2014-3120 Elastic Search Remote Code Execution Attempt"

• "ET TROJAN Possible Linux.Mirai Login Attempt (54321)"

• "GPL TFTP MISC TFTP32 Get Format string attempt"

• "ET EXPLOIT OctoberCMS Auth Bypass Inbound M1 trigger_reset (CVE-2021-32648)"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp iiop) (CVE-2021-44228)"

• "ET EXPLOIT Possible Edgewater Networks Edgemarc Blind Command Injection Attempt (CVE-2017-6079)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M1"

• "ET EXPLOIT Image Manager 5.2.4 - RCE Attempt"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M2"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections7) M3"

• "ET WEB_SPECIFIC_APPS [PT OPEN] Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE-2018-7600)"

• "GPL NETBIOS SMB-DS Session Setup AndX request username overflow attempt"

• "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/hostcheck_validate (CVE-2023-27997)"

• "ET EXPLOIT ManageEngine Unauthenticated RCE Attempt M10 (CVE-2022-47966)"

• "ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M3"

• "ET EXPLOIT Possible rConfig 3.9.2 Remote Code Execution PoC M1 (CVE-2019-16662)"

• "ET EXPLOIT Oracle Coherence Deserialization RCE (CVE-2020-2555)"

• "ET EXPLOIT Totolink - Command Injection Attempt Inbound (CVE-2022-25075)"

• "ET EXPLOIT Apache log4j RCE Attempt (udp dns) (CVE-2021-44228)"

• "ET ATTACK_RESPONSE Linksys Router Returning Device Settings To External Source"

• "ET EXPLOIT Belkin G F5D7230-4 Router DNS Change GET Request"

• "GPL MISC rsh froot"

• "ET EXPLOIT GL iNet MTN300n Command Injection Attempt Inbound (CVE-2022-31898)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (fucker)"

• "ET EXPLOIT Apache log4j RCE Attempt (http rmi) (Outbound) (CVE-2021-44228)"

• "ET SCAN Tomato Router Default Credentials (admin:admin)"

• "ET EXPLOIT Apache log4j RCE Attempt (udp rmi) (CVE-2021-44228)"

• "ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1601)"

• "ET EXPLOIT Possible Windows DNS Integer Overflow Attempt M1 (CVE-2020-1350)"

• "ET WEB_SERVER Apache Struts Possible xwork Disable Method Execution"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Jdk7u21) M1"

• "GPL NETBIOS SMB NDdeSetTrustedShareW little endian overflow attempt"

• "ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate2 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M1"

• "ET EXPLOIT Possible Gitlab CE/EE Image Parser RCE Inbound (CVE-2021-22205)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections6) M1"

• "ET EXPLOIT Mitsubishi Electric smartRTU RCE Outbound (CVE-2019-14931)"

• "ET EXPLOIT Cisco IP Phones Web Server Vulnerability (CVE-2020-3161)"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode andx overflow attempt"

• "ET EXPLOIT Possible GoldenPac Priv Esc in-use"

• "ET EXPLOIT Cisco ASA and Firepower Path Traversal Vulnerability M2 (CVE-2020-3452)"

• "ET EXPLOIT Laravel Remote Code Execution (CVE-2021-3129) Inbound - Attempt to clear logs"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections5/MozillaRhino1/Vaadin) M3"

• "ET EXPLOIT Possible OpenDreamBox Attempted Remote Command Injection Inbound"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt JEXL Path (CVE-2022-42889) (Outbound)"

• "GPL FTP STAT overflow attempt"

• "ET NETBIOS Microsoft Windows Server 2003 Active Directory Pre-Auth BROWSER ELECTION Heap Overflow Attempt"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M5"

• "ET EXPLOIT Apache log4j RCE Attempt (udp ldap) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT F5 BIG-IP iControl REST Unauthenticated RCE Inbound (CVE-2021-22986)"

• "ET EXPLOIT Possible ManageEngine ADAudit Plus Directory Traversal Leading to Deserialization"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Construct M2"

• "ET EXPLOIT Linksys Auth Bypass override.cgi"

• "ET TROJAN APT/Donot Group Checkin Activity (GET)"

• "ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Jdk7u21) M2"

• "ET EXPLOIT Possible Qmail CVE-2014-6271 Mail From attempt"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Trigger SQL Injection via guestaccess.aspx - CVE-2023-34362 Stage 2"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit as Observed in Sundown/RIG EK (b642)"

• "ET EXPLOIT VMware SD-WAN Orchestrator Authentication Bypass (CVE-2020-4001)"

• "ET INFO Possible [401TRG] GhostCat LFI Successful Exploit (CVE-2020-1938)"

• "ET EXPLOIT Totolink - Command Injection Attempt Inbound (CVE-2022-26210)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections1/CommonsCollections3) M1"

• "ET POLICY PPTP Requester is not authorized to establish a command channel"

• "ET WEB_SPECIFIC_APPS Apache SkyWalking GraphQL SQL Injection Inbound (CVE-2020-13921)"

• "ET EXPLOIT Razer Sila Router - Command Injection Attempt Inbound (curl) (No CVE)"

• "ET EXPLOIT RUIJIE NBR/RGNBR Command Injection Attempt Inbound M2"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (MozillaRhino2) M3"

• "ET EXPLOIT DotNetNuke 9.2-9.2.2 Cookie Deserialization Exploit (CVE-2018-15811)"

• "ET EXPLOIT Windows DNS Server RCE Attempt Inbound (CVE-2021-26897)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (16)"

• "ET EXPLOIT Cisco Data Center Network Manager SQL Injection Inbound (CVE-2019-15984)"

• "ET EXPLOIT Linksys Auth Bypass fw_sys_up.cgi"

• "ET EXPLOIT Zerologon Phase 3/3 - Malicious NetrServerPasswordSet2 (CVE-2020-1472)"

• "GPL SMTP RCPT TO overflow"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (tcp nds) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested lower (udp) (CVE-2021-44228)"

• "ET EXPLOIT SolarWinds Web Help Desk Hard Coded Credentials Request (CVE-2021-35232)"

• "ET EXPLOIT Citrix NetScaler SD-WAN 9.1.2.26.561201 Devices CVE-2017-6316 (Inbound)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (udp corba) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Cisco IOS XE Web UI Command Injection Vulnerability (CVE-2023-20273)"

• "ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M1"

• "ET EXPLOIT PiHole Web Interface Regex Escape Leading to RCE Inbound M2 (CVE-2021-32706)"

• "ET EXPLOIT FCM-MB40 Attempted Remote Command Execution as Root"

• "ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781) M4"

• "ET EXPLOIT Apache ActiveMQ Remote Code Execution Attempt (CVE-2023-46604)"

• "ET TELNET busybox ECCHI hackers - Possible Brute Force Attack"

• "ET WEB_SPECIFIC_APPS Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE-2018-7600)"

• "ET WEB_SPECIFIC_APPS Apache Struts2 uploadFileName Directory Traversal Attempt (CVE-2023-50164) M2"

• "ET EXPLOIT Quanta LTE Router RDE Exploit Attempt 1 (ping)"

• "ET EXPLOIT REDIS Attemted SSH Authorized Key Writing Attempt"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (15)"

• "ET WEB_SERVER Possible SQL Injection (exec) in HTTP URI"

• "GPL FTP DELE overflow attempt"

• "ET EXPLOIT Possible Citrix Authentication Bypass Attempt Inbound (CVE-2020-8193)"

• "ET EXPLOIT Supermicro BMC Password Disclosure 2"

• "GPL POP3 AUTH overflow attempt"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Attempted Netgear Buffer Overflow into RCE Inbound M2"

• "ET EXPLOIT VMware Aria Operations for Networks RCE Attempt (CVE-2023-20887)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (ubnt)"

• "ET WEB_SERVER Possible WebLogic Admin Login With Default Creds"

• "ET EXPLOIT D-Link DIR-825 R1 Web Interface RCE (CVE-2020-29557)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M3"

• "ET EXPLOIT ManageEngine Unauthenticated RCE Attempt M12 (CVE-2022-47966)"

• "ET WEB_SPECIFIC_APPS vBulletin RCE Inbound (CVE-2019-16759 Bypass)"

• "ET EXPLOIT Zoho ManagedEngine Desktop Central Authentication Bypass - File Upload Attempt (CVE-2021-44515)"

• "ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request (CVE-2020-9480)"

• "GPL POP3 STAT overflow attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx overflow attempt"

• "ET EXPLOIT F5 BIG-IP iControl REST Authentication Bypass Attempt (CVE-2022-1388) M2"

• "ET WEB_SPECIFIC_APPS Apache Kylin REST API DiagnosisService Command Injection Inbound (CVE-2020-13925)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JRMPClient) M2"

• "ET TROJAN Possible Linux.Mirai Login Attempt (jvbzd)"

• "ET WEB_SPECIFIC_APPS LG Simple Editor Malicious JSP Disguised as BMP Upload Attempt (CVE-2023-40498)"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode overflow attempt"

• "ET EXPLOIT FritzBox RCE POST Request"

• "ET EXPLOIT HP Enterprise VAN SDN Controller Root Command Injection (Unix)"

• "GPL FTP SITE NEWER overflow attempt"

• "ET TROJAN 404 Response with an EXE Attached - Likely Malware Drop"

• "ET EXPLOIT Telesquare SDT-CW3B1 1.1.0 - OS Command Injection (CVE-2021-46422)"

• "ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M1"

• "ET WEB_SERVER ThinkPHP RCE Exploitation Attempt"

• "ET EXPLOIT CVE-2016-3210 Exploit Observed ITW M1 Nov 30"

• "GPL POLICY PCAnywhere Attempted Administrator Login"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JRMPClient) M3"

• "ET EXPLOIT Possible SpringCore RCE/Spring4Shell Inbound (CVE-2022-22965)"

• "ET EXPLOIT Attempted Remote Command Injection Outbound (CVE-2018-7841)"

• "ET EXPLOIT Citrix ShareFile Storage Zones Controller RCE Attempt (CVE-2021-22941)"

• "ET MALWARE Cobalt Strike Malleable C2 Amazon Profile POST (JPEG)"

• "ET EXPLOIT Possible Barracuda Email Security Gateway Remote Code Execution Attempt (CVE-2023-2868) M1"

• "ET EXPLOIT Possible Microsoft Exchange RCE with Python PSRP Client UA Inbound (CVE-2021-34473)"

• "ET EXPLOIT Possible VMware Workspace ONE Access RCE via Server-Side Template Injection Inbound (CVE-2022-22954)"

• "ET EXPLOIT ForgeRock Access Manager RCE (CVE-2021-35464)"

• "ET MALWARE Cobalt Strike Malleable C2 Amazon Profile POST (RIFF)"

• "ET EXPLOIT Possible Postfix CVE-2014-6271 attempt"

• "ET WEB_SPECIFIC_APPS Apache Struts ognl inbound OGNL injection remote code execution attempt"

• "ET INFO Suspicious PHP Code in HTTP POST (Inbound)"

• "ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -1 Data Exfil Request - Observed in MOVEit File Transfer - INBOUND"

• "ET TROJAN Possible Linux.Mirai Login Attempt (7ujMko0admin)"

• "ET EXPLOIT Possible NSDP (Netgear) Unauthenticated Write Access to DHCP Config (CVE-2020-35226)"

• "ET EXPLOIT Laravel Remote Code Execution (CVE-2021-3129) Inbound - Payload Execution Attempt"

• "ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965)"

• "ET EXPLOIT Dell KACE Attempted Remote Command Injection Inbound"

• "ET EXPLOIT SysAid Traversal Attack (CVE-2023-47246)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (udp) (CVE-2021-44228)"

• "ET EXPLOIT Apache log4j RCE Attempt (udp ldaps) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections6) M1"

• "ET EXPLOIT Yachtcontrol Webservers RCE CVE-2019-17270 (Inbound)"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested lower (tcp) (CVE-2021-44228)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M2"

• "ET EXPLOIT WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion"

• "ET EXPLOIT Genexis PLATINUM 4410 Command Injection Inbound (CVE-2021-29003)"

• "GPL NETBIOS SMB-DS llsrconnect unicode overflow attempt"

• "ET EXPLOIT InoERP 0.7.2 Unauthenticated Remote Code Execution (Outbound)"

• "ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Authentication Bypass Attempt"

• "GPL NETBIOS SMB-DS llsrconnect unicode little endian andx overflow attempt"

• "ET EXPLOIT VMWare View Planner RCE (CVE-2021-21978) Attempt M2"

• "ET EXPLOIT Technicolor TD5130.2 - Remote Command Execution"

• "GPL NETBIOS SMB NDdeSetTrustedShareW unicode overflow attempt"

• "ET TELNET busybox MEMES Hackers - Possible Brute Force Attack"

• "ET EXPLOIT Cisco ASA and Firepower Path Traversal Vulnerability M1 (CVE-2020-3452)"

• "ET WEB_SERVER DEWMODE Webshell Observed Outbound"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections7) M1"

• "ET EXPLOIT F5 BIG-IP rsync cmi authorized_keys successful exfiltration"

• "GPL RPC snmpXdmi overflow attempt TCP"

• "ET EXPLOIT Possible OpenSMTPD RCE Inbound (CVE-2020-7247)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (17)"

• "GPL NETBIOS SMB-DS DCERPC Remote Activation bind attempt"

• "ET EXPLOIT Possible Zerologon NetrServerAuthenticate with 0x00 Client Credentials (CVE-2020-1472)"

• "ET EXPLOIT [CISA AA21-336A] Zoho ManageEngine ServiceDesk Possible Exploitation Activity (CVE-2021-44077)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M2"

• "ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M1"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M2"

• "ET EXPLOIT NETGEAR R7000/R6400 - Command Injection Outbound (CVE-2019-6277)"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M5 (CVE-2023-23397)"

• "ET EXPLOIT Possible Barracuda Email Security Gateway Remote Code Execution Attempt (CVE-2023-2868) M2"

• "GPL POP3 APOP USER overflow attempt"

• "ET EXPLOIT Technicolor TD5130v2/TD5336 Router RCE CVE-2019-118396/CVE-2017-14127 (Inbound)"

• "ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M2"

• "ET TROJAN Possible Linux.Mirai DaHua Default Credentials Login"

• "ET EXPLOIT Possible Oracle WebLogic CVE-2020-2551 Scanning"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Jdk7u21) M3"

• "ET WEB_SPECIFIC_APPS MagnusBilling icepay.php democ Parameter Command Inject Attempt (CVE-2023-30258)"

• "ET WEB_SPECIFIC_APPS Mailtrail v0.53 Command Injection Attempt"

• "ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M2"

• "ET WEB_SPECIFIC_APPS Vulnerable Magento Adminhtml Access"

• "ET EXPLOIT Enigma Network Management Systems v65.0.0 CVE-2019-16072 (Inbound)"

• "ET EXPLOIT iRZ Mobile Router RCE Inbound M1 (CVE-2022-27226)"

• "ET WEB_SPECIFIC_APPS RaspAP Command Injection Attempt (CVE 2022-39986) M1"

• "ET EXPLOIT TIBCO Data Virtualization <= 8.3 RCE Attempt (CVE-2016-2510)"

• "ET EXPLOIT Possible Malicious NAT-PMP Response Successful TCP Map to External Network"

• "ET EXPLOIT Authenticated QuickBox CE 2.5.5/Pro 2.1.8 RCE Attempt Inbound M1 (CVE-2020-13448)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (service)"

• "ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)"

• "ET EXPLOIT Possible Vantage Velocity Field Unit RCE Inbound (CVE-2020-9020)"

• "ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DHCP ACK"

• "ET EXPLOIT Apache log4j RCE Attempt (udp iiop) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M1"

• "ET EXPLOIT Linksys WAP54G debug.cgi Shell Access as Gemtek"

• "ET EXPLOIT Sophos Firewall Authentication Bypass (CVE-2022-1040) Server Response M2"

• "ET WEB_CLIENT Possible Confluence SSTI Exploitation Attempt - Leads to RCE/LFI (CVE-2019-3396)"

• "ET WEB_CLIENT Metasploit Browser Autopwn Aug1 2016"

• "ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit Attempt"

• "ET EXPLOIT Razer Sila Router - Command Injection Attempt Inbound (find) (No CVE)"

• "ET WEB_SPECIFIC_APPS Apache Struts inbound .getClass OGNL injection remote code execution attempt"

• "ET EXPLOIT ysoserial Payload in HTTP URI (MozillaRhino2) M2"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JavassistWeld1) M3"

• "ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M4"

• "ET EXPLOIT NetGear WNR2000v5 Buffer Overflow Attempt Inbound (CVE-2017-6862)"

• "ET EXPLOIT Aviatrix Controller Unrestricted File Upload with Path Traversal Inbound (CVE-2021-40870)"

• "GPL NETBIOS SMB-DS llsrconnect unicode andx overflow attempt"

• "ET EXPLOIT Pulse Secure Post-Auth OS Command Injection (CVE-2019-11539)"

• "ET EXPLOIT Belkin Wemo Enabled Crock-Pot Unauthenticated Command Injection Outbound (CVE-2019-12780)"

• "ET EXPLOIT Microsoft Edge Chakra - InlineArrayPush Type Confusion Inbound M2 (CVE-2018-8617)"

• "ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M1 (CVE-2020-28020)"

• "ET EXPLOIT Apache Solr RCE via Velocity Template M2 (CVE-2019-17558)"

• "ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound - Information Disclosure Attempt (CVE-2020-28021)"

• "ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12636)"

• "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M1"

• "ET WEB_SPECIFIC_APPS Liferay Unauthenticated RCE via JSONWS Inbound (CVE-2020-7961)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M1"

• "ET EXPLOIT Apache log4j RCE Attempt (udp dns) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT MiCasaVerde VeraLite - Remote Code Execution Inbound (CVE-2016-6255)"

• "ET EXPLOIT LibreOffice pydoc RCE Inbound (CVE-2018-16858)"

• "GPL SMTP EXPN overflow attempt"

• "ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap Overflow Exploit Email (Inbound)"

• "ET ATTACK_RESPONSE Possible WebShell Upload Attempt via Directory Traversal M1"

• "ET EXPLOIT Apache log4j RCE Attempt - AWS Access Key Disclosure (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT NETGEAR R7000/R6400 - Command Injection Inbound (CVE-2019-6277)"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - Auth Bypass Attempt Inbound (CVE-2021-33543)"

• "ET EXPLOIT Possible Pulse Secure VPN RCE Inbound (CVE-2020-8218)"

• "ET EXPLOIT File Sharing Wizard 1.5.0 - SEH Overflow Inbound (CVE-2019-16724)"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp ldaps) (Outbound) (CVE-2021-44228)"

• "ET WEB_CLIENT Attempted RCE in Wordpress Social Warfare Plugin Inbound (CVE-2019-9978)"

• "ET EXPLOIT Linksys WRT54G Version 3.1 Command Injection Attempt"

• "ET EXPLOIT Possible TerraMaster TOS RCE Inbound (CVE-2020-28188 CVE-2020-35665)"

• "ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate3 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M1"

• "ET EXPLOIT TerraMaster TOS RCE via OS Command Injection Inbound (CVE-2020-28188)"

• "ET EXPLOIT Eir D1000 Remote Command Injection Attempt Outbound"

• "ET SCAN Dark Nexus IoT Variant User-Agent (Inbound)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Jdk7u21) M3"

• "ET EXPLOIT CentOS Control Web Panel Pre-Auth Remote Code Execution (CVE-2022-44877)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (meinsm)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - HTTP URI Obfuscation (CVE-2021-44228) (Outbound)"

• "GPL NETBIOS SMB OpenKey little endian overflow attempt"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M1"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 1b"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Netgear ProSAFE Plus Unauthenticated RCE Inbound (CVE-2020-26919)"

• "ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate3 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M2"

• "ET EXPLOIT Successful Cisco RV320/RV325 Config Disclosure (CVE-2019-1653)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JBossInterceptors1) M3"

• "ET EXPLOIT Sophos Web Appliance Pre-Auth Command Injection Attempt (CVE-2023-1671)"

• "ET EXPLOIT Fastweb Fastgate 0.00.81 - Remote Code Execution"

• "ET EXPLOIT Fuel CMS 1.4.1 RCE (CVE-2018-16763)"

• "ET EXPLOIT Possible MPC Sharj 3.11.1 - Arbitrary File Download Attempt"

• "ET EXPLOIT .NET Framework Remote Code Execution Injection (CVE-2020-1147)"

• "ET EXPLOIT Vulnerable Microsoft Exchange Server Response (CVE-2021-31207)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections5/MozillaRhino1/Vaadin) M1"

• "ET EXPLOIT Unknown Target Application Command Injection Inbound"

• "ET EXPLOIT Microsoft Edge Chakra - NewScObjectNoCtor InitProtoType Confusion Inbound (CVE-2019-0567)"

• "GPL NETBIOS SMB CoGetInstanceFromFile overflow attempt"

• "ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Joomla RCE (CVE-2011-5148)"

• "ET EXPLOIT OptiLink ONT1GEW GPON RCE Inbound"

• "ET EXPLOIT Razer Sila Router - Command Injection Attempt Inbound (wget) (No CVE)"

• "ET WEB_SERVER CVE-2014-6271 Attempt In HTTP Headers Line Continuation Evasion CRLF"

• "ET EXPLOIT Microsoft Exchange SUID Disclosure via SSRF Inbound M2 (CVE-2021-31207)"

• "ET EXPLOIT Linksys Auth Bypass switch_boot.cgi"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JBossInterceptors1) M1"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections7) M3"

• "ET EXPLOIT Apache Cocoon <= 2.1.x LFI (CVE-2020-11991)"

• "ET WEB_SPECIFIC_APPS LG Simple Editor Rename Malicious BMP to JSP Attempt (CVE-2023-40498)"

• "ET EXPLOIT Microsoft Exchange RCE Setup Inbound (CVE-2021-28482)"

• "ET CURRENT_EVENTS Possible Microsoft RDP Client for Mac RCE"

• "ET EXPLOIT Attempted HiSilicon DVR/NVR/IPCam RCE (Inbound)"

• "ET EXPLOIT D-Link Router DNS Changer Exploit Attempt"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Clojure1) M2"

• "ET EXPLOIT Prestashop Orderfiles Module Arbitrary File Upload"

• "ET EXPLOIT FatPipe Unrestricted File Upload"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JBossInterceptors1) M1"

• "ET EXPLOIT vBulletin 5.x Unauthenticated Remote Code Execution (CVE-2019-16759) M1"

• "ET EXPLOIT Possible Oracle Access Manager RCE Attempt (CVE-2021-35587)"

• "ET EXPLOIT SMB Null Pointer Dereference PoC Inbound (CVE-2018-0833)"

• "ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1600)"

• "ET EXPLOIT Citrix Application Delivery Controller Arbitrary Code Execution Attempt Scanner Attempt - Server Response (CVE-2019-19781)"

• "ET WEB_SPECIFIC_APPS Possible Attempted Microsoft Exchange RCE (CVE-2020-0688)"

• "ET WEB_SERVER Suspected SUPERNOVA Webshell Command (External)"

• "ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Clojure1) M3"

• "ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (Unassigned CVE)"

• "ET INFO Possible NOP Sled Observed in Large DNS over TCP Packet M2"

• "ET EXPLOIT Citrix Application Delivery Controller Arbitrary Code Execution Attempt Scanner Attempt (CVE-2019-19781)"

• "ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798)"

• "ET EXPLOIT ASUS RT N56U Router DNS Change GET Request 2"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp rmi) (CVE-2021-44228)"

• "ET EXPLOIT Possible NSDP (Netgear) Unauthenticated Buffer Overflow (CVE-2020-35232)"

• "ET EXPLOIT HiSilicon DVR - Application Credential Disclosure (CVE-2018-9995)"

• "ET EXPLOIT Possible Apache log4j Uncontrolled Recursion Lookup (CVE-2021-45105)"

• "ET WEB_SPECIFIC_APPS Atlassian Crowd Plugin Upload Attempt (CVE-2019-11580)"

• "ET EXPLOIT NetGain Enterprise Manager 7.2.562 Ping Command Injection"

• "ET EXPLOIT Attempted IDSVSE IP Camera RCE"

• "GPL NETBIOS SMB NDdeSetTrustedShareW unicode little endian andx overflow attempt"

• "ET EXPLOIT D-Link DWR Command Injection Inbound (CVE-2018-10823)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Clojure1) M2"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Clojure1) M2"

• "ET EXPLOIT Apache log4j RCE Attempt (http) (Inbound) (CVE-2021-44228)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Spring1/Spring2) M3"

• "ET EXPLOIT Default Apache CouchDB Erlang Cookie Observed (CVE-2022-24706)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JRMPClient) M1"

• "GPL NETBIOS SMB-DS llsrconnect andx overflow attempt"

• "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JRMPClient) M1"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections1/CommonsCollections3) M2"

• "ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Successful Exploitation (CVE-2021-34429)"

• "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (lower TCP Bypass) (CVE-2021-44228)"

• "ET EXPLOIT SEOWON INTECH SLC-130/SLR-120S RCE Inbound M1 (CVE-2020-17456)"

• "ET EXPLOIT Netgear ProSAFE Plus Possible Integer Overflow Attempt Inbound M1 (CVE-2020-35230)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - Base64 jndi (udp) (CVE-2021-44228)"

• "ET EXPLOIT Possible EXIM DoS (CVE-2019-16928)"

• "ET EXPLOIT Cisco Security Manager Path Traversal - athena (CVE-2020-27130)"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (tcp nis) (CVE-2021-44228)"

• "ET EXPLOIT Outbound GPON Authentication Bypass Attempt (CVE-2018-10561)"

• "ET EXPLOIT eMerge E3 Command Injection Inbound (CVE-2019-7256)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Clojure1) M3"

• "ET WEB_SPECIFIC_APPS DNN DNNPersonalization Cookie RCE Attempt (CVE-2017-9822)"

• "ET EXPLOIT CloudMe Sync Buffer Overflow"

• "ET EXPLOIT Atlassian Jira Unauth User Enumeration Attempt (CVE-2020-36289)"

• "ET EXPLOIT Possible Mirai Infection Attempt via OS Command Injection Inbound (CVE-2021-32305)"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - simple_reclistjs.cgi RCE via Command Injection Attempt Outbound (CVE-2021-33544)"

• "ET EXPLOIT Possible Malicious NAT-PMP Response Successful UDP Map to External Network"

• "ET EXPLOIT ysoserial Payload in HTTP URI (MozillaRhino2) M1"

• "ET EXPLOIT Qualcomm QCMAP NULL Pointer Dereference Attempt Inbound (CVE-2020-25858)"

• "ET EXPLOIT MiCasaVerde VeraLite - Remote Code Execution Outbound (CVE-2016-6255)"

• "ET EXPLOIT Possible SAP ICM MPI Desynchronization Scanning Activity (CVE-2022-22536) M1"

• "GPL POP3 x86 SCO overflow"

• "ET EXPLOIT Possible iOS Pegasus Safari Exploit (CVE-2016-4657)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M3"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JavassistWeld1) M3"

• "GPL NETBIOS SMB-DS llsrconnect unicode little endian overflow attempt"

• "ET EXPLOIT Firefox 0-day used against TOR browser Nov 29 2016 M2"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (lower UDP Bypass) (CVE-2021-44228)"

• "ET EXPLOIT Kramer VIAware Remote Code Execution (CVE-2021-35064 CVE-2021-36356)"

• "ET EXPLOIT rConfig < 3.9.7 SQLi (CVE-2020-10546)"

• "ET WEB_SPECIFIC_APPS Wordpress OptimizePress Arbitratry File Upload"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Clojure1) M1"

• "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Outbound (CVE-2020-8515) M1"

• "ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack"

• "ET EXPLOIT Belkin Wireless G Router DNS Change POST Request"

• "ET EXPLOIT UCM6202 1.0.18.13 - Remote Command Injection Attempt"

• "ET EXPLOIT Mitsubishi Electric smartRTU RCE Inbound (CVE-2019-14931)"

• "ET EXPLOIT Furukawa Electric ConsciusMAP 2.8.1 Java Deserialization Remote Code Execution (CVE-2020-12133)"

• "ET EXPLOIT Prestashop Supercheckout Module Arbitrary File Upload"

• "ET WEB_SERVER Possible CVE-2014-6271 Attempt in Client Body 2"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Spring1/Spring2) M1"

• "ET EXPLOIT WS_FTP Reflected XSS Payload Observed M1 (CVE-2022-27665)"

• "ET EXPLOIT Possible Vacron NVR Remote Command Execution M2"

• "ET EXPLOIT ysoserial Payload in HTTP URI (MozillaRhino2) M3"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp dns) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT ScadaBR RCE with JSP Shell Inbound (CVE-2021-26828)"

• "ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M5"

• "ET CURRENT_EVENTS Possible CVE-2017-8759 Soap File DL Over FTP"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (udp) (Outbound) (CVE-2021-44228)"

• "GPL FTP CMD overflow attempt"

• "ET EXPLOIT Cisco RV320/RV325 Config Disclosure Attempt Inbound (CVE-2019-1653)"

• "ET WEB_SPECIFIC_APPS PHP-Fusion Downloads.php Command Injection (CVE-2020-24949)"

• "GPL FTP RETR overflow attempt"

• "ET EXPLOIT DynoRoot DHCP - Client Command Injection"

• "ET EXPLOIT Possible Cisco REST API Container for Cisco IOS XE Software Authentication Bypass Attempt (CVE-2019-12643)"

• "GPL NETBIOS SMB OpenKey unicode overflow attempt"

• "ET EXPLOIT Possible Mirai Infection Attempt via OS Command Injection Outbound (CVE-2021-32305)"

• "ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M1"

• "ET EXPLOIT DNS Change Attempt (Unknown Device)"

• "ET WEB_SERVER CURL Command Specifying Output in HTTP Headers"

• "ET WEB_SPECIFIC_APPS TOTOLINK setTracerouteCfg Command Injection Attempt (CVE-2023-30013)"

• "ET EXPLOIT AirLive RCI HTTP Request"

• "ET TROJAN Megalodon/Gomorrah/CosaNostra HTTP Bot CnC Exfil"

• "ET EXPLOIT RUIJIE NBR/RGNBR Command Injection Attempt Inbound M1"

• "ET EXPLOIT Possible EyesOfNetwork Remote File Upload with PHP WebShell Inbound (CVE-2021-27513)"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit as Observed in Sundown/RIG EK (b643)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (udp nis) (Outbound) (CVE-2021-44228)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Xfinity Gateway - Remote Code Execution"

• "ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request - RCE Attempt (CVE-2020-9480)"

• "ET EXPLOIT Apache log4j RCE Attempt (http dns) (CVE-2021-44228)"

• "ET EXPLOIT COMTREND ADSL Router CT-5367 Remote DNS Change Attempt"

• "ET EXPLOIT Monitorr 1.7.6m RCE Exploit Attempt"

• "ET EXPLOIT TP-LINK TL-WR750N DNS Change GET Request"

• "ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (CVE-2021-42013) M2"

• "ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228)"

• "ET EXPLOIT D-Link IP Camera Vulnerable HTTP Request (CVE-2013-1599)"

• "ET EXPLOIT Unknown Vulnerability Exploit Attempt (Possible Mirai Activity)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections6) M2"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit as Observed in Sundown/RIG EK (b646)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections5/MozillaRhino1/Vaadin) M1"

• "GPL FTP STOU overflow attempt"

• "GPL RPC STATD TCP stat mon_name format string exploit attempt"

• "ET EXPLOIT Apache log4j RCE Attempt (udp iiop) (CVE-2021-44228)"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - oem.cgi RCE via Command Injection Attempt Outbound (CVE-2021-33544)"

• "ET EXPLOIT Possible Sar2HTML plotting tool for Linux servers v3.2.1 (Outbound)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (Zte521)"

• "ET EXPLOIT IBM Data Risk Manager Arbitrary File Download (CVE-2020-4430)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT [401TRG] DeDeCMS RFI Attempt"

• "ET TROJAN Arid Viper APT Advtravel Campaign GET Request"

• "ET EXPLOIT MetInfo 7.0 SQL Injection (CVE-2019-16997)"

• "ET TROJAN Win32/Injector.DSQR CnC Activity (POST)"

• "ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toclient M3"

• "ET EXPLOIT Qualcomm QCMAP Command Injection Attempt Inbound (CVE-2020-3657)"

• "ET EXPLOIT Possible SAP ICM MPI Desynchronization Scanning Activity (CVE-2022-22536) M2"

• "ET EXPLOIT Scriptcase 9.7 Arbitrary File Upload Attempt"

• "ET EXPLOIT Possible Pure-FTPd CVE-2014-6271 attempt"

• "ET EXPLOIT Possible ZyXELs ZynOS Configuration Download Attempt (Contains Passwords)"

• "GPL RPC CMSD TCP CMSD_CREATE buffer overflow attempt"

• "ET EXPLOIT D-Link DSL-2740R Remote DNS Change Attempt"

• "ET EXPLOIT Possible NSDP (Netgear) Write Command Buffer Overflow Attempt - 0x0005 (CVE-2020-35225)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (klv123)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (4)"

• "ET WEB_SERVER Webmin RCE CVE-2019-15107"

• "ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap Overflow Exploit Email (Inbound)"

• "ET EXPLOIT Cisco RV320/RV325 Debug Dump Disclosure Attempt Inbound (CVE-2019-1653)"

• "ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2"

• "ET EXPLOIT ownCloud Remote Improper Authentication Attempt (CVE-2023-49105)"

• "ET EXPLOIT GoCD Authentication Bypass Successful Leak"

• "ET EXPLOIT EyesOfNetwork Cookie SQLi (CVE-2020-9465)"

• "ET EXPLOIT Possible Redis RCE Attempt - Dynamic Importing of liblua (CVE-2022-0543)"

• "ET EXPLOIT CCBill Online Payment Systems RCE (Inbound)"

• "ET EXPLOIT ManageEngine Unauthenticated RCE Attempt M11 (CVE-2022-47966)"

• "ET WEB_SPECIFIC_APPS Modx Revolution RCE (CVE-2018-1000207)"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt URL Prefix (CVE-2022-42889) (Outbound)"

• "ET EXPLOIT Supermicro BMC Password Disclosure 4"

• "ET EXPLOIT Laravel Remote Code Execution (CVE-2021-3129) Outbound - Payload Execution Attempt"

• "ET EXPLOIT VMware vCenter Unauthorized File Read Inbound"

• "ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965)"

• "ET EXPLOIT Possible Microsoft Exchange RCE Inbound M3 (CVE-2021-34473)"

• "ET WEB_SPECIFIC_APPS pfSense CE 2.7.0 gfif Parameter Remote Code Execution Attempt (CVE-2023-42326) M1"

• "ET WEB_SERVER [Cluster25] FortiOS Auth Bypass Attempt (CVE-2022-40684)"

• "ET EXPLOIT [NCC GROUP] Possible Bluekeep Inbound RDP Exploitation Attempt (CVE-2019-0708)"

• "ET EXPLOIT NetGain Systems Enterprise Manager CVE-2017-16602 (Outbound)"

• "ET EXPLOIT Possible Tenda OS Command Injection (CVE-2020-10987) (POST)"

• "ET EXPLOIT Possible MovableTypePoC RCE Inbound (CVE-2021-20837)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (12)"

• "ET EXPLOIT Zoho ManagedEngine Desktop Central Authentication Bypass - Administrator Password Reset Attempt (CVE-2021-44515)"

• "ET WEB_SPECIFIC_APPS Possible SharePoint RCE Attempt (CVE-2019-0604)"

• "ET EXPLOIT Totolink Command Injection Attempt (CVE-2020-40475)"

• "ET WEB_SPECIFIC_APPS Possible Apache Unomi MVEL Eval RCE Inbound M1 (CVE-2020-13942)"

• "ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Inbound (CVE-2022-3602)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (upper TCP Bypass) (CVE-2021-44228)"

• "ET EXPLOIT 3Com Office Connect Remote Code Execution (Inbound)"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M6"

• "ET EXPLOIT NUUO OS Command Injection"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections6) M3"

• "ET EXPLOIT Possible NGINX Reference LDAP Query Injection Attack"

• "ET TROJAN Possible Linux.Mirai Login Attempt (ikwb)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JavassistWeld1) M1"

• "ET EXPLOIT Fortinet FortiNAC - Observed POST .zip with Vulnerable Parameter (CVE-2022-39952)"

• "ET EXPLOIT Sunlogin Sunflower Simplified 1.0.1.43315 Directory Traversal Attempt (CVE-2022-48323)"

• "ET TELNET External Telnet Attempt To Cisco Device With No Telnet Password Set (Automatically Dissalowed Until Password Set)"

• "ET INFO Suspicious GET Request (Likely Pentester CnC)"

• "ET EXPLOIT Jboss RCE (CVE-2017-12149)"

• "GPL NETBIOS SMB-DS OpenKey unicode little endian andx overflow attempt"

• "ET EXPLOIT Nagios XI OS Command Injection (CVE-2021-25296)"

• "ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M2"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (5)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M2"

• "GPL RPC CMSD UDP CMSD_CREATE buffer overflow attempt"

• "ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M2 (CVE-2023-36844 CVE-2023-36845)"

• "ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M1"

• "ET EXPLOIT WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - tmpapp.cgi RCE via Command Injection Attempt Outbound (CVE-2021-33544)"

• "ET WEB_SPECIFIC_APPS Altenergy Power Control Software Command Injection Attempt (CVE-2022-25237)"

• "ET WEB_SERVER Suspected SUPERNOVA Webshell Command (Internal)"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW andx overflow attempt"

• "ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET WEB_SPECIFIC_APPS Apache Struts memberAccess inbound OGNL injection remote code execution attempt"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - language.cgi RCE via Command Injection Attempt Inbound (CVE-2021-33544)"

• "ET EXPLOIT FortiOS SSL VPN - Remote Code Execution (CVE-2018-13383)"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt Script Prefix (CVE-2022-42889) (Outbound)"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M8"

• "ET EXPLOIT Geutebruck Attempted Remote Command Injection Inbound"

• "ET EXPLOIT Smart Google Code Inserter < 3.5 Auth Bypass (CVE-2018-3810)"

• "ET EXPLOIT VMware Spring Cloud Gateway Code Injection (CVE-2022-22947)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections1/CommonsCollections3) M3"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (udp nds) (CVE-2021-44228)"

• "ET EXPLOIT Microsoft Exchange SUID Disclosure via SSRF Inbound M1 (CVE-2021-31207)"

• "ET EXPLOIT Adobe ColdFusion 11 - LDAP Java Object Deserialization RCE (POST) CVE-2018-15957"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit as Observed in Sundown/RIG EK (b644)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (10)"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt DNS Prefix (CVE-2022-42889) (Outbound)"

• "GPL NETBIOS SMB-DS OpenKey andx overflow attempt"

• "ET EXPLOIT HP Enterprise VAN SDN Controller Root Command Injection (Linux)"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M4"

• "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M2"

• "ET WEB_SPECIFIC_APPS Apache Struts2 Possible uploadFileName Directory Traversal Attempt (CVE-2023-50164) - uploadFileName Parameter M2"

• "ET WEB_SPECIFIC_APPS Possible Wordpress Plugin TheCartPress Privilege Escalation Attempt Inbound"

• "ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy"

• "ET EXPLOIT Possible Oracle Database Text Component ctxsys.drvxtabc.create_tables Remote SQL Injection Attempt"

• "ET EXPLOIT Barracuda Spam Firewall 3.3.x RCE 2006-4000 (Inbound)"

• "ET ATTACK_RESPONSE Possible WebShell Upload Attempt via Directory Traversal M2"

• "ET EXPLOIT Possible Zimbra RCE Attempt Inbound (CVE-2022-27925)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (tcp nis) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (udp nis) (CVE-2021-44228)"

• "ET SCAN SQLNinja Attempt To Create xp_cmdshell Session"

• "ET EXPLOIT Known Malicious Router DNS Change GET Request"

• "ET EXPLOIT Apache log4j RCE Attempt (http ldaps) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT ManageEngine AdSelfService Plus - Authentication Bypass Attempt (CVE-2021-40539)"

• "ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M1"

• "ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step2/3 File Retrieval Request- Observed in MOVEit File Transfer - INBOUND"

• "ET EXPLOIT DBltek GoIP GoIP-1 GSM Gateway - Local File Inclusion"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - certmngr.cgi RCE via Command Injection Attempt Outbound (CVE-2021-33544)"

• "ET WEB_SPECIFIC_APPS Nette Command Injection Attempt Inbound (CVE-2020-15227)"

• "ET WEB_SERVER Suspected China Chopper Variant Webshell Command (inbound)"

• "ET EXPLOIT dotCMS Arbitrary File Upload Attempt (CVE-2022-26352) M2"

• "ET WEB_SERVER Possible SUPERMICRO IPMI url_redirect.cgi Directory Traversal Attempt"

• "ET EXPLOIT Netlink GPON Remote Code Execution Attempt (Inbound)"

• "GPL NETBIOS DCERPC Messenger Service buffer overflow attempt"

• "ET EXPLOIT Oracle WebLogic Unrestricted File Upload (CVE-2018-2894)"

• "ET EXPLOIT IPMI Cipher 0 Authentication mode set"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode little endian overflow attempt"

• "ET EXPLOIT Possible OpenDreamBox Attempted Remote Command Injection Outbound"

• "GPL NETBIOS DCERPC CoGetInstanceFromFile little endian overflow attempt"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - certmngr.cgi RCE via Command Injection Attempt Inbound (CVE-2021-33544)"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt Script Prefix (CVE-2022-42889) (Inbound)"

• "ET MALWARE AllaKore RAT ID Command Observed"

• "GPL NETBIOS SMB llsrconnect unicode little endian overflow attempt"

• "ET EXPLOIT Apache Struts RCE Attempt (CVE-2020-17530)"

• "ET EXPLOIT Possible Spring Cloud Connector RCE Inbound (CVE-2022-22963)"

• "ET EXPLOIT Possible Mida eFramework RCE Attempt Inbound (CVE-2020-15922)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (zlxx)"

• "ET SCAN Polaris Botnet User-Agent (Inbound)"

• "ET EXPLOIT Possible Citrix ShareFile RCE Inbound (CVE-2021-22941)"

• "ET EXPLOIT WP Download From Files Plugin <= 1.48 Arbitrary File Upload Attempt"

• "ET WEB_CLIENT Apple Quicktime RTSP Overflow (1)"

• "ET EXPLOIT Mi Router 3 Remote Code Execution CVE-2018-13023"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections6) M3"

• "ET EXPLOIT Nuuo NVR RCE Attempt (CVE-2018-15716)"

• "ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M1 (CVE-2020-28021)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (27)"

• "GPL NETBIOS SMB OpenKey unicode andx overflow attempt"

• "ET EXPLOIT Possible Oracle Identity Manager Attempt to Logon with default account"

• "GPL NETBIOS SMB-DS OpenKey little endian andx overflow attempt"

• "ET WEB_SPECIFIC_APPS rConfig ajaxArchiveFiles.php Command Injection Inbound (CVE-2019-19509)"

• "ET EXPLOIT vBulletin 5.6.2 widget_tabbedContainer_tab_panel Remote Code Execution (Outbound)"

• "GPL NETBIOS SMB llsrconnect unicode little endian andx overflow attempt"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (Outbound) (CVE-2021-44228)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (28)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections7) M2"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - Possible Stack Buffer Overflow Attempt Outbound (Multiple CVE IDs)"

• "ET EXPLOIT IE Scripting Engine Memory Corruption Vulnerability M1 (CVE-2019-0752)"

• "ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M3"

• "ET SCAN Tomcat admin-blank login credentials"

• "ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap Overflow Exploit Email (Inbound)"

• "ET EXPLOIT Possible WordPress Plugin BBPress 2.5 - Unauthenticated Priv Esc Attempt (CVE-2020-13693)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections1/CommonsCollections3) M3"

• "ET EXPLOIT HP Enterprise VAN SDN Controller Upload Backdoor 2"

• "ET EXPLOIT Dataprobe iBoot-PDU Pre-Auth Remote Code Execution Attempt via git-update.php (CVE-2022-3184) M2"

• "ET EXPLOIT Apache HTTP Server SSRF (CVE-2021-40438)"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper UDP Bypass M1 (CVE-2021-44228)"

• "ET EXPLOIT Possible EXIM RCE Inbound (CVE-2019-15846)"

• "ET EXPLOIT Inbound VMware vCenter RCE Attempt M3 (CVE-2021-21972)"

• "ET EXPLOIT Secutech Router DNS Changer Exploit Attempt"

• "ET EXPLOIT Possible Cisco Jabber RCE Inbound (CVE-2020-3495)"

• "ET EXPLOIT Possible WebShell GIF Upload"

• "ET WEB_SERVER Generic Webshell Observed Outbound"

• "ET TROJAN SpyAgent C&C Activity (Response)"

• "ET EXPLOIT NetGain Systems Enterprise Manager CVE-2017-16602 (Inbound)"

• "GPL FTP MKD overflow"

• "ET WEB_SPECIFIC_APPS Openfire Authentication Bypass With RCE (CVE-2023-32315)"

• "ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M1"

• "ET EXPLOIT Cisco IOS XE Web Server Possible Authentication Bypass Attempt (CVE-2023-20198) (Inbound)"

• "ET EXPLOIT Seagate Business NAS Unauthenticated Remote Command Execution"

• "ET TROJAN AllaKore RAT CnC Checkin M1"

• "ET EXPLOIT Apache log4j RCE Attempt (http ldaps) (CVE-2021-44228)"

• "ET EXPLOIT Netgear ProSAFE Plus Possible Integer Overflow Attempt Inbound M2 (CVE-2020-35230)"

• "GPL NETBIOS SMB llsrconnect little endian overflow attempt"

• "GPL NETBIOS SMB OpenKey andx overflow attempt"

• "ET EXPLOIT Possible FatPipe Unrestricted File Upload"

• "ET TROJAN Observed Malicious DNS Query (BazarLoader/Team9 Backdoor CnC Domain)"

• "ET WEB_SPECIFIC_APPS pfSense CE 2.7.0 gfif Parameter Remote Code Execution Attempt (CVE-2023-42326) M2"

• "ET ATTACK_RESPONSE Windows 32bit procdump Dump File Exfiltration"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (tcp corba) (CVE-2021-44228)"

• "ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12635)"

• "ET EXPLOIT Complaint Management System 1.0 - Authentication Bypass Attempt"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Centreon 20.04 Authenticated RCE (CVE-2020-12688)"

• "ET EXPLOIT SonicWall SMA 100 Series - Possible Heap-Based Overflow Activity (CVE-2021-20043)"

• "ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5405)"

• "ET TROJAN Cobalt Strike Related Domain in DNS Lookup (world .healthamericacu .com)"

• "GPL NETBIOS SMB NDdeSetTrustedShareW unicode little endian overflow attempt"

• "GPL NETBIOS SMB-DS OpenKey unicode little endian overflow attempt"

• "ET WEB_SPECIFIC_APPS Possible KLOG Server RCE Inbound (CVE-2020-35729)"

• "ET WEB_SERVER SQLi - SELECT and sysobject M1"

• "ET EXPLOIT Possible JNBridge Java Deserialization Attempt M3"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections1/CommonsCollections3) M1"

• "ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)"

• "ET EXPLOIT Linksys Auth Bypass share_editor.cgi"

• "ET EXPLOIT Microsoft Edge Chakra - InlineArrayPush Type Confusion Inbound M1 (CVE-2018-8617)"

• "ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M6 (CVE-2020-14882)"

• "ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781)"

• "ET EXPLOIT NodeBB Path Traversal (CVE-2021-43788)"

• "ET WEB_SERVER Possible SQL Injection Attempt Danmec related (declare) in HTTP URI"

• "ET EXPLOIT Equation Group ExtraBacon Cisco ASA PMCHECK Disable"

• "ET EXPLOIT Cisco HyperFlex OS Command Injection M1 (CVE-2021-1497)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JavassistWeld1) M1"

• "ET WEB_SERVER CVE-2014-6271 Attempt In HTTP Headers Line Continuation Evasion LF"

• "ET EXPLOIT Bonitasoft Authorization Bypass M1 (CVE-2022-25237)"

• "ET EXPLOIT QNAP PhotoStation Privilege Escalation Attempt M2 (plaintext token)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (upper UDP Bypass) (CVE-2021-44228)"

• "ET MALWARE Lazarus Maldoc CnC"

• "ET WEB_SERVER Possible CVE-2014-6271 Attempt in Client Body 3"

• "ET EXPLOIT Belkin Wemo Enabled Crock-Pot Unauthenticated Command Injection Inbound (CVE-2019-12780)"

• "ET EXPLOIT Sunhillo SureLine Unauthenticated OS Command Injection Inbound (CVE-2021-36380)"

• "ET EXPLOIT Netgear passwordrecovered.cgi attempt"

• "ET EXPLOIT Possible Command Injection via User-Agent (PwnAgent) - CVE-2023-24749, CVE-2022-47208"

• "ET EXPLOIT ysoserial Payload in HTTP URI (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M3"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp ldaps) (CVE-2021-44228)"

• "ET EXPLOIT VMware SD-WAN Orchestrator Path Traversal (CVE-2020-4000)"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Attempt"

• "ET WEB_SERVER WEBSHELL Linux/Torte Uploaded"

• "ET EXPLOIT Bonitasoft Authorization Bypass and RCE Upload M2 (CVE-2022-25237)"

• "ET EXPLOIT Linear eMerge E3 Unauthenticated Command Injection Outbound (CVE-2019-7256)"

• "ET EXPLOIT Supermicro BMC Password Disclosure 1"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JRMPClient) M2"

• "ET EXPLOIT ysoserial Payload in HTTP URI (CommonsCollections5/MozillaRhino1/Vaadin) M2"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (22)"

• "ET WEB_CLIENT Attempted WordPress GDPR Plugin Privilege Escalation M1 (Enable Registration)"

• "ET WEB_SERVER Possible attempt to enumerate MS SQL Server version"

• "ET WEB_SPECIFIC_APPS pfSense CE 2.7.0 Stored Cross Site Script Attempt - Firewall Logs Dynamic View (CVE-2023-42325)"

• "GPL NETBIOS SMB OpenKey unicode little endian andx overflow attempt"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M1"

• "ET TROJAN Possible Linux.Mirai Login Attempt (666666)"

• "ET EXPLOIT Exim/Dovecot Possible MAIL FROM Command Execution"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET WEB_SPECIFIC_APPS Oracle WebLogic Deserialization (CVE-2018-2893)"

• "GPL NETBIOS DCERPC Remote Activation bind attempt"

• "GPL FTP MKD overflow attempt"

• "GPL FTP APPE overflow attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile overflow attempt"

• "ET EXPLOIT [PT Security] Exim <4.90.1 Base64 Overflow RCE (CVE-2018-6789)"

• "ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)"

• "ET INFO Suspicious PHP Code in HTTP POST (Inbound)"

• "ET EXPLOIT UPnP UUID Password Change Exploit Attempt Inbound - R6700V3 PoC Gadgets (CVE-2021-34991)"

• "ET WEB_SPECIFIC_APPS Zoneminder Create Snapshot Command Injection Attempt (CVE-2023-26035)"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile andx overflow attempt"

• "ET WEB_SPECIFIC_APPS [eSentire] Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE-2018-7600)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - Base64 jndi (udp) (Outbound) (CVE-2021-44228)"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Nagios XI <= 5.6.5 Privesc (CVE-2019-15949)"

• "ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M2 (CVE-2020-28020)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET ACTIVEX Possible Successful Generic Phish (set) 2021-03-08"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JBossInterceptors1) M3"

• "ET EXPLOIT Multiple Router RCE Routersploit"

• "ET EXPLOIT .NET Framework Remote Code Execution Injection (CVE-2020-0646)"

• "ET EXPLOIT Mi TV Integration Remote Code Execution CVE-2018-16130"

• "ET EXPLOIT WNR2000v4 HTTP POST RCE Attempt Via Timestamp Discovery"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections7) M2"

• "ET TROJAN OceanLotus APT Related Domain in DNS Lookup (confusion-cerulean-samba .glitch .me)"

• "ET EXPLOIT Smart Google Code Inserter < 3.5 SQLi (CVE-2018-3811)"

• "ET EXPLOIT Possible Moxa MxView RCE Attempt (CVE-2021-38454)"

• "ET EXPLOIT GraphQL Introspection Query Attempt"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested upper (tcp) (CVE-2021-44228)"

• "ET EXPLOIT TikiWiki CMS Authentication Bypass (Forced Blank Admin Pass) Attempt Inbound (CVE-2020-15906)"

• "GPL FTP invalid MDTM command attempt"

• "ET EXPLOIT Authenticated QuickBox CE 2.5.5/Pro 2.1.8 RCE Attempt Inbound M2 (CVE-2020-13448)"

• "ET MALWARE Cobalt Strike Malleable C2 Amazon Profile POST (PNG)"

• "GPL POP3 POP3 PASS overflow attempt"

• "ET EXPLOIT Possible Exim 4.87-4.91 RCE Attempt Inbound (CVE-2019-10149)"

• "ET EXPLOIT Samba Arbitrary Module Loading Vulnerability (.so file write to share) (CVE-2017-7494)"

• "ET EXPLOIT DLink DNS 320 Remote Code Execution (CVE-2019-16057)"

• "ET EXPLOIT PAN-OS OS Command Injecton Attempt Inbound (CVE-2020-2038)"

• "ET EXPLOIT MikroTik RouterOS Chimay Red Remote Code Execution Probe"

• "ET EXPLOIT SpringShell/Spring4Shell RCE Attempt (CVE-2022-22965)"

• "ET WEB_SPECIFIC_APPS pfSense CE 2.7.0 Stored Cross Site Script Attempt - getservicesproviders.php connection parameter (CVE-2023-42327)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (MozillaRhino2) M3"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (udp nds) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (JBossInterceptors1) M2"

• "ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M3"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (19)"

• "ET WEB_SERVER Possible CVE-2015-1427 Elastic Search Sandbox Escape Remote Code Execution Attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode overflow attempt"

• "ET TROJAN Possible Linux.Mirai Login Attempt (888888)"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M7"

• "ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response M2"

• "ET EXPLOIT Jira Server/Data Center 8.4.0 Remote File Read Attempt (CVE-2021-26086) M2"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (2)"

• "ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Attempt Inbound (CVE-2021-34429)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JRMPClient) M3"

• "ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis"

• "ET EXPLOIT TOTOLINK Router DNS Changer Exploit Attempt"

• "ET CURRENT_EVENTS Possible vBulletin object injection vulnerability Attempt"

• "ET EXPLOIT Thomson Reuters Velocity Analytics Vhayu Analytic Servers 6.94 build 2995 CVE-2013-5912 (Outbound)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 - Known Exploit Instance"

• "ET INFO Suspicious PHP Code in HTTP POST (Outbound)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt URL Prefix (CVE-2022-42889) (Inbound)"

• "ET EXPLOIT Advantech iView RCE Setup via Config Overwrite Inbound (CVE-2021-22652)"

• "ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap Overflow Exploit Email (Inbound)"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M2 (CVE-2023-23397)"

• "ET EXPLOIT phpMyAdmin setup.php Local File Include"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections1/CommonsCollections3) M3"

• "ET EXPLOIT PCMan FTP Server 2.0.7 Remote Command Execution"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (24)"

• "ET WEB_SPECIFIC_APPS Apache Struts inbound .getWriter OGNL injection remote code execution attempt"

• "ET EXPLOIT Yachtcontrol Webservers RCE CVE-2019-17270 (Outbound)"

• "ET EXPLOIT Cisco HyperFlex OS Command Injection M2 (CVE-2021-1497)"

• "GPL NETBIOS SMB trans2open buffer overflow attempt"

• "ET EXPLOIT Possible CVE-2014-6271 malicious DNS response"

• "ET EXPLOIT D-Link - RCE Attempt Inbound (CVE-2021-45382)"

• "ET EXPLOIT Eir D1000 Remote Command Injection Attempt Inbound"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (MozillaRhino2) M2"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - Base64 jndi (tcp) (CVE-2021-44228)"

• "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections5/MozillaRhino1/Vaadin) M3"

• "ET EXPLOIT Suspected SAP EEM SOLMAN RCE (CVE-2020-6207)"

• "ET EXPLOIT SonicWall SMA Stack-Based Buffer Overflow CVE-2021-20038 M1"

• "ET EXPLOIT Wireless IP Camera (P2) WIFICAM Remote Code Execution"

• "ET WEB_SERVER lwp-download Command Specifying Output in HTTP Headers"

• "ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toclient M1"

• "ET EXPLOIT Fortinet FortiWeb OS Command Injection Inbound M1 (CVE-2021-22123)"

• "ET EXPLOIT Sangoma Asterisk Originate AMI RCE (CVE-2019-18610) (PoC Based)"

• "ET EXPLOIT Attempted VMware Authentication Bypass (CVE-2022-31656)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (klv1234)"

• "ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String ILMI"

• "ET TROJAN Scarab APT - HeaderTip CnC Domain in DNS Lookup (product2020 .mrbasic .com)"

• "GPL RPC STATD UDP stat mon_name format string exploit attempt"

• "ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017)"

• "GPL FTP PASS overflow attempt"

• "ET EXPLOIT VMWare ESXi 6.7.0 OpenSLP Remote Code Execution Attempt - Directory Agent Advertisement Heap Overflow (CVE-2021-21974)"

• "ET EXPLOIT CyberArk Enterprise Password Vault XXE Injection Attempt"

• "ET CURRENT_EVENTS Possible CVE-2017-8759 Soap File DL"

• "ET EXPLOIT Confluence Server Path Traversal Vulnerability (CVE-2019-3398)"

• "ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Create DAG (CVE-2020-11978)"

• "ET WEB_SPECIFIC_APPS RaspAP Command Injection Attempt (CVE 2022-39986) M2"

• "ET EXPLOIT Fortigate VPN - Repeated POST Requests to /remote/logincheck (CVE-2023-27997)"

• "ET EXPLOIT FortiOS SSL VPN - Pre-Auth Messages Payload Buffer Overflow (CVE-2018-13381)"

• "GPL NETBIOS SMB OpenKey unicode little endian overflow attempt"

• "GPL NETBIOS SMB-DS OpenKey overflow attempt"

• "ET EXPLOIT Microsoft Exchange - Information Disclosure flowbit set (CVE-2021-33766)"

• "ET INFO Suspicious Response (MS-Officecmd)"

• "ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M4 (CVE-2022-21587)"

• "ET EXPLOIT Suspected Exim External Auth Overflow (CVE-2023-4115) set"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - testcmd.cgi RCE via Command Injection Attempt Inbound (CVE-2021-33544)"

• "ET EXPLOIT [PwnedPiper] Exploitation Attempt - Large Malformed Translogic Packet (CVE-2021-37164)"

• "ET EXPLOIT Apache log4j RCE Attempt (udp rmi) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Zyxel NAS RCE Attempt Inbound (CVE-2020-9054) M2"

• "ET EXPLOIT FortiOS SSL VPN - Improper Authorization Vulnerability (CVE-2018-13382)"

• "ET EXPLOIT Citrix ADC and NetScaler Gateway Information Disclosure Attempt (CVE-2023-4966)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT TP-Link Archer AX21 Unauthenticated Command Injection Inbound (CVE-2023-1389)"

• "ET EXPLOIT SonicWall SMA 100 Series - Unauthenticated File Upload Path Traversal (CVE-2021-20040)"

• "ET EXPLOIT Linux/Attempted Hosts File Exfil"

• "ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M1 (CVE-2020-14882)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-30333) M2"

• "ET WEB_SPECIFIC_APPS PeopleSoft Portal Command with Default Creds"

• "ET EXPLOIT Motorola SBG900 Router DNS Change GET Request"

• "ET SCAN Tomcat admin-admin login credentials"

• "ET EXPLOIT Zyxel Command Injection RCE (CVE-2017-6884)"

• "ET EXPLOIT Possible AVCON6 Video Conferencing System RCE (Outbound)"

• "GPL FTP MDTM overflow attempt"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - Possible Stack Buffer Overflow Attempt Inbound (Multiple CVE IDs)"

• "GPL POP3 APOP overflow attempt"

• "ET EXPLOIT Apache log4j RCE Attempt (http rmi) (CVE-2021-44228)"

• "ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M3 (CVE-2023-23397)"

• "ET EXPLOIT Possible VMWare NSX Manager Remote Code Execution Exploit Attempt (CVE-2021-39144)"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian overflow attempt"

• "ET EXPLOIT Sonicwall Unauthenticated Stack-Based Buffer Overflow (CVE-2021-20038)"

• "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Outbound (CVE-2020-8515) M2"

• "ET MALWARE Unattributed WebShell Access - Command Execution"

• "GPL NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt"

• "ET EXPLOIT Qianxin Netcom NGFW Command Injection"

• "ET TROJAN Observed FIN12 Related Cobalt Strike Domain (netrie .com in TLS SNI)"

• "ET EXPLOIT Netis WF2419 2.2.36123 - Remote Code Execution CVE-2019-19356"

• "ET WEB_SERVER Possible SQL Injection (varchar2) in HTTP URI"

• "ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toserver M3"

• "ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M1"

• "ET EXPLOIT Enigma Network Management Systems v65.0.0 CVE-2019-16072 (Outbound)"

• "ET WEB_SPECIFIC_APPS Jiecheng Management Information System CWSFinanceCommon SQL injection"

• "ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Fuzzing Inbound M1"

• "ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DNS"

• "ET EXPLOIT Citrix NetScaler SD-WAN 9.1.2.26.561201 Devices CVE-2017-6316 (Outbound)"

• "ET EXPLOIT Possible MeltDown PoC Download In Progress"

• "ET EXPLOIT BlogEngine 3.3 - syndication.axd XXE Injection Attempt"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections5/MozillaRhino1/Vaadin) M2"

• "ET WEB_SPECIFIC_APPS PaperCut NG/MF Directory Traversal/File Upload Vulnerability Check (CVE-2023-39143)"

• "ET EXPLOIT Apache log4j RCE Attempt (udp ldaps) (CVE-2021-44228)"

• "GPL NETBIOS SMB CoGetInstanceFromFile little endian overflow attempt"

• "ET EXPLOIT Razer Sila Router - Command Injection Attempt Inbound (sh) (No CVE)"

• "ET EXPLOIT Possible IBM Data Risk Manager Authentication Bypass - Session ID Assignment"

• "ET EXPLOIT Barracuda Spam Firewall 3.3.x RCE 2006-4000 (Outbound)"

• "ET WEB_SERVER Possible Oracle SQL Injection utl_inaddr call in URI"

• "GPL NETBIOS SMB-DS llsrconnect overflow attempt"

• "ET EXPLOIT Inbound VMware vCenter RCE Attempt M4 (CVE-2021-21972)"

• "ET EXPLOIT Possible CloudMe Sync Stack-based Buffer Overflow Inbound (CVE-2018-6892)"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt DNS Prefix (CVE-2022-42889) (Inbound)"

• "ET EXPLOIT Successful Atlassian Confluence Improper Authentication Validation Exploitation Attempt (CVE-2023-22518)"

• "GPL MISC rsh root"

• "GPL FTP USER overflow attempt"

• "ET EXPLOIT Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228)"

• "ET EXPLOIT Apache log4j RCE Attempt (tcp rmi) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Possible Atlassian Confluence Pre-Authorization Arbitrary File Read Attempt (web.xml) (CVE-2021-26085)"

• "GPL FTP RNTO overflow attempt"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (23)"

• "ET EXPLOIT Zerologon Phase 3/3 - NetrLogonSamLogonWithFlags Request with 0x00 Client Credentials (CVE-2020-1472)"

• "ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M1"

• "ET EXPLOIT Possible SolarWinds Serv-U SSH RCE Inbound M1 (CVE-2021-35211)"

• "ET EXPLOIT VMWare View Planner RCE (CVE-2021-21978) Attempt M1"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (30)"

• "ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Inbound"

• "ET TROJAN BOUNCEBEAM Backdoor CnC Activity"

• "ET EXPLOIT InoERP 0.7.2 Unauthenticated Remote Code Execution (Inbound)"

• "GPL POP3 XTND overflow attempt"

• "ET EXPLOIT Possible Apache log4j RCE Attempt (tcp nds) (CVE-2021-44228)"

• "ET WEB_SERVER Babydraco WebShell Activity"

• "ET EXPLOIT vBulletin 5.6.2 widget_tabbedContainer_tab_panel Remote Code Execution (Inbound)"

• "ET EXPLOIT Dell KACE Attempted Remote Command Injection Outbound"

• "ET EXPLOIT Attempted Remote Command Injection Inbound (CVE-2019-3929)"

• "ET EXPLOIT REDIS Attempted SSH Key Upload"

• "ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution attempt"

• "ET WEB_SPECIFIC_APPS Possible WHMCS SQLi AES_ENCRYPT at start of value"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - CSRF Token Request on guestaccess.aspx - CVE-2023-34362 Stage 1b"

• "ET EXPLOIT Ruckus vRIoT Authentication Bypass Attempt Inbound (CVE-2020-26879)"

• "ET EXPLOIT Possible Spectre PoC Download In Progress"

• "ET EXPLOIT JCK Editor 6.4.4 SQLi Attempt (CVE-2018-17254)"

• "ET ACTIVEX Possible Sparkasse Phishing Domain 2021-04-05"

• "ET EXPLOIT Samba Arbitrary Module Loading Vulnerability M2 (NT Create AndX .so) (CVE-2017-7494)"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Engineers Online Portal System Access Control Bypass (CVE-2021-42671)"

• "ET EXPLOIT SonicWall SMA Authenticated Command Injection Attempt CVE-2021-20039"

• "ET WEB_SERVER PHPMyAdmin BackDoor Access"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections5/MozillaRhino1/Vaadin) M1"

• "ET EXPLOIT ACTi ASOC 2200 Web Configurators versions <2.6 RCE (Outbound)"

• "ET MALWARE Unattributed WebShell Access - File Upload"

• "ET EXPLOIT Exim Stack Exhaustion via BDAT Error Inbound (CVE-2020-28019)"

• "ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Inbound M3 (CVE-2020-14882)"

• "ET EXPLOIT Possible Atlassian Confluence Improper Authentication Validation Exploitation Attempt set (CVE-2023-22518)"

• "ET EXPLOIT F5 BIG-IP - Unauthenticated RCE via AJP Smuggling Request - User Deletion (CVE-2023-46747)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JavassistWeld1) M2"

• "ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (18)"

• "ET WEB_SPECIFIC_APPS Bonitasoft Default User Login Attempt M1 (Possible Staging for CVE-2022-25237)"

• "ET WEB_SPECIFIC_APPS Apache ActiveMQ File Upload RCE (CVE-2016-3088)"

• "GPL RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-41352) M3"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M3"

• "ET EXPLOIT Possible Malicious NAT-PMP Response to External Network"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible Cisco Data Center Network Manager - Authenticated File Upload (CVE-2019-1620)"

• "GPL FTP SITE overflow attempt"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections7) M1"

• "ET EXPLOIT Archeevo 5.0 - Local File Inclusion"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper UDP Bypass M2 (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT PiHole Web Interface Regex Escape Leading to RCE Inbound M1 (CVE-2021-32706)"

• "ET EXPLOIT Possible Successful VMware Cloud Director RCE Attempt (CVE-2020-3956)"

• "ET EXPLOIT Hikvision IP Camera RCE Attempt (CVE-2021-36260)"

• "ET WEB_CLIENT Attempted WordPress GDPR Plugin Privilege Escalation M2 (Set as Administrator)"

• "ET EXPLOIT Zhone ZNID GPON 2426A < S3.0.501 RCE (CVE-2014-9118) M2"

• "ET EXPLOIT LB-Link Command Injection Attempt (CVE-2023-26801)"

• "ET EXPLOIT EnGenius EnShare IoT Gigabit Cloud Service RCE"

• "GPL EXPLOIT rsh froot"

• "ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M1 (CVE-2023-36844 CVE-2023-36845)"

• "ET INFO F5 BIG-IP - Password Reset Attempt - Observed Post CVE-2023-46747 Activity"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "GPL FTP SITE CHOWN overflow attempt"

• "ET TROJAN ftpchk3.php upload attempted"

• "ET EXPLOIT Cisco Security Manager Path Traversal - cwhp (CVE-2020-27130)"

• "ET EXPLOIT SolarView Compact Command Injection Inbound (CVE-2022-29303)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M2"

• "ET EXPLOIT F5 BIG-IP rsync cmi access attempt"

• "ET EXPLOIT ASUS RT-N56U/RT-AC66U Remote Code Execution"

• "ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Outbound (CVE-2022-3602)"

• "ET EXPLOIT Possible VMware Cloud Director RCE Attempt (CVE-2020-3956)"

• "ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Unpause (CVE-2020-11978)"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M7 (CVE-2023-23397)"

• "ET EXPLOIT Possible JNBridge Java Deserialization Attempt M2"

• "ET EXPLOIT Cisco Data Center Network Manager Information Disclosure Inbound"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 5a"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections6) M3"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (9)"

• "ET EXPLOIT Successful Cisco RV320/RV325 Debug Dump Disclosure (CVE-2019-1653)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (JavassistWeld1) M1"

• "ET WEB_SPECIFIC_APPS Atlassian JIRA Template Injection RCE (CVE-2019-11581)"

• "ET EXPLOIT TP-LINK TL-WR340G Router DNS Change GET Request"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (29)"

• "ET EXPLOIT JetBrains TeamCity Auth Bypass Attempt (CVE-2023-42793)"

• "ET EXPLOIT Apache log4j RCE Attempt (http dns) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT Qualcomm QCMAP Stack-Based Buffer Overflow Attempt Inbound (CVE-2020-3657)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M1"

• "ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Remote Code Execution Inbound (CVE-2020-17530)"

• "ET WEB_SPECIFIC_APPS Apache Struts2 Possible uploadFileName Directory Traversal Attempt (CVE-2023-50164) - uploadFileName Parameter M1"

• "GPL NETBIOS DCERPC CoGetInstanceFromFile overflow attempt"

• "GPL NETBIOS SMB NDdeSetTrustedShareW overflow attempt"

• "ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M4 (CVE-2023-23397)"

• "ET ATTACK_RESPONSE PHP script in OptimizePress Upload Directory Possible WebShell Access"

• "ET EXPLOIT Possible MySQL CVE-2016-6662 Attempt"

• "ET EXPLOIT Quanta LTE Router RDE Exploit Attempt 2 (traceroute)"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian overflow attempt"

• "ET WEB_SPECIFIC_APPS Possible Apache Druid RCE Inbound (CVE-2021-25646)"

• "ET WEB_SPECIFIC_APPS Citrix XenMobile Server Directory Traversal Attempt Inbound (CVE-2020-8209)"

• "ET EXPLOIT Sophos Firewall Authentication Bypass (CVE-2022-1040) Server Response M1"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JBossInterceptors1) M2"

• "ET EXPLOIT DCN DCBI-Netlog-LAB Remote Code Execution Vulnerability Attempt (CVE-2023-26802)"

• "ET EXPLOIT IBM Data Risk Manager Remote Code Execution via NMAP Scan"

• "ET INFO Possible NOP Sled Observed in Large DNS over TCP Packet M1"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper UDP Bypass M2 (CVE-2021-44228)"

• "ET EXPLOIT Firefox 0-day used against TOR browser Nov 29 2016 M1"

• "ET EXPLOIT F5 BIG-IP iControl REST Authentication Bypass Attempt (CVE-2022-1388) M3"

• "GPL NETBIOS SMB OpenKey overflow attempt"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - testcmd.cgi RCE via Command Injection Attempt Outbound (CVE-2021-33544)"

• "ET EXPLOIT VMware vCenter RCE Exploitation Attempt M2 (CVE-2021-22005)"

• "ET EXPLOIT Netgear DGN1000B Router DNS Change GET Request"

• "ET EXPLOIT Belkin N750 Buffer Overflow Attempt"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Clojure1) M1"

• "ET EXPLOIT LG SuperSign EZ CMS 2.5 Remote Code Execution CVE-2018-17173"

• "ET EXPLOIT Attempted Schneider Electric SpaceLogic C-Bus Home Controller 5200WHC2 Remote Code Execution (CVE-2022-34753)"

• "ET EXPLOIT Possible Microsoft Exchange ProxyLogon Activity - OABVirtualDirectory SetObject (CVE-2021-27065)"

• "ET EXPLOIT Possible SysAid Traversal Attack (CVE-2023-47246)"

• "GPL NETBIOS SMB llsrconnect andx overflow attempt"

• "ET EXPLOIT Azure Automation Authentication Bypass"

• "ET EXPLOIT TerraMaster TOS Unauthenticated Command Injection Inbound M1 (CVE-2022-24989)"

• "GPL NETBIOS SMB-DS llsrconnect little endian overflow attempt"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (CommonsCollections7) M1"

• "ET WEB_SPECIFIC_APPS Possible Joomla SQLi Attempt (CVE-2015-7297 CVE-2015-7857 CVE-2015-7858)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (CommonsCollections7) M3"

• "ET EXPLOIT Possible OpenVPN CVE-2014-6271 attempt"

• "ET EXPLOIT [401TRG] GhostCat LFI Attempt Inbound (CVE-2020-1938)"

• "ET EXPLOIT Suspicious SVCCTL CreateService Command via SMB - Observed Zerologon Post Compromise Activity"

• "ET WEB_SPECIFIC_APPS Possible CVE-2013-2618 Attempt (PHP Weathermap Persistent XSS)"

• "ET EXPLOIT CreateService via SMB to Reset-ComputerMachinePassword - Observed Post Zerologon Activity"

• "ET EXPLOIT Linksys Failed Upgrade BackDoor Access (Server Response)"

• "ET EXPLOIT [FIREEYE] Suspicious Pulse Secure HTTP Request (CVE-2021-22893) M2"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested lower (udp) (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode"

• "ET ATTACK_RESPONSE Possible CVE-2016-1287 Inbound Reverse CLI Shellcode"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - oem.cgi RCE via Command Injection Attempt Inbound (CVE-2021-33544)"

• "ET EXPLOIT Intel AMT Login Attempt Detected (CVE 2017-5689)"

• "ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Exploit Attempt"

• "ET WEB_SPECIFIC_APPS Possible CVE-2020-8518 (Horde Groupware RCE)"

• "ET EXPLOIT TP-LINK DNS Change GET Request (DNSChanger EK)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (8)"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit as Observed in Sundown/RIG EK (b641)"

• "ET EXPLOIT Possible NSDP (Netgear) Write Command Buffer Overflow Attempt - 0x0003 (CVE-2020-35225)"

• "ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/13 Obfuscation Observed (tcp) (CVE-2021-44228)"

• "ET EXPLOIT F5 BIG-IP - Unauthenticated RCE via AJP Smuggling Request (CVE-2023-46747)"

• "ET EXPLOIT Nagios XI OS Command Injection (CVE-2021-25297 & CVE-2021-25298)"

• "ET EXPLOIT SEOWON INTECH SLC-130/SLR-120S RCE Inbound M2 (CVE-2020-17456)"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested lower (tcp) (Outbound) (CVE-2021-44228)"

• "GPL FTP SITE ZIPCHK overflow attempt"

• "ET EXPLOIT Bonitasoft Authorization Bypass M2 (CVE-2022-25237)"

• "ET EXPLOIT Dataprobe iBoot-PDU Pre-Auth Remote Code Execution Attempt via git-update.php (CVE-2022-3184) M1"

• "ET EXPLOIT Citrix App Delivery Controller and Citrix Gateway M1 (CVE-2019-19781)"

• "ET WEB_CLIENT Apple Quicktime RTSP Overflow (2)"

• "ET EXPLOIT Possible Apache Text4shell RCE Attempt JEXL Path (CVE-2022-42889) (Inbound)"

• "ET WEB_SERVER Possible SQL Injection (varchar) in HTTP URI"

• "ET EXPLOIT Trend Micro IWSVA Unauthenticated Command Injection Inbound (CVE-2020-8466)"

• "ET EXPLOIT Nagios XI Post-Auth Path Traversal (CVE-2021-37343)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Jdk7u21) M2"

• "ET INFO Possible Apache Airflow Experimental API Authentication Bypass Attempt (CVE-2020-13927)"

• "ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M1 (Outbound) (CVE-2021-44228)"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M3"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (25)"

• "ET EXPLOIT D-Link DI-804HV DNS Changer Exploit Attempt"

• "ET EXPLOIT D-Link HNAP SOAPAction Command Injection (CVE-2015-2051)"

• "ET EXPLOIT [401TRG] ZeroShell RCE Inbound (CVE-2019-12725)"

• "ET EXPLOIT ARG-W4 ASDL Router DNS Changer Exploit Attempt M2"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian andx overflow attempt"

• "ET TELNET busybox MIRAI hackers - Possible Brute Force Attack"

• "ET EXPLOIT pfBlockerNG HTTP Host Header Remote Code Execution Attempt (CVE-2022-31814)"

• "ET TROJAN Possible Linux.Mirai Login Attempt (dreambox)"

• "ET CURRENT_EVENTS 401TRG Liferay RCE (CVE-2020-7961)"

• "ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M2 (CVE-2020-28021)"

• "ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap Overflow Exploit Email (Inbound)"

• "ET WEB_SERVER Possible CVE-2014-6271 Attempt in Client Body"

• "ET EXPLOIT MVPower DVR Shell UCE MSF Check"

• "ET EXPLOIT FortiOS SSL VPN - Information Disclosure (CVE-2018-13379)"

• "ET EXPLOIT Cisco HyperFlex HX RCE Outbound (CVE-2021-1498)"

• "ET EXPLOIT Trenda Router AC11 RCE Outbound (CVE-2021-31755)"

• "ET WEB_SERVER LEMURLOOT WebShell Interaction Header (X-siLock-Comment) - Observed in MOVEit File Transfer - INBOUND"

• "ET EXPLOIT Potential External VMware vRealize Automation Authentication Bypass Vulnerability"

• "ET EXPLOIT Adobe ColdFusion 11 - LDAP Java Object Deserialization RCE (GET) CVE-2018-15957"

• "ET EXPLOIT Possible D-Link Command Injection Attempt Inbound (CVE-2020-13782)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (JRMPClient) M1"

• "ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2"

• "ET EXPLOIT ysoserial Payload in HTTP Header (BeanShell1/Click1/CommonsCollections1/CommonsCollections4) M2"

• "ET WEB_SPECIFIC_APPS KLOG Server RCE Public POC Inbound - Possible Scanning (CVE-2020-35729)"

• "ET EXPLOIT Inbound VMware vCenter RCE Attempt M2 (CVE-2021-21972)"

• "ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfiltration"

• "ET TROJAN SpyAgent C&C Activity (Request)"

• "ET EXPLOIT Amcrest Camera and NVR Buffer Overflow Attempt (CVE-2020-5735)"

• "ET TROJAN Observed CobaltStrike CnC Domain (krinsop .com in TLS SNI)"

• "ET EXPLOIT ysoserial Payload in HTTP URI (Spring1/Spring2) M1"

• "GPL NETBIOS SMB-DS NDdeSetTrustedShareW little endian andx overflow attempt"

• "ET EXPLOIT Possible Zimbra Arbitrary File Upload (CVE-2022-30333) M1"

• "ET EXPLOIT Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine (Log Poisoning) (CVE-2020-16152) M1"

• "ET TROJAN Possible Linux.Mirai Login Attempt (hi3518)"

• "GPL NETBIOS SMB-DS OpenKey unicode andx overflow attempt"

• "ET EXPLOIT Possible Oracle Opera RCE Attempt (CVE-2023-21932)"

• "ET WEB_SPECIFIC_APPS LifterLMS Arbitrary File Write Attempt Inbound (CVE-2020-6008)"

• "ET SCAN Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation - Responding with Superuser Credentials"

• "ET WEB_SPECIFIC_APPS Metabase Pre-Auth RCE Attempt - CVE-2023-38646"

• "ET EXPLOIT Suspected cPanel XSS Exploit Activity (CVE-2023-29489)"

• "ET EXPLOIT Linksys E-Series Device RCE Attempt"

• "ET WEB_SPECIFIC_APPS PaperCut NG/MF Possible Directory Traversal/File Upload Exploit Attempt (CVE-2023-39143)"

• "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - language.cgi RCE via Command Injection Attempt Outbound (CVE-2021-33544)"

• "ET EXPLOIT Apache log4j RCE Attempt - Nested upper (udp) (CVE-2021-44228)"

• "ET EXPLOIT Apache log4j RCE Attempt - AWS Access Key Disclosure (CVE-2021-44228)"

• "ET CURRENT_EVENTS CVE-2016-0189 Exploit as Observed in Sundown/RIG EK (b645)"

• "ET EXPLOIT Possible Apache Shiro 1.2.4 Cookie RememberME Deserial RCE (CVE-2016-4437)"

• "ET EXPLOIT GoCD Authentication Bypass URI Path - add-on"

• "ET EXPLOIT EyesOfNetwork Generate API Key SQLi (CVE-2020-8656)"

• "ET WEB_SERVER WEBSHELL pwn.jsp shell"

• "ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M2"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (Jdk7u21) M1"

• "ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers"

• "ET WEB_SPECIFIC_APPS WordPress Plugin - Essential Addons for Elementor - Password Reset Attempt (CVE-2023-32243)"

• "ET EXPLOIT QNAP PhotoStation Pre-Auth Local File Disclosure Attempt"

• "ET EXPLOIT Possible Microsoft Exchange Mailbox Enumeration Inbound (CVE-2021-34473)"

• "ET EXPLOIT VMware Spring Cloud Gateway Code Injection (CVE-2022-22947) (set)"

• "ET EXPLOIT ysoserial Payload in HTTP Header (Hibernate1/Hibernate2/JSON1/Myfaces1/ROME/URLDNS) M1"

• "ET EXPLOIT Mikrotik Winbox RCE Attempt (CVE-2018-14847)"

• "ET EXPLOIT Inbound Hashicorp Consul RCE via Services API"

• "ET EXPLOIT OctoberCMS Auth Bypass Inbound M2 set_password (CVE-2021-32648)"

• "ET EXPLOIT Laravel Remote Code Execution (CVE-2021-3129) Outbound - Attempt to clear logs"

• "ET SCAN Possible WordPress xmlrpc.php wp.getUsersBlogs Flowbit Set"

• "ET EXPLOIT OptiLink ONT1GEW GPON RCE Outbound"

• "ET SCAN ELF/Mirai Variant User-Agent (Inbound)"

• "ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound"

• "ET WEB_SPECIFIC_APPS Pandora FMS SQLi"

• "ET EXPLOIT HTTP POST Request With ysoserial In Request Body (MozillaRhino2) M1"

• "ET EXPLOIT NUUO OS Command Injection M2"

• "ET EXPLOIT Possible SAP NetWeaver SQL Injection Attempt Inbound (CVE-2016-2386)"

• "ET EXPLOIT Possible LG SuperSign EZ CMS 2.5 RCE (CVE-2018-17173)"

• "ET EXPLOIT DD-WRT UPNP Unauthenticated Buffer Overflow (CVE-2021-27137)"

• "ET WEB_SERVER Possible 3Com OfficeConnect Router Default User Account Remote Command Execution Attempt"

• "ET EXPLOIT QNAP PhotoStation Privilege Escalation Attempt M1 (encrypted token)"

• "ET EXPLOIT CCBill Online Payment Systems RCE (Outbound)"

• "ET EXPLOIT F5 BIG-IP - Unauthenticated RCE via AJP Smuggling Request - User Creation (CVE-2023-46747)"

• "ET EXPLOIT ETERNALBLUE Exploit M2 MS17-010"

• "ET SCAN Polaris Botnet User-Agent (Inbound)"

• "ET SNMP Samsung Printer SNMP Hardcode RW Community String"

• "ET EXPLOIT Oracle WebLogic IIOP JNDI Injection (CVE-2020-14841)"

• "ET EXPLOIT Possible IBM Data Risk Manager Authentication Bypass - Password Retrieval"

• "ET EXPLOIT ysoserial Payload in HTTP Header (MozillaRhino2) M2"

• "ET EXPLOIT ARG-W4 ASDL Router DNS Changer Exploit Attempt"

• "ET EXPLOIT Solr DataImport Handler RCE (CVE-2019-0193)"

• "ET EXPLOIT MetInfo 7.0 SQL Injection (CVE-2019-17418)"

• "ET WEB_SPECIFIC_APPS Successful MinIO Information Disclosure Attempt (CVE-2023-28432)"

• "ET EXPLOIT Quanta LTE Router Information Disclosure Exploit Attempt"

• "ET WEB_SPECIFIC_APPS Zimbra XSS via momoveto"

• "ET EXPLOIT Tenda G103 Command Injection Attempt (CVE-2023-27076)"

• "ET EXPLOIT Multiple CCTV-DVR Vendors RCE"

• "ET EXPLOIT UDP Technology Firmware (IP Cam) - tmpapp.cgi RCE via Command Injection Attempt Inbound (CVE-2021-33544)"

• "GPL MISC rlogin root"

• "ET EXPLOIT Netgear ProSAFE Plus Stored XSS Inbound (CVE-2020-35228)"

• "ET WEB_SPECIFIC_APPS Kibana Prototype Pollution RCE Inbound (CVE-2019-7609)"

• "GPL RPC STATD TCP monitor mon_name format string exploit attempt"

• "ET POLICY Dlink Soho Router Config Page Access Attempt"

• "ET WEB_SPECIFIC_APPS GoAnywhere MFT Authentication Bypass Attempt - GET Request M2 (CVE-2024-0204)"

• "ET WEB_SERVER Possible SQL Injection SELECT CAST in HTTP URI"

• "ET WEB_SERVER Possible SQL Injection INTO OUTFILE in HTTP Request Body"

• "ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2"

• "ET WEB_SERVER Possible SQL Injection SELECT CAST in HTTP Request Body"

• "ET TROJAN Wordpress Social Warfare Plugin Exploit Payload Impression Request"

• "ET EXPLOIT Uniview IPC2322lb Authentication Bypass Attempt - RSA Public Key Parameter Retrieval"

• "ET EXPLOIT Rejetto HTTP File Server Unauthenticated RCE Attempt (CVE-2024-23692)"

• "ET WEB_SPECIFIC_APPS Fortra FileCatalyst Workflow Insecure HSQLDB Default Credentials"

• "ET WEB_SERVER Possible SQL Injection CHR() in HTTP Request Body M2"

• "ET WEB_SPECIFIC_APPS Ivanti Avalanche Directory Traversal Attempt (CVE-2023-41474)"

• "ET WEB_SPECIFIC_APPS Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt (CVE-2023-46805, CVE-2024-21887) M2"

• "ET EXPLOIT Atlassian Confluence RCE Attempt Observed (CVE-2023-22527) M2"

• "ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt"

• "ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6"

• "ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473) - Information Leak via show_sysinfo"

• "ET WEB_SERVER Possible SQL Injection DELETE FROM in HTTP Request Body"

• "ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5"

• "ET EXPLOIT Hongjing eHR Showmedia.jsp SQL Injection Inbound"

• "ET TROJAN Wordpress Social Warfare Plugin Exploit CMS Users Exfil M3"

• "ET WEB_SPECIFIC_APPS Contec SolarView Compact downloader.php Command Injection Attempt (CVE-2023-23333)"

• "ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2024-3273)"

• "ET EXPLOIT Possible Telerik Deserialization Attempt - POST to Vulnerable Path with Specific Extension (CVE-2024-1800)"

• "ET WEB_SERVER Possible SQL Injection SELECT CONCAT in HTTP Request Body"

• "ET EXPLOIT JEPaaS Development Platform File Upload Authentication Bypass"

• "ET EXPLOIT Selenium Server Chrome 3.141.59 Remote Code Execution"

• "ET WEB_SERVER Possible SQL Injection sp_configure in HTTP Request Body"

• "ET EXPLOIT Ivanti Connect Secure (9.x,22.x) / Ivanti Policy Secure (9.x,22.x) / Ivanti Neurons for ZTA SSRF Pattern (CVE-2024-21893)"

• "ET EXPLOIT MoveIT Transfer SFTP Authentication Bypass Attempt Inbound M0 (CVE-2024-5806)"

• "ET EXPLOIT HikVision iSecure Center RCE Attempt Inbound"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) - Auth Token Creation Attempt"

• "ET EXPLOIT Jenkins Unauthenticated RCE Attempt Observed (CVE-2024-23897)"

• "ET EXPLOIT Splunk Unauthenticated Path Traversal Attempt Inbound (CVE-2024-36991)"

• "ET WEB_SPECIFIC_APPS Apache OFBiz Pre-Auth Remote Code Execution Attempt (CVE-2024-38856)"

• "ET EXPLOIT Viessmann Vitogate 300 Command Injection Attempt (CVE-2023-5702)"

• "ET WEB_SERVER Possible SQL Injection WAITFOR DELAY in HTTP URI"

• "ET EXPLOIT Solarwinds Serv-U Directory Traversal Attempt Inbound (CVE-2024-28995)"

• "ET EXPLOIT Possible Uniview IPC2322lb Authentication Bypass Attempt - Admin Password Reset Attempt"

• "ET WEB_SERVER Possible SQL Injection SELECT FROM in HTTP Request Body"

• "ET EXPLOIT Telecommunications Gateway Configuration Management System Unauthenticated File Upload"

• "ET TROJAN Wordpress Social Warfare Plugin Exploit CMS Users Exfil M2"

• "ET WEB_SPECIFIC_APPS Gitlab Account Takeover Attempt (CVE-2023-7028)"

• "ET WEB_SPECIFIC_APPS ReCrystallize Server Possible Authentication Bypass Attempt via AdminUsername Cookie (CVE-2024-26331) and Arbitrary File Upload via FileManagement.aspx (CVE-2024-28269)"

• "ET WEB_SPECIFIC_APPS GoAnywhere MFT Authentication Bypass Attempt - POST Request M1 (CVE-2024-0204)"

• "ET WEB_SERVER Possible SQL injection WAITFOR DELAY in HTTP Request Body"

• "ET WEB_SPECIFIC_APPS GoAnywhere MFT Authentication Bypass Attempt - GET Request M1 (CVE-2024-0204)"

• "ET WEB_SERVER Possible SQL Injection Obfuscated by REVERSE function in HTTP Request Body"

• "ET EXPLOIT D-LINK Router DIR-645 / DIR-815 RCE (CVE-2014-100005)"

• "ET EXPLOIT NextGen Mirth Connect <4.4.1 RCE Attempt (CVE-2023-43208)"

• "ET WEB_SPECIFIC_APPS ConnectWise ScreenConnect - Attempted SetupWizard Auth Bypass CWE-288 (CVE-2024-1709)"

• "ET WEB_SPECIFIC_APPS Ruijie Network Switches Unauthenticated Command Execution"

• "ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1"

• "ET EXPLOIT Dahua DSS Security Management Platform Attempted Privilege Escalation"

• "ET WEB_SPECIFIC_APPS ReCrystallize Server Possible Authentication Bypass Attempt via AdminUsername Cookie (CVE-2024-26331)"

• "ET EXPLOIT ZhongCheng Kexin Ticket Management System SQLi Attempt"

• "ET TROJAN Wordpress Social Warfare Plugin Exploit CMS Users Exfil M1"

• "ET WEB_SERVER Possible SQL Injection UNION SELECT in HTTP Request Body"

• "ET WEB_SERVER Possible SQL Injection (declare) in HTTP Request Body"

• "ET WEB_SERVER Possible SQL Injection (exec) in HTTP Request Body"

• "ET EXPLOIT OpenBMC slpd-lite Language Tag Length Memory Corruption Attempt (CVE-2024-41660)"

• "ET WEB_SPECIFIC_APPS Possible Oracle Weblogic IIOP/T3 JNDI Injection Attack (CVE-2024-20931)"

• "ET EXPLOIT MoveIT Transfer SFTP Authentication Bypass Attempt Inbound M1 (CVE-2024-5806)"

• "ET WEB_SERVER Possible SQL Injection (varchar2) in HTTP Request Body"

• "ET WEB_SPECIFIC_APPS GL.iNet Authentication Bypass/SQL Injection attempt (CVE-2023-50919)"

• "ET WEB_SERVER Possible SQL Injection CHAR() in HTTP Request Body M1"

• "ET EXPLOIT UFIDA PLM getWorkGroups Unauthorized Information Access Attempt"

• "ET EXPLOIT Zhibang International ERP System SQL Injection Attempt"

• "ET EXPLOIT Possible Telerik Auth Bypass Attempt - Account Creation from External Host (CVE-2024-4358)"

• "ET EXPLOIT Atlassian Confluence RCE Attempt Observed (CVE-2023-22527) M1"

• "ET WEB_SPECIFIC_APPS Jetbrains TeamCity SwaggerUI REST API Directory Traversal Attempt (CVE-2024-24942)"

• "ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M4"

• "ET WEB_SPECIFIC_APPS Zyxel Authentication Bypass Attempt (CVE-2023-4473)"

• "ET WEB_SPECIFIC_APPS Gambio E-Commerce Suite Deserialization of Untrusted Data (CVE-2024-23759)"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) - Admin User Creation Attempt"

• "ET EXPLOIT PHP-Live-Chat Get Shell Attempt Inbound"

• "ET WEB_SPECIFIC_APPS ConnectWise ScreenConnect - Attempted User Creation via SetupWizard with Auth Bypass CWE-288 (CVE-2024-1709)"

• "ET WEB_SPECIFIC_APPS Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt (CVE-2023-46805, CVE-2024-21887) M1"

• "ET EXPLOIT Possible Google Cookie Token Manipulation Activity"

• "ET TROJAN Wordpress Social Warfare Plugin Attempted Admin User Creation"

• "ET WEB_SERVER Possible SQL Injection CHR() in HTTP Request Body M1"

• "ET WEB_SERVER Possible SQL Injection (varchar) in HTTP Request Body"

• "ET WEB_SERVER Possible SQL Injection INSERT INTO in HTTP Request Body"

• "ET TROJAN Wordpress Social Warfare Plugin Exploit C2 Connect Request (POST)"

• "ET WEB_SPECIFIC_APPS Apache Kafka UI Unsanitized Groovy Script Filter Remote Code Execution Attempt (CVE-2023-52251)"

• "ET TROJAN Wordpress Social Warfare Plugin Exploit Payload URI in GET Request"

• "ET EXPLOIT Ivanti Connect Secure (9.x,22.x) / Ivanti Policy Secure (9.x,22.x) / Ivanti Neurons for ZTA Command Injection via SSRF (CVE-2024-21887)"

• "ET EXPLOIT D-Link DIR-X4860 RCE Attempt Inbound"

• "ET WEB_SPECIFIC_APPS GoAnywhere MFT Authentication Bypass Attempt - POST Request M2 (CVE-2024-0204)"

• "ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3"

• "ET WEB_SERVER SQLi - SELECT and sysobject M2"

• "ET WEB_SPECIFIC_APPS Apache OFBiz Directory Traversal Remote Code Execution Attempt (CVE-2024-36104)"

• "ET WEB_SERVER Possible SQL Injection CHAR() in HTTP Request Body M2"

misc-activity

• "ET INFO HTTP POST Form Submitted to Weebly Free Hosting"

• "ET INFO URL Shortener Service Domain in DNS Lookup (s .id)"

• "ET INFO DNS Over HTTP Style Request (GET)"

• "ET INFO File Sharing Service Domain in DNS Lookup (ufile .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (armorrush .eu .org)"

• "ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .twtrs .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (* .dnscry .pt)"

• "ET INFO HTTP GET Request XOR Key a2"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jjm .asia)"

• "ET INFO File Sharing Domain Observed in TLS SNI (wetransfer .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (whax .eu .org)"

• "ET ATTACK_RESPONSE Obfuscated JS - URL Encoded Unescape Function Call Inbound"

• "ET INFO Safe Surfer DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .boje8 .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .harvester .fr)"

• "ET INFO DNS For Family DNS Over HTTPS Certificate Inbound"

• "ET INFO Python BaseHTTP ServerBanner"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sitdns .com)"

• "ET INFO External Host Sending Docker Swarm Join Command"

• "ET INFO Keepnetlabs Domain in DNS Lookup (keepnetlabs .com)"

• "ET INFO HTTP POST Request XOR Key e6"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .darktraffic .cloud)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (justhost .bedro .cloud)"

• "ET INFO HTTP GET Request XOR Key 56"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (hardbin .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ag .ff0x .ca)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officested .com)"

• "ET INFO Microsoft Connection Test"

• "ET INFO HTTP POST Request XOR Key 5f"

• "ET INFO URL Shortener Service Domain in DNS Lookup (cutt .ly)"

• "ET INFO Request for EXE via GO HTTP Client"

• "ET INFO HTTP GET Request XOR Key be"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cdn .0ms .dev)"

• "ET INFO DNS Query to Domain used for Phishing (jemi .so)"

• "ET INFO Clearbit Logo Query in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .freegod .ml)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kernel-error .de in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 15"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jp-dns1 .bancuh .com)"

• "ET INFO Observed URL Shortening Service Domain (gg-l .xyz in TLS SNI)"

• "ET INFO Observed DNS Query to .mov TLD"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .rodovatech .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .davidruhmann .com)"

• "ET INFO Suspicious Netlify Hosted GET Request - Possible Phishing Landing"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (tmkis-dns .de)"

• "ET INFO PowerShell Command Prompt Outbound On High Port"

• "ET CHAT IRC authorization message"

• "ET INFO Abused Confluence/Jira External Sharing Site (external-share .com in TLS SNI)"

• "ET INFO PDF - Acrobat Enumeration - pdfobject.js"

• "ET INFO HTTP POST Request XOR Key a3"

• "ET INFO IPFS Gateway Domain in DNS Lookup (ipfs .w3s .link)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (gclouddns .com)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharepointin .com)"

• "ET INFO Abused Confluence/Jira External Sharing Site in DNS Lookup (external-share .com)"

• "ET INFO Observed URL Shortening Service Domain (maxiurl .com in TLS SNI)"

• "ET INFO BitNinja IO Security Check"

• "ET INFO [TW] Likely Javascript-Obfuscator Usage Observed M3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .crownor .com)"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (cloudflare-ipfs .com)"

• "ET INFO HTTP POST Request XOR Key 6c"

• "ET INFO HTTP POST Request XOR Key de"

• "ET INFO .exe File requested over FTP"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (securenet .mhsystems .net)"

• "ET INFO HTTP POST Request XOR Key 91"

• "ET INFO HTTP GET Request XOR Key fc"

• "ET INFO Cisco IOS XE Web Server Auth From Suspicious Username (cisco_tac_admin) (CVE-2023-20198) (Inbound)"

• "ET INFO URL Shortening Service Domain in DNS Lookup (vtaurl .com)"

• "ET INFO HTTP GET Request XOR Key c9"

• "ET INFO HTTP POST Request XOR Key c1"

• "ET CHAT IRC PING command"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .7sec .com)"

• "ET INFO WeDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key 73"

• "ET INFO Plaintext SSH Authentication Identified (Encryption set to None)"

• "ET INFO Observed DNS over HTTPS Domain (internetsehat .bebasid .com)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (tiny .cc)"

• "ET INFO localhost .run TLS Certification Observed"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (attemplate .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .pumpkinvrar .com)"

• "ET INFO HTTP POST Request XOR Key 0c"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jurre-home .duckdns .org)"

• "ET INFO HTTP GET Request XOR Key ba"

• "ET INFO Possible ThousandEyes User-Agent Outbound"

• "ET INFO Observed DNS Over HTTPS Domain (dns .syaifullah .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .30x .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (q3i6k7j3 .stackpathcdn .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .privado .ovh)"

• "ET INFO Request for EXE via Powershell"

• "ET INFO HTTP GET Request XOR Key 35"

• "ET INFO HTTP POST Request XOR Key cc"

• "ET INFO HTTP POST Request XOR Key a5"

• "ET INFO Possible EXE Download From Suspicious TLD (.men) - set"

• "ET INFO HTTP GET Request XOR Key ef"

• "GPL SCAN PING Delphi-Piette Windows"

• "ET INFO HTTP GET Request XOR Key 58"

• "ET INFO Zip File"

• "ET INFO DNS Query to .onion proxy Domain (onion.guide)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .aaytorr .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .ihatemy .live)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (wikimedia-dns .org)"

• "ET INFO DNS Over HTTPS Certificate Inbound (adguard .konikoni428 .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .rabmoor .cz)"

• "ET INFO File Sharing Related Domain in DNS Lookup (file .pizza)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .meeo .win in TLS SNI)"

• "ET INFO Possible EXE Download From Suspicious TLD (.work) - set"

• "ET INFO HTTP GET Request XOR Key da"

• "ET INFO Observed DNS Over HTTPS Domain (doh .futa .gg in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (douglaster .com)"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (m .pipedream .net)"

• "ET INFO Suspicious HTTP POST Only Containing Password - Possible Phishing"

• "ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .nikolagjorgjijoski .com)"

• "ET INFO Cisco IOS XE Web Server Auth From Suspicious Username (cisco_support) (CVE-2023-20198) (Inbound)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .rkjha .com .np)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (colean .go .ro)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cossxiu .ga)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .joaofidelix .com .br)"

• "ET INFO HTTP GET Request XOR Key 82"

• "ET INFO HTTP POST Request XOR Key 52"

• "ET POLICY GridinSoft.com Software Version Check"

• "ET INFO Cisco IOS XE Web Server Auth From Suspicious Username (cisco_tac_admin) (CVE-2023-20198) (Outbound)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .datahata .by)"

• "ET INFO HTTP POST Request XOR Key 7b"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ca01 .dns4me .net)"

• "ET INFO DNS Over HTTP Style Request (GET)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (goga7777777 .bissnes .org)"

• "ET INFO Request for PDF via PowerShell"

• "ET INFO HTTP GET Request XOR Key b2"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default Cert Subject Common Name"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns2 .cbio .top)"

• "ET INFO HTTP POST Request XOR Key c3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (www .aizi .app)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_bottom_half"

• "ET INFO File Sharing Domain in DNS Lookup (dracoon .team)"

• "ET CURRENT_EVENTS SUSPICIOUS PPT Download with Embedded OLE Object"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Request)"

• "ET INFO Microsoft Defender Attack Simulation Training Domain in DNS Lookup (mesharepoint .com)"

• "ET INFO HTTP POST to XYZ TLD Containing Pass - Possible Phishing"

• "ET INFO HTTP POST Request XOR Key c5"

• "ET INFO Simplenote Notes Taking App Domain in DNS Lookkup (app .simplenote .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns2 .gms .net .id)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officentry .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .52306 .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI ( * .dns .mullvad .net)"

• "ET INFO HTTP GET Request XOR Key 78"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .safeith .com)"

• "ET INFO HTTP POST Request XOR Key 35"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .chenu .ch)"

• "ET INFO HTTP GET Request XOR Key fa"

• "ET INFO Open Internet DNS Over HTTPS Certificate Inbound"

• "ET INFO DropBox User Content Download Access over SSL M2"

• "ET INFO Interactsh Domain in DNS Lookup (.oast .pro)"

• "ET INFO External File Sharing Service in DNS Lookup (sharefile .com)"

• "ET INFO URL Shortening Service Domain in DNS Lookup (maxiurl .com)"

• "ET INFO HTTP POST Request XOR Key 3d"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jp .dns .ikataruto .com)"

• "ET INFO Possible MSXMLHTTP Request (msi) unset (no exe)"

• "ET INFO HTTP POST Request XOR Key 56"

• "ET INFO Observed IP Tracker Domain in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (home27 .duckdns .org)"

• "ET INFO LLNMR query response to wpad"

• "ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Remote Instance"

• "ET INFO HTTP GET Request XOR Key 85"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .aman .ltd)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officence .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole .mulu .at)"

• "ET INFO HTTP GET Request XOR Key 0e"

• "ET INFO HTTP POST Request XOR Key cb"

• "ET INFO HTTP POST Request XOR Key 69"

• "ET INFO URL Shortening Service Domain in DNS Lookup (appurl .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .cretu .xyz)"

• "ET INFO CMS Hosting Domain in DNS Lookup (storyblok .com)"

• "ET INFO Observed DNS over HTTPS Domain (family .puredns .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (hermes .ohai .ca)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-br .dnsflex .com)"

• "ET INFO URL Shortener Service Domain in TLS SNI (bulkurlshortener .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jp .kano .sh)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .240527 .xyz)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (intertop .link)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (kudns .kescher .at)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .dnswarden .com)"

• "ET INFO HTTP GET Request XOR Key 4b"

• "ET MALWARE All Numerical .ru Domain Lookup Likely Malware Related"

• "ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com"

• "ET INFO Adobe PKG Download Flowbit Set"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .wang .art)"

• "ET INFO Observed Image Hosting Domain (resimag .com in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key a3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (airmaxcloud .ml)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (mrcapslock .ir)"

• "ET INFO HTTP GET Request XOR Key 70"

• "ET INFO [401TRG] RPCNetlogon UUID (CVE-2020-1472) (Set)"

• "ET INFO DNS Query to .onion proxy Domain (onion.link)"

• "ET INFO Commonly Abused File Sharing Domain (wasabisys .com) in TLS SNI"

• "ET INFO TRR DNS over HTTPS detected"

• "ET INFO File Sharing Related Domain in DNS Lookup (wormhole .app)"

• "ET INFO Observed DNS Query to *.ngrok Domain (ngrok .pizza)"

• "ET POLICY Cisco IOS Self Signed Certificate Served to External Host"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ychen .ga)"

• "ET INFO DnsCrypt DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .goldplate .org)"

• "ET INFO HTTP GET Request XOR Key 26"

• "ET INFO HTTP GET Request XOR Key 1e"

• "ET INFO Instagram Story Viewer Domain in DNS Lookup (dumpor .com)"

• "ET INFO HTTP POST Request XOR Key 29"

• "ET INFO HTTP POST Request XOR Key 7c"

• "ET INFO Observed DNS Query to .dad TLD"

• "ET INFO HTTP GET Request XOR Key b8"

• "ET INFO Observed URL Shortening Service Domain (longurl .in in TLS SNI)"

• "GPL ICMP_INFO PING Cisco Type.x"

• "ET INFO AutoIt User-Agent Downloading ZIP"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dohtrial .att .net)"

• "ET INFO HTTP POST to .php on Appspot Hosting - Possible Phishing"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default Cert Subject Common Name"

• "ET INFO Observed URL Shortener Service Domain in DNS Lookup (goo .su)"

• "ET INFO [TW] Likely Hex Executable String"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns1 .fdn .fr)"

• "ET CHAT IRC PRIVMSG command"

• "ET INFO HTTP POST Request XOR Key fb"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection/Tunneling Service (.free .beeceptor .com)"

• "ET GAMES FreeRide Games"

• "ET INFO HTTP GET Request XOR Key a8"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_middle_out"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (krtekvpn .duckdns .org)"

• "ET INFO HTTP POST Request XOR Key 25"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - STOR SET_DNP1.TXT File Upload Attempt"

• "ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack"

• "ET INFO HTTP GET Request XOR Key 38"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .phdns2 .lonet .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ads-eu .landgame .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .mirandil .ru)"

• "ET INFO Observed URI Shortening Service Domain (p1 .rs in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ellichua .com)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_reverse"

• "ET INFO RustDesk Relay Domain in DNS Lookup"

• "ET INFO LibreDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO URL Shortener Service Domain in DNS Lookup (tw .sv)"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (webhook .site in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 5e"

• "ET CURRENT_EVENTS Abused Domain Delivering Malicious Payloads in DNS Lookup (freeclickr .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .ramansarda .com in TLS SNI)"

• "ET INFO Commonly Abused Domain in TLS SNI (freeclickr .com)"

• "ET INFO DYNAMIC_DNS Query to 3322.net Domain *.7766.org"

• "ET INFO Interactsh Domain (.oast .site in TLS SNI)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - SET_DNP1.TXT File Download Attempt"

• "ET INFO HTTP POST Request XOR Key 7d"

• "ET INFO File Sharing Related Domain in DNS Lookup (cyberfile .me)"

• "ET INFO Observed DNS Over HTTPS Domain (agh .kul-lippek .de in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key cd"

• "ET INFO URL Shortening Service DNS Lookup (welcome .to)"

• "ET INFO HTTP GET Request XOR Key 76"

• "ET CHAT IRC JOIN command"

• "ET INFO HTTP GET Request XOR Key e0"

• "ET INFO URL Shortener Service Domain in DNS Lookup (2 .ua)"

• "ET INFO EXE - OSX Executable Download - PowerPC Arch"

• "GPL SCAN PING CyberKit 2.2 Windows"

• "ET INFO QR Code Generator Domain in DNS Lookup (qrco .de)"

• "ET INFO DNS Over HTTPS Certificate Inbound (unfiltered .adguard-dns .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .itdept .pro)"

• "ET INFO Observed Avalanche / Lavina Pulse Domain (avl .team in TLS SNI)"

• "ET INFO Observed Telegram Domain (t .me in TLS SNI)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (bitly .ws)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .rayanbab .com)"

• "ET INFO Observed DNS Query to xsph .ru Domain"

• "ET INFO HTTP POST Request XOR Key 7e"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .belnet .be)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .flymc .cc)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .bin .st)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole3 .hoerli .net)"

• "ET INFO HTTP GET Request XOR Key c6"

• "ET INFO HTTP POST Request XOR Key 12"

• "ET INFO HTTP GET Request XOR Key a5"

• "ET INFO HTTP GET Request XOR Key b0"

• "ET INFO HTTP GET Request XOR Key 5e"

• "ET INFO Suspicious Possible CollectGarbage in base64 3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .depieri .net)"

• "ET INFO Limo Telu DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key c1"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .dgea .fr)"

• "ET INFO HTTP GET Request XOR Key 15"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ningkelle .id)"

• "ET INFO File Sharing Related Domain in DNS Lookup (pixeldrain .com)"

• "ET INFO Possible Malicious Document Request to .tk domain"

• "ET INFO HTTP POST Request XOR Key 8a"

• "ET INFO HTTP POST Request XOR Key ff"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (oraclejp2 .chungyu .com)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (lower UDP Bypass) (Outbound) (CVE-2021-44228)"

• "ET INFO Possible Generic Stealer Sending System Information"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .glorydns .com)"

• "ET INFO Image Hosting Domain in DNS Lookup (hizliresim .com)"

• "ET INFO File Sharing Related Domain in DNS Lookup (sendgb .com)"

• "ET INFO HTTP POST Request XOR Key f4"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-tr .dnsflex .com)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (templatent .com)"

• "ET INFO SyncroMSP Remote Remote Management Software Install Checkin"

• "GPL ICMP_INFO PING BeOS4.x"

• "ET INFO 3XX redirect to data URL"

• "ET INFO Mailtrack Email Activity Tracking M2"

• "ET INFO Observed DNS Query to Dynamic DNS Service Domain (duia .ro)"

• "ET INFO RustDesk Peer Discovery (ping)"

• "ET INFO HTTP GET Request XOR Key fe"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ag .apollohct .com)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (bulkurlshortener .com)"

• "ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)"

• "ET INFO Observed Pastebin-style Service Domain (justpaste .it) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (chaos .altendorfme .com)"

• "ET INFO ZIP file exfiltration over raw TCP"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - DNPMAP.TXT File Upload Attempt"

• "ET INFO HTTP GET Request XOR Key 25"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizemons .com)"

• "ET INFO QR Code Generator Domain in DNS Lookup (qr-code-generator .com)"

• "ET INFO Observed File Transfer Service SSL/TLS Certificate (transfer .sh)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole1 .hoerli .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (home3 .brosena .xyz)"

• "ET MALWARE [PTsecurity] DeathBot.Java (Minecraft Spambot)"

• "ET INFO Request to Hidden Environment File - Inbound"

• "ET MALWARE All Numerical .ru Domain HTTP Request Likely Malware Related"

• "ET INFO HTTP GET Request XOR Key 81"

• "ET INFO HTTP GET Request XOR Key 07"

• "ET INFO Suspicious User-Agent (CustomStringHere)"

• "ET INFO HTTP POST Request XOR Key d9"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_middle_out"

• "ET INFO Observed URL Shortening Service Domain (www .temporary-url .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ric .openbld .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .beliefanx .cn)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .4-the .win)"

• "ET USER_AGENTS Go HTTP Client User-Agent"

• "ET INFO La Contre-Voie DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (deus-server .duckdns .org)"

• "ET INFO Suspicious HTTP Server Value in Response (ngengx)"

• "ET INFO HTTP POST Request XOR Key 79"

• "ET INFO IPFS Gateway Domain in DNS Lookup (gateway .pinata .cloud)"

• "ET INFO PDF /FlateDecode and PDF version 1.0"

• "ET INFO MyDNS .network DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key 91"

• "ET TROJAN DNS Query for Suspicious tolotor.com Domain - Possible CryptoWall Activity"

• "ET INFO HTTP GET Request XOR Key 69"

• "ET INFO HTTP POST Request XOR Key 46"

• "ET INFO Suspicious HTTP Server Value in Response (Apache \r\n)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cdzopi .duckdns .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (n-wan .dynv6 .net)"

• "ET INFO Possible Malicious Document Request to ChangeIP Dynamic DNS Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .nas-server .ru)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-sg .dnsflex .com)"

• "ET INFO HTTP GET Request XOR Key 8f"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ychen .cf)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_forward"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .technochat .in)"

• "GPL ICMP_INFO PING WhatsupGold Windows"

• "ET INFO Observed URL Shortener Service Domain (u5p .cn in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key d9"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (nongdanthanky .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 9b"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .onedns .net)"

• "ET POLICY Java EXE Download"

• "ET INFO Observed Anonymous File Sharing Service Domain (qu .ax) in TLS SNI"

• "ET POLICY Monero Mining Pool DNS Lookup (xmr .pool .mingergate .com)"

• "ET USER_AGENTS Shadowcoin Cryptocurrency UA Observed"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .anoogohost .net)"

• "ET EXPLOIT Serialized Spring Java Object Generated by ysoserial"

• "ET INFO HTTP GET Request XOR Key 8a"

• "ET INFO F5 BIG-IP - Failed Auth Due To Expired Password"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.6600.org"

• "ET CURRENT_EVENTS IRS Credential Phish Domain in DNS Lookup (jbdelmarket .com)"

• "ET INFO Level.io Agent Domain in DNS Lookup (agents .level .io)"

• "ET INFO Observed DNS Over HTTPS Domain (rayneau .fr in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 8c"

• "ET INFO HTTP POST Request XOR Key ca"

• "ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (gpchubjk .dnsfish .com)"

• "ET INFO HTTP POST Request XOR Key 49"

• "ET POLICY [MS-RPRN] Windows Printer Spooler Activity - AddPrinterDriverEx with Suspicious Filepath"

• "ET INFO Observed DNS Over HTTPS Domain (doh .xcom .pro in TLS SNI)"

• "ET INFO JAVA - Java Serialized Data Download by Vulnerable Client"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key df"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (upper TCP Bypass) (CVE-2021-44228)"

• "ET INFO File Sharing Related Domain in DNS Lookup (gofile .cc)"

• "ET INFO HTTP GET Request XOR Key 42"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .mokocup .cf)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adl .adfilter .net)"

• "ET INFO Suspicious Netlify Hosted DNS Request - Possible Phishing Landing"

• "ET INFO Observed URL Shortening Service Domain (welcome .to in TLS SNI)"

• "ET TROJAN DNS Query to PacketShare Proxy API Domain (api .packetshare .io)"

• "ET INFO ControlId DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key a0"

• "ET INFO HTTP POST Request XOR Key 51"

• "ET INFO Possible Generic Stealer Sending a Screenshot"

• "ET POLICY Pastebin-style service (note .youdao .com) in TLS SNI"

• "ET INFO HTTP GET Request XOR Key 2b"

• "ET INFO File Sharing Domain Observed in TLS SNI (put .re)"

• "ET INFO HTTP POST Request XOR Key 0d"

• "ET INFO Observed External IP Lookup Domain (ufile .io in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 21"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .jfchenier .ca)"

• "ET INFO Generic HTTP EXE Upload Inbound"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (mcsharepoint .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (shalenkov .dev)"

• "ET INFO JAVA - Zip/JAR File Downloaded Containing Executable Downloaded"

• "ET INFO Observed DNS Over HTTPS Domain (doh .qis .io in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key ec"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (kids .5ososea .com)"

• "ET INFO HTTP GET Request XOR Key a9"

• "ET USER_AGENTS Observed Malicious CASPER/Mirai UA"

• "ET INFO Applied Privacy DNS over HTTPS Certificate Inbound"

• "ET INFO Observed Pastebin-style Service Domain (pasteio .com in TLS SNI)"

• "ET INFO Suspicious POST to Wordpress Folder - Possible Successful Banking Phish"

• "ET TROJAN Medfos Connectivity Check"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ronc .ru)"

• "ET INFO ChatGPT-User Traffic Detected Inbound M1"

• "ET INFO Instagram Story Viewer Domain in DNS Lookup (greatfon .com)"

• "ET INFO EXE Downloaded from Github"

• "ET INFO Cisco IOS XE Web Server execCLI in SOAP (CVE-2023-20198) (Inbound)"

• "ET INFO HTTP GET Request XOR Key f2"

• "ET INFO HTTP GET Request XOR Key 53"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officenced .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (hooliganska .duckdns .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (a11 .diplo .es)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (privatlab .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .cloudmini .net)"

• "ET INFO HTTP POST Request XOR Key c0"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .0ooo .icu)"

• "ET INFO External Host Creating Docker Container"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jkdns .me)"

• "ET INFO Credit and Debit Card Metadata Lookup Domain in DNS Lookup (binlist .net)"

• "ET INFO Observed DNS over HTTPS Domain (resolver3 .absolight .net)"

• "ET INFO DNS Over HTTPS Certificate Inbound (dns .codepays .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .muxinghe .cn)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .panszelescik .pl)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (o .rsaikat .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .karl .one)"

• "ET INFO HTTP GET Request XOR Key 47"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (tlz .asia)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .comeonjames .club)"

• "ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M5"

• "ET INFO RustDesk Domain in DNS Lookup"

• "ET INFO Observed URL Shortening Service Domain (e .vg in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (agh .printk .info)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (karimdns .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dnsvps .familiamv .ml)"

• "ET INFO Possible Malicious Document Request to .tk domain"

• "GPL SCAN PING Sniffer Pro/NetXRay network scan"

• "ET INFO HTTP POST Request XOR Key e8"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jpok .996333 .xyz)"

• "ET SCAN Behavioral Unusual Port 137 traffic Potential Scan or Infection"

• "ET INFO HTTP GET Request XOR Key 06"

• "GPL ATTACK_RESPONSE isakmp login failed"

• "ET POLICY File Being Uploaded to SendSpace File Hosting Site"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (d .apemlegit .my .id)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharestion .com)"

• "ET INFO HTTP GET Request XOR Key 4a"

• "ET INFO HTTP GET Request XOR Key 09"

• "ET INFO Observed DNS Over HTTPS Domain (dns .repressoh .it in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ipoac .nl)"

• "ET INFO HTTP POST Request XOR Key dd"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .jinwoo .dev)"

• "ET INFO HTTP POST Request XOR Key f1"

• "ET INFO HTTP POST Request XOR Key 37"

• "ET INFO HTTP GET Request XOR Key 6b"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in DNS Lookup)"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default X509 Certificate"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .sarak .as)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .azcom .dev)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns3 .link)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (lc .sv)"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Subject Common Name"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizewel .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .niyawe .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (xyz2 .jammerxd .dev)"

• "ET INFO DNS Query for Suspicious .cf Domain"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (requestbin .cn)"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (webhook .site)"

• "ET SCAN Behavioral Unusual Port 1433 traffic Potential Scan or Infection"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns140 .zhhz .cc)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .grantbruneau .com)"

• "ET INFO jp.tiar DNS Over HTTPS Certificate Inbound"

• "ET INFO URI Shortening Domain in DNS Lookup (sprl .in)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .slinkyman .net)"

• "ET INFO Suspected Malicious Telegram Communication (POST)"

• "ET INFO HTTP POST Request XOR Key c8"

• "ET POLICY PCHunter CnC activity"

• "ET INFO Observed Abused File Hosting Domain (transferxl .com in TLS SNI)"

• "ET INFO DNS Query for Suspicious .ga Domain"

• "ET INFO Observered File Sharing Service in TLS SNI (frocdn .ch)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .amigo-mgn .ru)"

• "ET INFO DNS Over HTTPS Certificate Inbound (family .adguard-dns .com)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (opennic .i2pd .xyz)"

• "ET INFO HTTP GET Request XOR Key aa"

• "ET TROJAN DNS Query for Suspicious cvredirect.no-ip.net Domain - CoinLocker Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .supercluster .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .hinet .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (guard .magic-pics .tk)"

• "ET POLICY PDF File Containing arguments.callee in Cleartext - Likely Hostile"

• "ET INFO HTTP POST Request XOR Key 48"

• "ET INFO Possible EXE Download From Suspicious TLD (.webcam) - set"

• "ET INFO Possible Racoon Stealer Retrieving Google Account Details (GET)"

• "ET INFO HTTP POST Request XOR Key 97"

• "ET INFO Suspicious File Extension Inbound (.phonk)"

• "ET INFO HTTP POST Request XOR Key 2c"

• "ET INFO HTTP POST Request XOR Key a2"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .spaceindex .net)"

• "ET INFO Commonly Abused File Sharing Domain (put .io) in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (uk01 .dns4me .net)"

• "ET INFO Possible EXE Download From Suspicious TLD (.accountant) - set"

• "ET INFO HTTP POST Request XOR Key a4"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .asf1992labs .tk)"

• "ET POLICY [TW] IPFS Protocol HTTP Headers Observed"

• "ET INFO Observed Credit and Debit Card Metadata Lookup Domain (binlist .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .mulu .at)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (hole .elbschloss .xyz)"

• "ET INFO Plan9-dns DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key bb"

• "GPL ICMP_INFO PING Pinger Windows"

• "ET INFO HTTP POST Request XOR Key 4a"

• "ET INFO Possible EXE Download From Suspicious TLD (.download) - set"

• "ET INFO HTTP GET Request XOR Key d0"

• "ET INFO localtunnel Tunneling Domain in DNS Lookup (loca .lt)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .emiliyan .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .nl .ahadns .net)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL 2032 Processor Telnet Banner"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (per .adfilter .net)"

• "ET INFO Observed DNS Over HTTPS Domain (blackhole .myon .lu in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .bluemeda .cf)"

• "ET INFO HTTP GET Request XOR Key 44"

• "ET INFO Redirect via HTTP 300 to URI Shortening Service (sprl .in)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (3 .11i .eu)"

• "ET CURRENT_EVENTS Possible Instagram Phishing or Scam Landing Page"

• "ET INFO HTTP GET Request XOR Key f4"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adb .aadityakushwaha .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .d365 .in)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ebner .tech)"

• "ET INFO HTTP POST Request XOR Key 73"

• "ET INFO Observed Domain used for Phishing in TLS SNI (jemi .so)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (wc .sv)"

• "ET INFO HTTP GET Request XOR Key 77"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (eth .link)"

• "ET INFO HTTP POST Request XOR Key a8"

• "ET USER_AGENTS ABBCCoin Activity Observed"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (windocyte .com)"

• "ET INFO HTTP POST Request XOR Key 23"

• "ET INFO Observed Pastebin Style Domain in TLS SNI"

• "ET INFO Image Hosting Domain in DNS Lookup (resimupload .org)"

• "ET FTP Outbound Java Downloading jar over FTP"

• "ET POLICY Telegram API Certificate Observed"

• "ET INFO HTTP GET Request XOR Key 1d"

• "ET INFO HTTP GET Request XOR Key 16"

• "ET INFO HTTP POST Request XOR Key 94"

• "ET INFO Observed Filesharing Domain (lifeboxtransfer .com in TLS SNI)"

• "ET INFO DNS Query to a *.ngrok domain (ngrok.io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .cloudlinz .de)"

• "ET INFO Microsoft cmd.exe Banner Output - Decimal Encoded"

• "ET INFO HTTP POST Request XOR Key 0b"

• "ET INFO HTTP GET Request XOR Key b4"

• "ET INFO HTTP GET Request XOR Key 2a"

• "ET INFO URL Shortening Service Domain in TLS SNI (hyp .ae)"

• "ET INFO Suspicious Request to Image with User-Agent Ending in .exe"

• "ET INFO Observed Delivr .to Phishing/Security Simulation Service Domain (delivrto .me in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 94"

• "ET INFO Observed File Sharing Service Domain (dropmefiles .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .gando .fr)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - SET_ File Upload Attempt"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (tungdnsne .duckdns .org)"

• "ET INFO Windows OS Submitting USB Metadata to Microsoft"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (ipfs .eternum .io)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol UDP (Outbound) (CVE-2021-44228)"

• "ET INFO Suspicious HTTP Server Value in Response (Microsoft -IIS)"

• "ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M4"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard1 .leadmon .net)"

• "ET POLICY Microsoft user-agent automated process response to automated request"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .gambini .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cloudns .bosco .ovh)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officested .com)"

• "ET INFO HTA Download with PowerShell User-Agent"

• "ET CHAT IRC PONG response"

• "ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M3"

• "ET INFO Outdated Browser Landing Page M2"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (anggityuls .my .id)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .vishalk .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .yingroad .top in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .jucker .engineering)"

• "ET INFO Possible EXE Download From Suspicious TLD (.gdn) - set"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .laison .ltd)"

• "ET INFO Possible EXE Download From Suspicious TLD (.tokyo) - set"

• "ET INFO Observed DNS over HTTPS Domain (dns .circl .lu)"

• "ET INFO Suspicious Cisco Privilege Level 15 in HTTP Header (Outbound)"

• "ET INFO Observed DNS Query to .foo TLD"

• "ET INFO HTTP POST Request XOR Key b1"

• "ET INFO Abused File Sharing Site Domain Observed (qaz .su) in DNS Lookup"

• "ET INFO Observed DNS Query to Reverse Shell Generator (reverse-shell .sh)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (open-resolver1 .unima .ac .id)"

• "ET INFO Observed Image Hosting Domain (imgyukle .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (frontpace .co .uk)"

• "ET INFO HTTP POST Request XOR Key 04"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jp3 .meidouling .com)"

• "ET INFO DYNAMIC_DNS Query to softether .net Domain"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .bingner .com)"

• "ET INFO Observed Domain (autoitscript .com) in TLS SNI"

• "ET POLICY Recuva File Recovery Software - Observed User-Agent"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vps .abgnetwork .es)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard1 .jsanagustin .net)"

• "ET INFO [TW] Internet Computer HTTP Referer Observed"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (shield .afixer .app)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .ryanleek .com)"

• "ET INFO File Sharing Domain Observed in TLS SNI (drop .chapril .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .hopper .org .uk)"

• "ET INFO HTTP GET Request XOR Key 10"

• "ET INFO Observed DNS Over HTTPS Domain (ag .brianlee .fun in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 81"

• "ET INFO RustDesk Get Software Update URL"

• "ET TROJAN DNS Query for Suspicious cvredirect.ddns.net Domain - CoinLocker Domain"

• "ET INFO Observed Fleetdeck Remote Management Software Domain in TLS SNI (fleetdeck .io)"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (ancillarycheese .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .piekacz .pl)"

• "ET INFO Abused File Sharing Site Domain Observed (qaz .im) in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (fra1 .eyecay .xyz)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dnsserver .mailchan .eu)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (kswro .web .id)"

• "ET INFO HTTP GET Request XOR Key ca"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (infura-ipfs .io)"

• "ET INFO Observed DNS Over HTTPS Domain (doh1 .b-cdn .net in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key f5"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .d96 .info)"

• "ET INFO Go-http-client POSTing IP Address and Username"

• "ET USER_AGENTS Observed Reconnaissance Related UA"

• "ET INFO HTTP POST Request XOR Key 93"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default Cert Issuer Common Name"

• "ET INFO Pulse Secure VPN Version Disclosure Attempt"

• "ET INFO HTTP GET Request XOR Key f0"

• "ET INFO Free Web Hosting Domain (c1 .biz) in DNS Lookup"

• "ET INFO File Sharing Related Domain in DNS Lookup (nitrofile .cc)"

• "ET POLICY TeamViewer Keep-alive outbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .jpjb .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .morizt .id)"

• "ET INFO HTTP POST Request XOR Key 06"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .tuankhaiit .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sa01 .dns4me .net)"

• "ET WEB_CLIENT PROPFIND Flowbit Set"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .vpnglobal .my .id)"

• "ET INFO User-Agent (wininet)"

• "ET INFO HTTP POST Request XOR Key 20"

• "ET INFO HTTP GET Request XOR Key 5a"

• "ET INFO [TW] Internet Computer Domain Observed"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dlcea .com)"

• "ET INFO URL Shortening/Redirect Service Domain in DNS Lookup (cutit .org)"

• "ET INFO HTTP POST Request XOR Key d1"

• "ET INFO PE EXE Download over raw TCP"

• "ET INFO Mullvad DNS Over HTTPS Certificate Inbound"

• "ET INFO Abused File Sharing Domain (wasabi .com) in TLS SNI"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - DNPMAP.TXT File Download Attempt"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .siry .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (resolv .srv-pro .de)"

• "ET INFO RustDesk Peer Discovery (pong)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharession .com)"

• "ET INFO HTTP POST Request XOR Key 1c"

• "ET INFO Observed DNS over HTTPS Domain (dns .repressoh .it)"

• "ET INFO Generic HTTP EXE Upload Outbound"

• "ET INFO File Sharing Related Domain in DNS Lookup (send .whateveritworks .org)"

• "ET INFO HTTP POST Request XOR Key 02"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .dmr .pw)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (appart .yoannchappaz .best)"

• "ET INFO HTTP GET Request XOR Key 52"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .elashri .xyz)"

• "ET USER_AGENTS BLEXBot User-Agent"

• "ET INFO HTTP GET Request XOR Key c3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (bcandrade .ml)"

• "ET INFO HTTP GET Request XOR Key f3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ada .openbld .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .brian-hong .tech)"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.8866.org"

• "ET WEB_CLIENT Download of .MOV Content flowbit set"

• "ET INFO HTTP GET Request XOR Key eb"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adg .yybyy .wiki)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .mipauns .com)"

• "ET INFO [eSentire] Possible Kali Linux Updates"

• "ET INFO Cloudflare DNS Over HTTPS Certificate Inbound"

• "ET INFO Possible Rogue LoJack Asset Tracking Agent"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (atlantic .dyn1 .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .kr .chavy .dev)"

• "ET INFO Observed DNS Over HTTPS Domain (agh .workfordemo .co .in in TLS SNI)"

• "ET INFO e-utp DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key 24"

• "ET INFO File Sharing Service Domain (docdroid .net) in TLS SNI"

• "ET INFO SSL/TLS Certificate Observed (Lucy Phishing Awareness Default Certificate)"

• "ET INFO File Hosting Service Domain Domain in DNS Lookup (files .pythonhosted .org)"

• "ET INFO Observed DNS over HTTPS Domain (antivirus .bebasid .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-dns .hoover .eu .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (lion .yazilimatolye .com)"

• "ET INFO HTTP POST Request XOR Key 3e"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard1 .kapuyhome .hu)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (d .toairs .com)"

• "ET INFO HTTP GET Request XOR Key 02"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .yameenassotally .com)"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (.apiary-mock .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (mailer .amlegion .org)"

• "ET INFO Tox Chat Domain in DNS Lookup (tox .chat)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (u .to)"

• "ET INFO Splashtop Domain in DNS Lookup (splashtop .eu)"

• "ET INFO DYNAMIC_DNS HTTP Request to a softether .net Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (n5 .lsasss .com)"

• "ET INFO Possible MSXMLHTTP Request (no .exe)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharepointen .com)"

• "ET INFO HTTP POST Request XOR Key 13"

• "ET INFO DNS Over HTTPS Certificate Inbound (0ms .run)"

• "ET INFO Win32/Sogou User-Agent (SOGOU_UPDATER)"

• "ET POLICY File Uploaded to ge.tt Filesharing Service"

• "ET INFO HTTP POST Request XOR Key 87"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (intercept .rest)"

• "ET INFO File Sharing Domain Observed in TLS SNI (send .zcyph .cc)"

• "ET INFO File Sharing Related Domain in DNS Lookup (send .hrzn .cool)"

• "ET INFO File Sharing Domain Observed in TLS SNI (qiwi .gg)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .porteii .com)"

• "ET POLICY External Unencrypted Connection To Aanval Console"

• "ET INFO Anyplace Remote Access Initial Connection Attempt (005)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns3 .cx)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .lunet .design)"

• "ET INFO Microsoft Compact Office Document Format File Download"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (irre .li)"

• "ET INFO LavaDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .209 .wf)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (teradns .org)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (kids .dns0 .eu)"

• "ET INFO File Sharing Related Domain in DNS Lookup (drop .chapril .org)"

• "ET INFO DNS Query to Browser FingerprintJS Domain (openfpcdn .io)"

• "ET INFO HTTP POST Request XOR Key 0a"

• "ET INFO Observed DNS over HTTPS Domain (blog .kimiblock .top) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .andrewnw .xyz)"

• "ET INFO HTTP POST Request XOR Key d8"

• "ET INFO Ark Trader API Login (POST)"

• "ET INFO Observed DNS over HTTPS Domain (dns .feldy .my .id) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .applewebkit .dev)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (templatern .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .jimirobaer .be)"

• "ET INFO Cisco Smart Install Protocol Observed"

• "ET POLICY ABBCCoin Checkin"

• "ET INFO HTTP GET Request XOR Key 19"

• "ET INFO JAVA - Java Archive Download By Vulnerable Client"

• "ET INFO HTTP GET Request XOR Key 3f"

• "ET INFO DNS Query to .onion proxy Domain (torwoman.com)"

• "ET INFO HTTP GET Request XOR Key ab"

• "ET INFO Interactsh Domain (.oast .live in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .apigw .online)"

• "ET INFO Observed URL Shortener Service Domain (zshorten .com in TLS SNI)"

• "ET INFO URL Shortner Domain in DNS Lookup (urlz .fr)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .ccb-net .it in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 1b"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .electrotm .org)"

• "ET INFO Hitian .me DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS Over HTTPS Domain (paranoia .mydns .network in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .avdkishore .dev)"

• "ET INFO Explorer Shell CLSID COM Object Call Method Inbound via TCP"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-de .dnsflex .com)"

• "ET INFO HTTP POST Request XOR Key d2"

• "ET INFO File Sharing Domain Observed in TLS SNI (send .hrzn .cool)"

• "ET WEB_CLIENT Proxy - OWASP Zed Attack Proxy Certificate Seen"

• "ET INFO Observed DNS Over HTTPS Domain (dns .vinnyp .xyz in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 63"

• "ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)"

• "ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound"

• "ET EXPLOIT NTDump Session Established Reg-Entry port 139"

• "ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (com-token-auth .com)"

• "ET INFO HTTP GET Request XOR Key 0f"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Current directory /SEL-2701"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (privacy .plumedns .com)"

• "ET INFO Observed DNS Query to .zip TLD"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (bluemood .me)"

• "ET WEB_CLIENT WebDAV GET Request for .url Flowbit Set"

• "ET INFO Observed DNS over HTTPS Domain (dns .ndo .dev)"

• "ET INFO HTTP POST Request XOR Key 64"

• "ET INFO HTTP GET Request XOR Key d3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ad .ipsecloud .ru)"

• "ET INFO HTTP GET Request XOR e4"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kamilszczepanski .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ggdns .club)"

• "ET INFO HTTP GET Request XOR Key d1"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vpn-tw .teng .sh)"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (ipfs .infura .io)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .molinero .dev in TLS SNI)"

• "ET INFO EXE SCardForgetReaderGroupA (Used in Malware Anti-Debugging)"

• "ET INFO File Sharing Domain Observed in TLS SNI (file .pizza)"

• "ET POLICY Microsoft TEREDO IPv6 tunneling"

• "ET INFO Observed DNS over HTTPS Domain (spacedns .org)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (u5p .cn)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (id .sv)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3620 Default Cert Subject Common Name"

• "ET INFO HTTP POST Request XOR Key ad"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .dns4all .eu)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .in-berlin .de)"

• "ET INFO HTTP GET Request XOR Key ad"

• "ET INFO HTTP GET Request XOR Key c5"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .myddns .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole .datamatter .co .za)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (send .exploit .in in DNS Lookup)"

• "ET INFO Observed File Sharing Related Domain in TLS SNI (mediafire .com)"

• "ET CHAT IRC USER command"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (requestinspector .com in TLS SNI)"

• "ET INFO URL Shortening Domain in DNS Lookup (urlbae .com)"

• "ET INFO Possible Lateral Movement - File Creation Request in Remote System32 Directory (T1105)"

• "ET INFO HTTP GET Request XOR Key 7e"

• "ET INFO HTTP POST Request XOR Key c4"

• "ET INFO HTTP GET Request XOR Key d8"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.8800.org"

• "ET INFO SUSPICIOUS Single JS file inside of ZIP Download (Observed as lure in malspam campaigns)"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (intercept .rest in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ninny .duckdns .org)"

• "ET INFO HTTP GET Request XOR Key 4c"

• "ET INFO HTTP GET Request XOR Key 50"

• "ET INFO HTTP GET Request XOR Key 61"

• "ET INFO HTTP POST Request XOR Key 1e"

• "ET INFO HTTP GET Request XOR Key 4e"

• "ET INFO HTTP GET Request XOR Key 74"

• "ET INFO Observed Custom Logo Domain (seeklogo .com in TLS SNI)"

• "ET INFO Installshield One Click Install User-Agent Toys File"

• "ET INFO File Sharing Related Domain in DNS Lookup (instant .io)"

• "ET INFO Apache ActiveMQ Instance - Vulnerable to CVE-2023-46604 - Local Instance"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncInstallPrinterDriverFromPackage"

• "ET INFO NoxPlayer Simulator Update Activity"

• "ET INFO URI Shortening Domain in DNS Lookup (p1 .rs)"

• "ET INFO DnsCrypt DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (darya .persiannit .net)"

• "ET INFO Cisco Umbrella (OpenDNS) DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adg .geili .me)"

• "ET INFO HTTP GET Request XOR Key 7f"

• "ET INFO URL Observed in PDF Downloaded via Dropbox"

• "ET INFO Edgy DNS Over HTTPS Certificate Inbound"

• "ET INFO URL Shortener Service Domain in DNS Lookup (cli .co)"

• "ET INFO Pastebin Style Domain in DNS Lookup"

• "ET INFO Commonly Abused WordPress Application Related Domain in DNS Lookup (dreamwp .com)"

• "ET INFO HTTP GET Request XOR Key 1b"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .switch .ch)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .hee .ink)"

• "ET INFO Level.io Download Agent Domain in DNS Lookup (downloads .level .io)"

• "ET INFO HTTP GET Request XOR Key 66"

• "ET INFO HTTP GET Request XOR Key 36"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .joey01245 .nl)"

• "ET INFO HTTP POST Request XOR Key 68"

• "ET INFO Control Panel Applet File Download"

• "ET INFO HTTP POST Request XOR Key ee"

• "ET INFO HTTP POST Request XOR Key fe"

• "ET INFO Observed URL Shortener Service Domain (fanlink .to) in TLS SNI"

• "ET INFO GameHouse License Check"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (awan .ftp .sh)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (open .dns0 .eu)"

• "ET INFO DNS Query to .onion proxy Domain (torman2.com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .khanhtran .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .5ive .net)"

• "ET INFO Possible Snake Header in HTTP Request"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (windocyte .com)"

• "ET INFO Plan9-dns DNS Over HTTPS Certificate Inbound"

• "ET INFO IPFS Gateway Domain in DNS Lookup (ipfs .dweb .link)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (wantaquddin .com)"

• "ET GAMES Solaris2 Checkin"

• "ET INFO HTTP POST Request XOR Key 09"

• "ET INFO HTTP POST Request XOR Key da"

• "ET INFO HTTP GET Request XOR Key 3d"

• "ET INFO [TW] Uri Contains Likely Urlpages Web Hosting Technique"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (net-login .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .tracker .ink)"

• "ET INFO Upload to Links-Server File Sharing Server"

• "ET INFO Observed DNS over HTTPS Domain (dns .hubservices .vn)"

• "ET INFO HTTP GET Request XOR Key 3a"

• "ET INFO HTTP GET Request XOR Key b9"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .kantinyoyok .xyz)"

• "ET INFO Observed DNS Over HTTPS Domain (pro .shecan .ir in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (internetsehat .bebasid .com in TLS SNI)"

• "ET INFO File Sharing Related Domain in DNS Lookup (anonymfile .com)"

• "ET INFO Commonly Abused File Sharing Domain (wasabi .com) in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adblock .technovus .in)"

• "ET INFO HTTP POST Request XOR Key dc"

• "ET INFO HTTP GET Request XOR Key d5"

• "ET INFO HTTP POST Request XOR Key 31"

• "ET INFO Observed Google DNS over HTTPS Domain (dns .google .com in TLS SNI)"

• "ET INFO DNS Query to File Sharing Domain (drop .xtrafrancyz .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (elshad-adgh-dns .ru)"

• "ET INFO HTTP GET Request XOR Key bc"

• "ET INFO EXE - Served Attached HTTP"

• "ET INFO [TW] Likely Javascript-Obfuscator Usage Observed M2"

• "ET INFO HTTP GET Request XOR Key 46"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncAddPrinterDriver"

• "ET INFO HTTP GET Request XOR Key bd"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (family .5ososea .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ant .dns .qwer .pw)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .agadez .net)"

• "ET INFO Symantec Download Flowbit Set"

• "ET INFO HTTP GET Request XOR Key b1"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (syd .adfilter .net)"

• "ET INFO Observed URI Shortening Service Domain (alturl .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .silentlybren .com)"

• "ET POLICY File Downloaded via ge.tt Filesharing Service"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (surt .ml)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (lf-ns-001 .my .to)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .haoxuan .xyz)"

• "ET INFO Base64 Encoded octet-stream File in HTML Body (Mime Type)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (lindung .pp .ua)"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (.curlhub .io in TLS SNI)"

• "ET POLICY TeamViewer Keep-alive inbound"

• "ET INFO Observed DNS Over HTTPS Domain (dns .quad9 .net in TLS SNI)"

• "ET INFO DNS Query for Suspicious .ml Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ekipapi .com)"

• "ET INFO HTTP GET Request XOR Key f9"

• "ET INFO Packetriot Tunneling Domain in DNS Lookup (betabuild .dev)"

• "ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 9d"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ps1 .modr .club)"

• "ET ICMP_INFO DNSBin Demo (requestbin .net) - Data Exfil"

• "ET INFO URL Shortener Service Domain in DNS Lookup (s .yam .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (2 .11i .eu)"

• "ET TROJAN PacketShare Proxy Connection Init (POST)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cloudseriousshit .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sagutxustech .com)"

• "ET INFO File Sharing Domain in DNS Lookup (pan .tencent .com)"

• "ET INFO HTTP POST Request XOR Key ac"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sbdns .co .in)"

• "ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP POST Request XOR Key 6b"

• "ET INFO HTTP POST Request XOR Key ab"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (com-onlinebanking .com)"

• "ET INFO File Sharing Related Domain in DNS Lookup (pomf .lain .la)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole2 .hoerli .net)"

• "ET INFO Observed URL Shortener Service Domain (www .kisa .link in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (nas1403 .duckdns .org)"

• "ET INFO HTTP POST Request XOR Key e2"

• "ET INFO HTTP GET Request XOR Key 29"

• "ET POLICY TLS possible TOR SSL traffic"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .mmmalia .com)"

• "ET INFO Base64 Encoded RAR File in HTML Body (Magic Bytes)"

• "ET INFO HTTP Request to Webhook/HTTP Request Inspection Service Domain (requestbin .cn)"

• "ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (ipfs .eternum .io)"

• "ET INFO Observed Ordns DNS over HTTPS Domain (Ordns .he .net in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 45"

• "ET INFO Observed IPFS Gateway Domain (ipfs .w3s .link) in TLS SNI"

• "ET INFO GET Request Exfiltrating Username and Hostname"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .myddns .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns8 .org)"

• "ET INFO File Sharing Domain Observed in TLS SNI (gofile .cc)"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriverPackage"

• "ET INFO URL Shortening Service Domain in DNS Lookup (gg-l .xyz)"

• "ET INFO Possible EXE Download From Suspicious TLD (.biz) - set"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (mcsharepoint .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .aganin .org)"

• "ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 71"

• "ET INFO Ibksturm DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS Over HTTPS Domain (common .dot .dns .yandex .net in TLS SNI)"

• "ET WEB_SERVER Possible SSRF Attempt Inbound Using Common Dork M7"

• "ET INFO HTTP POST Request XOR Key 34"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .rowdyengeesje .nl)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .bitteeinbyte .de)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns .esegece .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ghost .pm)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cluster-1 .gac .edu)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .yamamoto .ren)"

• "ET INFO Possible Outdated Browser Landing Page M1"

• "ET INFO File Sharing Related Domain in DNS Lookup (filecave .lol)"

• "ET INFO Custom Logo Domain Domain in DNS Lookup (logodownload .org)"

• "ET INFO Observed DNS Over HTTPS Domain (family .puredns .org in TLS SNI)"

• "ET SCAN Behavioral Unusual Port 1434 traffic Potential Scan or Infection"

• "ET INFO EXE - Served Inline HTTP"

• "ET INFO HTTP GET Request XOR Key d4"

• "ET INFO Observed SSL Cert (URL Shortener Service - tiny .cc)"

• "ET ATTACK_RESPONSE PowerShell Geo Check Before Execution"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (doctricant .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard-dns .rouga .ch)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-02 .spectrum .com)"

• "ET INFO HTTP GET Request XOR Key 6a"

• "ET INFO tor2www .onion Proxy SSL cert"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (blockerads .multimediaconcept .fr)"

• "ET INFO Possible Malicious Document Request to NOIP DynDNS Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .la .ahadns .net)"

• "ET INFO HTTP POST Request XOR Key b8"

• "ET INFO HTTP POST Request XOR Key 53"

• "ET INFO HTTP GET Request XOR Key d6"

• "ET INFO RAR file exfiltration over raw TCP"

• "ET INFO Adilbo HTML Encoder Observed"

• "ET INFO Observed Free Hosting Domain (infinityfreeapp .com) in TLS SNI"

• "ET INFO DNS Query to .onion proxy Domain (torroadsters.com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .phdns3 .lonet .org)"

• "ET MALWARE Observed PacketShare Proxy Domain Domain (api .packetshare .io in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 17"

• "ET INFO HTTP GET Request XOR Key 30"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (freedom .mydns .network)"

• "ET INFO RustDesk Register Public Key"

• "ET INFO HTTP GET Request XOR Key cf"

• "ET INFO HTTP POST Request XOR Key 89"

• "ET WEB_CLIENT Encoded javascriptdocument.write - usually hostile"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (rdjdns .ajraspi .xyz)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dnsadguard .co .uk)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vvmm .me)"

• "ET INFO DNS Query to a Free Hosting Domain Domain (*.ct8 pl)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (leecurrylawfirm .com)"

• "ET INFO HTTP GET Request XOR Key d2"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizegives .com)"

• "ET INFO Bit.do Shortened Link Request (set)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .23-4 .cn)"

• "ET INFO Base64 Encoded ISO File in HTML Body (Magic Bytes)"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default X509 Certificate String"

• "ET INFO Observed URL Shortening Service Domain (meet .id in TLS SNI)"

• "ET POLICY Proxy Server Lookup (nntime)"

• "ET WEB_CLIENT Proxy - Fiddler Proxy Certificate Seen"

• "ET INFO EXE - OSX Executable Download - Multi Arch w/Intel"

• "ET INFO HTTP POST Request XOR Key 14"

• "ET INFO DYNAMIC_DNS softether .net Domain Observed in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ag .ssrahul96 .xyz)"

• "ET INFO GG Url Shortener Observed in DNS Query"

• "ET INFO Ex Libris Library Software DNS Lookup"

• "ET INFO DYNAMIC_DNS Query to *.dyndns. Domain"

• "GPL ICMP_INFO PING speedera"

• "ET INFO HTTP POST Request XOR Key af"

• "GPL ICMP_INFO PING Flowpoint2200 or Network Management Software"

• "ET INFO HTTP POST Request XOR Key f7"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (1 .11i .eu)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (send .exploit .in in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key b3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (kilabit .info)"

• "ET INFO jp.tiar DNS Over HTTPS Certificate Inbound"

• "ET WEB_CLIENT SUSPICIOUS Local file read using read protocol"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (yovbak .com)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharestion .com)"

• "ET INFO Observed File Sharing Service (www .uplooder .net) in DNS Lookup"

• "ET INFO Suspicious NULL DNS Request"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .skrep .eu)"

• "ET INFO URL Shortening Service DNS Lookup (come .to)"

• "ET INFO Anonymous File Sharing Domain in DNS Lookup (qu .ax)"

• "ET INFO HTTP POST Request XOR Key 2e"

• "ET INFO Base64 Encoded Null Byte Padded File in HTML Body (Magic Bytes)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ociamd1 .fatucloud .gosprout .org)"

• "ET INFO Public Array DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS Over HTTPS Domain (dns .b612 .me in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 5c"

• "ET INFO HTTP POST Request XOR Key 2d"

• "ET INFO HTTP POST Request XOR Key f8"

• "ET INFO HTTP POST Request XOR Key 6a"

• "ET INFO HTTP POST Request XOR Key 30"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns .vmath .my .id)"

• "ET INFO DYNAMIC_DNS Query to 3322.org Domain"

• "ET INFO HTTP GET Request XOR Key 8e"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (shareholds .com)"

• "ET INFO Observed DNS Over HTTPS Domain (ihctw .synology .me in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .koshonsa .fr)"

• "ET INFO Base64 Encoded zip-compressed File in HTML Body (Mime Type)"

• "ET POLICY Ryeol HTTP Client Class "

• "ET INFO URL Shortening Service Domain in DNS Lookup (s3r .io)"

• "ET INFO Cisco IOS XE Web Server execCLI in SOAP (CVE-2023-20198) (Outbound)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .tvk .rwth-aachen .de)"

• "ET INFO External Host Creating Docker Image"

• "ET INFO Splashtop Domain (splashtop .com) in TLS SNI"

• "ET INFO External IP Lookup Domain (iplogger .com in DNS lookup)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .shuting .idv .tw in TLS SNI)"

• "ET INFO Possible SQLi Attempt in User Agent (Outbound)"

• "ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .app)"

• "ET INFO Observed DNS over HTTPS Domain (query .hdns .io)"

• "ET INFO ZIP file download over raw TCP"

• "ET INFO Android Device Connectivity Check"

• "ET CHAT IRC USER Off-port Likely bot with 0 0 colon checkin"

• "ET INFO Observed DNS Over HTTPS Domain (secforads3 .ch in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .techcpu .net)"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (.apiary-mock .com in TLS SNI)"

• "ET GAMES UnknownApps Game Cheat Service Checkin (auth .hwidspoof .me)"

• "ET INFO HTTP POST Request XOR Key 90"

• "ET INFO Observed Instagram Story Viewer Domain (dumpor .com in TLS SNI)"

• "ET INFO Rezhajul DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns2 .flodns .net)"

• "ET INFO HTTP GET Request XOR Key 20"

• "ET INFO Likely PCTools.com Installer User-Agent (Installer Ping)"

• "ET INFO HTTP POST Request XOR Key 9a"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (muxyuji .ru)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .decisivedevops .com)"

• "ET INFO HTTP GET Request XOR Key 28"

• "ET SCAN Rapid POP3 Connections - Possible Brute Force Attack"

• "ET INFO HTTP POST Request XOR Key b7"

• "ET INFO HTTP request for resource ending in .scr"

• "ET INFO URL Shortener Service Domain DNS Lookup (zshorten .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .eliatofani .it)"

• "ET INFO URL Shortening Service Domain in TLS SNI (coki .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (msr177 .com)"

• "ET MALWARE All Numerical .cn Domain Likely Malware Related"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adg .dankatapich .eu .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .itcosc .com)"

• "ET INFO HTTP POST Request XOR Key 5a"

• "ET CURRENT_EVENTS PUBG Credential Phish 2023-03-06"

• "GPL ICMP_INFO PING Microsoft Windows"

• "ET INFO HTTP POST Request XOR Key cf"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .lrdnet .cf)"

• "ET INFO CMS Hosting Domain in TLS SNI (storyblok .com)"

• "ET POLICY Pastebin-style service note .youdao .com in DNS query"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adtec .aidentec .top)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .cynthialabs .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .dutchwhite .nl)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .phdns5 .lonet .org)"

• "ET INFO Packetriot Tunneling Domain in DNS Lookup (reversetunnel .net)"

• "ET INFO Bit.do Shortened Link Request to EXE"

• "ET INFO DNS Query to PekkaRat Store Front Domain (pekkarat .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .ibr .cs .tu-bs .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .bt .com)"

• "ET INFO Abused File Sharing Domain (put .io) in TLS SNI"

• "ET INFO URL Shortener Service Domain in DNS Lookup (yt .sv)"

• "ET INFO HTTP POST Request XOR Key 11"

• "ET INFO HTTP POST Request XOR Key a9"

• "ET INFO HTTP GET Request XOR Key f7"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .tipsy .coffee)"

• "ET INFO OpenSea API Query NFT Discovery Details (GET)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vpn .jogjacloud .com)"

• "ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .dev)"

• "GPL ICMP_INFO PING Seer Windows"

• "ET INFO JAVA - Java Class Download By Vulnerable Client"

• "ET POLICY Java Client HTTP Request"

• "ET INFO ZoneAlarm Download Flowbit Set"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pcornet .freeboxos .fr)"

• "ET INFO Interactsh Domain in DNS Lookup (.oast .fun)"

• "ET POLICY Cnet App Download and Checkin"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .timochan .cn)"

• "ET INFO HTTP GET Request XOR Key 92"

• "ET INFO Improperly Spaced Accept Header in User-Agent"

• "ET INFO Outbound POST Request with Zipped Directory Traversal Filename"

• "ET INFO HTTP POST Request XOR Key 19"

• "ET INFO Microsoft Script Encoder Encoded File"

• "ET INFO Internet Initiative Japan DNS Over HTTPS Certificate Inbound"

• "ET INFO Possible Malicious Document Request to Hostinger Domains"

• "ET INFO Bitcoin QR Code Generated via Btcfrog.com"

• "ET INFO Observed IPFS File Service Domain in TLS SNI (nftstorage .link)"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard Low Port)"

• "ET INFO DLL File Download Request via Discord"

• "ET INFO Suspicious HTTP Server Value in Response (Apache64)"

• "ET INFO HTTP GET Request XOR Key e2"

• "ET INFO 404/Snake/Matiex Keylogger Style External IP Check"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pdns .itxe .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .firestrike-services .de)"

• "ET INFO HTTP POST Request XOR Key 71"

• "ET INFO Veeam Credential Recovery Script Inbound"

• "ET INFO Suspicious HTTP Server Value in Response (Apache Coyote)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (externalmobiel .lekdijk .online)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .expert in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 7c"

• "ET POLICY External FTP Connection TO Local HP JetDirect Printer"

• "ET INFO File Sharing Domain Observed in TLS SNI (peergos .org)"

• "ET INFO Observed URL Shortening Service Domain (zws .im in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (resolver2 .absolight .net)"

• "ET INFO myobfuscate.com Encoded Script Calling home"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (eu1 .dns .lavate .ch)"

• "ET INFO HTTP POST Request XOR Key e4"

• "ET INFO HTTP GET Request XOR Key d7"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .d94 .xyz)"

• "ET INFO HTTP GET Request XOR Key 6f"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .edison42 .dev)"

• "ET INFO File Sharing Domain Observed in TLS SNI (wormhole .app)"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (saucelabs .com in TLS SNI)"

• "ET INFO Paesa DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key 31"

• "ET INFO HTTP POST Request XOR Key c2"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dog .dns .qwer .pw)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (anonfiles .com in DNS Lookup)"

• "ET INFO Abused File Sharing Site Domain Observed (qaz .im) in TLS SNI"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Default User Account Password TAIL Login Attempt"

• "ET TROJAN Bortzmeyer DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed testcookie-nginx-module"

• "ET INFO HTTP POST Request XOR Key 5d"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .inforlogia .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .wibenson .cloud)"

• "ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .streamlas .fr)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ca02 .dns4me .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .dscloud .me)"

• "GPL EXPLOIT rsyncd module list access"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (yarp .lefolgoc .net)"

• "ET WEB_SERVER WebShell - PostMan"

• "ET INFO HTTP POST Request XOR Key b4"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (eweyo .duckdns .org)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizemons .com)"

• "ET INFO LNK File Downloaded via HTTP"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (hgns .harriganhome .ga)"

• "ET INFO HTTP POST Request XOR Key a7"

• "ET CHAT IRC NICK command"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (templatern .com)"

• "ET INFO Observed SyncroMSP Remote Management Software Domain in DNS Lookup (kabutoservices .com)"

• "ET INFO HTTP POST Request XOR Key ef"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (safe .kswro .web .id)"

• "ET INFO Observed Discord Domain in DNS Lookup (discord .com)"

• "ET USER_AGENTS Suspicious HttpSocket User-Agent Observed"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (virga .pp .ua)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-in .dnsflex .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .iamninja .ru)"

• "ET INFO HTTP GET Request XOR Key 14"

• "ET INFO HTTP GET Request XOR Key 93"

• "ET INFO HTTP POST Request XOR Key 57"

• "ET INFO Observed DNS Query to autoitscript .com"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (m .pipedream .net in TLS SNI)"

• "ET INFO Observed File Sharing Domain (drive .internxt .com in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 78"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .foximao .cn)"

• "ET INFO Observed DNS Query to BaitAndPhish Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .norgan .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .disconnect .app)"

• "ET INFO HTTP POST Request XOR Key 21"

• "ET INFO Observed DNS Over HTTPS Domain (safe .dot .dns .yandex .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (xenergy .cc)"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (ipfs .infura .io)"

• "ET INFO HTTP POST Request XOR Key b0"

• "ET INFO HTTP GET Request XOR Key f6"

• "ET INFO HTTP GET Request XOR Key cb"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (findmethedns .info)"

• "GPL ICMP_INFO PING *NIX"

• "ET POLICY Internal Host Getting External IP Address - ip2city.asp"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .alloxr .info)"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (infura-ipfs .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ad1 .heronet .nl)"

• "ET INFO Observed Initial New Kind of Network (NKN) POST Request"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (addns .jpr .space)"

• "ET INFO HTTP GET Request XOR Key 48"

• "ET INFO HTTP POST Request XOR Key 70"

• "ET INFO HTTP GET Request XOR Key 2d"

• "ET INFO HTTP GET Request XOR Key 60"

• "ET INFO HTTP POST Request XOR Key 9f"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriverPackagePath"

• "ET INFO HTTP GET Request XOR Key 99"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ngc7331 .top)"

• "ET INFO File Sharing Domain Observed in TLS SNI (pomf .lain .la)"

• "ET USER_AGENTS BeeMovie Related Activity"

• "ET INFO HTTP POST Request XOR Key b6"

• "ET INFO Java Downloading Archive flowbit no alert"

• "ET INFO PDF - Acrobat Enumeration - var PDFObject"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (killads .vpms .xyz)"

• "ET INFO Possible EXE Download From Suspicious TLD (.stream) - set"

• "ET INFO Possible IP Check curlmyip.com"

• "ET INFO Observed Discord Domain (discordapp .com in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key ec"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .simulhost .com)"

• "ET POLICY Wise Solutions Install Reporting via HTTP - User Agent (Wise)"

• "ET INFO HTTP POST Request XOR Key 84"

• "ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)"

• "ET INFO HTTP GET Request XOR Key 9e"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (addguard .greenet .id)"

• "ET INFO Observed DNS Query to HTTP Sniffer Domain (httpdebugger .com)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Change working directory 2701"

• "ET INFO Free File Hosting Domain in DNS Lookup (fileditch .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .blindtechs .com)"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (mockbin .org in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .worthmind .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (osefcorp .duckdns .org)"

• "ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (tg .sv)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (sa .sv)"

• "ET INFO Microsoft Malware Protection User-Agent Observed to Non-Microsoft Domain"

• "ET INFO Level.io Agent P2P Connection Domain in DNS Lookup (global .stun .twilio .com)"

• "ET INFO HTTP GET Request XOR Key 01"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jp .68360612 .xyz)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sky .rethinkdns .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (area51 .mywire .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .filipccz .eu)"

• "ET INFO External IP Lookup Domain (geolocation-db .com) in TLS SNI"

• "ET INFO HTTP GET Request XOR Key 0a"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .josephyap .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jp .hm3 .day)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (block .buck .ovh)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .betamax65 .de)"

• "ET INFO HTTP GET Request XOR Key 96"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .laurenlaufman .com)"

• "ET INFO HTTP GET Request XOR Key 8d"

• "ET INFO Commonly Abused Domain in TLS SNI (one-click .cc)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns2 .dns-ga .de)"

• "ET INFO HTTP GET Request XOR Key 75"

• "ET INFO IRC Nick change on non-standard port"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (mydns .bielperes .me)"

• "ET INFO HTTP POST Request XOR Key e5"

• "ET INFO HTTP GET Request XOR Key c0"

• "ET INFO Git Service Hosted with Gittea"

• "ET INFO HTTP GET Request XOR Key 68"

• "ET INFO File Sharing Domain Observed in TLS SNI (krakenfiles .com)"

• "ET SCAN Behavioral Unusual Port 445 traffic Potential Scan or Infection"

• "ET INFO Observed DNS Over HTTPS Domain (dnstls .mobik .com in TLS SNI)"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (2read .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .jstockley .com)"

• "ET INFO HTTP POST Request XOR Key 1d"

• "ET INFO HTTP GET Request XOR Key f1"

• "ET INFO HTTP GET Request XOR Key 2e"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)"

• "ET POLICY SSL Certificate IRC GEEKS Likely Encrypted IRC or CnC"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetCorePrinterDrivers"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (awsdns .vpnrf .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-ca-tor .dnsflex .com)"

• "ET POLICY Outbound Multiple Non-SMTP Server Emails"

• "ET INFO URL Shortener Service Domain in DNS Lookup (me .sv)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (upper UDP Bypass) (Outbound) (CVE-2021-44228)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .stvsk .ml)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .arroudlohgpg .site)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ams .nl .agh-dns .net)"

• "ET INFO HTTP GET Request XOR Key 98"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ads .x88 .in)"

• "ET INFO HTTP POST Request XOR Key 4c"

• "ET INFO Observed DNS Over HTTPS Domain (xray .krnl .eu in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (zxcvb .pp .ua)"

• "ET INFO HTTP POST Request XOR Key 60"

• "ET INFO Observed DNS Over HTTPS Domain (sundalandia .pp .ua in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key f9"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .t53 .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (myhottiemama .de)"

• "ET INFO HTTP POST Request XOR Key 96"

• "ET FTP Outbound Java Anonymous FTP Login"

• "ET INFO localhost .run Domain in DNS Lookup DNS Lookup (.lhr .life)"

• "ET INFO File Sharing Related Domain in DNS Lookup (wetransfer .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole1 .hoerli .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (secure .anudeep .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (guoyingwei .top)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .apad .pro)"

• "ET INFO DYNAMIC_DNS Query to didns .ru Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (punono .duckdns .org)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (ns1 .dotls .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .sev .monster)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ggrbb .xyz)"

• "ET INFO EXE - OSX Disk Image Download"

• "ET INFO Observed DNS Over HTTPS Domain (dns .silen .org in TLS SNI)"

• "ET INFO Adguard DNS Over HTTPS Certificate Inbound"

• "ET USER_AGENTS Discord Bot User-Agent Observed (DiscordBot)"

• "ET INFO DYNAMIC_DNS Query to 3322.net Domain *.3322.net"

• "ET INFO Python SimpleHTTP ServerBanner"

• "ET ATTACK_RESPONSE Obfuscated JS - Possible URL Encoded JS Inbound"

• "ET POLICY PCHunter Download Observed"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .hostingim .com)"

• "ET INFO DNSlify DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguardh .ga)"

• "ET INFO PNG image exfiltration over raw TCP"

• "ET INFO URL Shortener Service Domain in DNS Lookup (vk .sv)"

• "ET INFO Baidu MiniDownloader System Fingerprint Exfiltration"

• "ET INFO File Sharing Domain Observed in TLS SNI (send .whateveritworks .org)"

• "ET INFO Tor2Web .onion Proxy Service SSL Cert (2)"

• "ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .daw .dev)"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (bloemlight .com)"

• "ET INFO HTTP POST Request XOR Key 0f"

• "ET INFO Possible Fake Edu Host On InfinityFree Service"

• "ET INFO HTTP POST Request XOR Key 6f"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ds .free .svipss .top)"

• "ET INFO DNSPod DNS Over HTTPS Certificate Inbound"

• "ET INFO Possible Malicious Document Request to Afraid.org Top 100 Dynamic DNS Domain"

• "ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .opnsource .com .au)"

• "ET INFO Observed DNS Over HTTPS Domain (mail .data .haus in TLS SNI)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_1_middle_out"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .telekom .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (140 .238 .202 .136 .sslip .io)"

• "ET INFO HTTP POST Request XOR Key 76"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .shimul .me)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .datacore .ch in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (v2 .xm706v .com)"

• "ET INFO URL Shortening Service Domain in DNS Lookup (s59 .site)"

• "ET INFO HTTP POST Request XOR Key 16"

• "ET INFO HTTP GET Request XOR Key b5"

• "ET INFO HTTP POST Request XOR Key 2f"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .webstor .net)"

• "ET INFO Aaflalo .me DNS Over HTTPS Certificate Inbound"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (attemplate .com)"

• "ET INFO HTTP GET Request XOR Key 9d"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .clawsucht .nrw)"

• "ET INFO Observed Telegram API Domain (api .telegram .org in TLS SNI)"

• "ET INFO JAVA - Zip/JAR File Downloaded Possibly Containing Serialized Data by By Vulnerable Client"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (n0 .eu)"

• "ET INFO File Sharing Related Domain in DNS Lookup (chibisafe .moe)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ipv6dns .com)"

• "ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)"

• "ET SCAN ICMP Delphi Likely Precursor to Scan"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .mzrme .cn)"

• "ET GAMES UnknownApps Game Cheat Service Checkin (auth .unknownp .one)"

• "ET INFO Out-of-Band Interaction Domain in DNS Lookup (requestbin .net)"

• "ET INFO URL Shortener Domain in DNS Lookup (lk .tc)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (ai .sv)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (echoe1yidzu4ioo5 .myfritz .net)"

• "ET INFO Generic - Mozilla 4.0 EXE Request"

• "ET INFO Suspicious EXE requested with Java UA"

• "ET INFO HTTP GET Request XOR Key 7d"

• "ET INFO Observed URL Shortener Service Domain (cutt .ly in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 8d"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .886886886 .xyz)"

• "ET INFO Observed DNS Query to (proxies .black) Web Proxy/Anonymizer Domain/Sub-Domain"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (saucelabs .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .dtness .com)"

• "ET INFO Webhook/HTTP Request Inspection Service Domain via HTTP (mockbin .org in TLS SNI)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol TCP (Outbound) (CVE-2021-44228)"

• "ET INFO Observed URL Shortening Service Domain (dwz .mk in TLS SNI)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (fl .sv)"

• "ET INFO Observed DNS over HTTPS Domain (dns .yingroad .top)"

• "ET INFO HTTP GET Request XOR Key 59"

• "ET INFO Observed DNS Over HTTPS Domain (pi1 .node15 .com in TLS SNI)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (mesharepoint .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (1 .dns .noridev .moe)"

• "ET INFO Query to FingerprintJS (GET)"

• "ET INFO HTTP GET Request XOR Key 4f"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharession .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (arashi .eu .org)"

• "ET INFO HTTP POST Request XOR Key 67"

• "ET INFO Redirect to Discord Attachment Download"

• "ET INFO AhaDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP Request to a *.zip Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .tardishost .ru)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dnscrypt .uk)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (lastentarvike .fi)"

• "ET INFO DYNAMIC_DNS Query to 3322.net Domain *.2288.org"

• "ET INFO URL Shortening Service Domain in DNS Lookup (t .ly)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (qlf-doh .inria .fr)"

• "ET INFO HTTP GET Request XOR Key 83"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .phdns1 .lonet .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (esel .stusta .mhn .de)"

• "ET INFO HTTP GET Request XOR Key 41"

• "ET INFO File Sharing Related Domain in TLS SNI (gofile .io)"

• "ET INFO Observed Dynamic DNS Service Domain in TLS SNI (duia .ro)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns2 .art-nas .pp .ua)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (typaza .com)"

• "ET INFO HTTP GET Request XOR Key 1f"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .bw .i81 .ru)"

• "ET INFO Custom Logo Domain in DNS Lookup (seeklogo .com)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (anonfiles .com in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key ac"

• "ET INFO Observed DNS over HTTPS Domain (dns .s3cure .us)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .reckoningslug .name in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (2 .alpo .pp .ua)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .thiagoalmeida .ca)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .nocnik .org)"

• "ET INFO Restena DNS Over HTTPS Certificate Inbound"

• "ET INFO PureDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO File Sharing Domain Observed in TLS SNI (p .fuwafuwa .moe)"

• "ET SCAN ICMP @hello request Likely Precursor to Scan"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-gb .dnsflex .com)"

• "ET INFO HTTP GET Request XOR Key 1a"

• "ET INFO HTTP GET Request XOR Key 64"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .debian .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (basic .rethinkdns .com)"

• "ET INFO HTTP POST Request XOR Key e7"

• "ET INFO HTTP POST Request XOR Key db"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (hoofoo .icu)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (resolver .r0cket .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .lspcr .space)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .imaicool .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .dessoi .cloud)"

• "ET INFO Observed DNS Over HTTPS Domain (query .hdns .io in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (o1 .lt)"

• "ET INFO Observed URL Shortening Service Domain (n9 .cl in TLS SNI)"

• "ET INFO Mailtrack .io Email Activity Tracking M1"

• "ET INFO DigitalSize DNS Over HTTPS Certificate Inbound"

• "ET INFO Download of Embedded OpenType (EOT) File flowbit set"

• "ET INFO Observed URL Shortening Service Domain in TLS SNI (urlbae .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .kss .ovh)"

• "ET INFO Observed Abused File Hosting Domain (transferxl-download .com in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 75"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officenced .com)"

• "ET EXPLOIT NTDump.exe Service Started port 445"

• "ET INFO HTTP POST Request XOR Key aa"

• "ET INFO HTTP POST Request XOR Key e1"

• "ET INFO HTTP POST Request XOR Key c9"

• "ET INFO Possible Malicious Document Request to ChangeIP Dynamic DNS Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .jupitrdns .net)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .s3cure .us in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (aattwwss .duckdns .org)"

• "ET INFO Ordns DNS Over HTTPS Certificate Inbound"

• "ET SCAN Behavioral Unusual Port 139 traffic Potential Scan or Infection"

• "ET INFO SAFIB Assistant Remote Administration Tool CnC Checkin"

• "ET INFO EXE File Download Request via Discord"

• "ET MALWARE Lookup of Malware Domain twothousands.cm Likely Infection"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (resolver .noaddns .com)"

• "ET INFO HTTP POST Request XOR Key d5"

• "ET INFO Suspicious Possible CollectGarbage in base64 2"

• "ET INFO Java Url Lib User Agent Web Crawl (Inbound)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (youlinkto .com)"

• "ET INFO Smocker Server Mock Tool Response"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default Cert Issuer Common Name"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (home .dlinkddns .com)"

• "ET POLICY Signed TLS Certificate with md5WithRSAEncryption"

• "ET INFO Observed URL Shortening Service Domain (shrtcnl .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .ddns .network)"

• "ET INFO HTTP POST Request XOR Key 9b"

• "ET INFO HTTP POST Request XOR Key 07"

• "ET INFO HTTP GET Request XOR Key 32"

• "ET INFO Observed URL Shortening Service Domain in DNS Lookup (dwz .mk)"

• "ET INFO File Sharing Related Domain in DNS Lookup (0x0 .st)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .circl .lu in TLS SNI)"

• "ET INFO MegaNerd DNS Over HTTPS Certificate Inbound"

• "ET INFO DNS Query to .onion proxy Domain (torforall.com)"

• "ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded"

• "ET INFO HTTP GET Request XOR Key 12"

• "ET INFO HTTP POST Request XOR Key 17"

• "ET INFO HTTP GET Request XOR Key c7"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (home .marcrnt .de)"

• "ET INFO PK/Compressed doc/JAR header"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cgmzdd .com)"

• "ET INFO Observed Cloudflare Tunneling Domain (argotunnel .com in TLS SNI)"

• "ET INFO File Sharing Service Domain in DNS Lookup (dropmefiles .com)"

• "ET INFO Observed URL Shortening Service Domain (vtaurl .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ttag .dns .nomu .pw)"

• "ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (admin .dotls .org)"

• "ET INFO HTTP GET Request XOR Key 3e"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharesbyte .com)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizegives .com)"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Response)"

• "ET INFO Infotek DNS Over HTTPS Certificate Inbound"

• "ET INFO [TW] Likely Javascript-Obfuscator Usage Observed M1"

• "ET INFO Simplenote Notes Taking App Domain (app .simplenote .com in TLS SNI)"

• "ET INFO File Sharing Domain (pan .tencent .com in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key ed"

• "ET INFO Observed DNS Over HTTPS Domain (nz01 .dns4me .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (muli .stusta .mhn .de)"

• "ET INFO FutaDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .nic .lv)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .deekshith .in)"

• "ET INFO HTTP POST Request XOR Key b2"

• "ET INFO HTTP GET Request XOR Key 0c"

• "ET INFO HTTP POST Request XOR Key f2"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (freedns .controld .com)"

• "ET INFO HTTP POST Request XOR Key d4"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .frankslabs .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .psociety .de)"

• "ET INFO DYNAMIC_DNS Query to *.duckdns. Domain"

• "ET INFO DYNAMIC_DNS Query to 3322.net Domain *.8866.org"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .mcasviper .de)"

• "ET INFO Switch DNS Over HTTPS Certificate Inbound"

• "ET EXPLOIT Serialized Groovy Java Object Generated by ysoserial"

• "ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (gztech .me)"

• "ET INFO Redirect via HTTP 300 to URI Shortening Service (rb .gy)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (zero .dns0 .eu)"

• "ET INFO Observed OneNote Template Domain in TLS SNI (onenotegem .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dot .anir0y .in)"

• "ET INFO HTTP POST Request XOR Key 61"

• "ET INFO URL Shortener Service Domain in DNS Lookup (go .sv)"

• "ET INFO HTTP POST Request XOR Key 77"

• "ET INFO HTTP GET Request XOR Key 9a"

• "ET EXPLOIT NTDump Session Established Reg-Entry port 445"

• "ET SCADA [nsacyber/ELITEWOLF] Siemens S7-1200 Default Cert Issuer Common Name"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .unerror .network)"

• "ET INFO Instagram Story Viewer Domain in DNS Lookup (smihub .com)"

• "ET INFO HTTP POST Request XOR Key 88"

• "ET INFO JAVA - ClassID"

• "ET INFO HTTP POST Request XOR Key 28"

• "ET INFO Suspicious HTTP POST Only Containing Pass - Possible Phishing"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.org"

• "ET INFO Observed DNS Over HTTPS Domain (adg .tshost .no in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 8f"

• "ET INFO External IP Lookup Domain DNS Lookup (ip .dnsexit .com)"

• "ET SCADA [nsacyber/ELITEWOLF] Siemens S7-1200 Default X509 Certificate String"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (lion .dns .qwer .pw)"

• "ET INFO HTTP GET Request XOR Key fd"

• "ET WEB_SERVER OptionsBleed (CVE-2017-9798)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .hahnjo .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (block .abstergo .it)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (nebula .sly .io)"

• "ET INFO CZ.NIC DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP POST Request XOR Key 26"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (tk31z .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .adblocker .eu .org)"

• "ET INFO HTTP POST Request XOR Key 32"

• "ET INFO HTTP POST Request XOR Key 18"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (blackhole .gugainfo .com .br)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .privacy .cm)"

• "ET INFO Observed DNS Over HTTPS Domain (resolver .unstoppable .io in TLS SNI)"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (.curlhub .io)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (link .sv)"

• "ET INFO Artikel10 DNS Over HTTPS Certificate Inbound"

• "ET INFO URL Shortener Service Domain in DNS Lookup (do .sv)"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncUploadPrinterDriverPackage"

• "ET INFO Observed Image Hosting Domain (resimupload .org in TLS SNI)"

• "ET INFO Observed URL Shortener Service Domain Domain (zii .to in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jp .tiarap .org)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (doctricant .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (t2c .240130034 .xyz)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizewings .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (1 .0rz .space)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .randomaizer .lentel .ru)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .extrawdw .net)"

• "ET INFO Metasploit Framework Checking For Update"

• "ET INFO Observed Free Hosting Domain (mypressonline .com) in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (x-o-x .duckdns .org)"

• "ET INFO RDP - Response To External Host"

• "ET INFO HTTP POST Request XOR Key fa"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (kr .pigs .eu .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adg .rokh .biz)"

• "ET INFO File Sharing Domain Observed in TLS SNI (filecave .lol)"

• "ET INFO HTTP GET Request XOR Key e5"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default X509 Certificate String"

• "ET WEB_CLIENT SUSPICIOUS Microsoft-Edge protocol in use (Observed in Magnitude EK)"

• "ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M6"

• "ET INFO HTTP POST Form Submitted to 123formbuilder Free Hosting"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - SEL-751A FTP Banner Observed"

• "ET CURRENT_EVENTS Abused Domain Delivering Malicious Payloads in DNS Lookup (one-click .cc)"

• "ET INFO HTTP POST Request XOR Key 50"

• "ET INFO RustDesk Register Peer where serial=0"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .clanless .ovh)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .marcbond .uk)"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.9966.org"

• "ET INFO Gophish X-Server"

• "ET INFO HTTP POST Request XOR Key f0"

• "ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officentry .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (snoke .meganerd .nl)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (vietdns .vn)"

• "ET INFO Observed Instagram Story Viewer Domain (smihub .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (tiger .dns .qwer .pw)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .cwlys .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (r1bnc .com)"

• "ET POLICY Outbound HTTP Connection From Cisco IOS Device"

• "ET INFO HTTP POST Request XOR Key 2a"

• "ET INFO HTTP GET Request XOR Key 43"

• "ET INFO URL Shortening Service Domain in DNS Lookup (kutti .co)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .startupstack .tech in TLS SNI)"

• "ET INFO File Sharing Domain Observed in TLS SNI (send-anywhere .com)"

• "ET INFO DNS Query for Webhook/HTTP Request Inspection Service (requestinspector .com)"

• "ET INFO File Sharing Related Domain in DNS Lookup (peergos .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (unixfox .duckdns .org)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharepointle .com)"

• "ET INFO Observed DNS over HTTPS Domain (dot .occ .top) in TLS SNI"

• "ET INFO Proxy Domain in DNS Lookup (proxynet .io)"

• "ET INFO HTTP GET Request XOR Key 27"

• "ET INFO Observed Online Collab Tool Domain (figma .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole4 .hoerli .net)"

• "ET INFO HTTP POST contains pasa form"

• "ET INFO HTTP GET Request XOR Key dc"

• "ET INFO File Sharing Domain Observed in TLS SNI (chibisafe .moe)"

• "ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"

• "ET INFO HTTP POST Request XOR Key 55"

• "ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .n3120 .wang)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (kcolspacrm .ir)"

• "ET INFO HTTP POST Request XOR Key d7"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (kb4 .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .phdns4 .lonet .org)"

• "ET INFO WeDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key 87"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ikataruto .com)"

• "ET INFO Filesharing Domain in DNS Lookip (lifeboxtransfer .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dupatruwi22 .fun)"

• "ET INFO HTTP POST Request XOR Key a0"

• "ET INFO Interactsh Domain (.oast .pro in TLS SNI)"

• "GPL ICMP_INFO PING BayRS Router"

• "ET INFO HTTP POST Request XOR Key bd"

• "GPL ICMP_INFO PING Network Toolbox 3 Windows"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .korks .tk)"

• "ET INFO Observed DNS Over HTTPS Domain (resolver3 .absolight .net in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 5c"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (templateau .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (keymiagar .ir)"

• "ET INFO Njalla DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .frece .de)"

• "ET INFO File Sharing Related Domain in DNS Lookup (send .zcyph .cc)"

• "ET INFO Namecheap URL Forward"

• "ET INFO URL Shortening Service Domain in DNS Lookup (www .temporary-url .com)"

• "ET INFO Potential Malicious PDF (EmbeddedFiles) improper case"

• "ET INFO HTTP POST Request XOR Key 24"

• "ET INFO Malware Destroyer Checkin"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (hardbin .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .meddy94 .de)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (lower UDP Bypass) (CVE-2021-44228)"

• "ET INFO URL Shortening Service Domain in DNS Lookup (n9 .cl)"

• "ET INFO HTTP POST Request XOR Key 08"

• "ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup"

• "ET INFO URL Shortener Service Domain in DNS Lookup (4 .fo)"

• "ET INFO Cloned Page Hosted on Microsoft Hosting"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (home .norvrandt .co .uk)"

• "ET INFO ZIP File Download Request via Discord"

• "ET INFO HTTP GET Request XOR Key 0d"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .mjanson .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns3 .com)"

• "ET INFO DNSlow DNS Over HTTPS Certificate Inbound"

• "ET INFO Wordpress Error, Cannot modify header information - headers already sent by"

• "ET INFO Cisco IOS XE Web Server Auth From Suspicious Username (cisco_support) (CVE-2023-20198) (Outbound)"

• "ET INFO Observed IPFS Gateway Domain (gateway .pinata .cloud) in TLS SNI"

• "ET INFO Online Collab Tool Domain in DNS Lookup (figma .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .wns .watch)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .nhtsky .com in TLS SNI)"

• "ET INFO Possible Malicious Document Request to Hostinger Domains"

• "ET INFO URL Shortener Service Domain in DNS Lookup (snip .ly)"

• "ET INFO HTTP GET Request XOR Key b7"

• "ET INFO Observed DNS Over HTTPS Domain (dns .mni .li in TLS SNI)"

• "ET INFO File Sharing Related Domain in DNS Lookup (p .fuwafuwa .moe)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns-family .esegece .com)"

• "ET INFO HTTP GET Request XOR Key dd"

• "ET INFO HTTP POST Request XOR Key 1a"

• "ET INFO Interactsh Domain (.oast .fun in TLS SNI)"

• "ET INFO Possible WinHttpRequest (no .exe)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sg01 .dns4me .net)"

• "ET INFO CIRA Canadian Shield DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .flwagners .com)"

• "ET INFO Interactsh Domain (.oast .online in TLS SNI)"

• "ET USER_AGENTS Microsoft Edge on Windows 10 SET"

• "ET INFO Possible Successful Credential Phish - Form submitted to submit-form Form Hosting"

• "ET INFO Possible EXE Download From Suspicious TLD (.yokohama) - set"

• "ET INFO Killbot JS Configuration - Possible Phishing"

• "ET INFO External IP Address Lookup - myip.ch"

• "ET TROJAN Generic DNS Query for Suspicious CryptoWall (crpt) Domains"

• "ET INFO Observed File Sharing Domain (dracoon .team in TLS SNI)"

• "ET INFO Interactsh Domain (.oast .me in TLS SNI)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizewel .com)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol UDP (CVE-2021-44228)"

• "ET POLICY EXE Base64 Encoded potential malware"

• "ET INFO HTTP GET Request XOR Key 49"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriverDirectory"

• "ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (project-evoex .de)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .rin .sh in TLS SNI)"

• "ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M2"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (lower TCP Bypass) (Outbound) (CVE-2021-44228)"

• "ET INFO Packetriot Tunneling Domain in DNS Lookup (mediastreamer .app)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jabber-server .de)"

• "ET INFO Observed DNS over HTTPS Domain (doh .qis .io)"

• "ET INFO HTTP POST Request XOR Key 3f"

• "ET INFO AutoIt User Agent Executable Request"

• "ET INFO HTTP POST Request XOR Key 4f"

• "ET INFO File Sharing Related Domain in DNS Lookup (send-anywhere .com)"

• "ET INFO HTTP GET Request XOR Key 04"

• "ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)"

• "ET POLICY Known External IP Lookup Service Domain in SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns2 .afastserver .com)"

• "ET INFO JAVA - document.createElement applet"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (thecremeens .com)"

• "ET INFO Suspicious HTTP Server Value in Response (Apache.)"

• "ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .maolaohei .xyz)"

• "ET POLICY Suspicious Windows Executable CreateRemoteThread"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.7766.org"

• "ET INFO Blokada DNS Over HTTPS Certificate Inbound"

• "ET INFO Minimal HTTP GET Request to rebrand .ly"

• "ET INFO Packetriot Tunneling Domain in DNS Lookup (pktriot .net)"

• "ET INFO Webhook/HTTP Request Inspection/Tunneling Service Domain (.free .beeceptor .com in TLS SNI)"

• "ET INFO File Sharing Domain Observed in TLS SNI (nitrofile .cc)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .kenzohost .de)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (soay38us0r7goa7 .cmsdp .my .id)"

• "ET INFO HTTP POST Request XOR Key ba"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (magnetonics .com)"

• "ET INFO Observed URL Shortening Service Domain (t .ly in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (au01 .dns4me .net)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .zln .wtf in TLS SNI)"

• "ET SCAN LeakIX Inbound User-Agent"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .1 .bsh4 .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (timmes .nl)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (keithchung .hopto .org)"

• "ET INFO HTTP POST Request XOR Key 33"

• "ET INFO HTTP GET Request XOR Key a1"

• "ET INFO Keweon Center DNS Over HTTPS Certificate Inbound"

• "ET INFO Commonly Abused File Sharing Domain (wasabisys .com) in DNS Lookup"

• "ET INFO [TW] Internet Computer HTTP Location Redirect Observed"

• "ET INFO DNS Over HTTPS Certificate Inbound (dns .hanahira .dev)"

• "ET POLICY External Unencrypted Connection to BASE Console"

• "ET INFO DYNAMIC_DNS HTTP Request to a no-ip Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (abel .waringer-atg .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (masters-of-cloud .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .benpro .fr)"

• "ET INFO Cisco IOS XE Web Server Config Change in SOAP (CVE-2023-20198) (Inbound)"

• "ET INFO Observed SSL Cert (logodownload .org)"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriver"

• "ET INFO File Sharing Related Domain in DNS Lookup (qiwi .gg)"

• "ET INFO Observed URL Shortening Service Domain (dik .si in TLS SNI)"

• "ET INFO Serialized Java Object Calling Common Collection Function"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .kngnet .de)"

• "ET INFO File Sharing Related Domain in DNS Lookup (put .re)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh003 .280blocker .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns .00dani .me)"

• "ET INFO Observed URL Shortening Service SSL/TLS Cert (rb.gy)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (is .gd)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ora .yingroad .top)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns2 .1899 .com .mx)"

• "ET WEB_CLIENT Observed Hunter Obfuscator Code M2"

• "ET INFO Observed DNS Over HTTPS Domain (doh .luigi .nexific .it in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (family .dot .dns .yandex .net in TLS SNI)"

• "ET INFO RustDesk Check NAT Type"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .clroot .io)"

• "ET INFO Observed URL Shortening Service Domain (webz .cc in TLS SNI)"

• "ET INFO Possible MSXMLHTTP Request (msp) unset (no exe)"

• "ET INFO HTTP GET Request XOR Key f8"

• "ET INFO HTTP GET Request XOR Key e3"

• "ET SCAN ICMP PING IPTools"

• "ET INFO infinityfree .net Domain in DNS Lookup"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default X509 Certificate String"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (resolver1 .absolight .net)"

• "ET INFO URL Shortening/Redirect Service Domain (clik .rip in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns .rotunneling .net)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-2488 Default Cert Subject Common Name"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .lujiacai .top)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .acrobyte .org)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_forward"

• "ET INFO HTTP POST Request XOR Key 1f"

• "ET INFO Observed DNS Query to Pastebin-style Service (pasteio .com)"

• "ET SCAN Rapid POP3S Connections - Possible Brute Force Attack"

• "ET INFO HTTP GET Request XOR Key 2c"

• "ET INFO Observed IPFS Gateway Domain (ipfs .dweb .link) in TLS SNI"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointen .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .bobstrecansky .com)"

• "ET INFO HTTP GET Request XOR Key a4"

• "ET INFO URL Shortening/Redirect Service Domain in DNS Lookup (clik .rip)"

• "ET INFO HTTP POST Request XOR Key 72"

• "ET POLICY HTMLGET User Agent Detected - Often Linux utility based"

• "GPL ICMP_INFO PING Ping-O-MeterWindows"

• "ET INFO HTTP GET Request XOR Key 51"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (home .bruckmoser .it)"

• "ET INFO HTTP POST Request XOR Key a6"

• "ET INFO DYNAMIC_DNS Query to 3322.net Domain *.8800.org"

• "ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP POST Request XOR Key 42"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .richardapplegate .io)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns .5ososea .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .familiamichels .com .br)"

• "ET INFO HTTP POST Request XOR Key 41"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (upper UDP Bypass) (CVE-2021-44228)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - ERR.TXT File Download Attempt"

• "ET INFO File Sharing Related Domain in DNS Lookup (bunkrr .su)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (secure .onedns .cc)"

• "ET POLICY Majestic12 User-Agent Request Outbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sink .nolo .ltd)"

• "ET TROJAN PacketShare Proxy Connection Heartbeat (POST)"

• "ET INFO HTTP POST Request XOR Key d0"

• "ET INFO HTTP POST Request XOR Key 92"

• "ET INFO Online Code Editor Domain in DNS Lookup (trinket .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .tiarap .org)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_top_half"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .ondrejsramek .cz)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .neubsi .at)"

• "ET INFO HTTP POST Request XOR Key d6"

• "ET INFO HTTP GET Request XOR Key 22"

• "ET INFO Observed DNS Over HTTPS Domain (1a .ns .ozer .im in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .aaronplayzgaming .com)"

• "ET INFO HTTP GET Request XOR Key ed"

• "ET INFO Possible EXE Download From Suspicious TLD"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (orau .lz0724 .com)"

• "ET INFO HTTP POST Request XOR Key 7a"

• "ET INFO Tor2Web .onion Proxy Service SSL Cert (1)"

• "ET INFO HTTP POST Request XOR Key b5"

• "ET MALWARE Observed DNS Query to Malvertising Related Domain"

• "ET INFO HTTP POST Request XOR Key 3b"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ofdoom .net)"

• "ET INFO HTTP POST Request XOR Key 85"

• "ET INFO Anyplace Remote Access Checkin (051)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (opennameserver .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .lv)"

• "ET INFO HTTP POST Request XOR Key 27"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns-public .ibakerserver .pt)"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (cf-ipfs .com)"

• "ET INFO HTTP POST Request XOR Key bf"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (templateau .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (felipefalcao .me)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns0 .eu)"

• "ET INFO RustDesk Register Peer where serial=1"

• "ET INFO HTTP POST Request XOR Key 74"

• "ET INFO HTTP POST Request XOR Key 01"

• "ET WEB_CLIENT Download of Multimedia Content flowbit set"

• "ET INFO HTTP GET Request XOR Key 7a"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3530-RTAC AcSELerator Firmware Activity"

• "ET INFO HTTP GET Request XOR Key 57"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (agh .xinfeng16m .top)"

• "ET INFO HTTP POST contains pasa= in cleartext"

• "ET INFO Observed DNS Over HTTPS Domain (dns .shecan .ir in TLS SNI)"

• "ET INFO File Sharing Domain Observed in TLS SNI (sendgb .com)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3620 Default X509 Certificate String"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .2t9 .de)"

• "ET INFO Usable Privacy DNS Over HTTPS Certificate Inbound"

• "ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (secforads3 .ch)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (darkness .is .my .waifu .cz)"

• "ET SCADA [nsacyber/ELITEWOLF] Siemens S7-1200 Default Cert Subject Common Name"

• "ET INFO File Sharing Related Domain in DNS Lookup (hostr .co)"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (ipfs .2read .net)"

• "ET INFO Possible EXE Download From Suspicious TLD (.icu) - set"

• "ET INFO TDS Domain in DNS Lookup (cloakerly .com)"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (msftemail .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (link .altapo .ru)"

• "ET INFO HTTP POST Request XOR Key 47"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (emozee .cf)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adb-home .xaoimoon .fr)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .druta .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .b33 .space)"

• "ET INFO File Sharing Domain in DNS Lookup (drive .internxt .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (home .quentin-stoeckel .fr)"

• "ET INFO HTTP POST Request XOR Key 83"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (doh .ubd .ac .id)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cluster-0 .gac .edu)"

• "ET INFO Observed DNS Query to .nexus TLD"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .isteal .info)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .freequensi .com)"

• "ET INFO External IP Lookup Domain in DNS Lookup (geolocation-db .com)"

• "ET INFO Monero Mining Pool DNS Lookup"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (cf-ipfs .com)"

• "ET INFO DNS request for Monero mining pool"

• "ET INFO TheRifleMan DNS Over HTTPS Certificate Inbound"

• "ET INFO DNS Query to .onion proxy Domain (onion .casa in DNS Lookup)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole .aws .ketan .dev)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (everovpn .co)"

• "ET INFO External IP Lookup HTTP Request (ip .dnsexit .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .privilab .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (gustamadh .dynv6 .net)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (fex .net in DNS Lookup)"

• "ET INFO HTTP POST Request XOR Key fc"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vpn .gosami .xyz)"

• "ET INFO HTTP POST Request XOR Key 5b"

• "ET INFO HTTP GET Request XOR Key b6"

• "ET INFO WinHttpRequest Downloading EXE"

• "ET INFO Fleetdeck Remote Management Software Domain in DNS Lookup (fleetdeck .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (gunag .duckdns .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (axaxa .fun)"

• "ET POLICY PTsecurity Remote Desktop AeroAdmin Server Hello"

• "ET INFO HTTP POST Request XOR Key 8b"

• "ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)"

• "ET INFO HTTP POST Request XOR Key a1"

• "ET INFO Observed Tox Chat Domain (tox .chat in TLS SNI)"

• "ET INFO .onion proxy Domain (onion .plus in DNS Lookup)"

• "ET INFO File Sharing Domain Observed in TLS SNI (www .sharedrop .io)"

• "ET INFO DNS Query to .onion proxy Domain (onion.city)"

• "ET INFO Observed Discord Domain (discord .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sgpcloud .duckdns .org)"

• "ET INFO DNS Query to Cloudflare Tunneling Domain (argotunnel .com)"

• "ET INFO HTTP GET Request XOR Key c8"

• "ET INFO URL Shortener Service Domain in DNS Lookup (ya .sv)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .aavesh .tech)"

• "ET WEB_CLIENT Download of PDF With Uncompressed Flash Content flowbit set"

• "ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI"

• "ET INFO HTTP GET Request XOR Key e6"

• "ET INFO URL Shortener (s .yam .com) in TLS SNI"

• "ET INFO HTTP POST Request XOR Key 44"

• "ET INFO Chinese CDN Domain in DNS Lookup (ctcontents .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .2poi .com)"

• "ET POLICY Telnet to HP JetDirect Printer With No Password Set"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .cryptomize .com)"

• "ET INFO IQDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doth .huque .com)"

• "ET INFO File Sharing Domain Observed in TLS SNI (anonymfile .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (xthwo .duckdns .org)"

• "ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (fr-dns1 .bancuh .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .zxi7 .cn)"

• "ET INFO SAFIB Assistant Remote Administration Tool Keepalive"

• "ET INFO Netlink GPON Login Attempt (GET)"

• "ET INFO Qihoo 360 DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .youroute .ru)"

• "ET INFO HTTP POST Request XOR Key 9c"

• "ET INFO Webhook/HTTP Request Inspection Service Domain (x .pipedream .net in TLS SNI)"

• "ET INFO Observed Free Hosting Domain (infinityfreeapp .com) in DNS Lookup"

• "ET INFO HTTP POST Request XOR Key bb"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (8888 .google)"

• "ET INFO HTTP POST Request XOR Key c6"

• "ET INFO HTTP POST Request XOR Key 22"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-01 .spectrum .com)"

• "ET INFO DNS Query to Domain used for Phishing (codeanyapp .com)"

• "ET INFO Observed URL Shortening Service Domain (come .to in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key be"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns .gnb09 .id)"

• "ET INFO HTTP POST Request XOR Key 95"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (korzhov .dev)"

• "ET EXPLOIT Serialized Java Object Calling Common Collection Function"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (doh .sb)"

• "ET INFO Suspicious HTTP POST to 404.php"

• "ET INFO Suspicious Base64 Encoded ZIP File in HTML Body (Magic Bytes)"

• "ET INFO HTTP GET Request XOR Key 39"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (gusald .com)"

• "ET INFO File Sharing Domain Observed in TLS SNI (0x0 .st)"

• "ET INFO Possible EXE Download From Suspicious TLD (.win) - set"

• "ET POLICY PTsecurity Remote Desktop AeroAdmin handshake"

• "ET INFO [TW] Page Contains Redirect to Likely Urlpages Web Hosting Technique"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (tuic .salome .my .id)"

• "ET INFO HTTP GET Request XOR Key e7"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .yunmoc .top)"

• "ET INFO File Sharing Domain Observed in TLS SNI (cyberfile .me)"

• "ET INFO HTTP GET Request XOR Key 1c"

• "GPL ICMP_INFO PING IP NetMonitor Macintosh"

• "ET POLICY Suspicious Windows Executable WriteProcessMemory"

• "ET INFO Observed URI Shortening Service Domain (sprl .in in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .aquilenet .fr in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key de"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (instantrevert .net)"

• "ET INFO HTTP POST Request XOR Key 0e"

• "ET INFO Possible EXE Download From Suspicious TLD (.science) - set"

• "ET POLICY [TW] IPFS File Request Observed"

• "ET INFO Observed DNS Over HTTPS Domain (doh .killtw .im in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 9f"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vm .mytm .cc)"

• "ET INFO HTTP GET Request XOR Key ae"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (www .91557 .cn)"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (2read .net)"

• "ET INFO HTTP GET Request XOR Key 6d"

• "ET INFO HTTP GET Request XOR Key 90"

• "ET INFO HTTP GET Request XOR Key 7b"

• "ET INFO ffmuc DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS Over HTTPS Domain (vn .dns .abpvn .com in TLS SNI)"

• "ET INFO Platform-As-A-Service Domain in DNS Lookup (cleverapps .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole3 .hoerli .net)"

• "ET INFO HTTP POST Request XOR Key eb"

• "ET INFO Suspicious Cisco Privilege Level 15 in HTTP Header (Inbound)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vpn .vokuev .org)"

• "ET INFO HTTP POST Request XOR Key 65"

• "ET INFO HTTP GET Request XOR Key 18"

• "ET INFO Base64 Encoded RAR Compressed File in HTML Body (Mime Type)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (tiny .one)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .sitdns .com)"

• "ET INFO Successful PROPFIND Response for Application Media Type"

• "ET INFO Free Hosting Domain (*.freehostia .com in DNS Lookup)"

• "ET INFO Supabase Development Platform Related Domain in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (notecore .me)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (secure .avastdns .com)"

• "ET INFO ProvideSupport.com Related Domain in DNS Lookup (papepritz .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .wakgood .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .brightesttv .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (levislondon-proxy .nerdpol .ovh)"

• "ET INFO EXE - OSX Executable Download - Intel Arch"

• "ET INFO File Sharing Related Domain in DNS Lookup (krakenfiles .com)"

• "ET INFO SSH-2.0-Go version string Observed in Network Traffic"

• "ET INFO HTTP GET Request XOR Key 0b"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (clientdns3 .softcom .net)"

• "ET INFO HTTP POST Request XOR Key f6"

• "ET INFO HTTP GET Request XOR Key 33"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .msxnet .ru)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .freyja .pw)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole4 .hoerli .net)"

• "ET INFO Public Array DNS Over HTTPS Certificate Inbound"

• "ET INFO Bebasid DNS Over HTTPS Certificate Inbound"

• "ET CURRENT_EVENTS GET Request to Googleapis Hosting (set)"

• "ET INFO HTTP GET Request XOR Key 95"

• "ET POLICY Norton Update User-Agent (Install Stub)"

• "ET INFO Observed DNS Over HTTPS Domain (antivirus .bebasid .com in TLS SNI)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (lower TCP Bypass) (CVE-2021-44228)"

• "ET INFO Java Downloading Class flowbit no alert"

• "ET INFO HTTP GET Request XOR Key 80"

• "ET INFO URL Shortener Service Domain in DNS Lookup (bd .sv)"

• "ET INFO User-Agent (python-requests) Inbound to Webserver"

• "ET INFO Plan9-dns DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .nullrecon .com)"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (compromisedblog .com)"

• "ET INFO HTTP GET Request XOR Key 3c"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dr-adguard .de)"

• "ET INFO Commonly Abused Github-like Site (codeberg .org in DNS Lookup)"

• "ET POLICY Edwards Packed proxy.pac from 724sky"

• "ET INFO HTTP GET Request XOR Key 84"

• "ET INFO URL Shortener Service Domain in DNS Lookup (ffm .to)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .norvig .dk)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .harrache .info)"

• "ET INFO HTTP GET Request XOR Key 5f"

• "ET INFO URL Shortener Service Domain in DNS Lookup (fb .sv)"

• "ET INFO HTTP GET Request XOR Key 8c"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (thanos .pleumkungz .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (res-acst3 .absolight .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (jackyes .ovh)"

• "ET INFO HTTP GET Request XOR Key 72"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (maddino .dedyn .io)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (shareholds .com)"

• "ET POLICY Petite Packed Binary Download"

• "ET INFO File Sharing Related Domain in DNS Lookup (www .sharedrop .io)"

• "ET EXPLOIT NTDump.exe Service Started port 139"

• "ET INFO Observed DNS Query to *.ngrok Domain (ngrok .app)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (2 .0rz .space)"

• "ET INFO Redirect to Joom AG Hosted Document - Potential Phishing"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .ambiya .net)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (kisa .link)"

• "ET USER_AGENTS Observed Suspicious User-Agent (inflammable)"

• "ET INFO HTTP POST Request XOR Key 86"

• "ET INFO File Sharing Domain Observed in TLS SNI (bunkrr .su)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (wa .sv)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .lululu .eu .org)"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (malwarebouncer .com)"

• "ET INFO Interactsh Domain in DNS Lookup (.oast .online)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (premiumtier-network .instadart .net)"

• "ET INFO Abused File Sharing Site Domain Observed (qaz .su) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (dns .spil .co .id)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .moog .sh)"

• "ET INFO Peer to Peer File Sharing Service Domain in TLS SNI (ipfs .2read .net)"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncCorePrinterDriverInstalled"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .altairzone .it)"

• "ET SCAN Rapid IMAP Connections - Possible Brute Force Attack"

• "ET INFO HTTP GET Request XOR Key af"

• "ET INFO Cisco Umbrella (OpenDNS) DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .hinytz .com)"

• "ET INFO SyncroMSP Remote Remote Management Software Install Registration"

• "ET USER_AGENTS Microsoft Office Existence Discovery User-Agent"

• "ET INFO Possible EXE Download From Suspicious TLD (.gq) - set"

• "ET INFO HTTP POST Request XOR Key 43"

• "ET INFO HTTP Request for External IP Check (ip-addr .es)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .fresh-waffles .online)"

• "ET INFO MSSQL sp_addextendedproc Command Observed"

• "ET INFO Suspicious HTTP Header in Response (Expired:)"

• "ET TROJAN PacketShare Proxy Client Login (GET)"

• "ET INFO Observed Domain used for Phishing in TLS SNI (codeanyapp .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh2 .gslb2 .xfinity .com)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_reverse"

• "ET TROJAN Known Sinkhole Response Kryptos Logic"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .ef67daisuki .club)"

• "GPL ICMP_INFO PING BSDtype"

• "ET INFO HTTP POST Request XOR Key f3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns01 .flm9 .net)"

• "ET INFO Possible EXE Download From Suspicious TLD (.top) - set"

• "ET INFO Possible EXE Download From Suspicious TLD (.link) - set"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (bvo .giize .com)"

• "ET INFO HTTP POST Request XOR Key ea"

• "ET USER_AGENTS SideStep User-Agent"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (brb .pp .ua)"

• "ET INFO Observed URL Shortening Service Domain (kutti .co in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a .dyndns. domain"

• "ET INFO Observed DNS Over HTTPS Domain (ns1 .qquack .org in TLS SNI)"

• "ET INFO Keweon Center DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP POST Request XOR Key 6e"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Access Change"

• "ET INFO Splashtop Domain in DNS Lookup (splashtop .com)"

• "ET WEB_CLIENT Download of PDF With Compressed Flash Content"

• "ET INFO HTTP POST Request XOR Key 99"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .mikeliu .org)"

• "ET INFO Observed DNS Query to *.ngrok Domain (ngrok .dev)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .spyrisk .fr)"

• "ET INFO Suspicious HTTP POST to Free Web Host Atwebpages"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .alvosec .com)"

• "ET INFO Lars Lehmn DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .techeasy .org)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .e2ee .li)"

• "ET INFO HTTP POST Request XOR Key 82"

• "ET INFO NextDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key e8"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .ilker .se)"

• "ET POLICY SSL/TLS Certificate Observed (Upaste)"

• "ET WEB_CLIENT WebDAV PUT Request for .url Flowbit Set"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .n23 .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (vpservice .cf)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .audet .cloud)"

• "ET WEB_CLIENT Microsoft Office RTF Stack Buffer Overflow"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (kennethhuang .com)"

• "ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (phishwall .net)"

• "ET INFO HTTP POST Request XOR Key 10"

• "ET INFO HTTP GET Request XOR Key 05"

• "ET INFO URL Shortener Service Domain DNS Lookup (zii .to)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .gcp .pathofgrace .com in TLS SNI)"

• "ET INFO Interactsh Domain in DNS Lookup (.oast .site)"

• "ET INFO Level.io Agent P2P Connection Domain in DNS Lookup (global .turn .twilio .com)"

• "ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M1"

• "ET INFO Observed File Sharing Service Domain (www .uplooder .net) in TLS SNI"

• "ET INFO Alekberg DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key f5"

• "ET INFO Packed Executable Download"

• "ET CURRENT_EVENTS Successful OneDrive Credential Phish 2023-04-18"

• "ET INFO Observed DNS Over HTTPS Domain (free .shecan .ir in TLS SNI)"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (fex .net in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key a6"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (pihole2 .hoerli .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cloud .198 .games)"

• "ET INFO File Sharing Domain Observed in TLS SNI (hostr .co)"

• "ET INFO Observed DNS over HTTPS Domain (ag .brianlee .fun)"

• "ET WEB_CLIENT Observed Hunter Obfuscator Code M1"

• "ET INFO Observed DNS Over HTTPS Domain (spacedns .org in TLS SNI)"

• "ET INFO HTTP Request to logo .clearbit .com"

• "ET INFO Observed DNS over HTTPS Domain (doh .aaaab3n .moe) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .carson-family .com)"

• "ET INFO HTTP GET Request XOR Key 40"

• "ET INFO Observed HTTP Request to *.pythonanywhere .com Domain"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (securedns .vendorvista .xyz)"

• "ET INFO Possible EXE Download From Suspicious TLD (.click) - set"

• "ET CURRENT_EVENTS Possible Webmail Phishing Landing Utilizing Clearbit"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .faze .dev)"

• "ET INFO Abused File Hosting Domain in DNS Lookup (transferxl .com)"

• "ET INFO HTTP POST Request XOR Key 39"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup)"

• "ET INFO Observed DNS over HTTPS Domain (asia-east2-pfrmxgnk .cloudfunctions .net) in TLS SNI"

• "ET INFO Ryan Palmer DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key cd"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriver"

• "ET POLICY Mattermost API Usage"

• "ET INFO ChatGPT-User Traffic Detected Inbound M2"

• "ET INFO HTTP GET Request XOR Key 6c"

• "ET INFO DNS Over HTTPS Certificate Inbound (dns .adguard-dns .com)"

• "ET INFO Image Hosting Domain in DNS Lookup (resimag .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .syshero .org)"

• "ET INFO HTTP GET Request XOR Key 62"

• "ET INFO EXE - OSX Executable Download - Multi Arch w/PowerPC"

• "ET INFO HTTP POST Request XOR Key 3c"

• "ET INFO HTTP GET Request XOR Key 23"

• "ET INFO HTTP GET Request XOR Key 11"

• "ET INFO DYNAMIC_DNS Query to 3322.net Domain *.6600.org"

• "ET INFO URL Shortener Service Domain in DNS Lookup (in .sv)"

• "ET INFO HTTP POST Request XOR Key d3"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .mrmartian .co)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (myadguardhome .com)"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officences .com)"

• "ET INFO URL Shortening Service Domain in DNS Lookup (shrtcnl .com)"

• "ET INFO HTTP GET Request XOR Key 08"

• "ET INFO HTTP POST Request XOR Key 98"

• "ET INFO Observed URL Shortening Service Domain (s .id in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .tls-data .de)"

• "ET INFO HTTP GET Request XOR Key b3"

• "ET INFO HTTP GET Request XOR Key 55"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .bluestarnc .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cirruscloud .it)"

• "ET INFO HTTP GET Request XOR Key bf"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .feiyuyu .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (toaster .lol)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .novali .date)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .decloudus .com in TLS SNI)"

• "ET INFO HTTP POST Request XOR Key 40"

• "ET INFO Malware Destroyer FTP Login"

• "ET INFO HTTP URI contains pasa="

• "ET INFO SSH-2.0-Go version string Observed in Network Traffic"

• "ET INFO HTTP GET Request XOR Key 67"

• "ET INFO URL Shortening Service DNS Lookup (meet .id)"

• "ET INFO HTTP GET Request XOR Key ff"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns-east .tylerwahl .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .me7878 .com)"

• "ET INFO HTTP GET Request XOR Key 54"

• "ET INFO HTTP POST Request XOR Key b9"

• "ET INFO External IP Address Lookup Service in TLS SNI (invertexto .com)"

• "ET INFO Observed SSL Cert (hizliresim .com)"

• "GPL POLICY PCAnywhere server response"

• "ET INFO HTTP GET Request XOR Key df"

• "ET INFO imPcRemote Download"

• "ET INFO Redirect via HTTP 300 to URI Shortening Service (alturl .com)"

• "ET INFO dnsHome DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP POST Request XOR Key ae"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (v2 .dionysus .beauty)"

• "ET INFO HTTP POST Request XOR Key 54"

• "ET INFO HTTP GET Request XOR Key 88"

• "ET INFO HTTP GET Request XOR Key c2"

• "ET INFO URL Shortener Service Domain in DNS Lookup (rebrand .ly)"

• "ET INFO HTTP POST Request XOR Key 2b"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net"

• "ET EXPLOIT Serialized Java Object Generated by ysoserial"

• "ET INFO URL Shortener Service Domain in DNS Lookup (to .sv)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (srv5 .jiripocta .cz)"

• "ET INFO Observed DNS Query to Remote Utilities Domain"

• "ET INFO Suspicious HTTP Server Value in Response (CloudFlare)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228)"

• "ET SCAN Rapid IMAPS Connections - Possible Brute Force Attack"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .adrianion .eu)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dgca .myds .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dot .sillundil .ovh)"

• "ET INFO HTTP GET Request XOR Key 65"

• "ET INFO HTTP GET Request XOR Key a7"

• "ET INFO Interactsh Domain in DNS Lookup (.oast .live)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (safeservedns .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (firewall .darknet .bg)"

• "ET INFO [TW] Internet Computer HTTP Request Observed"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .herkhof .nl)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adg .jnorton .us)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .gbrossi .com .br)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3620 Default Cert Issuer Common Name"

• "ET INFO HTTP GET Request XOR Key db"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .froth .zone)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .uplenk .com)"

• "ET INFO HTTP Request to Free Hosting Domain (*.ct8 .pl)"

• "ET INFO Telegram API Request (GET)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharesbyte .com)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (qq .sv)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (www .nilanjan .rocks)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (tra-ta-ta.it .com)"

• "ET INFO Observed External IP Lookup Domain (geoiplookup .io in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 45"

• "ET INFO Observed Notion Notes Taking App Domain (api .notion .com in TLS SNI)"

• "ET INFO ISO File Downloaded"

• "ET INFO HTTP POST Request XOR Key 9e"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dart .kpsn .org)"

• "ET INFO External Host Querying Erlang Port Mapper Daemon"

• "ET INFO HTTP POST Request XOR Key e9"

• "ET INFO Possible Malicious Document Request to Afraid.org Top 100 Dynamic DNS Domain"

• "ET INFO Possible MSXMLHTTP Request to Dotted Quad"

• "ET INFO Observed DNS Over HTTPS Domain (dns .ndo .dev in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (sg-dns1 .bancuh .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns168 .zhhz .cc)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .lightmaster .space)"

• "ET INFO HTTP Request to a *.pw domain"

• "ET INFO Delivr .to Phishing/Security Simulation Service Domain in DNS Lookup (delivrto .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (mainframe .dewed .de)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (blackhole .aflr .io)"

• "ET INFO Possible ThousandEyes User-Agent Inbound"

• "ET INFO HTTP POST Request XOR Key 38"

• "ET INFO RAR File Download Request via Discord"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (hk .erw .cc)"

• "ET INFO HTTP POST Request XOR Key 58"

• "ET INFO Observed Pastebin-like Service Domain (paste .bingner .com in TLS SNI)"

• "ET INFO Observed DNS Query to .phd TLD"

• "ET INFO Chrome/0 in User-Agent"

• "ET INFO HTTP POST Request XOR Key bc"

• "ET INFO DYNAMIC_DNS Query to 3322.net Domain *.9966.org"

• "ET INFO HTTP GET Request XOR Key 5b"

• "ET INFO Observed URL Shortening Service Domain (s59 .site) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh-lb-atl .dnsflex .com)"

• "ET INFO Observed Instagram Story Viewer Domain (greatfon .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns0 .tardishost .ru)"

• "ET INFO Whoami Command Inbound On High Port"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-2488 Default Cert Issuer Common Name"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officences .com)"

• "ET INFO URI Shortening Domain in DNS Lookup (alturl .com)"

• "ET INFO HTTP GET Request XOR Key cc"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .bitdefender .net)"

• "ET INFO Lock Emoji In Title - Possible Social Engineering Attempt"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .luan .contact)"

• "ET INFO Observed URL Shortener Domain (lk .tc in TLS SNI)"

• "ET INFO Brahma World DNS Over HTTPS Certificate Inbound"

• "ET INFO Powershell Base64 Decode Command Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (tj .jamesxue .xyz)"

• "ET INFO Level.io Agent Update Domain in DNS Lookup (builds .level .io)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .keweon .center)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (tt .sv)"

• "ET INFO HTTP GET Request XOR Key 9c"

• "ET INFO HTTP GET Request XOR Key fb"

• "ET INFO HTTP POST Request XOR Key 4b"

• "ET INFO Telegram API Domain in DNS Lookup"

• "ET INFO Peer to Peer File Sharing Service in DNS Lookup (cloudflare-ipfs .com)"

• "ET INFO Splashtop Domain (splashtop .eu) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dukun .de in TLS SNI)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizewings .com)"

• "ET INFO Null31 DNS Over HTTPS Certificate Inbound"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default Cert Issuer Common Name"

• "ET POLICY DNSWatch .info IP Check"

• "ET INFO Certificate with Unknown Content M1"

• "ET INFO Observed URL Shortener Service Domain (goo .su in TLS SNI)"

• "ET INFO External IP Address Lookup Service in DNS Lookup (invertexto .com)"

• "ET INFO URL Shortening Service Domain in DNS Lookup (e .vg)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .connect .fail)"

• "ET INFO Observed DNS over HTTPS Domain (dns .ramansarda .com)"

• "ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_invalid"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (storydoh .kinergetica .com)"

• "ET INFO Kickidler Employee Monitoring Software Related Domain in DNS Lookup (my .kickidler .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.2288.org"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adgaurd .lingmont .net)"

• "ET INFO HTTP POST Request XOR Key 6d"

• "ET INFO HTTP GET Request XOR Key ee"

• "ET INFO Possible Phishing Page - Page Saved with SingleFile Extension"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .cachitopetshop .com)"

• "ET INFO HTTP GET Request XOR Key ea"

• "ET INFO Redirect via HTTP 300 to URI Shortening Service (rb .gy) with Fragment Identifier"

• "ET INFO HTTP GET Request XOR Key e9"

• "ET INFO HTTP GET Request XOR Key 3b"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (chandr1000 .net)"

• "ET INFO AhaDNS DNS Over HTTPS Certificate Inbound"

• "ET INFO Suspicious Possible CollectGarbage in base64 1"

• "ET INFO DNS Over HTTPS Certificate Inbound (cnnic-chinatelecom-chinamobile-chinaunicom--bili-d .dahi .icu)"

• "ET INFO HTTP GET Request XOR Key 37"

• "ET INFO DNSForge DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain (dns .noridev .moe) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (agp01 .tek411 .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (anixlab .com)"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriverEx"

• "ET INFO Certificate with Unknown Content M2"

• "ET INFO HTTP GET Request XOR Key 34"

• "ET POLICY External Unencrypted Connection to Ossec WUI"

• "ET CURRENT_EVENTS Suspicious BITS EXE DL From Dotted Quad"

• "ET WEB_CLIENT Proxy - BurpSuite PortSwigger Proxy Certificate Seen"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .lege .despagne .net)"

• "ET INFO HTTP GET Request XOR Key 79"

• "ET INFO ARM File Requested via WGET (set)"

• "ET INFO HTTP POST Request XOR Key 8e"

• "ET INFO Andrews & Arnold DNS Over HTTPS Certificate Inbound"

• "ET INFO HTTP GET Request XOR Key 89"

• "ET INFO URL Shortener Service Domain in DNS Lookup (yourls .org)"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointin .com)"

• "ET INFO HTTP GET Request XOR Key 8b"

• "ET INFO HTTP POST Request XOR Key 3a"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .moeyk .com)"

• "ET INFO Charter DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .irumatech .com)"

• "ET INFO Interactsh Domain in DNS Lookup (.oast .me)"

• "ET INFO HTTP GET Request XOR Key e1"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (adns .kreonet .net)"

• "ET INFO IDrive Backup Connection"

• "ET INFO Kickidler Employee Monitoring Sofrtware Domain (my .kickidler .com in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 4d"

• "ET INFO Generic 302 Redirect to Google"

• "ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Outbound)"

• "ET INFO Possible Apache log4j RCE Attempt - Any Protocol (upper TCP Bypass) (Outbound) (CVE-2021-44228)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns1 .1899 .com .mx)"

• "ET INFO Flowbit set for POST to Quicken Updater"

• "ET INFO Observed DNS Query to .esq TLD"

• "ET INFO File Sharing Domain Observed in TLS SNI (instant .io)"

• "ET GAMES Dragon Raja Activity"

• "ET INFO HTTP GET Request XOR Key ce"

• "ET INFO Possible MSXMLHTTP Request (exe) unset (no exe)"

• "ET INFO MSSQL SELECT SPID Query Observed"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (bilidon .dnsuser .info)"

• "ET INFO HTTP POST Request XOR Key fd"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns-primary .giaan .org)"

• "ET INFO Possible Malicious Document Request to NOIP DynDNS Domain"

• "ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officence .com)"

• "ET WEB_CLIENT WebDAV Retrieving an .url"

• "ET INFO HTTP POST Request XOR Key 59"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .fancyorg .at)"

• "ET INFO Observed DNS over HTTPS Domain (nz01 .dns4me .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (gateway .fomichev .cloud)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (dl .sv)"

• "ET INFO RAR file download over raw TCP"

• "ET INFO Commonly Abused File Sharing Site Domain Observed (privatlab .net in DNS Lookup)"

• "ET INFO HTTP POST Request XOR Key 80"

• "ET INFO stopify .co Domain in DNS Lookup"

• "ET INFO HTTP POST Request XOR Key 62"

• "ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)"

• "ET POLICY archive.org heritix Crawler User-Agent (Outbound)"

• "ET INFO HTTP GET Request XOR Key 86"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .adrianlam .com)"

• "ET INFO OneNote Notebook Downloaded via Powershell"

• "ET INFO MailJet URL Shortening Service Domain in DNS Lookup (mjt .lu)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (beacon .dog)"

• "ET INFO HTTP POST Request XOR Key ce"

• "ET INFO URL Shortener Service Domain in DNS Lookup (rt .sv)"

• "ET INFO HTTP POST Request XOR Key 36"

• "ET INFO NetSupport Remote Admin Response"

• "ET INFO Observed DNS over HTTPS Domain (dns .sips .my .id) in TLS SNI"

• "ET INFO Observed DNS Query to Pastebin-style Service (justpaste .it)"

• "ET INFO HTTP POST Request XOR Key c7"

• "ET INFO MySQL Database Query Version OS compile"

• "ET POLICY SMB2 NT Create AndX Request For an Executable File In a Temp Directory"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns-free .link)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (muc-ns01 .ibytex .systems)"

• "ET INFO HTTP Sniffer Domain in TLS SNI (httpdebugger .com)"

• "ET INFO Avalanche / Lavina Pulse Domain in DNS Lookup (avl .team)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns0 .fdn .fr)"

• "ET INFO HTTP GET Request XOR Key 2f"

• "ET VOIP H.323 in Q.931 Call Setup - Inbound"

• "ET INFO Observed DNS Over HTTPS Domain (dns .hubservices .vn in TLS SNI)"

• "ET CURRENT_EVENTS Roblox Credential Phish 2023-03-06"

• "ET INFO HTTP POST Request XOR Key 4e"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - SET_ File Download Attempt"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .purbalinggakab .go .id)"

• "ET INFO Level.io Check Connectivity Status in DNS Lookup (online .level .io)"

• "ET INFO Observed DNS Query to .prof TLD"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Issuer Common Name"

• "ET INFO HTTP POST Request XOR Key e3"

• "ET INFO JAVA - ClassID"

• "ET INFO HTTP POST Request XOR Key e0"

• "ET INFO Free Online Form Builder Domain in DNS Lookup (tally .so)"

• "ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M1"

• "ET INFO HTTP POST Request XOR Key 4d"

• "ET INFO Observed DNS Over HTTPS Domain (doh .max .net .id in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (oracle .cepheus0 .com)"

• "ET INFO Mullvad DNS Over HTTPS Certificate Inbound"

• "ET INFO Observed DNS Over HTTPS Domain (www .c-dns .com in TLS SNI)"

• "ET INFO HTTP GET Request XOR Key 5d"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cloud .samutz .com)"

• "ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default Cert Subject Common Name"

• "ET INFO HTTP GET Request XOR Key 13"

• "ET INFO URL Shortening Service Domain in DNS Lookup (webz .cc)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .moonssif .com)"

• "ET TROJAN Drivermax Utility Checkin Activity"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns-secondary .cloudnx .cloud)"

• "ET INFO Delphi JEDI Visual Component Library User-Agent (JEDI-VCL)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .cornes .me)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (au02 .dns4me .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ivnkn .xyz)"

• "ET INFO HTTP GET Request XOR Key 6e"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dhold .2025up .xyz)"

• "ET CHAT IRC USER Likely bot with 0 0 colon checkin"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (n .3363 .net)"

• "ET INFO HTTP GET Request XOR Key c4"

• "ET INFO Cisco IOS XE Web Server Config Change in SOAP (CVE-2023-20198) (Outbound)"

• "ET INFO HTTP GET Request XOR Key 97"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .malwarelul .download)"

• "ET INFO HTTP POST Request XOR Key 66"

• "ET INFO HTTP POST Request XOR Key 03"

• "ET INFO HTTP POST Request XOR Key 7f"

• "ET INFO NetSupport Remote Admin Checkin"

• "ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (templatent .com)"

• "ET INFO Possible Fake Edu Host with __test Cookie"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (apne1 .dns .terumi .club)"

• "ET INFO HTTP GET Request XOR Key 03"

• "ET INFO Suspicious Glitch Hosted GET Request - Possible Phishing Landing"

• "ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)"

• "ET INFO EXE CheckRemoteDebuggerPresent (Used in Malware Anti-Debugging)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (guard .sntrk .ru)"

• "ET INFO HTTP POST Request XOR Key 63"

• "ET INFO HTTP POST Request XOR Key 05"

• "ET USER_AGENTS Willowcoin Cryptocurrency UA Observed"

• "ET INFO URL Shortening Service Domain in DNS Lookup (zws .im)"

• "ET INFO File Sharing Domain Observed in TLS SNI (pixeldrain .com)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .nielsdb .be)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (cvt-ic-us-adns-001 .clearviewtechnology .net)"

• "ET INFO Observed DNS Over HTTPS Domain in TLS SNI (rdns .faelix .net)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (agafon .space)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns3 .bit-trail .nl)"

• "ET INFO Terse Request to note .youdao .com - Possible Download"

• "ET EXPLOIT libPNG - Possible integer overflow in allocation in png_handle_sPLT"

• "ET INFO Observed DNS Over HTTPS Domain (aerodrorne .live) in TLS SNI"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (gmail-online .net)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .labnekotest .site in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .seiffert .me in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (alleesph .online in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns1 .server .my .id) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .maskab .com in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (commie .io)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kawa .tf) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (huanmengmeta .art in TLS SNI)"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (request-human-received .xyz)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .pggns .de) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .senthil .us) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .ourvau .lt) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (bitbin .it) in TLS SNI"

• "ET INFO File Sharing Service Related Domain in DNS Lookup (ws .onehub .com)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .cctld .kg)"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (click-manage-room .cfd)"

• "ET INFO Query to IP Check Tool With Minimal Headers (ip .tool .chinaz .com"

• "ET INFO Observed DNS Over HTTPS Domain (sg .rslvr .eu in TLS SNI)"

• "ET INFO URI Shortening Service Domain in DNS Lookup (cli .re)"

• "ET INFO Observed Pastebin-like Service Domain (hastebin .com) in TLS SNI"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed3 .binance .org)"

• "ET INFO Observed DNS over HTTPS Domain (mikezhang .xyz) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (maherhost .uk) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pasted .co)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .ruby .ci in TLS SNI)"

• "ET INFO Google DNS Over HTTPS Certificate Inbound"

• "ET INFO DNS Query to Document Management Domain (virtualcabinet .com)"

• "ET INFO Observed DNS over HTTPS Domain (adguard .leadseason .eu in TLS SNI)"

• "ET INFO Simplehelp Remote Administration Suite Default SSL Certificate Observed"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (nail-forward-valid .lol)"

• "ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed4 .ninicoin .io)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .tryk .app in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (bl .eq .md in TLS SNI)"

• "ET INFO Suspected Pentesting Related Activity"

• "ET INFO Observed DNS Over HTTPS Domain (dns .bermeitinger .eu) in TLS SNI"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed4 .binance .org)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .pragmasec .nl in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (ca .loii .in) in TLS SNI"

• "ET INFO URL Shortening Service Domain in DNS Lookup (trimmer .to)"

• "ET INFO Observed Pastebin-like Service Domain (dpaste .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (351242444 .xyz) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .sh)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .criena .net) in TLS SNI"

• "ET INFO Observed Commonly Abused Link Aggregating Service Domain (bio .link) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (p .ip .fi) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (agh .ero-sayhi .com in TLS SNI)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET TROJAN AutoIt3.exe Downloaded via Powershell"

• "ET INFO Observed DNS Over HTTPS Domain (nashkan .net) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (pashagame456 .com) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cryptpad .private .coffee)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (egnyte .com in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (notes .io) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (nl .rslvr .eu in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .org .ru)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (tutpaste .com)"

• "ET INFO Observed Pastebin-like Service Domain (cutapaste .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (your-dns .run) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .indust .me) in TLS SNI"

• "ET INFO Anonymous File Sharing Service Domain in DNS Lookup (file-drop .cc)"

• "ET INFO Observed Dropbox paper Domain (paper-attachments .dropboxusercontent .com) in TLS SNI"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (gmail-online .net) in TLS SNI"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-2-s2 .binance .org in TLS SNI)"

• "ET INFO Observed Abused File Sharing Domain (discreetshare .com in TLS SNI)"

• "ET INFO Observed File Sharing Domain (terabox .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .wael .name:4433 in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (commie .io) in TLS SNI"

• "ET INFO File Sharing Domain (d .kuku .lu) in DNS Lookup"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-2-s1 .binance .org in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (agh .dshubham .xyz) in TLS SNI"

• "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (jsfiddle .net)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .wahr .top in TLS SNI)"

• "ET INFO Observed File Sharing Domain (d .kuku .lu) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (pdns .krctechnologies .net) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .csa-rz .de)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (notes .io)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (blocker .thethorsens .org)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .doh .best in TLS SNI)"

• "ET TROJAN Observed APT42/TA453 Related Domain (s20 .site in TLS SNI)"

• "ET INFO Phishing Training Domain (notifierservice .com) in TLS SNI"

• "ET INFO Observed URL Shortener Service Domain (iplog .co in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .h3z .jp) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .fizz .studio) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pastebin .fi)"

• "ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (cryptpad .private .coffee) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .9999 .sg in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dot .modsh .top) in TLS SNI"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (office65 .info)"

• "ET INFO DNS Query to Abused File Sharing/CRM Domain (getflg .com)"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (ms365 .group)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Abused File Sharing/CRM Platform in DNS Lookup (pipedrive-files--pipedrive .com .s3 . .amazonaws .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .caksono .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (ikarosalpha .xyz in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .oryxlabs .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .janl .eu in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (www .zburger .top) in TLS SNI"

• "ET INFO Observed Abused File Sharing/CRM Domain (pipedrive .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .au .newpangea .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .pangerl .it) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (aqua .is .my .waifu .cz in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (paste .jp) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (nsec .arnor .org)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .renardyre .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .sg .newpangea .de in TLS SNI)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed3 .defibit .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .w3ctag .org) in TLS SNI"

• "ET INFO URL Shortening/File Sharing Service Domain in DNS Lookup (d .pr)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (bpa .st)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .busold .ws) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (paulo .nom .za in TLS SNI)"

• "ET INFO DNS Query to Domain Hosting Port Scanning Tools (advanced-port-scanner .com)"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (hcbanking .com) in TLS SNI"

• "ET INFO Observed URL Shortening Service Domain (ddsl .me in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .svoi .dev in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (vpsus3 .pzhg .meat .pzhg .me) in TLS SNI"

• "ET INFO Observed Anonymous File Sharing Service Domain in TLS SNI"

• "ET TROJAN Observed APT42/TA453 Related Domain (m85 .online in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (privatebin .net) in TLS SNI"

• "ET INFO Commonly Abused Link Aggregating Service Domain in DNS Lookup (mssg .me)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .jp)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed2 .ninicoin .io in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (doh .funil .de in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .eliv .co .kr) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (ad .systemfall .ru in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (xusqui .com) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (ivpaste .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .l337 .site) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .narl .app in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .denypradana .com)"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (adobeconnections .com) in TLS SNI"

• "ET INFO Observed Suspicious Domain (f5sec .s3 .il-central-1 .amazonaws .com in TLS SNI)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed4 .ninicoin .io in TLS SNI)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (redr .me)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (request-human-received .xyz)"

• "ET INFO Observed DNS over HTTPS Domain (dns .rjls .me in TLS SNI)"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (d75 .site)"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (house-server-digital .xyz)"

• "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO DYNAMIC_DNS Query to .giswebservice .com Domain"

• "ET INFO Observed DNS Over HTTPS Domain (dns .diarbagus .id) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .sec511 .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (c .cicitt .ch) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Thinkst Honeytoken Domain in DNS Lookup (o3n .io)"

• "ET INFO Observed DNS Over HTTPS Domain (bestwon203 .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (squidmall .vip) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns-1 .wil .cloud)"

• "ET INFO Observed DNS Over HTTPS Domain (vorlif .org) in TLS SNI"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed3 .binance .org in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .ple91 .uk in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (ad .eren .homes) in TLS SNI"

• "ET INFO Observed Dropbox paper Domain (paper-attachments .dropboxusercontent .com) in DNS Query"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (flow-exulltation-uplift .top)"

• "ET INFO Observed DNS Over HTTPS Domain (003153 .xyz) in TLS SNI"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (sirumuv .com)"

• "ET INFO Observed DNS over HTTPS Domain (mikatos .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .cl .newpangea .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .dyn1 .de) in TLS SNI"

• "ET INFO Observed Abused File Sharing Service Domain (tempfiles .ninja in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (tny .cz)"

• "ET INFO URL Shortener Service Domain in DNS Lookup (iplog .co)"

• "ET INFO Observed DNS over HTTPS Domain (deep-henchman-excuse .cfd) in TLS SNI"

• "ET INFO Possible Machine GUID Observed in HTTP POST"

• "ET INFO Observed DNS over HTTPS Domain (yeralin .net in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .esnube .es)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .b33 .network) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (quickhighlighter .com)"

• "ET INFO Observed Pastebin-like Service Domain (www .paste .lv) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (p .ip .fi)"

• "ET INFO DNS Query to a *giize.com DYNAMIC_DNS Domain"

• "ET INFO Observed DNS Over HTTPS Domain (dns .velyn .my .id) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (www .pastebin .pt)"

• "ET INFO Observed File Sharing Service Related Domain (ws .onehub .com in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dnssilo .top)"

• "ET INFO Observed Pastebin-like Service Domain (pad .envs .net) in TLS SNI"

• "ET INFO Request to AI Image Generation Service"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .axto .me)"

• "ET INFO Lucy Security Time Tracking - Awareness Training"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .sscw .win in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .hypercute .eu in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (africadns1 .liquidtelecom .net)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .comff .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (resolv2 .trash .net) in TLS SNI"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (click-choose-figured .cfd)"

• "ET INFO Document Sharing Site Domain Observed in DNS Query (docsend .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kapite .in) in TLS SNI"

• "ET INFO Observed DNS Related Tools Domain (viewdns .net in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (vpaste .net)"

• "ET INFO Observed DNS Query to AI Image Generation Service (stablediffusionapi .com)"

• "ET INFO Possible Fake Nintendo User-Agent Observed"

• "ET INFO Observed Pastebin-like Service Domain (cryptpad .fr) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (cl1p .net) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (albertocognetti .com)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (farmerswife .com in TLS SNI)"

• "ET INFO DNS Query to Online Application Hosting Domain (onrender .com)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed2 .defibit .io)"

• "ET INFO File Upload Activity Response"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pastecode .io)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .sec511 .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .simplylinux .ch in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (secure-dns .pleumkungz .com in TLS SNI)"

• "ET INFO Suspicious Domain in DNS Lookup (f5sec .s3 .il-central-1 .amazonaws .com)"

• "ET INFO Observed DNS over HTTPS Domain (doh .magunyan .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dnsdoh .art:444 in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .powerbs .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (affsoft .cc) in TLS SNI"

• "ET INFO Commonly Actor Abused Online Service Domain (imgurl .ir)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .oliviertv .co .za in TLS SNI)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-2-s3 .binance .org in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .rohitab .com)"

• "ET INFO Observed DNS Over HTTPS Domain (loadlow .me) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (resov .wehao .net)"

• "ET INFO Observed Pastebin-like Service Domain (bpa .st) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (anycast .uncensoreddns .org in TLS SNI)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (doh .javi .lat) in TLS SNI"

• "ET INFO Observed DNS Query to URL Shortener Domain (lnkz .at)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (usrfiles .com in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .utangard .net)"

• "ET INFO Acunetix Web Vulnerability Scanning Serice Domain in DNS Lookup (testphp .vulnweb .com)"

• "ET INFO Observed DNS over HTTPS Domain (doh .immerda .ch) in TLS SNI"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (www .paste .lv)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .ajinga .net) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (paste .mozilla .org) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (nana-is .so-gorgeo .us .kg)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .digitaladapt .com in TLS SNI)"

• "ET INFO DNS Query to Cloud Computing Domain (puter .com)"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (frame-roar-retire .top)"

• "ET INFO Observed DNS Over HTTPS Domain (testaghome .meshkov .info) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .in .newpangea .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .phillipjberry .net in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .jichi .io) in TLS SNI"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (imgurl .ir in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (outdoor .v6 .army in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (us .rslvr .eu in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (doh .denypradana .com in TLS SNI)"

• "ET INFO Observed DYNAMIC_DNS Domain (giize .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .saneaki .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .novg .net) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (adg .khon .dev in TLS SNI)"

• "ET INFO Commonly Actor Abused Online Service Domain (storjshare .io)"

• "ET INFO Observed File Sharing Domain (2zie .com in TLS SNI)"

• "ET INFO Observed DNS Query to Webhook/HTTP Request Inspection Service (mockbin .io)"

• "ET INFO Observed DNS Over HTTPS Domain (nightlymoon .us .kg) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .manish .ltd) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (blocker .thethorsens .org in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (adguard .speeddemon .co .za) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .tierradeayala .com) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (dns .gayanalysing .co .uk) in TLS SNI"

• "ET INFO Phishing Training Domain in DNS Lookup (notifierservice .com)"

• "ET INFO Observed DNS Over HTTPS Domain (signsservers .ru) in TLS SNI"

• "ET INFO Observed Marketing Agency Domain (pixelprohn .com in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns1 .hanahira .dev)"

• "ET INFO Observed DNS over HTTPS Domain (adguard-kartoffel .zernico .de) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .ian .rocks in TLS SNI)"

• "ET TROJAN APT42/TA453 Related CnC Domain in DNS Lookup (bitly .org .il)"

• "ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .sealyserver .com in TLS SNI)"

• "ET INFO DNS Query to 2zie File Sharing Service (2zie .com)"

• "ET INFO Observed DNS over HTTPS Domain (albertocognetti .com in TLS SNI)"

• "ET INFO Observed File Sharing Service Domain (arvanstorage .ir in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (www .pastebin .pt) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .decky .eu)"

• "ET INFO Commonly Actor Abused Online Service Domain (arkinfo .in in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .smartguard .io in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (princez .uk in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .abraservice .xyz in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (africadns1 .liquidtelecom .net in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (pastebin .fi) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (doh .978159 .xyz in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns-1 .wil .cloud in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .webpotato .nl) in TLS SNI"

• "ET INFO DNS Query to ArvanCloud File Sharing Service Domain (arvanstorage .ir)"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .nordvpn .com in TLS SNI)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s2 .binance .org)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (adguard .tcpu .io)"

• "ET INFO Observed DNS Over HTTPS Domain (doh1 .infotek .net .id) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (paste .ofcode .org) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .npsolution .it)"

• "ET INFO Observed Pastebin-like Service Domain (quickhighlighter .com) in TLS SNI"

• "ET INFO Commonly Actor Abused Online Service Domain (passproviders .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .numerus .com) in TLS SNI"

• "ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-2-s1 .binance .org)"

• "ET INFO Centrastage RMM Agent Update Request"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed1 .binance .org)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (jsitor .com)"

• "ET INFO Observed DNS over HTTPS Domain (dns .pacificmonster .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (polisidns .4ch .my .id in TLS SNI)"

• "ET INFO Observed QR Code Generator Domain (qrfy .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .johanliebert .top) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .wael .name:4433)"

• "ET INFO TsPlus Remote Support Agent Download"

• "ET INFO Observed DNS over HTTPS Domain (dns .rafn .is in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (nicsezcheckfbi .gov) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ofcode .org)"

• "ET INFO Observed DNS Over HTTPS Domain (diy .itsa .top in TLS SNI)"

• "ET INFO Observed Commonly Abused Link Aggregating Service Domain (linkbio .co) in TLS SNI"

• "ET TROJAN APT42/TA453 Related CnC Domain in DNS Lookup (s20 .site)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s2 .binance .org in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .iki .my .id in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (tor .vasi .li) in TLS SNI"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s3 .binance .org in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .xwdmw .xyz in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .zui .lol) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .pacificmonster .com)"

• "ET INFO Observed DNS Over HTTPS Domain (family .dns .doubleangels .com in TLS SNI)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (zuhause .webteufel .net in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .falkenthal .org) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .wargan .io)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .sr .ht)"

• "ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (notes .dunst .be)"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (isthmiboutique .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .mtoo .vip) in TLS SNI"

• "ET INFO Observed Desktop Productivity Software Domain (desktime .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .kel .pe in TLS SNI)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .olpploiopkuyhiopsfrt .info) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .jupitrdns .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .lobbygod .com in TLS SNI)"

• "ET INFO Suspicious Header Name In HTTP Request (U)"

• "ET INFO Observed Pastebin-like Service Domain (anotepad .com) in TLS SNI"

• "ET INFO Observed Dropbox paper Domain (paper .dropbox .com) in DNS Lookup"

• "ET INFO Observed Free Website Builder/Hosting Domain (eventcreate .com) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (bitbin .it)"

• "ET INFO Observed DNS Over HTTPS Domain (b-ii .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (antarlangit .my .id) in TLS SNI"

• "ET INFO Observed Webhook/HTTP Request Inspection Service Domain (mockbin .io) in TLS SNI"

• "ET INFO Commonly Abused Service in DNS Lookup (tempfiles .ninja)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed3 .defibit .io)"

• "ET INFO Commonly Abused Link Aggregating Service Domain in DNS Lookup (linkbio .co)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .dev-umbrellagov .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .wargan .io in TLS SNI)"

• "ET INFO Tunneling Service in TLS SNI (* .ply .gg)"

• "ET INFO Observed DNS over HTTPS Domain (dns .yumenashyi .com in TLS SNI)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (click-choose-figured .cfd)"

• "ET INFO Observed DNS Over HTTPS Domain (family .dns .teknoholistik .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .dekedin .me in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (ide .geeksforgeeks .org)"

• "ET INFO Observed Pastebin-like Service Domain (pastecode .dev) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (adguard .leadseason .eu)"

• "ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)"

• "ET INFO Pastebin-like Service Observed in TLS SNI (termbin .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .immanuelschaffer .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .a47 .me in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (resolve .corpa .me)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .engineer .web .id) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (doh .viatech .com .tw) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .runsel .id in TLS SNI)"

• "ET INFO TsPlus Remote Support Client Activity M2"

• "ET INFO Marketing Agency Domain in DNS Lookup (pixelprohn .com)"

• "ET INFO Observed Pastebin-like Service Domain (paste .sh) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .nj0 .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .comss .one) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (megumin .is .my .waifu .cz in TLS SNI)"

• "ET INFO Commonly Actor Abused Online Service Domain (usrfiles .com)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .utangard .net in TLS SNI)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-2-s2 .binance .org)"

• "ET INFO Observed DNS over HTTPS Domain (dns .kosan .moe) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .valscosmos .com in TLS SNI)"

• "ET INFO Pastebin-like Service in DNS Lookup (anotepad .com)"

• "ET INFO Observed DNS over HTTPS Domain (agh .kyusang .win) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .bitservices .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (senpai .pp .ua) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .suche .org) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .mateo .ovh) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cryptpad .fr)"

• "ET INFO Observed DNS Over HTTPS Domain (bazooki-infra .dev) in TLS SNI"

• "ET INFO URL Shortening Service Domain in DNS Lookup (shorturl .at)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .0x55 .net in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .plaawan .uk)"

• "ET INFO Observed DNS Over HTTPS Domain (noad .kipp .cool) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (pygos .space) in TLS SNI"

• "ET TROJAN APT42/TA453 Related CnC Domain in DNS Lookup (decorous-super-blender .glitch .me)"

• "ET INFO Observed Pastebin-like Service Domain (ivpaste .com) in TLS SNI"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (fimotoclub .com)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (click-manage-room .cfd)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (frame-roar-retire .top)"

• "ET INFO Observed Pastebin-like Service Domain (friendpaste .com) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (resolv1 .trash .net) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .everdns .tech)"

• "ET INFO Observed DNS Over HTTPS Domain (3dcosas .xyz) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .propheci .xyz) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (codeshare .io)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .5u3 .org) in TLS SNI"

• "ET TROJAN Android Fintech Related Domain in DNS Lookup (iu .iuuaufbt .com)"

• "ET INFO Observed Cloud Computing Domain (puter .com in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (termbin .com)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (d75 .site)"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (hcbanking .com)"

• "ET INFO Observed DNS Over HTTPS Domain (doh-ca .naftalie .net in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .shareworx .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .ezyss .id in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .warma .me in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (controlc .com)"

• "ET INFO HTTP Request for FixMe.IT / Techinline Remote Access Tool"

• "ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .rafn .is)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .nick-slowinski .de) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .everdns .tech in TLS SNI)"

• "ET INFO Pastebin-like Service in DNS Lookup (pastie .org)"

• "ET INFO Observed DNS Over HTTPS Domain (adfreedns .top in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .warpnine .de) in TLS SNI"

• "ET INFO Observed Commonly Abused Link Aggregating Service Domain (mssg .me) in TLS SNI"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed2 .ninicoin .io)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .faked .org) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (hostdare .qtxd .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .csa-rz .de in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pastecode .dev)"

• "ET INFO Observed File Sharing Related Domain (4sync .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns1 .hanahira .dev in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .yrrev .com) in TLS SNI"

• "ET INFO Tunneling Service in DNS Lookup (* .ply .gg)"

• "ET INFO Document Sharing Site Domain Observed in TLS SNI (docsend .com)"

• "ET INFO Observed DNS over HTTPS Domain (89433332 .xyz) in TLS SNI"

• "ET TROJAN APT42/TA453 Related CnC Domain in DNS Lookup (m85 .online)"

• "ET INFO Observed Pastebin-like Service Domain (dpaste .org) in TLS SNI"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed1 .defibit .io)"

• "ET INFO Observed DNS Over HTTPS Domain (vpsus3 .pzhg .me) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .pl .newpangea .de) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cryptpad .piratenpartei-bw .de)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh-rs .whalebone .io)"

• "ET MALWARE Observed Android Fintech Related Domain (iu .iuuaufbt .com in TLS SNI)"

• "ET TROJAN DarkGate CnC Exfil via AutoIt Payload"

• "ET INFO Observed File Hosting Service Domain (zohopublic .eu) in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (adblockersite .com in TLS SNI)"

• "ET TROJAN APT42/TA453 Related CnC Domain in DNS Lookup (litby .us)"

• "ET INFO Observed Dropbox paper Domain (paper .dropbox .com) in TLS SNI"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (wrightparkerobrien .biz) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (jpst .it)"

• "ET INFO Observed DNS over HTTPS Domain (dns .neowutran .ovh in TLS SNI)"

• "ET INFO DNS Query to Data Storage Service (s3 .tebi .io)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .airwaynet .cz)"

• "ET INFO Observed DNS over HTTPS Domain (doh .beauty in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (nashkin .net) in TLS SNI"

• "ET INFO Observed Anonymous File Sharing Service Domain (file-drop .cc in TLS SNI)"

• "ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (privatebin .net)"

• "ET INFO Free Website Builder/Hosting Domain in DNS Lookup (eventcreate .com)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .pccoach .nl)"

• "ET INFO Observed DNS over HTTPS Domain (adguard .hartley .cloud) in TLS SNI"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s3 .binance .org)"

• "ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (resolve .corpa .me in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain in TLS SNI (blitz .ahadns .com)"

• "ET INFO Observed DNS Over HTTPS Domain (timedns .org in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (resolv3 .trash .net) in TLS SNI"

• "ET INFO QR Code Generator Domain in DNS Lookup (qrfy .io)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .s0ra .asia) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .esnube .es in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .neowutran .ovh)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .ch6se .com)"

• "ET CURRENT_EVENTS Observed Various Malware Related Domain (adobeacrobatreaderupdate .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (adgdh .omkv .in) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (cryptpad .disroot .org) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .tldn .org) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .privex .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .tsknf .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .midping .ir in TLS SNI)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (review-continue-entered .cfd)"

• "ET INFO Observed Webhook/HTTP Request Inspection Service Domain (insomnia .rest) in TLS SNI"

• "ET INFO Googlebot User-Agent Observed in Outbound HTTP Request"

• "ET INFO Observed AI Image Generation Service Domain (stablediffusionapi .com) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste2 .org)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .shutgaming .net in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .chriswservers .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (tirapan .top) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .aeiou .pp .ua) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (jsfiddle .net) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .decky .eu in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .us .newpangea .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .serverhost .no) in TLS SNI"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (complete-telecom-operation .top)"

• "ET INFO Observed Pastebin-like Service Domain (pasted .co) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (doh .plaawan .uk in TLS SNI)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed1 .ninicoin .io)"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (microsoft-files .link)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (guard .thefather .cloud)"

• "ET INFO Observed DNS Over HTTPS Domain (get-resolution-ok-cdn .dahi .icu) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (anycast .uncensoreddns .org)"

• "ET INFO Observed File Sharing Service Domain (onedriveemail .atlassian .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns4me .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (agh .gloom .nexus) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (pastelink .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (linkdiscord .xyz) in TLS SNI"

• "ET INFO DNS Query to Vultr Cloud file sharing domain (vultrobjects .com)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-2-s3 .binance .org)"

• "ET INFO Observed Dropbox paper Domain (paperusercontent .com) in DNS Lookup"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (n0paste .tk)"

• "ET INFO Observed Pastebin-like Service Domain (justpaste .me) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (codebeautify .org)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed1 .defibit .io in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (adguard .tcpu .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kusoneko .moe in TLS SNI)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed1 .binance .org in TLS SNI)"

• "ET INFO Encrypted Messaging Service in TLS SNI (getsession .org)"

• "ET INFO Observed DNS Over HTTPS Domain (mnrv .trade) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns-malwaresec .nordthreatprotection .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .cr4zzy .xyz in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (pastecode .io) in TLS SNI"

• "ET INFO Suspected Proxy Server List Retrieval (GET)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .cnetwork .cloud in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (friendpaste .com)"

• "ET INFO Observed DNS over HTTPS Domain (dns .kescher .at) in TLS SNI"

• "ET INFO Observed Dynamic DNS Domain ( .giswebservice .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .asterimoon .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .guard .io) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (doh .buzz) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .huas .me in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (doh .airwaynet .cz in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (ideone .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (izapi4 .fr) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (tributh .net) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (ideone .com)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (morbitzer .de)"

• "ET INFO Geo IP lookup service (quan .suning .com)"

• "ET INFO Observed DNS over HTTPS Domain (guard .thefather .cloud in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .totoro .pub) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .pietjacobs .be in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .iucc .ac .il)"

• "ET INFO Observed DNS Over HTTPS Domain (tuskythehusky .tech) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed Pastebin-like Service Domain (codeshare .io) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .edgeburnmedia .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (ns .trcnet .fi) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (cryptpad .malacher .fr) in TLS SNI"

• "ET INFO Observed URL Shortening Service Domain (pimlm .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (affcdn .net) in TLS SNI"

• "ET INFO Observed File Sharing Domain (freeupload .store in TLS SNI)"

• "ET INFO Commonly Actor Abused Online Service Domain (cdn .ethers .io)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .cert .ee)"

• "ET INFO Observed Pastebin-like Service Domain (n0paste .tk) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .axto .me in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (codebeautify .org) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (adblock .indianets .net in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .aslk685qwda .com) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (nekobin .com) in TLS SNI"

• "ET INFO Centrastage RMM Server Response M2"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (deepspaceocean .info)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pastebin .osuosl .org)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (adg .khon .dev)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (agh .ero-sayhi .com)"

• "ET INFO Observed DNS over HTTPS Domain (123000123 .xyz) in TLS SNI"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (fimotoclub .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .twotigers .xyz in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .londonwebnerd .cloud in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .odinpl .com) in TLS SNI"

• "ET INFO Observed Document Management Domain (virtualcabinet .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (ad .johnwick .me)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (egnyte .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns-privacy .puregeni .us in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (nekomiya-sama .top) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (atws2425 .xyz) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (ns1 .opennameserver .org) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (nekobin .com)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (controlc .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (performance .gosami .xyz) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (yeralin .net)"

• "ET INFO Observed DNS over HTTPS Domain (dns .tesem .dog) in TLS SNI"

• "ET INFO Observed DNS Query to Pantheon Hosting Domain (pantheonsite .io)"

• "ET INFO Observed DNS over HTTPS Domain (vps .poly-tank .jp) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (www .paste4btc .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .enzonix .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (doh-de .blahdns .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .listo .click) in TLS SNI"

• "ET INFO Commonly Abused Link Aggregating Service Domain in DNS Lookup (bio .link)"

• "ET INFO Observed DNS Over HTTPS Domain (elarvee .xyz) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pastebin .fr)"

• "ET INFO DNS Query to Abused File Sharing Domain (discreetshare .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .0rz .ing) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh1 .b-cdn .netdoh2 .b-cdn .net) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .ple91 .uk)"

• "ET INFO Observed Public File Sharing Service Domain (bashupload .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (orpi .privado .ovh in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (ad .justincounts .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (konpetr6 .site) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (adfiltro .fun in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (adg .rueiliu .space in TLS SNI)"

• "ET INFO Observed File Sharing Domain (fastupload .io) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (drs .rustsword .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (adguard .alu .dog) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (pastebin .osuosl .org) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dnsdoh .art:444)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .scott-smith .us) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (yunyun .is .my .waifu .cz in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .mozilla .org)"

• "ET INFO File Sharing Related Domain in DNS Lookup (4sync .com)"

• "ET INFO Observed Pastebin-like Service Domain (jsbin .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (hk .rslvr .eu in TLS SNI)"

• "ET INFO Public File Sharing Service Domain in DNS Lookup (bashupload .com)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .yumenashyi .com)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .eddi .net)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .beardic .cn) in TLS SNI"

• "ET INFO Observed Abused File Sharing/CRM Platform (flg .to in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .backschues .net) in TLS SNI"

• "ET INFO File Sharing Service Domain in DNS Lookup (onedriveemail .atlassian .net)"

• "ET INFO Observed DNS over HTTPS Domain (zdn .ro in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .technostriker .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .pnh .my .id in TLS SNI)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (house-server-digital .xyz)"

• "ET INFO Observed DNS over HTTPS Domain (doh .b86 .nl) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .levonet .sk in TLS SNI)"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (nail-forward-valid .lol)"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (wrightparkerobrien .biz)"

• "ET INFO Observed DNS over HTTPS Domain (doh .amonsul .net in TLS SNI)"

• "ET INFO Possible External IP Check"

• "ET TROJAN APT42/TA453 Related CnC Domain in DNS Lookup (s51 .online)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .bravoc .one in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (dotnetfiddle .net) in TLS SNI"

• "ET INFO Observed DNS Query to Cloudflare workers.dev Domain"

• "ET INFO URL Shortener Service Domain (qrs .ly) in DNS Lookup"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (office65 .info) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kugoapps .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .abppro .ru in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .npe .bz) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (oraclejp2 .chungyu .com) in TLS SNI"

• "ET INFO Observed Cloudflare workers.dev Domain in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .vaioswolke .xyz) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (green2 .jnraptor .net in TLS SNI)"

• "ET INFO URL Shortening Service Domain in DNS Lookup (pimlm .com)"

• "ET INFO Observed Dynamic DNS Domain ( .afshin .ir) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (dns .neilzone .co .uk in TLS SNI)"

• "ET INFO Desktop Productivity Software Domain in DNS Lookup (desktime .com)"

• "ET INFO Observed Commonly Abused Service Domain (tempfiles .ninja) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (uni5wap .info) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (au .rslvr .eu in TLS SNI)"

• "ET TROJAN Gamaredon APT Related Maldoc Activity (POST)"

• "ET TROJAN Observed APT42/TA453 Related Domain (litby .us in TLS SNI)"

• "ET INFO Pastebin-style Service Domain in DNS Lookup (textbin .net)"

• "ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M4"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (princez .uk)"

• "ET INFO Observed Data Storage Service Domain (s3 .tebi .io in TLS SNI)"

• "ET INFO DNS Query to Abused File Sharing/CRM Domain (flg .to)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed4 .binance .org in TLS SNI)"

• "ET INFO Geo IP lookup service (api .ipgeolocation .io)"

• "ET INFO Observed DNS over HTTPS Domain (hk .ahua .ltd in TLS SNI)"

• "ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (morbitzer .de in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (justpaste .me)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .stirringphoto .com) in TLS SNI"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed3 .ninicoin .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (jp .rslvr .eu in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (outdoor .v6 .army)"

• "ET INFO Observed URL Shortener Domain (lnkz .at) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .56k .uy)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .thegoodsource .net in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (paste .centos .org) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .vojtat .cz) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .dooks .uk)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (arkinfo .in)"

• "ET INFO Observed Abused File Sharing/CRM Platform (pipedrive-files--pipedrive .com .s3 . .amazonaws .com) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .beauty)"

• "ET INFO Observed Dropbox paper Domain (paperusercontent .com) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .nj0 .de)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed4 .defibit .io)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .nako .kr) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .angry .im) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (doh .cippapp .com) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (jsbin .com)"

• "ET CURRENT_EVENTS TA453 Domain in DNS Lookup (complete-telecom-operation .top)"

• "ET INFO Observed DNS over HTTPS Domain (ad .johnwick .me in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .wixxm .asia) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (4netguides .org) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (zdn .ro)"

• "ET INFO Observed DNS over HTTPS Domain (dns .cctld .kg in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cryptpad .malacher .fr)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (hk .ahua .ltd)"

• "ET INFO Observed DNS Over HTTPS Domain (aerodrorne .vip) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .volatile .ovh) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .henek .ovh in TLS SNI)"

• "ET INFO Observed Abused File Sharing/CRM Platform (getflg .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .flightspace .net) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (jpst .it) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (yuvelirtut .website) in TLS SNI"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed2 .defibit .io in TLS SNI)"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (deepspaceocean .info)"

• "ET INFO Commonly Actor Abused Online Service Domain (farmerswife .com)"

• "ET INFO web.go HTTP Server Value in Response"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain (dns .cert .ee in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cutapaste .net)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .amonsul .net)"

• "ET INFO Observed DNS Query to Webhook/HTTP Request Inspection Service (insomnia .rest)"

• "ET INFO Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .jupitrdns .com in TLS SNI)"

• "ET TROJAN Observed APT42/TA453 Related Domain (bitly .org .il in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kukal .cz in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (cryptpad .bolha .tools) in TLS SNI"

• "ET INFO Observed File Sharing Domain (sync .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .superstefan .win in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (rabbitdns .org) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .karfamily .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .renardyre .com in TLS SNI)"

• "ET INFO Observed Thinkst Honeytoken Domain (o3n .io) in TLS SNI"

• "ET INFO Observed DNS Query to vk .com API (api .vk .com)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO File Sharing Domain (fastupload .io) in DNS Lookup"

• "ET INFO Observed DNS over HTTPS Domain (doh .eddi .net in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (huanmengmeta .art)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .futa .gg)"

• "ET INFO Observed DNS over HTTPS Domain (dns .pccoach .nl in TLS SNI)"

• "ET INFO DNS Query to Baidu File Sharing Domain (pan .baidu .com)"

• "ET INFO Observed DNS Over HTTPS Domain (ahoj .email) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (www .paste4btc .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .p3k .sk in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .kekew .info in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (timedns .net) in TLS SNI"

• "ET INFO Observed Domain Hosting Port Scanning Tools Domain (advanced-port-scanner .com in TLS SNI)"

• "ET INFO Encrypted Messaging Service in DNS Lookup (getsession .org)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .privex .io)"

• "ET INFO Observed DNS over HTTPS Domain (dns .ch6se .com in TLS SNI)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed3 .ninicoin .io)"

• "ET INFO Centrastage RMM Server Response M1"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (flow-exulltation-uplift .top)"

• "ET INFO DYNAMIC_DNS Query to .afshin .ir Domain"

• "ET INFO Observed DNS Over HTTPS Domain (doh .archuser .org in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (dpaste .org)"

• "ET TROJAN Observed APT42/TA453 Related Domain (s51 .online in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .koala .us .to in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (dpaste .com)"

• "ET INFO Observed Baidu File Sharing Domain Domain (pan .baidu .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns2 .prima-solusindo .com in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .978159 .xyz)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .bmwhocking .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (resolver .sunet .se in TLS SNI)"

• "ET INFO Anonymous File Sharing Service Domain in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (dns .alanpearce .eu) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (3dns .eu in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .rjls .me)"

• "ET INFO DNS Related Tools Domain in DNS Lookup (viewdns .net)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (dotnetfiddle .net)"

• "ET INFO Observed Pastebin-like Service Domain (tutpaste .com) in TLS SNI"

• "ET INFO URL Shortening Service Domain in DNS Lookup (ddsl .me)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .sheggi .ch in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (tny .cz) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (mikatos .de)"

• "ET INFO URL Shortener Service Domain in TLS SNI (redr .me)"

• "ET INFO Observed DNS Over HTTPS Domain (ns .data .haus in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .vault81 .de) in TLS SNI"

• "ET INFO Abused File Sharing Service (tempfiles .ninja) in DNS Lookup"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .hyas .com)"

• "ET INFO DNS Query to Remote Monitoring and Management Domain (centrastage .net)"

• "ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (storjshare .io in TLS SNI)"

• "ET INFO Observed Suspicious Domain (vultrobjects .com in TLS SNI)"

• "ET INFO DNS Query to File Sharing Domain (sync .com)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cryptpad .disroot .org)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .rbn .gr in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .pesaventofilippo .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .brian-wee .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .keke125 .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (tsc .gov) in TLS SNI"

• "ET CURRENT_EVENTS TA453 Domain in TLS SNI (review-continue-entered .cfd)"

• "ET INFO Base64 Encoded Executable over Raw TCP"

• "ET INFO Observed DNS Over HTTPS Domain (dns .milftech .xyz) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .huas .me)"

• "ET INFO Observed DNS over HTTPS Domain (resov .wehao .net in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (horus-team .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dnspub .restena .lu in TLS SNI)"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup"

• "ET INFO Observed DNS Over HTTPS Domain (doh .linngde .com) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cryptpad .piratenpartei .de)"

• "ET INFO Observed Pastebin-like Service Domain (cryptpad .piratenpartei .de) in TLS SNI"

• "ET INFO Observed URL Shortening Service Domain (fancli .com in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .dooks .uk in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (truta .org in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste-bin .xyz)"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .fi .newpangea .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .repinger .my .id) in TLS SNI"

• "ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (nana-is .so-gorgeo .us .kg in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .funil .de)"

• "ET INFO Observed URL Shortening Service Domain (trimmer .to in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cl1p .net)"

• "ET INFO Observed DNS over HTTPS Domain (doh-rs .whalebone .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns1 .lothuscorp .com .br) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (ns2 .4netguides .org) in TLS SNI"

• "ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response"

• "ET INFO Observed DNS Over HTTPS Domain (dns8 .orgn0 .euns3 .comns3 .cxns3 .link) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .mnet-online .de) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .centos .org)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pad .envs .net)"

• "ET INFO AnyDesk Revoked Code Signing Certificate Observed"

• "ET INFO Observed URL Shortening Service Domain (qrs .ly) in TLS SNI"

• "ET INFO Observed Online Application Hosting Domain (onrender .com in TLS SNI)"

• "ET TROJAN AutoIt3 Script Downloaded via Powershell Shortly After AutoIt3.exe Download"

• "ET INFO Observed DNS Over HTTPS Domain (dns .xuming .studio) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .hyas .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (doh .dns-ga .de in TLS SNI)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (cdn .ethers .io in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .editechstudio .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .56k .uy in TLS SNI)"

• "ET INFO DNS Query to File Sharing Domain (terabox .com)"

• "ET INFO Observed Pastebin-like Service Domain (paste2 .org) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (ide .geeksforgeeks .org) in TLS SNI"

• "ET INFO DNS Query to File Sharing Domain (freeupload .store)"

• "ET INFO DNS Query to Abused File Sharing/CRM Domain (pipedrive .com)"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (sirumuv .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (0ms .dev) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .nydau .fr) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .netvpn .net) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .kooman .org in TLS SNI)"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (doh .webnmail .de)"

• "ET INFO Observed Pastebin-like Service Domain (paste-bin .xyz) in TLS SNI"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed2 .binance .org in TLS SNI)"

• "ET INFO Centrastage RMM Agent Checkin"

• "ET INFO Observed DNS Over HTTPS Domain (dns .txq .life in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (adfiltro .fun)"

• "ET INFO Observed URL Shortening/File Sharing Service Domain (d .pr in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .l6 .ee) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns1 .dnscrypt .ca)"

• "ET INFO Observed DNS Over HTTPS Domain (mendozasdelivery .com) in TLS SNI"

• "ET INFO Observed URL Shortening Service Domain (shorturl .at) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .keviland .com) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .stevenz .net) in TLS SNI"

• "ET INFO DeskTime Desktop Productivity Software Checkin"

• "ET INFO Observed DNS over HTTPS Domain (dnssilo .top in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (doh .webnmail .de in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .mihanentalpo .me in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .npsolution .it in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (doh .iucc .ac .il in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee)"

• "ET INFO Observed Pastebin-like Service Domain (cryptpad .piratenpartei-bw .de) in TLS SNI"

• "ET INFO Observed Pastebin-like Service Domain (notes .dunst .be) in TLS SNI"

• "ET INFO URL Shortening Service Domain in DNS Lookup (fancli .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .horcrux .vip in TLS SNI)"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (isthmiboutique .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (dns .indybanipal .com in TLS SNI)"

• "ET INFO Observed Pantheon Hosting Domain (pantheonsite .io in TLS SNI)"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (cryptpad .bolha .tools)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (passproviders .com)"

• "ET INFO DNS Query to Online Application Hosting Domain (glitch .me)"

• "ET INFO Observed DNS Over HTTPS Domain (bth .dance) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (nsec .arnor .org in TLS SNI)"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (ms365 .group) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (doh .jtcargokebumen .com) in TLS SNI"

• "ET INFO Observed DNS Over HTTPS Domain (a .zpn .me in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (dns .olgui .net) in TLS SNI"

• "ET INFO Pastebin-like Service Domain in DNS Lookup (pastelink .net)"

• "ET CURRENT_EVENTS Various Malware Related Domain in DNS Lookup (adobeacrobatreaderupdate .net)"

• "ET INFO Observed Honeytrace .io Honeytoken Domain (microsoft-files .link) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns .doserver .top in TLS SNI)"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed4 .defibit .io in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .kerekes .xyz in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .eliv .kr) in TLS SNI"

• "ET INFO DNS Over HTTPS Domain in DNS Lookup (dns .doserver .top)"

• "ET INFO Observed Pastebin-like Service Domain (paste .debian .net) in TLS SNI"

• "ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .learningman .top) in TLS SNI"

• "ET INFO Observed URI Shortening Service Domain (cli .re in TLS SNI)"

• "ET INFO Honeytrace .io Honeytoken Domain in DNS Lookup (adobeconnections .com)"

• "ET INFO TsPlus Remote Support Client Activity M1"

• "ET INFO Observed Commonly Actor Abused Online Service Domain (bsc-dataseed1 .ninicoin .io in TLS SNI)"

• "ET INFO Observed Pastebin-like Service Domain (paste .sr .ht) in TLS SNI"

• "ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI"

• "ET INFO Observed DNS over HTTPS Domain (dns1 .dnscrypt .ca in TLS SNI)"

• "ET INFO Observed DNS over HTTPS Domain (doh .futa .gg/dns-queryhttpsdoh .futa .app in TLS SNI)"

• "ET INFO DNS Query to Commonly Actor Abused Online Service (bsc-dataseed2 .binance .org)"

• "ET TROJAN Observed APT42/TA453 Related Domain (decorous-super-blender .glitch .me in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns-cybersec .nordthreatprotection .com in TLS SNI)"

• "ET INFO Observed DNS Over HTTPS Domain (dns .gamban .com in TLS SNI)"

bad-unknown

• "ET POLICY Vulnerable Java Version 20.0.x Detected"

• "ET INFO DYNAMIC_DNS Query to a *.stkhome .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.garmanage .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ath .cx Domain"

• "ET INFO HTTP Request to Suspicious *.work Domain"

• "ET INFO DYNAMIC_DNS Query to a *.likescandy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bad .mn Domain"

• "ET INFO DYNAMIC_DNS Query to a *.womenclothingtoday .com Domain"

• "ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement"

• "ET INFO Doc Template Downloaded from DDNS Site"

• "ET INFO DYNAMIC_DNS Query to a *.ionexusa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-mt .com Domain"

• "ET TROJAN DNS Query Gauss Domain *.bestcomputeradvisor.com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yozh .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iyb .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nicolasi .com Domain"

• "GPL FTP CWD ..."

• "ET INFO DYNAMIC_DNS Query to a *.lotusblossomconsulting .com Domain"

• "ET INFO Obfuscated Split String (Double Q) 13"

• "ET INFO DYNAMIC_DNS Query to a *.sulsel .go .id Domain"

• "ET EXPLOIT Cisco Smart Install Exploitation Tool - GetConfig"

• "ET INFO DYNAMIC_DNS Query to a *.southquay .com Domain"

• "ET INFO Suspicious GET Request for .spc File"

• "ET INFO DYNAMIC_DNS Query to a *.smh .com .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ppalma .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.raspberryip .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bumbleshrimp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.game-host .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isa-geek .org Domain"

• "ET WEB_CLIENT SUSPICIOUS Possible automated connectivity check (www.yahoo.com)"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-caterer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.0bit .org Domain"

• "ET POLICY LDAPSv3 LDAPS_START_TLS Request Outbound"

• "ET USER_AGENTS Suspicious User-Agent (Installed OK)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-linux-user .org Domain"

• "ET CURRENT_EVENTS Comcast/Xfinity Phishing Landing 2018-03-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yourspecialtee .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.worse-than .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jolleybeef .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.asadanasemesta .co .id Domain"

• "ET INFO Dotted Quad Host M4 (noalert)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.entermypicks .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nunc .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gandhinagar .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alltransportme .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of replace Javascript Function %u UTF-16 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-by .us Domain"

• "ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)"

• "ET WEB_CLIENT Hex Obfuscation of arguments.callee %u UTF-16 Encoding"

• "ET CURRENT_EVENTS OneDrive Phishing Landing 2018-04-09"

• "ET POLICY DNS Query to .onion proxy Domain (torpaycnf.com)"

• "ET INFO DYNAMIC_DNS Query to a *.4pu .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ldtp .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-uberleet .com Domain"

• "GPL TFTP Put"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Accessing Importing glassfish"

• "ET INFO Pastebin-style Service (textbin .net in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ubernerden .com Domain"

• "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"

• "ET DNS Query for Suspicious .us.tf Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xn--ds-bja .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wiab-service .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cuetara .name Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.loginto .me Domain"

• "ET INFO DYNAMIC_DNS Query to a *.henher .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servernux .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.myeffect .net"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servebbs .com Domain"

• "ET INFO Cloud Storage Related Domain in DNS Lookup (webdav .drivehq .com)"

• "ET INFO DYNAMIC_DNS Query to a *.visalawyer .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-liberal .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xxxxx .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jolleybeef .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lflink .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mobile-node .net Domain"

• "ET WEB_SERVER .PHP being served from WP 1-flash-gallery Upload DIR (likely malicious)"

• "ET INFO Observed SyncroMSP Remote Management Software Domain in DNS Lookup (repairshopr .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.internetzninja .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mystakidis .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.info .gf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.irq .ro Domain"

• "ET WEB_SERVER WebShell - MySQL Interface - Database List"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.surfnet .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.swhill .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-certified .com Domain"

• "ET INFO Observed Collaboration/File Sharing Platform Domain (www .notion .so in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.est-le-patron .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.firstimage .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zyns .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.callmark .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.buyshouses .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gr8domain .biz Domain"

• "ET INFO Possible ELF executable sent when remote host claims to send a Text File"

• "ET INFO DYNAMIC_DNS Query to a *.squirly .info Domain"

• "ET USER_AGENTS Observed Suspicious UA (\xa4)"

• "ET INFO DYNAMIC_DNS Query to a *.is-very-bad .org Domain"

• "ET INFO Observed File Sharing Domain (www .cloudme .com in TLS SNI)"

• "ET WEB_SERVER HTTP Request to a *.33db9538.com domain - Anuna Checkin - Compromised PHP Site"

• "ET INFO Suspicious GET Request with Possible COVID-19 URI M1"

• "ET INFO Suspicious Windows Commands in POST Body (ipconfig)"

• "ET INFO DYNAMIC_DNS Query to a *.bumbleshrimp .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of substr %u UTF-8 Encoding"

• "ET USER_AGENTS Suspicious User-Agent (Windows XP)"

• "ET INFO DYNAMIC_DNS Query to a *.khabbaby .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.authorizeddns .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dsmtp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.trumpetx .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.primeent .in Domain"

• "ET INFO DYNAMIC_DNS Query to a *.moonangel .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tdkare .ru Domain"

• "ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash Possibly Related to Remote Code Execution Attempt"

• "ET CURRENT_EVENTS Possible Fedex Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to *.lowestprices.at Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.anpmech .com Domain"

• "ET INFO Browser Plugin Detect - Observed in Apple Phishing"

• "ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound"

• "ET INFO DYNAMIC_DNS Query to a *.serveftp .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.roig .com Domain"

• "ET EXPLOIT Possible REvil 0day Exploitation Activity Inbound"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.flink .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.reves .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-fl .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kozow .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.randyalsup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dob .jp Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shit .vc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.justlearning .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-geek .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.hopto .me"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kozow .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.senaputra .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.klodia .ru Domain"

• "ET POLICY Possible Mobile Malware POST of IMSI International Mobile Subscriber Identity in URI"

• "ET INFO DYNAMIC_DNS Query to a *.toythieves .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xseller .com Domain"

• "ET POLICY Possible Powershell .ps1 Script Use Over SMB"

• "ET ATTACK_RESPONSE Obfuscated Eval String 1"

• "ET INFO DYNAMIC_DNS Query to a *.veta .su Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bloom .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-soxfan .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-nc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.manishnene .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.smlsoft .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.serveexchange .com"

• "ET POLICY DNS Query to DynDNS Domain *.mysecuritycamera .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tru .io Domain"

• "ET INFO File Sharing Related Domain in DNS Lookup (filesend .jp)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-libertarian .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.n43 .pw Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-01"

• "ET INFO DYNAMIC_DNS Query to a *.pintravel .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.friendship .twa Domain"

• "ET INFO Dotted Quad Host RAR Request"

• "ET POLICY DNS Query to DynDNS Domain *.golffan .us"

• "ET EXPLOIT Metasploit -Java Atomic Exploit Downloaded"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.d-n-s .org .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.taco-land .net Domain"

• "ET INFO Observed DNS Query for EmerDNS TLD (.lib)"

• "ET INFO Custom Endpoint Service Domain in DNS Lookup (mockbin .org)"

• "ET INFO DYNAMIC_DNS Query to dns-stuff.com Domain *.dns-stuff.com"

• "ET POLICY HTTP traffic on port 443 (CONNECT)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sequoiapartners .com Domain"

• "GPL MISC rlogin echo++"

• "ET TROJAN DNS Query Gauss Domain *.guest-access.net"

• "ET INFO DYNAMIC_DNS Query to a *.scieron.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.eubonia .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.mysecuritycamera .org"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-02-13 M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kicks-ass .org Domain"

• "ET DNS Query for a Suspicious *.upas.su domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String 5"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.earlyriserscoffeeshop .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hondascooterparts .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xst .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mooo .info Domain"

• "ET INFO Obfuscated Split String (Double Q) 9"

• "ET INFO DYNAMIC_DNS Query to a *.ucvradio .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-hard-worker .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ix .tc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yiamuc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homaxcorp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.internet-slackers .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.now-dns .org Domain"

• "ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download"

• "ET SCAN MySQL Malicious Scanning 2"

• "ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL"

• "ET POLICY DNS Query to DynDNS Domain *.serveirc .com"

• "ET INFO DYNAMIC_DNS Query to a *.powermotors .com .br Domain"

• "ET DNS Query for Suspicious .noip.cn Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.l5 .ca Domain"

• "ET CURRENT_EVENTS Centurylink Phishing Landing 2018-04-19"

• "ET INFO DYNAMIC_DNS Query to a Suspicious *.dnsip.ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-al .com Domain"

• "ET USER_AGENTS Suspicious User-Agent (Windows 10)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.usakoi .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.getmyip .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xox .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myeffect .net Domain"

• "ET CURRENT_EVENTS TDS Sutra - redirect received"

• "ET INFO DYNAMIC_DNS Query to a *.voyez .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsapi .info Domain"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Hex Encoded Class file"

• "ET INFO DYNAMIC_DNS Query to a *.livewave .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.norushcharge .com Domain"

• "ET USER_AGENTS Suspicious User-Agent (Windows 8)"

• "ET INFO HTTP POST Request to Suspicious *.gq domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nau .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.computersforpeace .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsapi .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.khabdha .org domain"

• "ET DNS DNS Query to a Suspicious *.vv.cc domain"

• "ET INFO DYNAMIC_DNS Query to a *.endoftheinternet .org Domain"

• "ET CURRENT_EVENTS Suspicious FTP RETR to .hta file possible exploit (CVE-2017-0199)"

• "ET INFO DYNAMIC_DNS Query to a *.hpc .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.it-share .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.merseine .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.krnc .biz Domain"

• "ET CURRENT_EVENTS TSB Bank / Lloyds Bank Phishing Landing 2018-02-01"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.anime-stars .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mandhplum .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chery .co .il Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myddns .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.abatek .com Domain"

• "ET INFO HTTP Request to a 3322.org.cn Domain"

• "ET CURRENT_EVENTS Banque Populaire Phishing Landing 2018-02-05"

• "ET CURRENT_EVENTS ABSA Online Phishing Landing 2018-01-23"

• "ET INFO Pastebin Style Domain in DNS Lookup (www .logpasta .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to *.byinter.net Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.merrittcredit .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.accesscam .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.enemyterritory .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ssmailer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.loscantarostemuco .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.neoneptune .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.clickit .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nelsonshack .com Domain"

• "ET INFO Observed Suspicious Reversed String Inbound (Winmgmts)"

• "ET INFO DYNAMIC_DNS Query to a *.swds .com .au Domain"

• "ET POLICY DNS Query to .onion proxy Domain (pay4tor.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveirc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mw .nom .za Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xxxy .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.surfnet .ca Domain"

• "ET INFO SUSPICIOUS Excel Add-in Download M1"

• "ET POLICY Packity Proxy Connection"

• "ET MALWARE DownLoadAdmin Activity"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tumsun .com Domain"

• "ET INFO Obfuscated Split String (Double Q) 11"

• "ET POLICY SMB2 Remote AT Scheduled Job Create Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isa-geek .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.intercop .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rundis .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bine .me Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.greengarden .net .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.utm .co .il Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-republican .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qhigh .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.btarena .com Domain"

• "ET INFO Empty POST with Terse Headers Over Non Standard Port"

• "ET INFO DYNAMIC_DNS Query to a *.darvin .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.linkin .tw Domain"

• "ET WEB_SERVER WebShell - Simple - Title"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-green .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ham .gd Domain"

• "ET INFO DYNAMIC_DNS Query to a *.abk .ch Domain"

• "ET POLICY SMB Remote AT Scheduled Job Pipe Creation"

• "ET INFO DYNAMIC_DNS Query to *.rr.nu Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dvrcam .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.now-dns .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ftpaccess .cc Domain"

• "ET POLICY HTTP Request to a *.co.be domain"

• "ET INFO Obfuscated Split String (Single Q) 4"

• "ET INFO DYNAMIC_DNS Query to a *.lovethosetrains .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mathewparkin .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zaibar .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.opticalize .com Domain"

• "ET INFO Lockbit Ransomware Related Domain in DNS Lookup (lockbit-decryptor .com)"

• "ET INFO Observed File Sharing Domain (zippyshare .com in TLS SNI)"

• "ET CURRENT_EVENTS Possible NatWest Bank Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.logic .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mrface .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-mail .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.enia .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.make .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ast .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynserv .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shekinahphotography .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dns1 .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.biketoss .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pegle .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rren .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-de .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.simplecharity .com Domain"

• "ET POLICY Possible HTA Application Download"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.operationbim .com Domain"

• "ET USER_AGENTS Suspicious User-Agent (adlib)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tecalideherrera .gob .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynuddns .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mynetav .org Domain"

• "ET NETBIOS DCERPC DCOM ExecuteShellCommand Call - Likely Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ozziesworld .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-office .com Domain"

• "ET WEB_CLIENT Base64 Encoded Java Value"

• "ET INFO Request to .CF Domain with Minimal Headers"

• "ET USER_AGENTS Suspicious User-Agent (Collection Info)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ajalo .com Domain"

• "ET INFO Base64 Encoded Windows IP Configuration Output in HTTP POST M1"

• "ET INFO DYNAMIC_DNS Query to a *.ve3 .info Domain"

• "ET INFO Observed SyncroMSP Remote Management Software Domain (repairshopr .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.icemail .me .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.boxathome .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-leet .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cuetara .name Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thompent .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gurdit .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.notici .as Domain"

• "ET INFO DYNAMIC_DNS Query to a *.host2go .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cylone .net Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.for-more .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alanbrothers .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rootsbobcat .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ftp1 .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.showmyhomes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ntdll .top Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.seasol .org Domain"

• "ET USER_AGENTS Observed Malicious User-Agent (Brute Force Attacks)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-cpa .com Domain"

• "ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound M5"

• "ET USER_AGENTS Suspcious LeakIX User-Agent (l9explore)"

• "ET WEB_SERVER PHP REQUEST SuperGlobal in POST"

• "ET MALWARE Win32/Adware.Vonteera.M Variant CnC Activity"

• "ET INFO Java Request to DynDNS Pro Dynamic DNS Domain"

• "ET INFO DYNAMIC_DNS Query to a *.photographs .gs Domain"

• "ET INFO Chocolatey Windows Package Management Installation File Retrieval"

• "ET INFO DYNAMIC_DNS Query to a *.fridg .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.taco-land .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bang .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sexxxy .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.benjamin .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jomblo .asia Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tibet .org Domain"

• "ET INFO Lucy Security - Awareness Landing Page M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.btbtrading .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isasecret .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mylogisoft .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cityofgreen .com .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.powermotors .com .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.suns .si Domain"

• "ET CURRENT_EVENTS Generic HeapSpray Construct"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webhop .me Domain"

• "ET INFO DYNAMIC_DNS Query to a *.loghomelights .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.360technologies .ca Domain"

• "ET INFO Observed DNS Query to .life TLD"

• "ET INFO DYNAMIC_DNS Query to a *.reasonman .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blueshadows .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.groups .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.proxydns .com Domain"

• "ET CURRENT_EVENTS Christian Mingle Phishing Landing 2018-08-07"

• "ET INFO DYNAMIC_DNS Query to a *.from-wv .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mollypornstar .com domain"

• "ET INFO DYNAMIC_DNS Query to a *.truckstore .ch Domain"

• "ET INFO Commonly Abused File Sharing Domain in DNS Lookup (filetransfer .io)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.endoftheinternet .org Domain"

• "ET POLICY Vulnerable Java Version 19.0.x Detected"

• "ET INFO DYNAMIC_DNS Query to a *.keystoneuniformcap .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hmsolucoes .com Domain"

• "ET CURRENT_EVENTS Styx Exploit Kit Payload Download"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tx2600 .net Domain"

• "ET CURRENT_EVENTS Adobe Phishing Landing 2018-08-07"

• "ET INFO DYNAMIC_DNS Query to a *.leonardocastano .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.game-host .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aen .su Domain"

• "ET INFO DYNAMIC_DNS Query to a *.firesidegrillandbar .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-cpa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sovich .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hedbergandson .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.moot .es Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-04-09"

• "ET INFO DYNAMIC_DNS Query to a *.dnsalias .com Domain"

• "ET DNS APT_NGO_wuaclt C2 Domain micorsofts.com"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-hard-worker .com Domain"

• "GPL FTP CWD ~root attempt"

• "ET INFO DYNAMIC_DNS Query to a *.onapon .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alfa145 .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blacknapkins .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sixth .biz Domain"

• "ET CURRENT_EVENTS Bank of America Phishing Landing 2018-04-19"

• "ET INFO HTTP Request with Double Cache-Control"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yourvaluedhomes .com Domain"

• "ET INFO Terse Request For Bitbucket Snippet"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (YXJ0LVByb2N) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.crossharbour .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sceniconline .com Domain"

• "ET INFO HTTP POST Request to Suspicious *.ml Domain"

• "ET INFO DYNAMIC_DNS Query to a *.adagio .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.teamradicus .com Domain"

• "ET POLICY HTTP Request to a *.vv.cc domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.davidmcorn .com Domain"

• "ET INFO SUSPICIOUS UA (iexplore)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.devicars .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fatdiary .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.servegame .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.parikh .net Domain"

• "ET INFO HTTP Request to a *.cam domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sococoffee .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yhkrubber .com .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.trickip .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.my .to Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.securitytactics .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.adepoju .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.astrabus .ru Domain"

• "ET WEB_CLIENT Obfuscated Javascript // ptth"

• "ET INFO Obfuscated Split String (Double Q) 6"

• "ET INFO Suspicious Request to iplogger .org Contains Period"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.publicvm .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.https443 .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servehalflife .com Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (ctT2J) in DNS TXT Response"

• "ET INFO DYNAMIC_DNS Query to a *.ubntddns .com Domain"

• "ET WEB_SERVER PHP ENV SuperGlobal in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jodymaroni .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynet .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pwm .hu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.baez .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sino .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.n-e-t .name Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.truckstore .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.galipan .org Domain"

• "ET INFO Request for .bin with BITS/ User-Agent"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-me .org Domain"

• "ET INFO Observed Remote Management Software Domain (syncromsp .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dailyview .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.klockars .com Domain"

• "ET CURRENT_EVENTS Upgrade Advantage Phishing Landing 2018-02-22"

• "ET INFO PS1 Powershell File Request"

• "ET INFO Cloned Chase Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.oc .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.champagnewishesandrvdreams .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a .dyndns-.com domain"

• "ET INFO DYNAMIC_DNS Query to a *.drtonywang .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.z0d .eu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-la .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.govt .hu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.smathis .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.essexregional .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.0x .no Domain"

• "ET WEB_CLIENT Hex Obfuscation of charCodeAt % Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.at-band-camp .net Domain"

• "ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)"

• "ET INFO DYNAMIC_DNS Query to a *.recruitment7 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mylftv .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jmstudios .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wild1 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.0x .no Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jkub .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.soapclient .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.andreymorozov .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.windmillstravel .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.celebsplay .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddns.info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.antexknitting .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mrface .com Domain"

• "ET POLICY Vulnerable Java Version 15.0.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pbohara .com Domain"

• "ET EXPLOIT Malformed HeartBeat Request"

• "ET INFO DYNAMIC_DNS Query to a *.lospenitentes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.everton .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddnsking .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.meier .li Domain"

• "ET CURRENT_EVENTS DRIVEBY EgyPack Exploit Kit Cookie Present"

• "ET INFO HTTP Request to a *.tc domain"

• "ET INFO DYNAMIC_DNS Query to a *.yourtrap .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kik .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iownyour .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.onthenetas.com Domain (Sitelutions)"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing M1 2018-04-19"

• "ET INFO Observed OpenDrive Cloud Storage SSL Cert"

• "ET INFO DYNAMIC_DNS Query to a *.inet2 .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.paulkelly .org Domain"

• "ET INFO DDoS-Guard Hosted Content"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lospenitentes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-bulls-fan .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alfa145 .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.project .li Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.grid-tronics .com Domain"

• "ET INFO Anonymous File Sharing Domain in DNS Lookup (fromsmash .co)"

• "ET INFO DYNAMIC_DNS Query to a *.from-pa .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.efxs .ca Domain"

• "ET INFO CDXML Powershell File Request"

• "ET INFO DYNAMIC_DNS Query to a *.wanip .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lflinkup .net Domain"

• "ET CURRENT_EVENTS Yahoo Account Verification Phishing Landing 2018-02-05"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.n4t .co Domain"

• "ET INFO RDP Wrapper Download (bat)"

• "ET INFO Cloned ATB Bank Online Page - Possible Phishing Landing"

• "ET INFO Commonly Abused Domain in DNS Lookup (rf .gd)"

• "ET INFO DYNAMIC_DNS Query to a *.ikwb .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.workisboring .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.giseler .com Domain"

• "ET CURRENT_EVENTS Possible Alibaba Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freewww .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.biometrika .cl Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torwinner.com)"

• "ET INFO Office UA Retrieving Content on Unusually High Port"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.encyclopedia .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.auraria .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dsmtp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sandhofner .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dade .si Domain"

• "ET CURRENT_EVENTS Likely Scalaxy Exploit Kit URL template download"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.3utilities .com Domain"

• "ET INFO DYNAMIC_DNS Query to *isthebe.st Domain (Sitelutions)"

• "ET WEB_SERVER PHP POST SuperGlobal in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.404 .mn Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String 4"

• "ET INFO DYNAMIC_DNS Query to a *.fr .to Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cable-modem .org Domain"

• "ET INFO Suspicious explorer.exe in URI"

• "ET INFO DYNAMIC_DNS Query to a *.dnsalias .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cityofgreen .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.larakaras .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.h0stname .net Domain"

• "ET INFO Pastebin Style Domain in DNS Lookup (pastetext .net)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lovethosetrains .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.longmusic .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.circusslaves .com Domain"

• "ET INFO PSM1 Powershell File Request"

• "ET INFO DYNAMIC_DNS Query to a *.jcor .ca Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.null)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pogramkran .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tipoiti .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sino .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.robot-armies .com Domain"

• "ET INFO Dotted Quad Host VBS Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.faefox .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pedie .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myogaya .jp Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kawa-kun .com Domain"

• "ET INFO PowerShell NonInteractive Command Common In Powershell Stagers"

• "ET INFO DYNAMIC_DNS Query to a *.devwonders .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.caribbeanpremierhotels .com Domain"

• "ET INFO Suspicious User-Agent (Mozilla/5.0_)"

• "ET INFO Generic IOT Downloader Malware in GET (Outbound)"

• "ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.possessed .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mrgshrimp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.justlearning .net Domain"

• "ET INFO Cloned Simplii Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.ripservers .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.off .li Domain"

• "ET WEB_CLIENT Google Chrome Pdfium JPEG2000 Heap Overflow"

• "ET INFO DYNAMIC_DNS Query to a *.stocktester .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.colloky .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onedumb .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alam-maritim .com .my Domain"

• "ET WEB_SERVER Possible SQLi xp_cmdshell POST body"

• "ET INFO DYNAMIC_DNS Query to a *.homelinux .org Domain"

• "ET USER_AGENTS Observed Suspicious UA (CODE)"

• "ET INFO DYNAMIC_DNS HTTP Request to *.kwik.to Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servegame .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.read-books .org"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-an-anarchist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pgdotocec .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iiiii .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.away .im Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cohens .org .il Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wolf-tec .net Domain"

• "ET POLICY DNS Query to DynDNS Domain *.fantasyleague .cc"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.simplecharity .com Domain"

• "ET WEB_SERVER SQL Errors in HTTP 500 Response (ERROR syntax error at or near)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.creery .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homeunix .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cechire .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.64-b .it Domain"

• "ET DNS Query to a *.pw domain - Likely Hostile"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-bookkeeper .com Domain"

• "ET INFO Suspected Impacket WMIExec Activity"

• "ET INFO DYNAMIC_DNS Query to a *.bizzapp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.joe-joubert .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kbgz .com .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sells-for-less .com Domain"

• "ET INFO DYNAMIC_DNS Query to *assexyas.com Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.privatedns .org Domain"

• "ET INFO Possible Successful Generic Phish to webwave .dev Domain 2023-05-24"

• "ET TROJAN DNS query for Morto RDP worm related domain jaifr.net"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myjamesonline .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jupiterns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.macrofox .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-sd .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gatesweb .info Domain"

• "ET WEB_CLIENT Suspicious Embedded Shockwave Flash In PDF"

• "ET POLICY SUSPICIOUS *.doc.exe in HTTP URL"

• "ET CURRENT_EVENTS Styx Exploit Kit Secondary Landing"

• "ET CURRENT_EVENTS Capital One Phishing Landing 2018-02-13 M1"

• "ET USER_AGENTS Suspicious UA Observed (Ave, Caesar!)"

• "ET INFO DYNAMIC_DNS Query to a *.isteingeek .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gilead .org .il Domain"

• "ET USER_AGENTS Suspicious User Agent (explorersvc)"

• "ET INFO Likely Hex Encoded Executable as String - Backtick Separated"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ubntddns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.revitcity .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wikaba .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.go .dyndns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mysecuritycamera .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.nflfan .org"

• "ET INFO Dotted Quad Host PPT Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.32-b .it Domain"

• "ET POLICY DNS Query to .onion proxy Domain (totortoweb.com)"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2018-04-14"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lotusblossomconsulting .com Domain"

• "ET INFO Wget Request for Executable"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zyns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class B64 encoded class"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thehomeserver .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a [Redacted - Vulgar] Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sly .io Domain"

• "ET INFO DYNAMIC_DNS Query to a *.addns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jbworks .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ldtp .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-mn .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.appia .com .au Domain"

• "ET INFO DYNAMIC_DNS Query to a *.4ippi .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.groks-this .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.staffpro .net Domain"

• "ET INFO Dotted Quad Host M8 (noalert)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.joseulloa .cl Domain"

• "ET POLICY DNS Query to .onion proxy Domain (onion2web.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.folklandmanagement .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lamivolts .com Domain"

• "ET INFO Observed URL Shortening Service Domain (appurl .io in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.gotdns .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shitcunt .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myhousesetup .com Domain"

• "ET CURRENT_EVENTS Dropbox Business Phishing Landing 2018-02-07"

• "ET POLICY DNS Query to DynDNS Domain *.dynns .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mudchute .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hijaxdesigns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.okay .com .tr Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.angellombardi .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.allez .la Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddns.name Domain"

• "ET INFO DYNAMIC_DNS Query to a *.itemdb .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.manishnene .com Domain"

• "ET CURRENT_EVENTS Smartsheet Phishing Landing 2018-01-29"

• "ET INFO DYNAMIC_DNS Query to a *.macao .org Domain"

• "ET INFO Observed Anonymous File Sharing Service in SSL Cert (fromsmash .co)"

• "ET GAMES Multiple Game Cheat Application Activity"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.readmyblog .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isageek .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-lost .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.machinezdesign .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.davidmcorn .com Domain"

• "ET CURRENT_EVENTS Bank of America Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.sjschroeder .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.buys .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ketubruk .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fpr .net Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M8"

• "ET POLICY Vulnerable Java Version 11.0.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.handfolding .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynalias .net Domain"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing Classes used in awt exploits"

• "ET INFO DYNAMIC_DNS Query to a *.appswiss .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.2fine .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kayanganmedia .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sleeperkidsworld .com Domain"

• "ET INFO Abnormal User-Agent No space after colon - Likely Hostile"

• "ET WEB_CLIENT Hex Obfuscation of charCodeAt %u UTF-16 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.work .gd Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dns-report .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.utm .co .il Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vr .lt Domain"

• "ET INFO External IP Address Lookup Service in DNS Lookup (getip .pro)"

• "ET INFO Suspicious GET Request for .x86"

• "ET INFO DYNAMIC_DNS Query to a *.mynumber .org Domain"

• "ET SCAN Suspicious inbound to PostgreSQL port 5432"

• "ET INFO DYNAMIC_DNS Query to a *.cky .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blackbeltmail .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.joiavip .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qvd .com .br Domain"

• "ET INFO UPnP Discovery Search Response - CVE-2012-5958 and CVE-2012-5959 Vulnerable UPnP device M1"

• "ET INFO DYNAMIC_DNS Query to a *.swphoa .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.baselinux .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.primeent .in Domain"

• "ET POLICY Vulnerable Java Version 21.0.x Detected"

• "ET INFO HTTP Request to Suspicious *.desi Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.empires-r .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sexmistrz .pl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.health-carereform .com Domain"

• "ET TROJAN DNS query for Morto RDP worm related domain jaifr.com"

• "ET INFO DYNAMIC_DNS Query to a *.is-uberleet .com Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String (Single Q) 7"

• "ET ATTACK_RESPONSE Obfuscated Eval String (Single Q) 4"

• "ET INFO Observed DNS Query for FurNIC TLD (.fur)"

• "ET INFO DYNAMIC_DNS Query to a *.vlad .md Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.derekcturner .net Domain"

• "ET INFO Observed Suspicious Reversed String Inbound (Powershell)"

• "ET WEB_CLIENT SUSPICIOUS Possible automated connectivity check (www.bing.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.echoparklake .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bmvl .ru Domain"

• "ET INFO Dotted Quad Host HTA Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.for-better .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kst .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.poo .li Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.minecraftnoob .com Domain"

• "ET INFO DNS Query for Suspicious .gq Domain"

• "ET INFO DYNAMIC_DNS Query to a *.qualitypoolsboulder .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.moochurch .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.absl .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.reasonman .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.2mydns .net Domain"

• "ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement"

• "GPL ATTACK_RESPONSE id check returned apache"

• "ET INFO DYNAMIC_DNS Query to a *.dagz .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mywww .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.acmetoy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.suroot.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thenest .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-saved .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.with .mirkforce .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.australia .ai Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ezwebsites .com Domain"

• "ET WEB_SERVER WebShell - MySQL Interface - Auth Prompt"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.usrsrc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webmdee .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.https443 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-wa .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.visorideags .gob .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-geek .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.afphila .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-co .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.scrapping .cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isteingeek .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dubya .us Domain"

• "ET WEB_SERVER PHP SERVER SuperGlobal in POST"

• "ET INFO curl User-Agent to Dotted Quad"

• "ET POLICY DNS Query to DynDNS Domain *.ditchyourip .com"

• "ET INFO DYNAMIC_DNS Query to a *.photogenic .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.montyconsulting .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.visite .es Domain"

• "ET CURRENT_EVENTS Possible YapiKredi Bank (TR) Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.garmanage .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.technicalsupportresources .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.starnerd .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.good-newz .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.broke-it .net Domain"

• "ET POLICY SMB2 NT Create AndX Request For a .sys File - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-guru .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ajalo .com Domain"

• "ET CURRENT_EVENTS Possible OWA Mail Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alanrjr .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.capim .com .mx Domain"

• "ET INFO Suspicious Request for Doc to IP Address with Terse Headers"

• "ET INFO DYNAMIC_DNS Query to a *.apocalypto .org .uk domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyn .mk Domain"

• "ET INFO Observed TinyNuke Admin Panel URL Pattern"

• "ET INFO DYNAMIC_DNS Query to a *.game-server .cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tehlab .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gally .jp Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ugo .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sixth .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.brokenfuture .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-celticsfan .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.corum .com Domain"

• "ET INFO Cloned Ziggo NL Page - Possible Phishing Landing"

• "ET INFO Base64 Encoded Windows IP Configuration Output in HTTP POST M2"

• "ET INFO GET Request to Pastebin .com with PowerShell User-Agent"

• "ET INFO Downloaded Powershell Script Detects AV Product"

• "ET INFO Dotted Quad Host DOC Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.arrowtechnical .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.navnirwana .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jade-hamburg .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mrgshrimp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-in .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-geek .net Domain"

• "ET INFO WinUpack Modified PE Header Inbound"

• "GPL TELNET Telnet Root not on console"

• "ET WEB_CLIENT Possible % Encoded Iframe Tag"

• "ET INFO DYNAMIC_DNS Query to a *.tantrum .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webredirect .org Domain"

• "ET WEB_CLIENT Hex Obfuscation of eval %u UTF-8 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.flazzard .com Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-08-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.robot-armies .com Domain"

• "ET CURRENT_EVENTS s0m3 Phishing Landing 2018-04-09"

• "ET WEB_SERVER Non-Standard HTML page in Joomla /com_content/ dir"

• "ET INFO DYNAMIC_DNS Query to a *.webmdee .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.unibutton .com Domain"

• "ET INFO Obfuscated Split String (Single Q) 12"

• "ET INFO DYNAMIC_DNS Query to a *.swhydro .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fridg .com Domain"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (CookiesList.txt)"

• "ET INFO DYNAMIC_DNS Query to a *.4040 .idv .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4pu .com Domain"

• "ET CURRENT_EVENTS Likely Cloned .EDU Website Phishing Landing 2018-02-02"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iugaming .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tombu .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.prs7 .org Domain"

• "ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ubergate .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dropfiles .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.voltage .nz Domain"

• "ET CURRENT_EVENTS Possible Google Docs Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.1337 .cx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.monkeywerks .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.undo .it Domain"

• "ET INFO DYNAMIC_DNS Query to a *.port25 .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-az .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.teamradicus .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.faefox .org Domain"

• "ET INFO External IP Address Lookup Domain (eth0 .me) in DNS Lookup"

• "ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement"

• "ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thenest .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.3dxtras .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homenode .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.potomacriversafetycommittee .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fr .to Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sandmeiers .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.onmypc .net Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torjam.com)"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-bookkeeper .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dicionar .io Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sandcherrysystems .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eating-organic .net Domain"

• "ET DNS Query for Suspicious .pl.tf Domain"

• "ET INFO Cloned Yahoo Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.tinyrealm .com Domain"

• "ET POLICY HTTP HEAD invalid method case outbound"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bbgc .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.giize .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homelinux .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mymom .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.visorideags .gob .mx Domain"

• "ET WEB_SERVER WebShell Generic - reg HKEY_LOCAL_MACHINE"

• "ET INFO DYNAMIC_DNS Query to a *.us .to Domain"

• "ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (Zva2UtUmVzdE1ld) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.fragmentary .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.2waky .com Domain"

• "ET INFO Executable Requested from Evernote Link M2 (GET)"

• "ET INFO DYNAMIC_DNS Query for Suspicious .dyndns-at-home.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-gone .com Domain"

• "ET CURRENT_EVENTS TDS Sutra - page redirecting to a SutraTDS"

• "ET INFO DYNAMIC_DNS Query to a *.hackershack .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.klipp .su Domain"

• "ET INFO DYNAMIC_DNS Query to a *.theriens .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fatdiary .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.malam .or .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bqc .co .za Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gurdit .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.point2this .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.idigo .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.opaline .cl Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-01-18 M1"

• "ET POLICY SMB NT Create AndX Request For a DLL File"

• "ET INFO Anonymous File Sharing Domain in DNS Lookup (fromsmash .com)"

• "ET INFO DYNAMIC_DNS Query to a *.cardias .adv .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tecalideherrera .gob .mx Domain"

• "ET INFO Minimal HTTP GET Request to cl .ly"

• "ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse"

• "ET POLICY Vulnerable Java Version 18.0.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.flamex .hm Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shakedfamily .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mypicture .info Domain"

• "ET CURRENT_EVENTS Possible Apple Phishing Landing - Title over non SSL"

• "ET ATTACK_RESPONSE Obfuscated Eval String 2"

• "ET POLICY DNS Query to .onion proxy Domain (torsona.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.punked .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.camdvr .org Domain"

• "ET INFO DYNAMIC_DNS Query to *.passinggas.net Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.photo-frame .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myiphost .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.propertyshots .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iceage .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cw03 .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.4irc.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lflinkup .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.x3mfly .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.okzk .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nswrogaining .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sitaci .com Domain"

• "ET CURRENT_EVENTS Possible Successful Remax Phish - Hotmail Creds Nov 25 2013"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET WEB_SERVER UA WordPress probable DDOS-Attack"

• "ET INFO DYNAMIC_DNS Query to a *.kreider .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.instanthq .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.id .web .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fhi .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.extramindcorp .com Domain"

• "ET CURRENT_EVENTS Microsoft Ajax Phishing Landing 2018-08-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-techie .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kfco .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eolicatalinay .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.stuns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.qpoe .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.yurigoron .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bbsindex.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gentile .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.icemail .me .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-nc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.developer .li Domain"

• "ET INFO Suspicious Windows NT version 3 User-Agent"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.truewan .co .za Domain"

• "ET INFO HTTP Request to a *.uni.cc domain"

• "ET POLICY DNS Query to .onion proxy Domain (bonytor.com)"

• "ET INFO Cloned RBC Royal Bank Page - Possible Phishing Landing"

• "ET POLICY Vulnerable Java Version 17.0.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gtk .cl Domain"

• "ET INFO EXE Download With Content Type Specified As Empty"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dabhome .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.keecha .com Domain"

• "ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"

• "ET POLICY DNS Query to DynDNS Domain *.mydissent .net"

• "ET INFO DYNAMIC_DNS Query to a *.kik .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lqtai .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.joe-joubert .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.buyshouses .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.klodia .ru Domain"

• "ET INFO HTTP Request to a *.at.tf domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.widlund .fi Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ma .com Domain"

• "ET POLICY DNS Query for try2check.me Carder Tool"

• "ET INFO SUSPICIOUS Excel Add-in Download M2"

• "ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.champagnewishesandrvdreams .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.podzone .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.satelit .org domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.leonisbg .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.disisleri .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-nurse .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sceniconline .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.autoprin .com Domain"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class file Importing Protection Domain"

• "ET INFO Likely Hex Encoded Executable as String - Percent Separated"

• "ET INFO DYNAMIC_DNS Query to a *.monitoryourinternet .com Domain"

• "ET INFO Likely Hex Encoded Executable as String - Double Quote Separated"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homeunix .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qpoe .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsdyn .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servequake .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.voyez .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zeleznock .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.crabdance .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.compy .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.themoosebarn .com Domain"

• "ET POLICY PDF With Embedded File"

• "ET INFO HTTP POST to WP Theme Directory Without Referer"

• "ET INFO DYNAMIC_DNS Query to a *.ideas-informatica .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fhi .hk Domain"

• "ET INFO Potential Common Malicious JavaScript Loop"

• "ET POLICY DNS Query to .onion proxy Domain (bladetor.com)"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.gopher)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sundby .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cartes .cl Domain"

• "ET DNS DNS Query for Suspicious .ch.vu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-tn .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gleeze .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.theserver .tk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsrd .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.southern .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rren .ch Domain"

• "ET INFO 404 Response with Javascript Variable in Page"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-ip .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.midjava .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.skytaxi .jp Domain"

• "ET INFO DYNAMIC_DNS Query to a *.appia .com .au Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.almostmy .com Domain"

• "ET INFO Suspected Malicious Powershell Script (Inbound)"

• "ET INFO DYNAMIC_DNS Query to a *.dsmtp .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rootsbobcat .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.linuxstart .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.uk .to Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bounceme .net Domain"

• "ET INFO External IP Check Domain in DNS Lookup (ip .cn)"

• "ET INFO Possible Phishing Redirect 2018-01-30"

• "ET USER_AGENTS Suspicious User-Agent (HaxerMen)"

• "ET INFO DYNAMIC_DNS Query to a *.mcsoft .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sococoffee .com Domain"

• "ET INFO PowerShell DownloadString Command Common In Powershell Stagers"

• "ET INFO DYNAMIC_DNS Query to a *.dontexist .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chickenkiller .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dontexist .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ivi .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.photo-cult .com Domain"

• "ET TROJAN DNS query for Morto RDP worm related domain qfsl.net"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ikwb .com Domain"

• "ET DNS Query for Suspicious .edu.tf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.maya .se Domain"

• "ET INFO Cloned Microsoft Office Apps Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chicago360factor .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wo5m .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bnene .com Domain"

• "ET INFO Interactsh Domain in DNS Lookup (.interactsh .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homelinux .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ppalma .cl Domain"

• "ET USER_AGENTS User-Agent (Internet Explorer)"

• "ET INFO DYNAMIC_DNS Query to a *.estic .org Domain"

• "ET CURRENT_EVENTS Generic Email Validation Phishing Landing 2018-02-13"

• "ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound M4"

• "ET INFO DYNAMIC_DNS Query to a *.bkpsports .com Domain"

• "ET POLICY HTTP Request to a *.be.ma domain"

• "ET CURRENT_EVENTS Spotify Phishing Landing 2018-02-19"

• "ET INFO DYNAMIC_DNS Query to a *.qc .to Domain"

• "ET CURRENT_EVENTS Possible Wells Fargo Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain"

• "ET POLICY SMB NT Create AndX Request For an Executable File In a Temp Directory"

• "ET INFO DYNAMIC_DNS Query to a *.contem .bz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kak .si Domain"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-04-09"

• "ET INFO DYNAMIC_DNS Query to a *.pusilkom .com Domain"

• "ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-blogger .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ikoona .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ne .com Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String (Single Q) 5"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gatesweb .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cloudns .net Domain"

• "ET POLICY DNS Query to DynDNS Domain *.point2this .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.leonardocastano .com .ar Domain"

• "ET INFO Cloned Fidelity Page - Possible Phishing Landing"

• "ET INFO Suspicious Windows NT version 2 User-Agent"

• "ET INFO DYNAMIC_DNS Query to a *.motorwisemechanical .com .au Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aletoledo .com Domain"

• "ET SMTP Incoming SMTP Message with Possibly Malicious MIME Epilogue 2016-05-13 (BadEpilogue)"

• "ET INFO DYNAMIC_DNS Query to a *.yaguar .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thainewasia .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ourhobby .com Domain"

• "ET CURRENT_EVENTS DRIVEBY Java Rhino Scripting Engine Exploit Downloaded"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hedbergandson .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.at-band-camp .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cartes .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pusilkom .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ftp .sh Domain"

• "ET INFO DYNAMIC_DNS Query to a *.docuprint .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jweststudio .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kicks-ass .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.webhop .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vpnx .nl Domain"

• "ET WEB_CLIENT Possible %u UTF-8 Encoded Iframe Tag"

• "ET INFO DYNAMIC_DNS Query to a *.selfip .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eupla .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sells-it .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.redsteedstudios .com Domain"

• "ET INFO WebDAV Retrieving .dll"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.minecraftr .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-lawyer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.24h .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.neisa .com Domain"

• "ET INFO Cloned Bank of America Page - Possible Phishing Landing M3"

• "ET INFO DYNAMIC_DNS Query to a *.oops .wtf Domain"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-02-12"

• "ET INFO Obfuscated Split String (Double Q) 10"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dubya .net Domain"

• "ET POLICY HTTP traffic on port 443 (PROPFIND)"

• "ET INFO DYNAMIC_DNS Query to a *.wiki .gd Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jcor .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.networkindia .com Domain"

• "ET INFO HTTP Request to a *.eu.tf domain"

• "ET INFO DYNAMIC_DNS Query to a *.novohorizonte .pt Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.audolatry .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.embeddedonline .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.stoupin .ru Domain"

• "ET POLICY Vulnerable Java Version 16.0.x Detected"

• "ET SCAN StarDotStar HELO, suspected AUTH LOGIN botnet"

• "ET INFO Request to .TOP Domain with Minimal Headers"

• "ET SMTP EXE - ZIP file with .pif filename inside"

• "ET INFO DYNAMIC_DNS Query to a *.usrsrc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dns2 .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.majoitus .ee Domain"

• "ET INFO Online File Storage Domain in DNS Lookup (gofile .io)"

• "ET INFO DNS Query to a *.slyip.net Dynamic DNS Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tobuy .us Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M7"

• "ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.doesntexist .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.biketoss .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blizzie .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.argusdenshi .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.doesntexist .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shadir .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mrbasic.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cardias .adv .br Domain"

• "ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aber .ir Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.horng-bin .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.easefun .hk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.remotecam .nu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dontexist .net Domain"

• "ET INFO HTTP POST Request to Suspicious *.cf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hs .vc Domain"

• "ET CURRENT_EVENTS WeTransfer Phishing Landing 2018-08-30"

• "ET MALWARE Win/Malware.FileTour Variant Checkin"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.for-some .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-liberal .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ind .st Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddnslive .com Domain"

• "ET CURRENT_EVENTS SUSPICIOUS Java Request to Afraid.org Top 100 Dynamic DNS Domain"

• "ET INFO Cloned Match Dating Page - Possible Phishing Landing"

• "ET POLICY DNS Query to DynDNS Domain *.serveminecraft .net"

• "ET DNS Query for Suspicious .gr.com Domain (gr .com in DNS Lookup)"

• "ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (V4dC5FbmNvZ) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .ws Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mine .bz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.readmyblog .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.merseine .com Domain"

• "ET CURRENT_EVENTS Possible Raiffeisen Bank Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.seahorsenet .com Domain"

• "ET CURRENT_EVENTS IRS Phishing Landing 2018-05-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.seasol .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-office .com Domain"

• "ET WEB_CLIENT SUSPICIOUS Possible automated connectivity check (www.msn.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hackershack .net Domain"

• "ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-very-bad .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.endofinternet .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ayasophia .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.v0id .nl Domain"

• "ET POLICY DNS Query to DynDNS Domain *.servecounterstrike .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dotbot .us Domain"

• "ET CURRENT_EVENTS Possible Successful Yahoo Phish Nov 25 2013"

• "ET INFO DYNAMIC_DNS Query to a *.bearfacts .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.paranormalgroup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ar .com Domain"

• "ET POLICY HTTP Request to a *.co.tv domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-id .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.k .vu Domain"

• "ET INFO HTTP Request to a *.us.tf domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-work .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myogaya .jp Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.est-a-la-masion .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gpk .si Domain"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-02-14"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.moonangel .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-lost .org Domain"

• "ET WEB_CLIENT PDF With Embedded Flash Possible Remote Code Execution Attempt"

• "ET INFO DYNAMIC_DNS Query to a *.ddnslive .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ks .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.x443 .pw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vasilevsky .org Domain"

• "ET INFO Generic Powershell Launching Hidden Window"

• "ET INFO HTTP Request to Suspicious *.fit Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sosfuvos .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hosthampster .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ec .gy Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shaqnet .nu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.videounlimit .com Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET FTP Suspicious Quotation Mark Usage in FTP Username"

• "ET USER_AGENTS Suspicious User-Agent (urlRequest)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.robinhud .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mutsuura .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.got-game .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.abuser .eu Domain"

• "ET INFO Observed POST to xsph .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.autoprin .com Domain"

• "ET INFO DYNAMIC_DNS Query to *onthenetas.com Domain (Sitelutions)"

• "ET USER_AGENTS Observed Suspicious UA (Absent)"

• "ET INFO DYNAMIC_DNS Query to a *.flink .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.crafting .xyz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.trudireaume .com domain"

• "ET INFO DYNAMIC_DNS Query to a *.aptrc .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a Suspicious dynapoint.pw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pgdotocec .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-chef .org Domain"

• "ET MALWARE Win/Malware.FileTour Variant Checkin"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tantrym .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aispilot .com Domain"

• "ET CURRENT_EVENTS Dropbox Phishing Landing 2018-02-15"

• "ET CURRENT_EVENTS Apple AES Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.jundy .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cleansite .us Domain"

• "ET INFO Cloned Bank of America Page - Possible Phishing Landing M1"

• "ET INFO Observed DNS Query to .okinawa TLD"

• "ET INFO GET Minimal HTTP Headers Flowbit Set"

• "ET INFO DYNAMIC_DNS Query to a *.minecraftr .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.linkin .tw Domain"

• "ET INFO http string in hex Possible Obfuscated Exploit Redirect"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jmstudios .com Domain"

• "ET INFO DNS Lookup to (laurentprotector .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isa-hockeynut .com Domain"

• "ET CURRENT_EVENTS Ebay Phishing Landing 2018-02-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dropfiles .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kickto .net Domain"

• "ET CURRENT_EVENTS MyADP Phishing Landing 2018-04-19"

• "ET POLICY Vulnerable Java Version 12.0.x Detected"

• "ET INFO Dotted Quad Host M5 (noalert)"

• "ET INFO Suspicious Jar name JavaUpdate.jar"

• "ET INFO DYNAMIC_DNS Query to *byinter.net Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.norushcharge .com Domain"

• "ET INFO wget in DNS TXT Response"

• "ET INFO DYNAMIC_DNS Query to a *.newpowergroup .com Domain"

• "ET INFO Observed Nighthawk 404 Server Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.x443 .pw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.worse-than .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jharrigan .net Domain"

• "ET SCAN Suspicious inbound to MSSQL port 1433"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.agila .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lojadebikini .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fowlergo .org Domain"

• "ET CURRENT_EVENTS Cloned Website Phishing Landing - Saved Website Comment Observed"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qthome .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.privatizehealthinsurance .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-bruinsfan .org Domain"

• "ET INFO File Sharing Domain in DNS Lookup (drive .protonmail .com)"

• "ET INFO DYNAMIC_DNS Query to a *.sells-for-u .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ucvradio .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.socalfishkillaz .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.x24hr .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sells-it .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddnsgeek .com Domain"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (History/Firefox_)"

• "ET POLICY DNS Query to .onion proxy Domain (tor2web)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.flnet.org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nya .pub Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-oh .com Domain"

• "ET INFO Obfuscated Split String (Double Q) 5"

• "ET INFO DYNAMIC_DNS Query to a *.zoho .to Domain"

• "ET POLICY DNS Query to DynDNS Domain *.bounceme .net"

• "ET CURRENT_EVENTS Mailbox Verification Phishing Landing 2018-01-31"

• "ET CURRENT_EVENTS Dropbox/OneDrive Phishing Landing 2018-02-07"

• "ET INFO DYNAMIC_DNS Query to a *.iownyour .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.suroot.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.24h .hk Domain"

• "ET INFO Obfuscated Split String (Single Q) 2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jharrigan .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsking .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alexandravlad .com Domain"

• "ET EXPLOIT Possible TLS HeartBleed Unencrypted Request Method 4 (Inbound to Common SSL Port)"

• "ET INFO DYNAMIC_DNS Query to a *.webhop .net Domain"

• "ET POLICY DNS Query to DynDNS Domain *.loginto .me"

• "ET INFO DYNAMIC_DNS Query to a *.solfa .org Domain"

• "ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)"

• "ET INFO DYNAMIC_DNS Query to a *.robbieb .me .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homeftp .org Domain"

• "ET WEB_SERVER WebShell Generic - ELF File Uploaded"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.triki .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.forss .to Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bmvl .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.diyplans .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.svmblocker .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.roth .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.irq .ro Domain"

• "ET POLICY DNS Query to DynDNS Domain *.freedynamicdns .net"

• "ET CURRENT_EVENTS Possible Adobe PDF Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.intec .es Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.princesaleia .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gerastar .ru Domain"

• "ET INFO Likely Hex Encoded Executable as String - Octothorp Separated"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-into-cars .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.poormanscow .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.flnet.org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.toadfishmonastery .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.itemdb .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.salford-hall .co .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pittentrepreneur .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.broke-it .net Domain"

• "ET INFO SQLite DLL Retrieval by Name (GET)"

• "ET INFO DYNAMIC_DNS Query to a *.mywire .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webhop .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eternalimpressions .com Domain"

• "ET INFO Cloned Dropbox Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tcp4 .me Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.texashotoilers .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.geekhardware .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.peeinthesnow .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ubeagle .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gotdns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.annaffiare .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pce-cihazlari .com .tr Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xinit .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.morganisageek .org Domain"

• "ET USER_AGENTS Observed Suspicious UA (Chrome)"

• "ET POLICY DNS Query to .onion proxy Domain (torexplorer.com)"

• "ET INFO Lockbit Ransomware Related Domain in DNS Lookup (lockbit-decryptor .top)"

• "ET SCAN MySQL Malicious Scanning 3"

• "ET INFO WinUpack Modified PE Header Outbound"

• "ET INFO DYNAMIC_DNS Query to a *.office-on-the .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dcmusic .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.donhoo .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lozan .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iamallama .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.remotecam .nu Domain"

• "ET INFO playit .gg Tunneling Domain in DNS Lookup"

• "ET CURRENT_EVENTS Possible Free Mobile Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mza .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.clienturl .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.intranetwifi .it Domain"

• "ET POLICY HTTP Request to a *.tk domain"

• "ET TROJAN [PTsecurity] Possible Trojan.Downloader UserAgent (binary_getter)"

• "ET INFO HTTP Request to transfer .sh via Powershell"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.scrapper-site .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ve3 .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hijaxdesigns .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.misconfused .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homedns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tanenbaumchat .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.triviem .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.66haoyun .com Domain"

• "ET INFO File Sharing Related Domain in HTTP Request (zippyshare .com)"

• "ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement"

• "ET POLICY DNS Query to DynDNS Domain *.servep2p .com"

• "ET INFO DYNAMIC_DNS Query to a *.traeumtgerade .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ndra .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myz .info Domain"

• "ET INFO Observed TA453 Related URL Shortening Service TLS SNI (litby .us)"

• "ET MALWARE Observed DNS Query to Known PUA Host Domain"

• "ET INFO DYNAMIC_DNS Query to ath .cx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddj .co .za Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-into-cartoons .com Domain"

• "ET INFO HTTP Request to a *.pl.tf domain"

• "ET INFO DYNAMIC_DNS Query to a *.tru .io Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ddnsgeek .com Domain"

• "ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2"

• "ET INFO DYNAMIC_DNS Query to a *.dontexist .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sportseducationinstructors .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-gone .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.abc92 .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nflfan .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.parquecidades-eim .pt Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.parody)"

• "ET INFO RealThinClient Session Init"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.surak .kz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ciscofreak .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mandhplum .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.b33r .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zanity .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.casacam .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.teachmetofish .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jumpingcrab .com Domain"

• "ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.grupompr .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kaohsiung .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.isyour .guru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pagostepeapulco .gob .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myactivedirectory .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.in-the-band .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dabhome .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.veriler .com Domain"

• "ET INFO HTTP Request to a *.osa.pl domain"

• "ET INFO DYNAMIC_DNS Query to a *.neat-url .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.memoryguide .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gfickt .de Domain"

• "ET INFO Possible Phishing Landing - Common Multiple JS Unescape May 25 2017"

• "ET INFO DYNAMIC_DNS Query to a *.blogdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cleansite .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ownip .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.v6 .rocks Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.reason .org .nz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bureaua .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.uitgavepatroon .nl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tountas .org Domain"

• "ET INFO Cloned Instagram Page - Possible Phishing Landing M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.huepfler .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.webqi .org Domain"

• "ET INFO Obfuscated Split String (Single Q) 5"

• "ET GAMES Multiple Game Cheat Application Activity"

• "ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.drupalpixels .com Domain"

• "ET INFO Public Proxy Service Domain in DNS Lookup (api .proxyscrape .com)"

• "ET DNS DNS Query for a Suspicious *.be.ma domain"

• "ET INFO DYNAMIC_DNS Query to a *.nm7 .cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sdp-mos .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.audolatry .com Domain"

• "ET CURRENT_EVENTS Generic Goth Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mystakidis .com Domain"

• "ET INFO Obfuscated Split String (Single Q) 11"

• "ET INFO DYNAMIC_DNS Query to a *.grid-tronics .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sibmed .org .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ga .com Domain"

• "ET INFO Possible Node.js REPL Shell Banner - Reverse Shell"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.amurt .org .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dontexist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.novohorizonte .pt Domain"

• "ET POLICY SMB NT Create AndX Request For a .sys File - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-doctor .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.developer .li Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myphotos .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.acmetoy .com Domain"

• "ET CURRENT_EVENTS Dropbox Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-nurse .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kidsqt .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blinklab .com Domain"

• "ET INFO MSP360 Backup Service Domain in DNS Lookup (mspbackups .com)"

• "ET POLICY Vulnerable Java Version 1.6.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aintno .info Domain"

• "ET INFO HTTP Request to a *.ga domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.visalawyer .co .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nova-gns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.daev .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.punked .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.smathis .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tien-shan .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-nascarfan .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.baikabibai .com Domain"

• "ET INFO PowerShell DownloadData Command Common In Powershell Stagers"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.changeip .biz Domain"

• "ET INFO Suspicious smss.exe in URI"

• "ET INFO Observed Peer-to-Peer File Sharing Service Domain (ipfs .io in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.monkeywerks .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.csproject .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kreider .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.uk .to Domain"

• "ET INFO DYNAMIC_DNS Query to a *.florafamily .com Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-05-09"

• "ET USER_AGENTS Suspicious User-Agent Simple Bot"

• "ET INFO DYNAMIC_DNS Query to a *.kmodem .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-by .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.here-for-more .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xxxy .info Domain"

• "ET WEB_CLIENT Hex Obfuscation of Script Tag %u UTF-8 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.etowns.net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ddns .cam Domain"

• "ET POLICY Tunneled RDP Handshake"

• "ET INFO UPnP Discovery Search Response - CVE-2012-5958 and CVE-2012-5959 Vulnerable UPnP device M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.off .li Domain"

• "ET CURRENT_EVENTS Post.ch Cloned Phishing Landing 2018-04-09"

• "ET ATTACK_RESPONSE Obfuscated Eval String 7"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Prgrm.txt)"

• "ET INFO Suspicious POST Format"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.keystoneuniformcap .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.recyclesolutionsllc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.n0p .at Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thinksnow .net Domain"

• "ET CURRENT_EVENTS Unknown Exploit Kit Java Archive Request (Java-SPLOIT.jar)"

• "ET CURRENT_EVENTS Smartermail Phishing Landing 2018-02-20"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.netlord .de Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (dm9rZS1XbWlNZXR) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.paumard .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rundis .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.clickip .de Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.pirate)"

• "ET INFO DYNAMIC_DNS Query to a *.alimentoshen .cl Domain"

• "ET INFO Obfuscated Split String (Single Q) 1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nn-foto .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.deaftone.com Domain"

• "ET TROJAN Evil Google Drive Download"

• "ET CURRENT_EVENTS Possible Capitech Internet Banking Phishing Landing - Title over non SSL"

• "ET INFO Obfuscated Split String (Single Q) 9"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chatnook.com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (slavetor.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ufodns .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dprdsulsel .go .id Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.lookin.at Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.birdsofnorthamerica .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-remote .com Domain"

• "ET INFO x86 File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS Query to a *.b0tnet .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.play .ai Domain"

• "ET INFO DYNAMIC_DNS Query to a *.longmusic .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.flazzard .com Domain"

• "ET CURRENT_EVENTS Redirect to driveby sid=mix"

• "ET INFO DYNAMIC_DNS Query to a *.jedimasters .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.soon .it Domain"

• "ET INFO DYNAMIC_DNS Query to a *.erke .biz .tr Domain"

• "ET DNS APT_NGO_wuaclt C2 Domain hotmal1.com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-mi .com Domain"

• "ET CURRENT_EVENTS Possible Paypal Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ind .st Domain"

• "ET POLICY DNS Query to DynDNS Domain *.workisboring .com"

• "ET CURRENT_EVENTS Office 365 Phishing Landing 2018-02-06"

• "ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.myz .info Domain"

• "ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .me)"

• "ET INFO DYNAMIC_DNS Query to a *.anpmech .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blogsyte .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dsmtp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ditchyourip .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-socialist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.moldeointeractive .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shacknet .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tcta .com .au Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dubya .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.home .dyndns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ntdll .top Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.friendship .twa Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bigmoney .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.logntw .com Domain"

• "ET POLICY HSRP Active Router Changed"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.donlafferty .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynalias .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bhms .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-home .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.oops .wtf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jake .eu Domain"

• "ET WEB_CLIENT Hex Obfuscation of parseInt %u UTF-16 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.8bit .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ddnsguru .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.collegefan .org"

• "ET INFO DYNAMIC_DNS Query to a *.iz .rs Domain"

• "ET WEB_SERVER IIS INDEX_ALLOCATION Auth Bypass Attempt"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.galipan .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lessmiths .com Domain"

• "ET POLICY External IP Lookup SSL/TLS Certificate (ifconfig .me)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jungleheart .com Domain"

• "ET TROJAN DNS Query Known Reveton Domain whatwillber.com"

• "ET INFO DYNAMIC_DNS Query to a *.dickeyfam .com domain"

• "ET INFO DYNAMIC_DNS Query to a *.cnr .com .pk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.docuprint .com .ar Domain"

• "ET INFO Dotted Quad Host XLSX Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mankenskiold .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.groks-the .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.custom-gaming .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.podzone .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jaytex .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.opazo .cl Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (52b2tlLVdtaU1) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ocry .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dickeyfam .com domain"

• "ET INFO DYNAMIC_DNS Query to a *.justdied .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.javahound .com Domain"

• "ET INFO Suspicious Windows NT version 9 User-Agent"

• "ET CURRENT_EVENTS Possible Halkbank (TK) Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.slyip.net Domain"

• "ET USER_AGENTS Suspicious User-Agent (HTTP-Test-Program)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.3dxtras .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.does-it .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.anondns .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chebicon .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.limetropy .com Domain"

• "ET CURRENT_EVENTS Mailbox Revalidation Phishing Landing 2018-02-09"

• "ET INFO DYNAMIC_DNS Query to a *.mp3real .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yao .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tumsun .com Domain"

• "ET WEB_SERVER PHP GET SuperGlobal in URI"

• "ET INFO DYNAMIC_DNS Query to a *.baden .ru Domain"

• "ET INFO Hiloti Style GET to PHP with invalid terse MSIE headers"

• "ET TROJAN Magecart Skimmer CSS"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cloudns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sells-for-less .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dumb1 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rwbcode .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.expedicionesytrekking .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.multicop .com .ar Domain"

• "ET INFO Public Cloud Domain in DNS Lookup (cld .pt)"

• "ET INFO DYNAMIC_DNS Query to a *.furryplace .eu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ideas-informatica .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webhop .org Domain"

• "ET ATTACK_RESPONSE Output of id command from HTTP server"

• "ET INFO Observed DNS Query to DDNS Domain .dns1 .us"

• "ET POLICY Apache HTTP Server 2.4.49 Observed - Vulnerable to CVE-2021-41773"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.antiphone .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lotusshipping .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bradam .org Domain"

• "ET CURRENT_EVENTS Generic Multi-Email Phishing Landing 2018-08-30"

• "ET INFO Suspicious csrss.exe in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.better-than .tv Domain"

• "ET INFO HTTP Request to a *.bg.tf domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ra3 .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.loghomelights .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.twilightparadox .com Domain"

• "ET SHELLCODE Possible Backslash Escaped UTF-8 0c0c Heap Spray"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.120v .ac Domain"

• "ET INFO DYNAMIC_DNS Query to a *.keriss .co .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gracesiefer .com Domain"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Hardware.txt)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ducklog .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.doomdns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.logular .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynuddns .com Domain"

• "ET INFO Suspicious Terse HTTP Request to textbin"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-into-games .com Domain"

• "ET ATTACK_RESPONSE PowerShell Base64 Encoded Content Command Common In Powershell Stagers M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.project .li Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nard .ca Domain"

• "GPL RPC rlogin LinuxNIS"

• "ET INFO DYNAMIC_DNS Query to a *.24x7 .hk Domain"

• "ET INFO DNS Query to a Suspicious *.orge.pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-conservative .com Domain"

• "ET WEB_SERVER SQL Errors in HTTP 500 Response (mssql_query)"

• "ET INFO DYNAMIC_DNS Query to a *.free-pic .org Domain"

• "ET ATTACK_RESPONSE Possible System Enumeration via WMI Queries (AntiSpywareProduct)"

• "ET INFO Executable Served From /tmp/ Directory - Malware Hosting Behaviour"

• "ET INFO DYNAMIC_DNS Query to a *.alam-maritim .com .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.funk .co .za Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gettrials .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sells-for-u .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sitaci .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hectorhector .com Domain"

• "ET TROJAN Large DNS Query possible covert channel"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.koakh .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.monobasin .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xxuz .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.appia .com .au Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.leitud .ee Domain"

• "ET POLICY SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement"

• "ET USER_AGENTS Observed Suspicious UA (.NET Framework Client)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-an-artist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.e-cloud .ch Domain"

• "ET INFO Cloned South State Bank Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.abatek .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.saucedchicago .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.be .sexy Domain"

• "ET INFO DYNAMIC_DNS Query to a *.contactme .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homeunix .org Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (Zva2UtQ29) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.ddj .co .za Domain"

• "ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.mysynology .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jesus .si Domain"

• "ET INFO POWERPC File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS Query to a *.crossharbour .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.minecraft .id .lv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mynumber .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nunc .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wikaba .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.yihtah .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.heroinewarrior .com Domain"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing 2018-08-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homingbeacon .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aeroantenna .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.forgot .her .name Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mcsoft .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.starscene .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.svmblocker .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dns .navy Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-22"

• "ET CURRENT_EVENTS Square Phishing Landing 2018-02-15"

• "ET INFO DYNAMIC_DNS Query to a *.empires-r .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.teleconomiser .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.uglyas.com Domain (Sitelutions)"

• "ET INFO Invalid User-Agent - MSIE 9 on Windows NT 5"

• "ET INFO Observed Query to .beauty TLD"

• "ET INFO External IP Check Domain in DNS Lookup (ip .me)"

• "ET WEB_CLIENT Hex Obfuscation of unescape %u UTF-16 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveftp .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.webs .vc Domain"

• "ET INFO Observed Public Proxy Service Domain (api .proxyscrape .com in TLS SNI)"

• "ET INFO MIPSEL File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.newpowergroup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.prs7 .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.simple-url .com Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS Query to a *.lojadebikini .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.khabbaby .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.anal-slavery .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zerocoolgames .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dateeasily .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mindhackers .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mutluay .com Domain"

• "ET CURRENT_EVENTS Mailbox Phishing Landing 2018-01-29"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.darriondemelo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-oh .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .mobi Domain"

• "ET WEB_SERVER HTTP Request to a *.54dfa1cb.com domain - Anuna Checkin - Compromised PHP Site"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ignorelist .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pristytools .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.dnsiskinky .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.organiccrap .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.giseler .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of unescape % Encoding"

• "ET INFO DYNAMIC_DNS Query to a *.oceanpolice .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dsmtp .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mcwrite .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kicks-ass .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vizvaz .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onmypc .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lee .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lczipper .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myddns .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ufcfan .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.contactme .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aen .su Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.neo)"

• "ET INFO DYNAMIC_DNS Query to a *.calvaryduncan .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thegiblins .com Domain"

• "ET TROJAN Observed DNS Query to Known Knotweed/SubZero Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wiab-service .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.axfor .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.podzone .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.primavera .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tinyrealm .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webhop .info Domain"

• "ET POLICY Suspicious Terse Request for .pif"

• "ET CURRENT_EVENTS Sakura/RedKit obfuscated URL"

• "ET INFO DYNAMIC_DNS Query to a *.bugaloop .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.go .dyndns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.beerprojects .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.centralpto .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.blogsyte .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xevna .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.womenclothingtoday .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.midjava .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.javahound .com Domain"

• "ET INFO Observed DNS Query for EmerDNS TLD (.emc)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.v6 .navy Domain"

• "ET CURRENT_EVENTS PDF Cloud Phishing Landing 2018-04-19"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homesecuritypc .com Domain"

• "ET INFO SUSPICIOUS UA starting with Mozilla/0"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sweeny .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ospachat .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bureaua .net Domain"

• "ET WEB_CLIENT Hex Obfuscation of Script Tag %u UTF-16 Encoding"

• "ET CURRENT_EVENTS Possible iCloud Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.sheepindonesia .org Domain"

• "ET INFO PowerShell DownloadFile Command Common In Powershell Stagers"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.likes-pie .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zhanwenhan .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tafca .co .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myiphost .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-very-good .org Domain"

• "ET POLICY DNS Query to .onion proxy Domain (tanktor.com)"

• "ET INFO External IP Check Domain in DNS Lookup (api .ipapi .com)"

• "ET INFO Cloned Instagram Page - Possible Phishing Landing M1"

• "ET INFO HTTP Connection To DDNS Domain Adultdns.net"

• "ET CURRENT_EVENTS exploit kit x/load/svchost.exe"

• "ET INFO Cloned Impots Gouv FR Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.industrialmill .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tdkare .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ne .com Domain"

• "ET ATTACK_RESPONSE Inbound PowerShell Checking for Virtual Host (Win32_DiskDevice WMI)"

• "ET INFO DYNAMIC_DNS Query to a *.dailyholycrap .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xcv .cx Domain"

• "ET WEB_CLIENT Hex Obfuscation of Script Tag % Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dontexist .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bizzapp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyn-dns.ru Domain"

• "ET CURRENT_EVENTS Possible OWA Mail Phishing Landing - Title over non SSL"

• "ET TROJAN DNS query for Morto RDP worm related domain jifr.info"

• "ET INFO DYNAMIC_DNS Query to a *.yiamuc .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of parseInt % Encoding"

• "ET INFO DYNAMIC_DNS Query to a *.jodymaroni .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ak .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.moldeointeractive .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.disisleri .com Domain"

• "ET INFO URL Shortening Service Used by Curl (ic9 .in)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.monitoryourinternet .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.selfip .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.palvelin .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.b0ne.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lettersandscience .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gotdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.geofuzz .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.joeliriano .com Domain"

• "ET INFO Observed DNS Query to .ryukyu TLD"

• "ET INFO DYNAMIC_DNS Query to a *.peeinthesnow .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dprdsulsel .go .id Domain"

• "ET POLICY Vulnerable Java Version 10.0.x Detected"

• "ET INFO Cloned Comcast / Xfinity Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.viiic .net Domain"

• "ET CURRENT_EVENTS Alibaba Phishing Landing 2018-08-07"

• "ET USER_AGENTS Suspicious User Agent (reqwest/)"

• "ET INFO DYNAMIC_DNS Query to a *.hondascooterparts .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.home .kg Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.joe .dj Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.opior .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.droidtech .it Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M5"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-rockstar .com Domain"

• "ET FTP Suspicious Percentage Symbol Usage in FTP Username"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wwwhost .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-pr .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tallison .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kstar .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.groks-this .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ericfox .hk Domain"

• "ET INFO HTTP Request to a *.gq domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ugo .si Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.erke .biz .tr Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hatenboer .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cot .lt Domain"

• "ET INFO DYNAMIC_DNS Query to a *.leitungsen .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.misconfused .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.barbaforte .org Domain"

• "GPL TELNET Bad Login"

• "ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.selfip .org Domain"

• "ET INFO Possible Firefox Plugin install"

• "ET INFO DYNAMIC_DNS Query to a *.fuettertdasnetz .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thetrist .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.euasazic .ro Domain"

• "ET DNS DNS Query for a Suspicious *.qc.cx domain"

• "ET INFO DYNAMIC_DNS Query to a *.mw .nom .za Domain"

• "ET DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port"

• "ET INFO DYNAMIC_DNS Query to a *.aeroantenna .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.veriler .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ianrossi .com Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String (Single Q) 3"

• "ET ATTACK_RESPONSE Possible System Enumeration via WMI Queries (AntiVirusProduct)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rav-kraski .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-into-anime .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fairuse .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyn-o-saur .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.minecraftnoob .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iii .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rpz .su Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onapon .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.parquecidades-eim .pt Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-very-sweet .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.epicgamer .org Domain"

• "ET POLICY DNS Query to DynDNS Domain *.access .ly"

• "ET INFO DYNAMIC_DNS Query to a *.webhop .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chatnook.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsdojo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ca .com Domain"

• "ET CURRENT_EVENTS Likely TDS redirecting to exploit kit"

• "ET ATTACK_RESPONSE Possible System Enumeration via WMI Queries (FirewallProduct)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mine .tk Domain"

• "ET DNS DNS Query for vpnoverdns - indicates DNS tunnelling"

• "ET INFO HTTP Request to a *.co.com.au domain"

• "ET INFO DYNAMIC_DNS Query to a *.ldtp .com Domain"

• "ET INFO ARM File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iownyour .biz Domain"

• "ET CURRENT_EVENTS Comcast/Xfinity Phishing Landing 2018-04-19"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cot .lt Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.youramys .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .cam Domain"

• "ET INFO DYNAMIC_DNS Query to a *.johanson .ee Domain"

• "ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.tcp4 .me Domain"

• "ET INFO Cloned Discover Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.mobile-node .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dsmtp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kunglin .com Domain"

• "ET INFO Observed Pastebin Style Domain (www .logpasta .com in TLS SNI)"

• "ET INFO Interactsh Domain in DNS Lookup (.interact .sh)"

• "ET DNS Query for Suspicious .ch.tf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dagz .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.poormanscow .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ubergate .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ame-life .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mypsx .net Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (dm9rZS1Db21tYW) in DNS TXT Reponse"

• "ET CURRENT_EVENTS [eSentire] Wells Fargo Phishing Landing 2018-06-20"

• "ET INFO DYNAMIC_DNS Query to a *.istmein .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jedimasters .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.youdontcare .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fivepals .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torpayeur.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kstar .us Domain"

• "ET INFO Lockbit Ransomware Related Domain in DNS Lookup (bigblog .at)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hackquest .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aarogyamnepal .org .np Domain"

• "ET POLICY DNS Query to DynDNS Domain *.pointto .us"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-or .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.reason .org .nz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.coreytech .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.freewww .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dvrdns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.peeramidspirits .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-wy .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-nh .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.themoosebarn .com Domain"

• "ET WEB_CLIENT PDF With Adobe Audition Session File Handling Buffer Overflow Flowbit Set"

• "ET WEB_CLIENT SUSPICIOUS Possible Office Doc with Embedded VBA Project"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ourhobby .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.osclabs .ro Domain"

• "ET POLICY DNS Query to .onion proxy Domain (bortor.com)"

• "ET INFO Obfuscated Split String (Single Q) 6"

• "ET INFO DYNAMIC_DNS Query to a *.tanenbaumchat .org Domain"

• "ET WEB_CLIENT PDF Containing Windows Commands Downloaded"

• "ET INFO DYNAMIC_DNS Query to a *.l5 .ca Domain"

• "ET MALWARE Win32/GameHack.ADW CnC Activity"

• "ET INFO DYNAMIC_DNS Query to a *.ku4oy .us Domain"

• "ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (2b2tlLVJlc3RNZX) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mollypornstar .com domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wooloo .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-wa .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-at-home .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-candidate .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mypop3 .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bouncers4rent .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.4rp .es Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dhcp .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.baden .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.freetruthordare .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sbinfo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cw03 .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.undo .it Domain"

• "ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .online)"

• "ET USER_AGENTS Suspicious User-Agent (HTTP_CONNECT_)"

• "ET INFO DYNAMIC_DNS Query to a *.thruhere .net Domain"

• "ET EXPLOIT Fortinet FortiWeb OS Command Injection Inbound M2 (CVE-2021-22123)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zoho .to Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homeunix .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kunglin .com Domain"

• "ET POLICY SMB Remote AT Scheduled Job Create Request - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.0rg .us Domain"

• "ET CURRENT_EVENTS Successful Google Account Phish Dec 04 2012"

• "ET INFO DYNAMIC_DNS Query to a *.nowddns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.2to1agri .com Domain"

• "ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse"

• "GPL TELNET TELNET login failed"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.0000000000000000000000 .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynssl .com Domain"

• "ET INFO GET to Puu.sh for TXT File with Minimal Headers"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mydad .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.djbomba .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.joe .dj Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.treetech .tw Domain"

• "ET INFO OpenAI API Domain in DNS Lookup (api .openai .com)"

• "ET INFO DYNAMIC_DNS Query to a *.mydad .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-an-entertainer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.soundrown .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.oitsc .com Domain"

• "ET CURRENT_EVENTS Netflix Phishing Landing 2018-05-09"

• "ET INFO DYNAMIC_DNS Query to a *.port0 .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rock-n-roll .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.francemacau .com Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M10 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.demoteam .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ryanbauman .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.koakh .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsdojo .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.majoitus .ee Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sumibi .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blogdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-la .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.socalfishkillaz .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-chef .org Domain"

• "ET DNS Query for Suspicious .int.tf Domain"

• "ET CURRENT_EVENTS Generic Multi-Email Phishing Landing 2018-08-30"

• "ET CURRENT_EVENTS Chase Phishing Landing 2018-04-09"

• "ET INFO Cloned Telstra Page - Possible Phishing Landing"

• "ET CURRENT_EVENTS ASB Bank Phishing Landing 2018-02-09 M1"

• "ET INFO DYNAMIC_DNS Query to a *.de-a .org Domain"

• "ET INFO Serialized Data request"

• "ET INFO Suspicious GET Request for .arm file File"

• "ET CURRENT_EVENTS Generic Chalbhai Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.0000000000000000000000 .com Domain"

• "ET INFO Observed DNS Query to DynDNS Domain (linkpc .net)"

• "ET DNS Query for a Suspicious *.noc.su domain"

• "ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh)"

• "ET WEB_CLIENT Hex Obfuscation of arguments.callee % Encoding"

• "ET WEB_SERVER SQL Errors in HTTP 500 Response (mysql_query)"

• "ET INFO Likely Hex Encoded Executable as String - Pipe Separated"

• "ET POLICY DNS Query to DynDNS Domain *.servequake .com"

• "ET INFO DYNAMIC_DNS Query to a *.4dq .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.centrodiagnosticogenetico .com Domain"

• "ET WEB_SERVER SQL Errors in HTTP 200 Response (SqlException)"

• "ET INFO DYNAMIC_DNS Query to a *.h0stname .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.takony .hu Domain"

• "ET INFO SUSPICIOUS UA starting with Mozilla/8"

• "ET INFO DYNAMIC_DNS Query to a *.ycare .org Domain"

• "ET CURRENT_EVENTS Observed DNS Query to Possible Phish Hosted on onlinehome.us"

• "ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (dm9rZS1SZXN0TWV0) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.is-very-evil .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mikata .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pakasak .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.louis-ip .com Domain"

• "ET MALWARE Downer.B Variant Checkin"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.macao .org Domain"

• "ET INFO Suspicious GET Request for .i686 File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sandmeiers .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.does-it .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-blog .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.69 .mu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homeftp .net Domain"

• "ET CURRENT_EVENTS Orange Phishing Landing 2018-02-05 (FR)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ohbah .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.collegefan .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.prasbharapolresbojonegoro .or .id Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servebeer .com Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vr .lt Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iwantthisjunk .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lflinkup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.work .gd Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.03c8 .net Domain"

• "ET CURRENT_EVENTS Blocked Incoming Emails Phishing Landing 2018-01-23"

• "ET INFO Base64 Encoded powershell.exe in HTTP Response M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gonnadoo .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ericfox .hk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.saucedchicago .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.carcano .me Domain"

• "ET INFO DYNAMIC_DNS Query to a *.03c8 .net Domain"

• "ET CURRENT_EVENTS SUSPICIOUS XXTEA UTF-16 Encoded HTTP Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.viktor .com .br Domain"

• "ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncEnumPrinterDrivers"

• "ET INFO DYNAMIC_DNS Query to a *.skc .su Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bgg .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ftp .sh Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kyleconstance .com Domain"

• "ET INFO Suspicious GET Request for .i468 File"

• "ET USER_AGENTS Observed Suspicious UA (Hello-World)"

• "ET INFO DYNAMIC_DNS Query to *.myfw.us Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.2to1agri .com Domain"

• "ET CURRENT_EVENTS OneDrive Phishing Landing 2018-05-01"

• "ET INFO DYNAMIC_DNS Query to a *.geofuzz .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-saved .org Domain"

• "ET INFO HTTP Connection To DDNS Domain myftp.com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.byte4byte .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chocolatespicacho .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.clarkstock .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dns .army Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.minetest .land Domain"

• "ET INFO DYNAMIC_DNS Query to a *.compucase .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.govt .hu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aletoledo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bot .nu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.arrowtechnical .co .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.actsministries .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.etitrans .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.photo-frame .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.edrennikov .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.technopagans .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kaznets .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.adamhayward .co .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nedvighimost-sochi .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gparente .net .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-pics .com Domain"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M3"

• "ET WEB_SERVER PHP ENV SuperGlobal in POST"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.station .moe Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sexcuatui .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mypop3 .net Domain"

• "ET INFO Base64 Encoded powershell.exe in HTTP Response M3"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (dy1PYmp) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.bedwell .org Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String 3"

• "ET INFO DYNAMIC_DNS Query to a *.happyrobotics .com Domain"

• "ET INFO HTTP Connection To DDNS Domain Redirectme.net"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.play .ai Domain"

• "GPL ATTACK_RESPONSE index of /cgi-bin/ response"

• "ET INFO DYNAMIC_DNS Query to a *.from-nm .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nya .pub Domain"

• "ET INFO DYNAMIC_DNS Query to a *.itekgroup .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-painter .com Domain"

• "ET INFO Observed Abused Website Archival Domain (archive .ph in TLS SNI)"

• "ET INFO HTTP POST Request to Suspicious *.gdn Domain"

• "ET USER_AGENTS Suspicious User-Agent (kath)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.istmein .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-blogger .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.efrati .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.authorizeddns .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.htpc .cl Domain"

• "ET CURRENT_EVENTS TDS Sutra - request in.cgi"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pixelfucker .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mrbonus .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-very-nice .org Domain"

• "ET INFO Microsoft net.tcp Connection Initialization Activity"

• "ET INFO DYNAMIC_DNS Query to a *.wwwhost .biz Domain"

• "ET INFO Observed Anonymous File Sharing Service (fromsmash .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.itsaol .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bestoftheat .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dark-byte .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.codingtheworld .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.r-o-o-t .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jetos .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jonward .com Domain"

• "ET INFO Suspicious POST Request with Possible COVID-19 URI M2"

• "ET INFO DYNAMIC_DNS Query to a *.macrofox .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-mail .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.breakingpar .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ambiserve .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.grupompr .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynamai .com Domain"

• "ET POLICY Vulnerable Java Version 9.x Detected"

• "ET INFO DYNAMIC_DNS Query to a *.hin .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.green-heroes .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.psybnc .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mp3real .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.neisa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.endofinternet .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ocry .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homenode .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-lawyer .com Domain"

• "ET CURRENT_EVENTS Email Server Mobile Security Settings Phishing Landing 2018-01-22"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shen .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ismoke .hk Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-12"

• "ET INFO DYNAMIC_DNS Query to a *.podzone .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.24-7 .ro Domain"

• "ET USER_AGENTS Observed Suspicious UA (Hello, World)"

• "ET POLICY SMB NT Create AndX Request For a .bat File"

• "ET WEB_CLIENT Possible %u UTF-16 Encoded Iframe Tag"

• "ET INFO Observed DNS Query to DDNS Domain .zzux .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.themcleans .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.industrialmill .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.opticalize .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cleansite .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.happyrobotics .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eubonia .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of substr %u UTF-16 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-mn .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mypop3 .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.raspberryip .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dcmusic .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shitgoddamnhellfuck .com Domain"

• "ET INFO Suspicious Purported MSIE 7 with terse HTTP Headers GET to PHP"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ragtopvintage .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-az .net Domain"

• "ET CURRENT_EVENTS Generic Mailbox Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.newsofmaricopa .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-into-cartoons .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ix .tc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.theworkpc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.qthome .org Domain"

• "ET INFO DYNAMIC_DNS Query to a [Redacted - Vulgar] Domain"

• "ET INFO DYNAMIC_DNS Query to a *.liquidsphere .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.focusmarketing .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.giantrobotfactory .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jade-hamburg .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pics .mu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.2fine .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blogsite .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lai .ac Domain"

• "ET INFO Suspicious POST to Axis OS (smtptest.cgi)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.johanson .ee Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.caminobooks .com Domain"

• "ET POLICY SUSPICIOUS *.pdf.exe in HTTP URL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsfor .me Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dorthel .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fxnxs .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-tn .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.servebeer .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kst .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.inovasi .co .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ssitech .bg Domain"

• "ET POLICY DNS Query to .onion proxy Domain (door2tor.org)"

• "ET SCAN Suspicious inbound to mSQL port 4333"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-painter .com Domain"

• "ET WEB_SERVER WebShell - MySQL Interface - Client Cookie mysql_web_admin*="

• "ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.artitech .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.airlinemeals .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mine .tk Domain"

• "ET POLICY DNS Query to DynDNS Domain *.ilovecollege .info"

• "ET INFO DYNAMIC_DNS Query to a *.multiverso .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ut .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.viiic .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.heatmypool .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lflinkup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.spacetechnology .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.joseulloa .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sheepindonesia .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alexlan .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-linux-user .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xcportugal .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.montyconsulting .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynathome .net Domain"

• "ET INFO HTTP Request to a *.ch.tf domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.progressivecongressnews .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ishevchenko .net Domain"

• "ET CURRENT_EVENTS AT&T Phishing Landing 2018-01-23"

• "ET INFO DYNAMIC_DNS Query to a *.ldop .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.scrapitsoftware .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iantaylor .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lilyspadd .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thehomeserver .net Domain"

• "ET WEB_SERVER SQL Errors in HTTP 200 Response (mssql_query)"

• "ET CURRENT_EVENTS Possible Google Docs Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.kompaniet .nu Domain"

• "ET USER_AGENTS Suspicious UA Observed (YourUserAgent)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.susangilmore .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-nd .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yaguar .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.good .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to *ontheweb.nu Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.silksky .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dx .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bearfacts .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.verymad .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pitam .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ra3 .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.internet-slackers .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mysecondarydns .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gun .vn domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.euasazic .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dulcegarii-culinare .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tecnova .com .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sismonda .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.b33r .us Domain"

• "ET POLICY HTTP Request to a *.noc.su domain"

• "ET INFO DYNAMIC_DNS Query to a *.yhoccotruyen .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.flamex .hm Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zsh .jp Domain"

• "ET INFO DYNAMIC_DNS Query to a *.evils .in Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kolody .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.deusexmachina .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lehoozeher .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.everton .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.roth .ca Domain"

• "ET CURRENT_EVENTS SUSPICIOUS IRC - PRIVMSG *.(exe|tar|tgz|zip) download command"

• "ET TROJAN Double HTTP/1.1 Header Inbound - Likely Hostile Traffic"

• "ET INFO DYNAMIC_DNS Query to a *.glengall .com Domain"

• "ET CURRENT_EVENTS ASB Bank Phishing Landing 2018-02-09 M2"

• "ET INFO DYNAMIC_DNS Query to a *.selfip .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynip .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jnrcs .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ms .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.loseyourip .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsdyn .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.beerprojects .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-va .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vlad .md Domain"

• "ET POLICY DNS Query to .onion proxy Domain (enter2tor.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.authorizeddns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nicolasi .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cloudranger .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.teachmetofish .net Domain"

• "ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 3"

• "ET INFO External File Sharing Domain in DNS Lookup (anonfile .com)"

• "ET INFO DYNAMIC_DNS Query to a *.capim .com .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.faqserv .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sv-italia .it Domain"

• "ET POLICY DNS Query to DynDNS Domain *.geekgalaxy .com"

• "ET INFO DYNAMIC_DNS Query to a *.computerworksaz .com Domain"

• "ET WEB_SERVER PHP GET SuperGlobal in POST"

• "ET INFO DYNAMIC_DNS Query to a *.line .pm Domain"

• "ET INFO DYNAMIC_DNS Query to a *.birdriver .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lain .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xxxy .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.duta .biz Domain"

• "ET CURRENT_EVENTS TDS Sutra - HTTP header redirecting to a SutraTDS"

• "ET USER_AGENTS Observed Suspicious UA (cctv.mtv)"

• "ET INFO DYNAMIC_DNS Query to a *.alexlan .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.serveuser .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.forgot .his .name Domain"

• "ET INFO DYNAMIC_DNS Query to a *.crafting .xyz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.darvin .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.soundcast .me Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.space-to-rent .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rude .li Domain"

• "ET POLICY SN and CN From MS TS Revoked Cert Chain Seen"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zsh .jp Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rainbowcup .com Domain"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing management MBeanServer"

• "ET INFO Terse Request for .txt - Likely Hostile"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wakingmoon .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homelinux .net Domain"

• "ET INFO Request for EXE via WinHTTP M1"

• "ET WEB_SERVER WebShell Generic - netsh firewall"

• "ET INFO DYNAMIC_DNS Query to a *.dleon .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.theserver .tk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.awiki .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.winkel .com .ar Domain"

• "ET DNS Query for Suspicious .ca.tf Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torvsusd.com)"

• "ET INFO DYNAMIC_DNS Query to a *.tx2600 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynalias .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gandhinagar .com Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (XctT2JqZW) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.usakoi .com Domain"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Chrome_Default.txt)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.salty72 .ca Domain"

• "ET POLICY DNS Query to DynDNS Domain *.dnsfor .me"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.traeumtgerade .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zzux .com Domain"

• "ET INFO Cloned Societe Generale FR Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.visite .es Domain"

• "ET WEB_CLIENT Likely Malicious PDF Containing StrReverse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qc .to Domain"

• "ET CURRENT_EVENTS TDS Sutra - cookie set"

• "ET INFO DYNAMIC_DNS Query to a *.mnode .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lawsonengineers .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.likudliberal .org Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (Zva2UtV21pTWV) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.deaftone.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thinksnow .net Domain"

• "ET INFO Dotted Quad Host GZ Request"

• "ET INFO DYNAMIC_DNS Query to a *.serveftp .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-pr .com Domain"

• "ET INFO Observed Bablosoft BAS Related SSL Cert (bablosoft .com)"

• "ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.drm .hk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynamicdns .biz Domain"

• "ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.logular .com Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-01-18 M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.keybusinessconnection .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ismoke .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jasems .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.oitsc .com Domain"

• "GPL FTP SITE EXEC attempt"

• "ET WEB_SERVER SQL Errors in HTTP 500 Response (pgsql_query)"

• "ET INFO DYNAMIC_DNS Query to a *.ugego .com Domain"

• "ET INFO Onion/TOR Proxy Client Request"

• "ET INFO DYNAMIC_DNS Query to *.myddns.me Domain"

• "ET INFO External IP Lookup Domain DNS Lookup (my-ip .io)"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-knight .org Domain"

• "ET INFO Generic IOT Downloader Malware in GET (Inbound)"

• "ET INFO DYNAMIC_DNS Query to a *.sweeny .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-into-anime .com Domain"

• "ET DNS Query for Suspicious .sg.tf Domain"

• "ET CURRENT_EVENTS OneDrive Phishing Landing 2018-02-12"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sandhofner .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-certified .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ryanbauman .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homingbeacon .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.authorizeddns .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tth .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyn .ch Domain"

• "ET USER_AGENTS Suspicious User-Agent (REBOL)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kidsqt .com Domain"

• "ET INFO Dotted Quad Host ZIP Request"

• "ET INFO DYNAMIC_DNS Query to a *.grid-tronix .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lwts .ru Domain"

• "ET POLICY Possible WMI .mof Managed Object File Use Over SMB"

• "ET CURRENT_EVENTS Chase Phishing Landing 2018-02-15"

• "ET INFO DYNAMIC_DNS Query to a *.memoryguide .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bugaloop .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveblog .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.scrapping .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynalias .net Domain"

• "ET INFO DYNAMIC_DNS Query to *lookin.at Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.reg .my .id Domain"

• "ET INFO DYNAMIC_DNS Query to *athersite.com Domain (Sitelutions)"

• "ET POLICY DNS Query to DynDNS Domain *.servegame .com"

• "ET INFO DYNAMIC_DNS Query to a *.0rg .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kir22 .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thejordaans .com Domain"

• "ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.diyplans .org Domain"

• "ET WEB_CLIENT PDF With Embedded U3D"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ugli .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.changeip .co Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cybertv .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.station .moe Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ldop .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.adepoju .org Domain"

• "ET WEB_SERVER MorXploit Shell Command"

• "ET ATTACK_RESPONSE Inbound PowerShell Checking for Virtual Host (MSAcpi_ThermalZoneTemperature WMI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynu .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-il .com Domain"

• "ET INFO Observed DNS Query to DDNS Domain .zyns .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kickto .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.networkoutpost .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.railpage .org Domain"

• "ET INFO DYNAMIC_DNS Query to *passas.us Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.brokenfuture .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kir22 .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-vt .com Domain"

• "ET INFO Likely Hex Encoded Executable as String - Comma Separated"

• "ET INFO HTTP Request to a *.surf domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ljhb .se Domain"

• "ET CURRENT_EVENTS Microsoft Onedrive Phishing Landing 2018-01-29"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mydissent .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wikaba .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.eating-organic .net"

• "ET INFO DYNAMIC_DNS Query to a *.madhacker .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.doesntexist .org Domain"

• "ET POLICY DNS Query to DynDNS Domain *.brasilia .me"

• "ET INFO DYNAMIC_DNS Query to a *.gfickt .de Domain"

• "ET POLICY DNS Query to DynDNS Domain *.ddnsking .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myftp .info Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-09"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bizis .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dns1 .us Domain"

• "ET INFO Office Retrieving .rtf (GET)"

• "ET CURRENT_EVENTS DRIVEBY EgyPack Exploit Kit Cookie Set"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.academic .org .il Domain"

• "ET INFO DYNAMIC_DNS Query to a *.moneyhome .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.for-our .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jomblo .asia Domain"

• "ET CURRENT_EVENTS Successful AOL/PayPal Phish Nov 24 2014"

• "ET INFO DYNAMIC_DNS Query to a *.riaspengantinluwes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.instanthq .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sismonda .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.afphila .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.embeddedonline .org Domain"

• "ET INFO Generic Powershell DownloadFile Command"

• "ET POLICY Suspicious Terse Request for .bmp"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.antexknitting .com Domain"

• "ET CURRENT_EVENTS DHL Phishing Landing 2018-04-09"

• "ET CURRENT_EVENTS Exploit Kit Delivering JAR Archive to Client"

• "ET POLICY HTTP traffic on port 443 (OPTIONS)"

• "ET INFO Obfuscated Split String (Double Q) 12"

• "ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-photographer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kanda .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.igotwasted .com Domain"

• "ET WEB_SERVER SQL Errors in HTTP 200 Response (mysql_query)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vctel .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.opior .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ez-dns.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-hunter .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.3n .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.geobattery .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lanas .cl Domain"

• "ET POLICY Vulnerable Java Version 1.4.x Detected"

• "ET INFO DYNAMIC_DNS Query to a *.yiannamarie .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jake .eu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aneisa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.https443 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mov Domain"

• "ET CURRENT_EVENTS DRIVEBY Java Atomic Exploit Downloaded"

• "ET POLICY DNS Query to .onion proxy Domain (browsetor.com)"

• "ET INFO Observed File Sharing Domain (drive .protonmail .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a Suspicious *.ez-dns.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.likes-pie .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.1337 .cx Domain"

• "ET INFO Suspicious Office Template Style Request (GET)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.proxydns .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-pics .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.buhichan .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.packeting .eu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nelsonshack .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.athissite.com Domain (Sitelutions)"

• "ET INFO Cloned Comcast / Xfinity Page - Possible Phishing Landing"

• "ET WEB_SERVER WebShell - Generic - c99shell based header"

• "ET INFO DYNAMIC_DNS Query to a *.silexcorp .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.freeddns .us Domain"

• "ET USER_AGENTS Suspicious User-Agent (test-upload)"

• "ET INFO Observed Temporary File Sharing Service Domain (litter .catbox .moe in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hiddencorner .org Domain"

• "ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse"

• "ET POLICY DNS Query to DynDNS Domain *.net-freaks .com"

• "ET INFO SUSPICIOUS UA starting with Mozilla/9"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.appia .com .au Domain"

• "ET INFO DYNAMIC_DNS Query to a *.runyeard .com Domain"

• "ET POLICY Vulnerable Java Version 1.8.x Detected"

• "ET INFO DYNAMIC_DNS Query to a *.falcongreen .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ftpserver .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.trickip .net Domain"

• "ET WEB_CLIENT Hex Obfuscation of document.write %u UTF-16 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.minecraft .id .lv Domain"

• "ET INFO Base64 Encoded powershell.exe in HTTP Response M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servep2p .com Domain"

• "ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1"

• "ET INFO DYNAMIC_DNS Query to a *.is-an-artist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mrcork .com Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (nZva2UtV21pTWV0aG) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sne .jp Domain"

• "ET INFO Doc Requesting Remote Template (.dotm)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.henher .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ketubruk .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.robbieb .me .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kmodem .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.slumbo .com Domain"

• "ET INFO Executable Requested from Evernote Link M1 (GET)"

• "ET INFO DYNAMIC_DNS Query to a *.linuxstart .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.knowsitall .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ber-engineering .com Domain"

• "ET INFO File Sharing Related Domain (www .mediafire .com) in DNS Lookup"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sazhenec .ru Domain"

• "ET INFO DNS Query to google .com Non Standard Port (tcp)"

• "ET INFO DYNAMIC_DNS Query to a *.is-slick .com Domain"

• "ET INFO Iperius Remote Related Domain in DNS Lookup"

• "ET INFO DYNAMIC_DNS Query to a *.oviivory .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ubeagle .com Domain"

• "ET CURRENT_EVENTS Possible MyEtherWallet Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.dtdns .org Domain"

• "ET INFO Noction IRP Probe"

• "ET CURRENT_EVENTS Adobe PDF Reader Phishing Landing 2018-03-27"

• "ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound M6"

• "ET INFO DYNAMIC_DNS Query to a *.erotikload .at Domain"

• "ET INFO DYNAMIC_DNS Query to a *.selfip .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bkpsports .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mywire .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.drupalpixels .com Domain"

• "ET CURRENT_EVENTS Generic Chalbhai Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.3vm .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.usajusaj .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sendsmtp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.franchisecandidates .com Domain"

• "ET INFO Self-Hosted Git Service Domain in DNS Lookup (gitea .com)"

• "ET INFO DYNAMIC_DNS Query to a *.pii .at Domain"

• "ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related"

• "ET INFO DYNAMIC_DNS Query to a *.fpr .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.eimertvink .nl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.okay .com .tr Domain"

• "ET POLICY SUSPICIOUS OVH Shared Host SSL Certificate (Observed In Use by Some Trojans)"

• "ET WEB_CLIENT PDF With Hidden Embedded File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.noamank .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.scrapper-site .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.whyboner .com Domain"

• "ET CURRENT_EVENTS Possible Dropbox Phishing Landing - Title over non SSL"

• "ET INFO Anonymous File Sharing Service Domain in DNS Lookup (send .vis .ee)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ny .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pltimes .net Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (V3LU9iam) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stoupin .ru Domain"

• "ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.writesthisblog .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.potomacriversafetycommittee .org Domain"

• "ET CURRENT_EVENTS [Deepend Research] BestaBid FakeFlash Redirect"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bucu .pl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.a-quo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bad .mn Domain"

• "ET INFO DYNAMIC_DNS Query to a *.x24hr .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ltu .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynamai .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.adagio .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveftp .net Domain"

• "ET INFO HTTP Request to Suspicious *.okinawa Domain"

• "ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.16-b .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.g33k .com .ve Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.viewdns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-an-actress .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-slick .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nedvighimost-sochi .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lessmiths .com Domain"

• "ET INFO curl in DNS TXT Response"

• "ET INFO DYNAMIC_DNS Query to a *.amurt .org .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.3cm .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.galitec .es Domain"

• "ET INFO DYNAMIC_DNS Query to a *.twilightparadox .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bang .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nx .tc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ame-life .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.marieblazek .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ezwebsites .com Domain"

• "ET TROJAN SUSPICIOUS IRC - NICK and Win"

• "ET TROJAN Suspicious flash_player.exe Download"

• "ET INFO DYNAMIC_DNS Query to a *.3cm .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nathan .to Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blue-jade .net Domain"

• "ET INFO Likely Hex Encoded Executable as String - Single Quote Separated"

• "ET MALWARE suspicious User-Agent (vb wininet)"

• "ET POLICY HTTP Request to a *.co.cc domain"

• "ET INFO Observed DNS Query to .biz TLD"

• "ET DNS Query for .cc TLD"

• "ET INFO DYNAMIC_DNS Query to a *.susangilmore .com Domain"

• "ET TROJAN SMTP Subject Line Contains C Path and EXE Possible Trojan Reporting Execution Path/Binary Name"

• "ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS Query to a *.ham .gd Domain"

• "ET INFO DYNAMIC_DNS Query to a *.americajhon .com .pe Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myvnc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.datacomponents .com .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eimertvink .nl Domain"

• "ET CURRENT_EVENTS LinkedIn Phishing Landing 2018-02-09 M1"

• "ET INFO DYNAMIC_DNS Query to a *.axfor .com Domain"

• "ET INFO HTTP POST Request to Suspicious *.ga Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bizis .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.h4ck .me Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mbiselangor .com .my Domain"

• "ET INFO Shared File Retrieved (roamresearch .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.verbateam .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.surak .kz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.darktech.org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cloudwatch .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.supbienestar .gob .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4dq .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hackquest .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-de .com Domain"

• "ET INFO Observed Abused Website Archival Domain in DNS Lookup (archive .ph)"

• "ET INFO Observed External IP Lookup Domain (whois .pconline .com .cn in TLS SNI)"

• "ET CURRENT_EVENTS Netflix Phishing Landing 2018-05-09"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.abuser .eu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.easefun .hk Domain"

• "ET INFO Observed CheckMal AV/Anti-Ransomware Domain (www .checkmal .com in TLS SNI)"

• "ET ATTACK_RESPONSE PowerShell Base64 Encoded Content Command Common In Powershell Stagers M2"

• "ET INFO DYNAMIC_DNS Query to a *.thomastech .net Domain"

• "ET INFO HTTP Request to a *.ru.tf domain"

• "ET INFO JAR Sent Claiming To Be Text Content - Likely Exploit Kit"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.radio-zvez .info Domain"

• "ET CURRENT_EVENTS Apple Phishing Landing 2018-04-09"

• "ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.slyip.com Domain"

• "ET INFO SUSPICIOUS Reassigned Eval Function 1"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class file Accessing Security Manager"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.scrapitsoftware .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.igotwasted .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freetruthordare .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.paranormalgroup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.triki .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gnutella2 .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.clickip .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.portalwebvillamercedes .gob .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.neurogine .com Domain"

• "ET CURRENT_EVENTS Verizon Wireless Phishing Landing 2018-01-30"

• "ET INFO DYNAMIC_DNS Query to a *.from-md .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fido .be Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ianrossi .com Domain"

• "ET INFO Lucy Security - Server Reply"

• "ET INFO Executable Download from dotted-quad Host"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bakli .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servegame .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-socialist .com Domain"

• "ET INFO Google Adwords Conversion not from Google"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M4"

• "ET INFO DYNAMIC_DNS Query to a *.computersforpeace .net Domain"

• "ET INFO SUSPCIOUS Non-standard base64 charset used for encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ham-radio-op .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.furryplace .eu Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.cyb)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-il .com Domain"

• "ET DNS DNS Lookup for localhost.DOMAIN.TLD"

• "ET INFO TLS Handshake Failure"

• "ET INFO DYNAMIC_DNS Query to a *.isageek .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tafca .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-nj .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.salford-hall .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zaibar .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.entermypicks .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.unusualperson .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wolf-tec .net Domain"

• "ET INFO Observed IP Tracking Domain (grabify .link in TLS SNI)"

• "ET POLICY Zero Content-Length HTTP POST with data (outbound)"

• "ET INFO DYNAMIC_DNS Query to a *.from-me .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.medbury .com Domain"

• "ET INFO HTTP Request to a *.orge.pl Domain"

• "ET INFO DNS Lookup for 8+ hexadecimal only duckdns domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-landscaper .com Domain"

• "ET EXPLOIT Cisco Smart Install Exploitation Tool - Update Ios and Execute"

• "ET SCAN Generic IDBTE4M Exploit Scanner (Inbound)"

• "ET INFO DYNAMIC_DNS Query to a *.shakedfamily .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.solfa .org Domain"

• "ET POLICY Possible Trojan File Download bad rar file header (not a valid rar file)"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.joseulloa .cl Domain"

• "ET WEB_CLIENT Hex Obfuscation of eval %u UTF-16 Encoding"

• "ET INFO Observed Self-Hosted Git Service Domain (gitea .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.computerworksaz .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lee .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.centralpto .com Domain"

• "ET CURRENT_EVENTS Possible Adobe ID Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-anarchist .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pegle .com Domain"

• "ET INFO Generic IOT Downloader Malware in GET (Outbound)"

• "ET POLICY SMB2 NT Create AndX Request For an Executable File"

• "ET CURRENT_EVENTS Generic Multi-Email Popupwnd Phishing Landing 2018-01-25"

• "ET WEB_SERVER SQL Errors in HTTP 200 Response (ERROR syntax error at or near)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.teleconomiser .com Domain"

• "ET INFO Possible Microsoft OMI Agent Default TLS Certificate Observed"

• "ET INFO DYNAMIC_DNS Query to a *.changeip .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ham-radio-op .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ignorelist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-democrat .com Domain"

• "ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI)"

• "ET TROJAN Generic -POST To file.php w/Extended ASCII Characters"

• "ET INFO Request to .TK Domain with Minimal Headers"

• "ET INFO DYNAMIC_DNS Query to a *.barrel-of-knowledge .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.whatajack .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.theoceanforest .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.crabdance .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-mt .com Domain"

• "ET INFO Powershell Request for paste .ee Page"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.geekgalaxy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.panel-laboralcj .gob .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.boblove .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tenspot .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.18t .biz Domain"

• "ET INFO Observed Custom Endpoint Service Domain (run .mocky .io in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns .ws Domain"

• "ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.isa-hockeynut .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-teacher .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.barrell-of-knowledge .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.oviivory .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.doomdns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jnrcs .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dubya .biz Domain"

• "ET INFO Cloud IPFS Service Domain in DNS Lookup (nftstorage .link)"

• "ET INFO DYNAMIC_DNS Query to a *.ireland .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tribeoftwo .com domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thetrist .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-nv .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dtdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.china .is Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.infocommthailand .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lflinkup .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ivi .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shekinahphotography .com Domain"

• "ET DNS Query for Suspicious .bg.tf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qyiku .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ut .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stkhome .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lain .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-an-entertainer .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ssott .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.doomdns .org Domain"

• "ET INFO Suspicious POST Format"

• "ET INFO DYNAMIC_DNS Query to a *.xox .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.answersbot .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.awiki .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.palvelin .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servebbs .net Domain"

• "ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound"

• "ET INFO DYNAMIC_DNS HTTP Request to *.passas.us Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.plugs .it Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bgg .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.technicalsupportresources .com Domain"

• "ET INFO Lucy Security - Admin Panel Accessed on External Server"

• "ET POLICY DNS Query to .onion proxy Domain (torwild.com)"

• "ET POLICY SUSPICIOUS *.pdf.exe in HTTP HEADER"

• "ET INFO DYNAMIC_DNS Query to *.myredirect.us Domain (Sitelutions)"

• "ET CURRENT_EVENTS Google Docs Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homedns .org Domain"

• "ET CURRENT_EVENTS Possible Keitaro TDS Redirect"

• "ET INFO DYNAMIC_DNS Query to a *.texashotoilers .com Domain"

• "ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI"

• "ET INFO Possible cs2nginx Proxy Redirect"

• "ET INFO DYNAMIC_DNS Query to a *.dmb .hk Domain"

• "ET INFO WebDAV Retrieving .exe"

• "ET INFO DYNAMIC_DNS Query to a *.datacommunicationsinc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.southquay .com Domain"

• "ET CURRENT_EVENTS Mailbox Verification Phishing Landing 2018-02-07"

• "ET INFO ARM7 File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS Query to a *.hunnur .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blackbeltmail .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.americajhon .com .pe Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-web.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kicks-ass .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ralphs .com .au Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-an-actress .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servepics .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-wv .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thainewasia .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.360technologies .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mypets .ws Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ilovetkd .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.selfip .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lflinkup .net Domain"

• "ET INFO Generic .bin download from Dotted Quad"

• "ET INFO DYNAMIC_DNS Query to a *.ryanjlowe .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.calvaryduncan .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.port25 .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.triviem .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.24x7 .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.samoobrona .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.barratella .com Domain"

• "ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement"

• "ET TROJAN Potential Blackhole Exploit Pack Binary Load Request"

• "ET INFO DYNAMIC_DNS Query to a *.mrbonus .com Domain"

• "ET INFO Dotted Quad Host DOCX Request"

• "ET WEB_SERVER PHP POST SuperGlobal in POST"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lotusshipping .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vcaptains .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lilyspadd .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.simple-url .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.radio-zvez .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ilovetkd .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kayanganmedia .com Domain"

• "ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thomastech .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.happyforever .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sqlizer .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of charCodeAt %u UTF-8 Encoding"

• "ET INFO Obfuscated Split String (Single Q) 10"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rainbowcup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vasilevsky .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chaseinator .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.4cloud .click Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ayso795 .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.squirly .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dubya .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.punkassgamers .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iyb .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bqc .co .za Domain"

• "ET INFO DYNAMIC_DNS Query to a *.randyalsup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.001www .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.teaches-yoga .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.est-mon-blogueur .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ryanjlowe .us Domain"

• "ET INFO Suspicious POST Request with Possible COVID-19 URI M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alte .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.comapatecoman .gob .mx Domain"

• "ET INFO Generic Powershell DownloadString Command"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.free-pic .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dns2 .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.n0p .at Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alsupnet .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.www1 .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-hi .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myhousesetup .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.webredirect .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.photogenic .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sen .org .nz Domain"

• "ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse"

• "ET INFO Suspicious Zipped Filename in Outbound POST Request (Cookies/Firefox_)"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.oss)"

• "ET INFO DYNAMIC_DNS Query to a *.generi .cc Domain"

• "ET INFO Dotted Quad Host TGZ Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsget .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-id .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.what2no .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.unids .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nethub .fi Domain"

• "ET INFO SUSPICIOUS SMTP EXE - ZIP file with .exe filename inside (Inbound)"

• "ET INFO DYNAMIC_DNS Query to a *.extramindcorp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsdojo .net Domain"

• "ET POLICY DNS Query to DynDNS Domain *.servesarcasm .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bedwell .org Domain"

• "ET CURRENT_EVENTS Facebook Upgrade Payment Phishing Landing 2018-02-05"

• "ET INFO DYNAMIC_DNS Query to a *.from-or .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.plugs .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sexmistrz .pl Domain"

• "ET EXPLOIT Cisco Smart Install Exploitation Tool - ChangeConfig"

• "ET INFO DYNAMIC_DNS Query to a *.otzo .com Domain"

• "ET TROJAN Suspected Gamaredon APT Related Activity"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pristytools .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ttkacz .com Domain"

• "ET TROJAN MacOS/Adload Proxy Node Response"

• "ET DNS DNS Query for Suspicious .co.be Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dns .army Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.endofinternet .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.de-a .org Domain"

• "ET INFO HTTP Request to a .noip.cn domain"

• "ET INFO DYNAMIC_DNS Query to a *.thejordaans .com Domain"

• "ET EXPLOIT Malformed HeartBeat Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.studiovk .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.telcomresearch .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dark-byte .net Domain"

• "ET INFO User-Agent with Non Standard Characters"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.688 .org Domain"

• "ET INFO Cloned La Banque Postale FR Page - Possible Phishing Landing"

• "ET POLICY DNS Query to .onion proxy Domain (torforlove.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.joecampanaro .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.faqserv .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ralphs .com .au Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnset .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.firstimage .biz Domain"

• "ET POLICY Outbound MSSQL Connection to Non-Standard Port - Likely Malware"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ladatap .com Domain"

• "ET INFO PSD1 Powershell File Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.for-the .biz Domain"

• "ET CURRENT_EVENTS Generic MRxJoker Phishing Landing 2018-09-27"

• "ET WEB_SERVER PHP COOKIE SuperGlobal in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.it-share .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.h-o-s-t .name Domain"

• "ET INFO SUSPICIOUS IRC - NICK and Possible Windows XP/7"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dx .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gparente .net .br Domain"

• "ET POLICY DNS Query to DynDNS Domain *.ciscofreak .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4040 .idv .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynet .com Domain"

• "ET SCAN Open-Proxy ScannerBot (webcollage-UA)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.essexregional .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tipoiti .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.404 .mn Domain"

• "ET INFO DNS Query to Free Hosting Domain (freevnn . com)"

• "ET INFO DYNAMIC_DNS Query to a *.servernux .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gracesiefer .com Domain"

• "ET INFO SUSPICIOUS SMTP EXE - EXE SMTP Attachment"

• "ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.fin-tech .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mefound .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tedfullwood .com Domain"

• "ET USER_AGENTS Observed Suspicious UA (system_file/2.0)"

• "ET INFO DYNAMIC_DNS Query to a *.yao .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.antrak .org .tr Domain"

• "ET EXPLOIT Possible TLS HeartBleed Unencrypted Request Method 3 (Inbound to Common SSL Port)"

• "ET INFO Psiphon VPN Related Activity (POST)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freedynamicdns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bouncers4rent .com Domain"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing jmx mbeanserver"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sexidude .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-md .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dicionar .io Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-va .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chicago360factor .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sourcekeeper .com Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-22"

• "ET CURRENT_EVENTS LCL Banque et Assurance (FR) Phishing Landing 2018-01-23"

• "ET INFO Lockbit Ransomware Related Domain in DNS Lookup (decoding .at)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.circusslaves .com Domain"

• "GPL ATTACK_RESPONSE id check returned web"

• "ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M1"

• "ET CURRENT_EVENTS Google/Adobe Shared Document Phishing Landing 2018-02-05"

• "ET INFO DYNAMIC_DNS Query to a *.mrcork .com Domain"

• "ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .fun)"

• "ET INFO PowerShell Hidden Window Command Common In Powershell Stagers M2"

• "ET POLICY Seetrol Software Download (GET)"

• "ET INFO DYNAMIC_DNS Query to a *.esmtp .biz Domain"

• "ET INFO HTTP POST Request to Suspicious *.icu domain"

• "ET INFO DYNAMIC_DNS Query to a *.thebranleur .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-llama .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.serveris .id .lv Domain"

• "ET CURRENT_EVENTS Microsoft Account Phishing Landing M2 2018-04-19"

• "ET INFO DYNAMIC_DNS Query to a *.yourvaluedhomes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nodnor .com Domain"

• "ET CURRENT_EVENTS WindowBase64.atob Function In Edwards Packed JavaScript - Possible iFrame Injection Detected"

• "ET POLICY DNS Query to DynDNS Domain *.myftp .org"

• "ET INFO BrowseTor .onion Proxy Service SSL Cert"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zerocoolgames .com Domain"

• "ET INFO Cloud IPFS Service Domain in DNS Lookup (fleek .co)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.keine-panik .net Domain"

• "ET INFO Microsoft Netconnection Domain in DNS Lookup"

• "ET INFO DYNAMIC_DNS Query to a *.homeplex .org Domain"

• "ET INFO HTTP Request to a *.asia domain"

• "ET POLICY DNS Query to .onion proxy Domain (payrobotor.com)"

• "ET POLICY HTTP traffic on port 443 (DELETE)"

• "ET DNS DNS Query for a Suspicious *.ae.am domain"

• "ET INFO DYNAMIC_DNS Query to a *.hectorhector .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homeftp .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-found .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zyix .com Domain"

• "ET INFO Inbound Powershell Creating .lnk File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aneisa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hiddencorner .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.queerline .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isyour .guru Domain"

• "ET WEB_CLIENT Hex Obfuscation of eval % Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.entergod .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.supbienestar .gob .ar Domain"

• "ET INFO File Sharing Service Domain in DNS Lookup (link .storjshare .io)"

• "ET CURRENT_EVENTS Stripe Phishing Landing 2018-08-30"

• "ET TROJAN Observed DNS Query to Known Knotweed/SubZero Domain"

• "ET INFO DYNAMIC_DNS Query to a *.agila .com .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cloudbusinessportal .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.trickip .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ks .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.panel-laboralcj .gob .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lutzenheiser .com Domain"

• "ET CURRENT_EVENTS Upgrade Email Account Phishing Landing 2018-03-12"

• "ET INFO DYNAMIC_DNS Query to a *.vaultnoir .com Domain"

• "ET ATTACK_RESPONSE Possibly Malicious VBS Writing to Persistence Registry Location"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vaizer .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wwwhost .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hatenboer .org Domain"

• "ET INFO InetSim Response from External Source Possible SinkHole"

• "ET INFO DYNAMIC_DNS Query to a *.sne .jp Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsup .net Domain"

• "ET CURRENT_EVENTS Possible Successful Phish - Generic POST to myform.php Feb 01 2013"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-soxfan .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vpndns .net Domain"

• "ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .pro)"

• "ET POLICY DNS Query to .onion proxy Domain (onion.gq)"

• "ET USER_AGENTS Observed Suspicious UA (My Agent)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.selfip .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tmxc .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-wiki .com Domain"

• "ET CURRENT_EVENTS Dropbox Business Phishing Landing 2018-02-07"

• "ET INFO DYNAMIC_DNS Query to a *.tftpd .net Domain"

• "ET CURRENT_EVENTS Possible Halkbank (TK) Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.changeip .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.minetest .land Domain"

• "ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response (Server Init Vuln Client)"

• "ET POLICY DNS Query to .onion proxy Domain (onion.direct)"

• "ET INFO Obfuscated Split String (Single Q) 8"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ky .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.game-server .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.caminobooks .com Domain"

• "ET INFO Observed Public Proxy Service Domain (www .89ip .cn in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.from-ms .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.moochurch .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.justdied .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.geekhardware .com Domain"

• "ET CURRENT_EVENTS SEO Injection/Fraud Domain in DNS Lookup (stat.trackstatisticsss .com)"

• "ET DNS Query for Suspicious .xe.cx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gigaportal .pl Domain"

• "ET INFO POST to Double Slash in URI"

• "ET INFO HTTP Request to a *.de.tf domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.localghost .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.osclabs .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnslive .net Domain"

• "ET POLICY DNS Query to .onion proxy Domain (tor2pay.com)"

• "ET INFO DYNAMIC_DNS Query to a *.xxxy .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.evils .in Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.csproject .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servecounterstrike .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hot-hed .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-wiki .com Domain"

• "ET INFO Observed DNS Query for EmerDNS TLD (.bazar)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nokedli .org Domain"

• "ET INFO HTTP Request to a *.c0m.li domain"

• "ET INFO Observed File Sharing Service Domain (link .storjshare .io in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-student .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.punkassgamers .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tomahawkchurch .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.softwarefinesse .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.toadfishmonastery .org Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-04-09"

• "ET INFO DYNAMIC_DNS Query to a *.etitrans .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pgafan .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ri .com Domain"

• "ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .live)"

• "ET INFO DYNAMIC_DNS Query to a *.bien .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.z0d .eu Domain"

• "ET INFO RDP Wrapper Download (ini)"

• "ET POLICY DNS Query to .onion proxy Domain (onion.glass)"

• "ET INFO X86_64 File Download Request from IP Address"

• "ET INFO Powershell Downloader with Start-Process Inbound M1"

• "ET INFO DYNAMIC_DNS Query to a *.dynu .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynalias .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sumibi .org Domain"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-01-23"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4ippi .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.away .im Domain"

• "ET WEB_CLIENT Hex Obfuscation of replace Javascript Function %u UTF-8 Encoding"

• "ET INFO Observed DNS Query to DDNS Domain .otzo .com"

• "ET INFO Cloned Bank of America Page - Possible Phishing Landing M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mascarenhas .inf .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.duta .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dixiesewing .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zanity .net Domain"

• "ET CURRENT_EVENTS Credit Mutuel de Bretagne (FR) Phishing Landing 2018-02-26"

• "ET CURRENT_EVENTS Possible BMO Bank of Montreal Phishing Landing - Title over non SSL"

• "ET INFO Likely Hex Encoded Executable as String - Dash Separated"

• "ET CURRENT_EVENTS Amazon Phishing Landing (DE) 2018-02-26"

• "ET INFO DYNAMIC_DNS Query to a *.now-dns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.folklandmanagement .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iamallama .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.takony .hu Domain"

• "ET INFO HTTP Request to a *.int.tf domain"

• "ET CURRENT_EVENTS [eSentire] Docusign Phishing Landing 2018-04-09"

• "ET INFO Office Doc Retrieving Shortened URL (bit .do)"

• "ET INFO WebDAV Retrieving .zip"

• "ET INFO DYNAMIC_DNS Query to a *.synoserver .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.isa-geek .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.img .com .ar Domain"

• "ET INFO Request for EXE via WinHTTP M2"

• "ET INFO DYNAMIC_DNS Query to a *.opensrc .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.stuff-4-sale .us Domain"

• "ET INFO Windows Commands and Variables in DNS Reply"

• "ET INFO DYNAMIC_DNS Query to a *.vix .ro Domain"

• "ET INFO MIPS File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.b0tnet .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mypets .ws Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (52b2tlLVdtaU1ldG) in DNS TXT Reponse"

• "ET WEB_CLIENT Hex Obfuscation of unescape %u UTF-8 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.soussa-csc .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torprivatebrowsing.org)"

• "ET INFO Observed MSP360 Backup Service Domain (mspbackups .com in TLS SNI)"

• "ET WEB_SERVER WebShell - JSPCMD - Form"

• "ET INFO DYNAMIC_DNS Query to a *.mrslove .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kaznets .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.office-on-the .net Domain"

• "ET CURRENT_EVENTS Successful PayPal Phish Nov 24 2014"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.bbs)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .info Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-05-09"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.merseine .org Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET POLICY DNS Query to .onion proxy Domain (onion. pw)"

• "ET INFO DYNAMIC_DNS Query to a *.xevna .net Domain"

• "ET INFO File Sharing Related Domain in DNS Lookup (download .mediafire .com)"

• "ET CURRENT_EVENTS Dropbox Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.slyip.com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.cable-modem .org"

• "ET WEB_CLIENT Hex Obfuscation of String.fromCharCode % Encoding"

• "ET DNS DNS Query for a Suspicious *.cu.cc domain"

• "ET INFO DYNAMIC_DNS Query to a *.mynetav .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.salty72 .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ax .lt Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-bruinsfan .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.isasecret .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ospachat .com Domain"

• "ET INFO Cloned American Express Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bbs .io Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fedea .com .ar Domain"

• "ET INFO Cloned ABSA Bank Page - Possible Phishing Landing"

• "ET INFO External IP Address Lookup Domain (get .geojs .io) in DNS Lookup"

• "ET DNS Query for Suspicious .net.tf Domain"

• "ET INFO DYNAMIC_DNS Query to a *.infe .com .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.anal-slavery .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vhfdental .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.barrell-of-knowledge .info Domain"

• "ET WEB_SERVER PHP SESSION SuperGlobal in URI"

• "ET POLICY DNS Query to DynDNS Domain *.servemp3 .com"

• "ET POLICY DynDNS CheckIp External IP Address Server Response"

• "ET INFO DYNAMIC_DNS Query to a *.onmypc .org Domain"

• "ET INFO Observed External IP Lookup Domain (ip .me in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.datacomponents .com .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vcaptains .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bloodforthebloodgod .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tftpd .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.coolfire25 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.with .mirkforce .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.progressivecongressnews .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.adistra .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.endofinternet .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.authorizeddns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ezua .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dade .si Domain"

• "ET CURRENT_EVENTS TDS Sutra - page redirecting to a SutraTDS"

• "ET INFO DYNAMIC_DNS Query to a *.tzafrir .org .il Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.donhoo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webhop .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.spacegas .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.defensoria-nsjp .gob .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fairuse .org Domain"

• "ET TROJAN Observed Malicious UA (Skuxray)"

• "ET INFO DYNAMIC_DNS Query to a *.ozziesworld .com Domain"

• "ET CURRENT_EVENTS Possible Paypal Phishing Landing - Title over non SSL"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (V3LU9) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ku4oy .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lqtai .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-democrat .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fin-tech .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aintno .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-dc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.run .place Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-chef .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.likescandy .com Domain"

• "ET CURRENT_EVENTS Chase Phishing Landing 2018-03-28"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.k22 .su Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-server .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.paulkelly .org Domain"

• "ET INFO DYNAMIC_DNS Query to *lowestprices Domain (Sitelutions)"

• "ET USER_AGENTS Suspicious User-Agent SimpleClient 1.0"

• "ET INFO DYNAMIC_DNS Query to a *.organiccrap .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myddns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.saves-the-whales .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mudchute .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.autoddns.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.apps .dj Domain"

• "ET USER_AGENTS Observed Suspicious UA (IExplorer 34)"

• "ET INFO DYNAMIC_DNS Query to a *.tcta .com .au Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chimmychurry .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.freewww .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mlbfan .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.reg .my .id Domain"

• "ET WEB_CLIENT Hex Obfuscation of arguments.callee %u UTF-8 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sandcherrysystems .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-sc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rpz .su Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hec .to Domain"

• "ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ionexusa .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of parseInt %u UTF-8 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.usajusaj .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.newsofmaricopa .com Domain"

• "ET CURRENT_EVENTS Possible Dynamic Dns Exploit Pack Java exploit"

• "ET TROJAN Observed DNS Query to bablosoft Domain (downloads .bablosoft .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.superizeme .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.milk .is Domain"

• "ET INFO DYNAMIC_DNS Query to a *.patelmortgage .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ndra .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.teaches-yoga .com Domain"

• "ET WEB_CLIENT FakeAV scanner page encountered Initializing Virus Protection System"

• "ET MALWARE Win/Malware.Filetour Variant Checkin M2"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-02-15"

• "ET INFO DYNAMIC_DNS Query to a *.mynetav .com Domain"

• "ET CURRENT_EVENTS Linkedin Phishing Landing 2018-02-14"

• "ET INFO DYNAMIC_DNS Query to a *.byte4byte .com Domain"

• "ET INFO EXE extension in DNS TXT Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yiannamarie .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.home .kg Domain"

• "ET POLICY DNS Query to DynDNS Domain *.damnserver .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.splinteredlightbooks .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.colloky .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-green .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jaytex .org Domain"

• "ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.18t .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.green-heroes .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.opaline .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.telcomresearch .com Domain"

• "ET CURRENT_EVENTS SofosFO obfuscator string 19 Dec 12 - possible landing"

• "ET INFO DYNAMIC_DNS Query to a *.dotbot .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.net-freaks .com Domain"

• "ET CURRENT_EVENTS Retrieve Pending Emails Phishing Landing 2018-03-12"

• "ET INFO DYNAMIC_DNS Query to a *.intranetwifi .it Domain"

• "ET INFO DYNAMIC_DNS Query to a *.letz .dev Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tien-shan .org Domain"

• "ET POLICY DNS Query to DynDNS Domain *.servehalflife .com"

• "ET INFO DYNAMIC_DNS Query to a *.borkar .in Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pleasecome .in Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ok .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-candidate .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.getamonkey .com Domain"

• "ET INFO DYNAMIC_DNS Query to *isgre.at Domain (Sitelutions)"

• "ET CURRENT_EVENTS Possible Dropbox Phishing Landing - Title over non SSL"

• "ET INFO Suspicious GET Request for .ppc File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mymediapc .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zapto .org Domain"

• "ET DNS Query for Suspicious .de.tf Domain"

• "ET INFO DYNAMIC_DNS Query to a *.a-quo .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zelslonik .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dansted .org Domain"

• "ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)"

• "ET INFO DYNAMIC_DNS Query to a *.freeddns .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.herbalhealthyh20 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chekanov .net Domain"

• "ET INFO PowerShell Hidden Window Command Common In Powershell Stagers M1"

• "ET CURRENT_EVENTS Possible Successful Remax Phish - Other Creds Jun 23 2015"

• "ET INFO DYNAMIC_DNS Query to a *.688 .org Domain"

• "ET POLICY DNS Query to DynDNS Domain *.health-carereform .com"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-personaltrainer .com Domain"

• "ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-al .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.livewave .ru Domain"

• "ET INFO Doc Requesting Remote Template (.dot)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.grid-tronix .com Domain"

• "ET WEB_SERVER WebShell Generic - net user"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.focusmarketing .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.est-le-patron .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.churchrez .org Domain"

• "ET POLICY HTTP Request to a *.dlinkddns.com domain"

• "ET INFO DYNAMIC_DNS Query to a *.melakaboy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jpleventos .cl Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M2 2018-08-30"

• "ET INFO Hidden embedded HTML Document"

• "ET INFO DYNAMIC_DNS Query to a *.gets-it .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.star .is Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dockl .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sexxxy .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.madhacker .biz Domain"

• "ET USER_AGENTS Observed Suspicious UA (zwt)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .tv Domain"

• "ET INFO Suspicious MSIE 10 on Windows NT 5"

• "ET POLICY DNS Query to DynDNS Domain *.securitytactics .com"

• "ET INFO DYNAMIC_DNS Query to a *.buhichan .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.n4t .co Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-techie .com Domain"

• "ET POLICY SUSPICIOUS *.doc.exe in HTTP HEADER"

• "ET INFO DYNAMIC_DNS Query to a *.darriondemelo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ga .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.barbaforte .org Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torbama.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mmafan .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4cloud .click Domain"

• "ET POLICY DNS Query to DynDNS Domain *.mlbfan .org"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.photographs .gs Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.knowsitall .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ctx .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.psybnc .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ftpaccess .cc Domain"

• "ET INFO Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hunnur .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.priamaakcia .sk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.codingtheworld .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.est-a-la-masion .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-mo .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of String.fromCharCode %u UTF-16 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onthewifi .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gtk .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shacknet .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.make .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jwork .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.e-m-a-i-l .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mutluay .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mysecuritycamera .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zverovich .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.donlafferty .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tmxc .ru Domain"

• "ET DNS Query for Suspicious .nl.ai Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dpo .co .id Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dmb .hk Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String (Single Q) 1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homaxcorp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.creery .org Domain"

• "ET CURRENT_EVENTS Possible Successful Yahoo Phish Jun 23 2015"

• "ET CURRENT_EVENTS Email Verification/Upgrade Phishing Landing 2018-01-22"

• "ET INFO Onion/TOR Successful Proxy Request Response (Inbound)"

• "ET POLICY DNS Query to DynDNS Domain *.dvrcam .info"

• "ET CURRENT_EVENTS Outlook Web App Phishing Landing 2018-02-07"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-republican .com Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-01-31"

• "ET USER_AGENTS Suspicious User-Agent (aaaa)"

• "ET INFO Cloned ADP Page - Possible Phishing Landing"

• "ET INFO External IP Address Lookup Domain (ifconfig .pro) in DNS Lookup"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-very-evil .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homeunix .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.infe .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsalias .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.klipp .su Domain"

• "ET INFO HTTP Request to Suspicious *.world Domain"

• "ET INFO SUSPICIOUS Reassigned Eval Function 3"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.htclink .com Domain"

• "ET INFO Inveigh Proxy Powershell Script Retrieval (Inbound)"

• "ET INFO Dotted Quad Host M1 (noalert)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tuquy .com Domain"

• "ET INFO SUPERH File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hpc .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.novgaz-rzn .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.reves .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.neurogine .com Domain"

• "ET INFO DYNAMIC_DNS Query to *bestdeals.at Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.samoobrona .one .pl Domain"

• "ET CURRENT_EVENTS Mailbox Upgrade Phishing Landing 2018-02-05"

• "ET MALWARE Win/Malware.Filetour Variant Checkin M1"

• "ET INFO DYNAMIC_DNS Query to a *.orienta .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blogdns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveexchange .com Domain"

• "ET WEB_CLIENT SUSPICIOUS Possible Office Doc with Embedded VBA Project"

• "ET INFO Observed DNS Query to .myq-see .com DDNS Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.k4w411 .net Domain"

• "ET CURRENT_EVENTS Observed CloudFlare Interstitial Phishing Page"

• "ET POLICY DNS Query to DynDNS Domain *.servehttp .com"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (RhcnQtUHJ) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.cascadesterling .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.abk .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.camdvr .org Domain"

• "ET INFO Cloned Telekom / Tmobile Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.koellreutter .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.keybusinessconnection .com Domain"

• "ET INFO SUSPICIOUS Dotted Quad Host MZ Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webs .vc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sytes.net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.birdriver .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gotgeeks.com Domain"

• "ET INFO HTTP Request to a *.buzz domain"

• "ET INFO DYNAMIC_DNS Query to a *.xseller .com Domain"

• "ET EXPLOIT Malformed HeartBeat Request method 2"

• "ET INFO DYNAMIC_DNS Query to a *.galecsy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.autoroutedemorges .ch Domain"

• "ET WEB_CLIENT Hex Obfuscation of document.write # Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.toshibanetcam .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.emldn .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.unids .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dateeasily .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sourcekeeper .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynuddns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bucu .pl Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torpayusd.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chickenkiller .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.videounlimit .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vaultnoir .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.deusexmachina .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.localghost .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chaseinator .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ripservers .com Domain"

• "ET POLICY Suspicious File Sharing Domain in DNS Lookup (drive .cloudplus .one)"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-free .com Domain"

• "ET POLICY HTTP traffic on port 443 (PUT)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.theriens .com Domain"

• "ET USER_AGENTS Suspicious User-Agent Mozilla/3.0"

• "ET INFO Dotted Quad Host M3 (noalert)"

• "ET INFO Observed URL Shortening Domain (da .gd in TLS SNI)"

• "ET POLICY DNS Query to .onion proxy Domain (onion. sx)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dns-free.ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-doctor .com Domain"

• "GPL FTP tar parameters"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsip.ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.china .is Domain"

• "ET ATTACK_RESPONSE Cisco TclShell TFTP Download"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M3"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bagus .org Domain"

• "ET POLICY DNS Query to DynDNS Domain *.couchpotatofries .org"

• "ET INFO DYNAMIC_DNS Query to a *.land-4-sale .us Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (RhcnQtUHJvY2) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.falcongreenenergy .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blizzie .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vizvaz .com Domain"

• "ET INFO Lucy Security - Admin Panel Accessed on Internal Server"

• "ET INFO Commonly Abused File Sharing Domain in DNS Lookup (ftpupload .net)"

• "ET POLICY Inbound RDP Connection with TLS Security Protocol Requested"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sulsel .go .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pogramkran .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wayner .ca Domain"

• "ET INFO Observed Public Cloud Domain (cld .pt in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.selfip .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.usjepor .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.demoteam .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gettrials .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fearpenguins .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stufftoread .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.strangled .net Domain"

• "ET POLICY Serialized Java Object returned via LDAPv3 Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.16-b .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.x3mfly .com Domain"

• "ET INFO Possible Phishing Landing - Zeus365 Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jkub .com Domain"

• "ET INFO SUSPICIOUS SMTP EXE - RAR file with .scr filename inside"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M1"

• "ET INFO DYNAMIC_DNS Query to a *.cloudranger .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hs .vc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-not-certified .com Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-player .com Domain"

• "ET INFO Observed Anonymous File Sharing Service Domain (send .vis .ee in TLS SNI)"

• "ET INFO Obfuscated Split String (Single Q) 7"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.andreymorozov .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.normaweese .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zyix .com Domain"

• "ET CURRENT_EVENTS Successful PayPal Phish Nov 30 2012"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynuddns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.oc .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nowddns .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.imexsac .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chebicon .ru Domain"

• "ET INFO Request to 000webhostapp Domain with Minimal Headers"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eiresol .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kanda .ru Domain"

• "ET INFO vibe.d Library User-Agent"

• "ET INFO DYNAMIC_DNS Query to a *.requitas .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.casacam .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.here-for-more .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.partybag .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.priamaakcia .sk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.h-o-s-t .name Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.barrel-of-knowledge .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cbu .net Domain"

• "ET INFO Observed External IP Lookup Domain (icanhazip .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.porngo .at Domain"

• "ET CURRENT_EVENTS Dropbox Phishing Landing 2018-02-15"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.smelly .cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-an-accountant .com Domain"

• "ET INFO Observed SyncroMSP Remote Management Software Domain (kabutoservices .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.aksnapshots .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sen .org .nz Domain"

• "ET INFO External IP Address Lookup Service in TLS SNI (getip .pro)"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-nascarfan .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-chef .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.adoubleu .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mymom .info Domain"

• "ET SCAN Suspicious inbound to mySQL port 3306"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.webqi .org Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-05-09"

• "ET POLICY HTTP Request to a *.qc.cx domain"

• "ET POLICY Tunneled RDP msts Handshake"

• "ET INFO DYNAMIC_DNS Query to a *.wakingmoon .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-celticsfan .org Domain"

• "ET INFO Public Proxy Service Domain in DNS Lookup (89ip .cn)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fartit .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.voles35 .ru Domain"

• "ET CURRENT_EVENTS Adobe PDF Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.monobasin .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.2dons .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blogdns .net Domain"

• "ET USER_AGENTS Observed Malicious User-Agent (Brute Force Attacks)"

• "ET INFO DYNAMIC_DNS Query to a *.prasbharapolresbojonegoro .or .id Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-02-05"

• "ET INFO DYNAMIC_DNS Query to a *.webhop .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.youdontcare .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ltu .one .pl Domain"

• "ET INFO UPnP Discovery Search Response - CVE-2012-5958 and CVE-2012-5959 Vulnerable UPnP device M3"

• "ET CURRENT_EVENTS USAA Phishing Landing 2018-02-20"

• "ET CURRENT_EVENTS Possible CIBC Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.2waky .com Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.etowns.org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.movdivx .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.btbtrading .it Domain"

• "ET INFO RealThinClient Outbound Communication"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gleeze .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jbworks .com Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (GFydC1Qcm9jZX) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.elitter .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mascarenhas .inf .br Domain"

• "ET USER_AGENTS Suspicious User-Agent (example/1.0)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-cubicle-slave .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torminater.com)"

• "ET INFO DYNAMIC_DNS Query to a *.ddnsfree .com Domain"

• "ET SCAN OpenVASVT RCE Test String in HTTP Request Outbound"

• "ET INFO DYNAMIC_DNS Query to a *.wooloo .net Domain"

• "ET POLICY Nessus Server SSL certificate detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shadir .com Domain"

• "ET POLICY HTTP Request to a *.cz.cc domain"

• "ET INFO Cloned Scotiabank Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.k4w411 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bisolta .com Domain"

• "ET CURRENT_EVENTS Google Drive Phishing Landing 2018-02-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wiki .gd Domain"

• "ET WEB_CLIENT SUSPICIOUS Java Lang Runtime in Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tibet .org Domain"

• "ET POLICY DNS Query to .onion proxy Domain (toralpacho.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.khabdha .org domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zipper-maker .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thegiblins .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aispilot .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dumb1 .com Domain"

• "ET INFO Suspicious POST Format"

• "ET INFO DYNAMIC_DNS Query to a *.nx .tc Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS Query to a *.robonauts .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.operationbim .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.poo .li Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.spacegas .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bestoftheat .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.home .dyndns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ygto .com Domain"

• "ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ssitech .bg Domain"

• "ET INFO DYNAMIC_DNS Query to a *.baselinux .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.herbalhealthyh20 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.quicksytes .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-into-games .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.24-7 .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.trudireaume .com domain"

• "ET INFO DYNAMIC_DNS Query to a *.rock-n-roll .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.devwonders .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vankin .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsup .net Domain"

• "ET CURRENT_EVENTS Possible Successful AOL Phish Nov 25 2013"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.airlinemeals .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.skies .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-with-theband .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zhanwenhan .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-tx .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rogerthedog .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ezua .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.expedicionesytrekking .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.uk .ms Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.guild-site .com Domain"

• "ET INFO Obfuscated Split String (Double Q) 8"

• "ET INFO DYNAMIC_DNS Query to a *.verbateam .net Domain"

• "ET POLICY DNS Query to DynDNS Domain *.homesecuritymac .com"

• "ET INFO Observed External IP Check Domain (api .ipapi .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sendsmtp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ideaustry .sg Domain"

• "ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07"

• "ET INFO DYNAMIC_DNS Query to a *.dubya .info Domain"

• "ET CURRENT_EVENTS Generic AES Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.australia .ai Domain"

• "ET WEB_SERVER WebShell Generic - *.tar.gz in POST body"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.golffan .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.scieron.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ycare .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freedynamicdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stuff-4-sale .us Domain"

• "ET CURRENT_EVENTS Bank of America Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.dynv6 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.getamonkey .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.widlund .fi Domain"

• "ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.battlecore .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-musician .com Domain"

• "ET CURRENT_EVENTS Capital One Phishing Landing 2018-02-13 M2"

• "ET INFO m68k File Download Request from IP Address"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mypop3 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alimentoshen .cl Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.indy)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.changeip .us Domain"

• "ET INFO External IP Lookup Domain (freegeiop .net in DNS lookup)"

• "ET INFO DYNAMIC_DNS Query to a *.3n .cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddnsguru .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.franchisecandidates .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.www1 .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-nj .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.qhigh .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.clienturl .net Domain"

• "ET POLICY DNS Query to DynDNS Domain *.stufftoread .com"

• "ET CURRENT_EVENTS TDS Sutra - redirect received"

• "ET INFO DYNAMIC_DNS Query to a *.bellasclown .com Domain"

• "ET INFO Request to .ML Domain with Minimal Headers"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ok .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iliensale .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dns-report .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bot .nu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myjamesonline .net Domain"

• "ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"

• "ET INFO DYNAMIC_DNS Query to a *.infocommthailand .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.abc92 .ru Domain"

• "ET INFO Possible Phish - Saved Website Comment Observed"

• "ET INFO DYNAMIC_DNS Query to a *.misecure .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnet .hu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-mo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hansa-tmp .cn Domain"

• "ET CURRENT_EVENTS Possible Generic Antibots Phishing Landing 2018-02-05"

• "ET INFO Unconfigured nginx Access"

• "ET INFO DYNAMIC_DNS Query to a *.ooguy .com Domain"

• "ET TROJAN SUSPICIOUS IRC - NICK and -PC"

• "ET INFO DYNAMIC_DNS Query to a *.almostmy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nodnor .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.normaweese .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.redirectme .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stocktester .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.radioimpactfm .ro Domain"

• "ET INFO Suspicious GET Request with Possible COVID-19 URI M2"

• "ET INFO DYNAMIC_DNS Query to a *.dubya .net Domain"

• "ET INFO DYNAMIC_DNS Query to freemyip .com Domain"

• "ET CURRENT_EVENTS Possible Dynamic DNS Exploit Pack Landing Page /de/sN"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.coolfire25 .com Domain"

• "ET INFO HTTP Connection To DDNS Domain Zapto.org"

• "ET INFO Observed certreq User-Agent (NDES client)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pushitlive .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dougtreadwell .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mbiselangor .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cbu .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gw .lt Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cechire .com Domain"

• "ET WEB_CLIENT Microsoft Tech Support Phone Scam Landing 2018-09-12"

• "ET INFO DYNAMIC_DNS Query to a *.soon .it Domain"

• "ET WEB_CLIENT Suspicious Possible Zip DL containing single VBS script"

• "ET INFO DYNAMIC_DNS Query to a *.scottexteriors .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homesecuritymac .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.est-mon-blogueur .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zza .pl Domain"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing tracing Provider Factory"

• "ET INFO Dotted Quad Host XLS Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.d-n-s .name Domain"

• "ET INFO DYNAMIC_DNS Query to a *.encyclopedia .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iz .rs Domain"

• "ET CURRENT_EVENTS Possible Ziraat Bank (TK) Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.land-4-sale .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nau .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.itsaol .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-hunter .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rtmuller .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.4twenty .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onmypc .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gun .vn domain"

• "ET INFO DYNAMIC_DNS Query to a *.merrittcredit .com Domain"

• "ET WEB_SERVER Possible bash shell piped to dev udp Inbound to WebServer"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.slumbo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.firesidegrillandbar .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sleeperkidsworld .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cnstefancelmare .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsking .ch Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torpaycash.com)"

• "ET INFO DYNAMIC_DNS Query to a *.inovasi .co .id Domain"

• "ET INFO SMTP PDF Attachment Flowbit Set"

• "ET INFO DYNAMIC_DNS Query to a *.minecraftpotato .com Domain"

• "ET INFO Likely Hex Encoded Executable as String - Tilde Separated"

• "ET INFO DYNAMIC_DNS Query to a *.vaizer .cl Domain"

• "ET WEB_SERVER WebShell - MySQL Interface - Server Set Cookie mysql_web_admin*="

• "ET INFO DYNAMIC_DNS HTTP Request to a *.moneyhome .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.spottt .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.adistra .com Domain"

• "ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak"

• "ET INFO DYNAMIC_DNS Query to a *.seasol .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.b0ne.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.imexsac .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yourtrap .com Domain"

• "ET INFO Cloned CIBC Bank Page - Possible Phishing Landing M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.soapclient .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.masplene .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bellywings .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wifizone .org Domain"

• "ET INFO Observed File Sharing Domain (roamresearch .com in TLS SNI)"

• "ET INFO Multiple Javascript Unescapes - Common Obfuscation Observed in Phish Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-wi .com Domain"

• "ET USER_AGENTS Suspicious User-Agent (Windows 7)"

• "ET USER_AGENTS Observed Suspicious UA (Client)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mywww .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dynalias .com Domain"

• "ET INFO JJEncode Encoded Script"

• "ET INFO DYNAMIC_DNS Query to a *.gpk .si Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.humorvisite .eu Domain"

• "ET MALWARE Socelars Related Domain in DNS Lookup"

• "ET USER_AGENTS Suspicious User-Agent (Random String)"

• "ET INFO DYNAMIC_DNS Query to a *.artisnotcrime .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.swphoa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.v6 .army Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alsupnet .com Domain"

• "ET DNS DNS Query for Suspicious .cz.cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mrslove .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hitremixes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.effers.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.good .one .pl Domain"

• "ET INFO Imposter USPS Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.orienta .com .br Domain"

• "ET CURRENT_EVENTS StyX Landing Page"

• "ET CURRENT_EVENTS Bank of America Phishing Landing 2018-05-01"

• "ET DNS Hiloti DNS CnC Channel Successful Install Message"

• "ET INFO Obfuscated Split String (Double Q) 1"

• "ET INFO DYNAMIC_DNS Query to a *.heroinewarrior .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dhcp .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pagostepeapulco .gob .mx Domain"

• "ET USER_AGENTS Observed Suspicious UA (easyhttp client)"

• "ET INFO DYNAMIC_DNS Query to a *.seprotec .net .br Domain"

• "ET CURRENT_EVENTS Mailbox Update Phishing Landing 2018-02-26"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gsp .co .id Domain"

• "ET INFO Double User-Agent (User-Agent User-Agent)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.callmark .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.swe .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mynetav .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bgdsupport .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.3utilities .com"

• "ET WEB_CLIENT Suspicious VBS Encoding Observed in BottleEK"

• "ET INFO DYNAMIC_DNS Query to a *.s4w .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.servebbs .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.academic .org .il Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sequoiapartners .com Domain"

• "ET CURRENT_EVENTS Possible Dropbox Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cashit .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.https443 .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.monopolepower .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.eupla .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.clickit .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.as19557 .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.for-more .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cybertv .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.irfna .com Domain"

• "ET INFO Redirect Link in TikTok URL"

• "ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.opensrc .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.automotive .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.possessed .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servehumour .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kitayori .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.answersbot .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torchek.com)"

• "ET INFO DYNAMIC_DNS Query to a *.ocean-nation .co .il Domain"

• "ET INFO DYNAMIC_DNS Query to a *.selfip .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.quilmes .gob .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gotdns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shacknet .biz Domain"

• "ET INFO Redirection to driveby Page Home index.php"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hobby-site .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.letz .dev Domain"

• "ET INFO DYNAMIC_DNS Query to a *.anime-stars .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.66haoyun .com Domain"

• "ET WEB_SERVER SQL Errors in HTTP 500 Response (SqlException)"

• "ET WEB_SERVER Possible Encrypted Webshell in POST"

• "ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.issmarterthanyou .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.mmafan .biz"

• "ET WEB_CLIENT Hex Obfuscation of String.fromCharCode %u UTF-8 Encoding"

• "ET CURRENT_EVENTS Possible Yahoo Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.misecure .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.leonisbg .com Domain"

• "ET INFO 7-zip Executable Requested (GET)"

• "ET INFO Observed Blockchain Domain (api .blockcypher .com in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.moot .es Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tuquy .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.basewisdom .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.now-dns .top Domain"

• "ET INFO Observed DNS Query for EmerDNS TLD (.coin)"

• "ET INFO DYNAMIC_DNS Query to a *.is-leet .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lutzenheiser .com Domain"

• "ET MALWARE FormatFactory Install Checkin"

• "ET INFO DYNAMIC_DNS Query to a *.horng-bin .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-at-work .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tth .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gotdns .ch Domain"

• "ET INFO DYNAMIC_DNS Query to nip .io Domain"

• "ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Server)"

• "ET INFO DYNAMIC_DNS Query to *uglyas.com Domain (Sitelutions)"

• "ET INFO Obfuscated Split String (Double Q) 7"

• "ET INFO DYNAMIC_DNS Query to a *.meier .li Domain"

• "ET WEB_SERVER Possible Encrypted Webshell Download"

• "ET INFO DYNAMIC_DNS Query to a *.scorm .gr Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alltransportme .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.id .web .id Domain"

• "ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ninth .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.auraria .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.soapagent .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of replace Javascript Function % Encoding"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.strangled .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iwantthisjunk .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tehlab .org Domain"

• "ET CURRENT_EVENTS Successful PayPal Phish Dec 19 2012"

• "ET INFO DYNAMIC_DNS Query to a *.happyminecraft .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ec .gy Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xn--ds-bja .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.good-newz .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ilovecollege .info Domain"

• "ET CURRENT_EVENTS RedKit - Potential Payload Requested - /2Digit.html"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (FydC1Qcm9) in DNS TXT Reponse"

• "ET POLICY Vulnerable Java Version 1.5.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.primavera .hk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shareroute .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.joseulloa .cl Domain"

• "ET INFO Suspicious Windows NT version 0 User-Agent"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-not-certified .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.motoretta .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.skytaxi .jp Domain"

• "ET CURRENT_EVENTS Netflix Phishing Landing 2018-05-02"

• "ET INFO JNLP embedded file"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (YXJ0LVByb2Nlc3) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.minecraft .pe Domain"

• "ET INFO DYNAMIC_DNS Query to a *.earlyriserscoffeeshop .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hbmc .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tecnova .com .br Domain"

• "ET POLICY Proxy TRACE Request - inbound"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.etsang .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.hosthampster .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.what2no .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tountas .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .org Domain"

• "ET CURRENT_EVENTS StyX Landing Page (2)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsdojo .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.onmypc .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-free .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aarogyamnepal .org .np Domain"

• "ET INFO DYNAMIC_DNS Query to a *.networkoutpost .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gsp .co .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myhomedns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.accesscam .org Domain"

• "ET POLICY DNS Query to .onion proxy Domain (onion.to)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.brasilia .me Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.as19557 .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aber .ir Domain"

• "ET POLICY DNS Query to DynDNS Domain *.nhlfan .net"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bgdsupport .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.galitec .es Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aussievitamin .com Domain"

• "ET INFO Suspicious Windows Commands in POST Body (net view)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.epicgamer .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.effers.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.idigo .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveftp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bloodforthebloodgod .com Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M1 2018-08-30"

• "ET INFO Unix/Linux Processhider Source Being Downloaded"

• "ET INFO DYNAMIC_DNS Query to a *.nux .co .za Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.larakaras .com Domain"

• "ET CURRENT_EVENTS Generic HeapSpray Construct"

• "ET INFO DYNAMIC_DNS Query to a *.g33k .com .ve Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lehoozeher .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynv6 .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homelinuxserver .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.verymad .net Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.epic)"

• "ET WEB_SERVER PHP REQUEST SuperGlobal in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveminecraft .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jcho .com Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-01-25"

• "ET INFO Suspicious Windows Commands in POST Body (net config)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.civvic .ro Domain"

• "ET USER_AGENTS Observed Suspicious UA (grab)"

• "ET POLICY DNS Query to DynDNS Domain *.homesecuritypc .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.now-dns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iceage .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dpo .co .id Domain"

• "ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bine .me Domain"

• "ET INFO DYNAMIC_DNS Query to a *.internetzninja .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ireland .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.swhydro .com Domain"

• "ET INFO Observed Remote Management Software Domain in DNS Lookup (syncromsp .com)"

• "ET CURRENT_EVENTS Office 365 Phishing Landing 2018-01-25"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.friendship .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.neat-url .com Domain"

• "ET WEB_SERVER WebShell - D.K - Title"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.masplene .com Domain"

• "ET TROJAN MacOS/Adload Proxy Node Beacon"

• "ET INFO HTTP Connection To DDNS Domain serveblog.net"

• "ET POLICY DNS Query to DynDNS Domain *.myvnc .com"

• "ET INFO DYNAMIC_DNS Query to a *.logic .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.synoserver .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.got-game .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.studiovk .com Domain"

• "ET MALWARE DriverPack Domain in DNS Query"

• "ET CURRENT_EVENTS Hellion Postmaster Phishing Landing 2018-01-31"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-caterer .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gw .lt Domain"

• "ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response (Client Init Vuln Server)"

• "ET INFO SUSPICIOUS IRC - NICK and 3 Letter Country Code"

• "ET INFO DYNAMIC_DNS Query to a *.frostcatcher .com Domain"

• "ET INFO HTTP POST Request to DuckDNS Domain"

• "ET POLICY Observed DNS Query to DynDNS Domain (dns-report .com)"

• "ET INFO DYNAMIC_DNS Query to a *.lai .ac Domain"

• "ET INFO DYNAMIC_DNS Query to a *.americanunfinished .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mylftv .com Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.defensoria-nsjp .gob .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.17ping .cn Domain"

• "ET INFO Observed DNS Query to .desi TLD"

• "ET INFO DYNAMIC_DNS Query to a *.ecosys .eu Domain"

• "ET INFO Java File Sent With X-Powered By HTTP Header - Common In Exploit Kits"

• "ET INFO Commonly Abused Domain Service Domain in DNS Lookup (temp .swtest .ru)"

• "ET INFO SUSPICIOUS UA starting with Mozilla/7"

• "ET CURRENT_EVENTS Impots.gouv.fr Phishing Landing 2018-01-30"

• "ET INFO DYNAMIC_DNS Query to a *.from-fl .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tomahawkchurch .org Domain"

• "ET USER_AGENTS Observed Suspicious UA (DxD)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.scay .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homeip .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dtdns.net Domain"

• "ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode"

• "ET INFO Dotted Quad Host RTF Request"

• "ET INFO DYNAMIC_DNS Query to a *.mine .nu Domain"

• "ET DNS Query to a .tk domain - Likely Hostile"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blueshadows .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.logntw .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.unix .id .lv Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.v6 .army Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.intec .es Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M3 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ps .ai Domain"

• "ET INFO DYNAMIC_DNS Query to a *.paumard .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wwwhost .us Domain"

• "ET CURRENT_EVENTS Microsoft Document Phishing Landing 2018-08-30"

• "ET CURRENT_EVENTS Dropbox Phishing Landing 2018-02-14"

• "ET POLICY DNS Query to .onion proxy Domain (torgateway.org)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dogdammit .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shitgoddamnhellfuck .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-therapist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dob .jp Domain"

• "GPL ATTACK_RESPONSE command error"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xinit .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ri .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iliensale .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kirelli .net Domain"

• "ET INFO Base64 Encoded Windows IP Configuration Output in HTTP POST M3"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hkieca .com Domain"

• "ET TROJAN EXE Using Suspicious IAT ZwUnmapViewOfSection Possible Malware Process Hollowing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myftp .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.automotive .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.treetech .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fernando-botero-sculpture .com Domain"

• "ET INFO Microsoft Dev Tunnels Domain DNS Lookup (devtunnels .ms)"

• "ET INFO DYNAMIC_DNS Query to a *.is-an-actor .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.opazo .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.host2go .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hepcats .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blogsite .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.d-n-s .name Domain"

• "ET INFO DYNAMIC_DNS Query to a *.scay .net Domain"

• "ET CURRENT_EVENTS Office 365 Phishing Landing 2018-01-29"

• "ET INFO DYNAMIC_DNS Query to a *.hansa-tmp .cn Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.motorwisemechanical .com .au Domain"

• "ET TROJAN Magecart Loader Javascript"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveuser .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-wy .com Domain"

• "ET CURRENT_EVENTS Possible Scotiabank Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.portalwebvillamercedes .gob .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.uitgavepatroon .nl Domain"

• "ET INFO HTTP Request to a *.ml domain"

• "ET CURRENT_EVENTS .exe download with no referer (noalert)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.baez .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gally .jp Domain"

• "ET CURRENT_EVENTS Turbotax Phishing Landing 2018-01-30"

• "ET INFO DYNAMIC_DNS Query to a *.fivepals .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.seburn .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mrbasic.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.compuinter .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.porngo .at Domain"

• "ET INFO PSSC Powershell File Request"

• "ET INFO DYNAMIC_DNS Query to a *.friendship .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.for-some .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-an-engineer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bluejeanblues .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.greengarden .net .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.morganisageek .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blue-jade .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sibmed .org .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-llama .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.weixservice .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ufodns .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pedie .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.64-b .it Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lettersandscience .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.minecraft .pe Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveusers .com Domain"

• "ET INFO Cloud File Sharing Domain in DNS Lookup (.filebase .io)"

• "ET INFO External IP Lookup Domain (ip-api .io) in DNS Lookup"

• "ET INFO DYNAMIC_DNS Query to a *.bmrresources .com Domain"

• "ET POLICY External IP Address Lookup (bei .kr)"

• "ET CURRENT_EVENTS Possible Capital One Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-teacher .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zzux .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-personaltrainer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.barratella .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.swhill .co .uk Domain"

• "ET POLICY HTTP Request to a *.cw.cm domain"

• "ET INFO DYNAMIC_DNS Query to a *.isa-geek .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.100mountain .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.klockars .com Domain"

• "ET INFO Suspicious GET Request for .mspl File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hmail .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stuff-4-sale .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-conservative .com Domain"

• "ET CURRENT_EVENTS Observed DNS Query to Known Scam/Phishing Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kronosoft .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.groks-the .info Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String (Single Q) 6"

• "ET INFO DYNAMIC_DNS Query to *findhere.org Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.louis-ip .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.moabphoto .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fintech-llc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.princesaleia .cl Domain"

• "ET INFO Suspicious rundll32.exe in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.geobattery .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.barvennon .com Domain"

• "ET CURRENT_EVENTS Generic Roundcube Multi-Brand Phishing Landing 2018-01-31"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bellasclown .com Domain"

• "ET POLICY Unserialized Java Payload via RMI Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kawa-kun .com Domain"

• "ET POLICY HTTP OPTIONS invalid method case outbound"

• "ET INFO DYNAMIC_DNS Query to a *.echoparklake .com Domain"

• "GPL ATTACK_RESPONSE id check returned root"

• "ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.oceanpolice .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dockl .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zza .pl Domain"

• "ET INFO External File Sharing Service Domain (api .anonfile .com in TLS SNI)"

• "ET TROJAN ETag HTTP Header Observed at CNCERT Sinkhole"

• "ET POLICY DNS Query to DynDNS Domain *.servehumour .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.forumz .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.passinggas.net Domain (Sitelutions)"

• "ET POLICY Potentially Vulnerable LibSSH Server Observed - Possible Authentication Bypass (CVE-2018-10933)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dvrdns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ygto .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.enia .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.star .is Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fido .be Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dns .navy Domain"

• "ET INFO DYNAMIC_DNS Query to a *.movdivx .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gilead .org .il Domain"

• "ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cobra200 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servemp3 .com Domain"

• "ET INFO Suspicious Domain (laurentprotector .com) in TLS SNI"

• "ET INFO Request to .GA Domain with Minimal Headers"

• "ET INFO DYNAMIC_DNS Query to a *.from-ct .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torpacho.com)"

• "ET INFO DYNAMIC_DNS Query to a *.ctx .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vicinanza .org Domain"

• "ET INFO SUSPICIOUS Reassigned Eval Function 2"

• "ET INFO DYNAMIC_DNS Query to a *.forgot .his .name Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thompent .com Domain"

• "ET USER_AGENTS Suspicious User Agent (KtulhuBrowser)"

• "ET CURRENT_EVENTS PayPal Phishing Landing Nov 24 2014"

• "ET ATTACK_RESPONSE Inbound PowerShell Checking for Virtual Host (Win32_Fan WMI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homeftp .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servesarcasm .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dream .org .il Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tscng .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ugego .com Domain"

• "ET POLICY Serialized Java Payload via RMI Response"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.spelar .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iownyour .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.n43 .pw Domain"

• "ET INFO Generic Powershell Starting Wscript Process"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myddns.me Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chrismac .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homeunix .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.derekcturner .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.farted .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.now-dns .top Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myftp .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.energysemi .com Domain"

• "ET USER_AGENTS Suspicious User-Agent (Embarcadero URI Client/1.0)"

• "ET INFO HTTP Request to a *.date domain"

• "ET INFO HTTP Request for OpenNIC API GeoIP Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.puffballofevil .com Domain"

• "ET POLICY SUSPICIOUS *.rar.exe in HTTP URL"

• "ET CURRENT_EVENTS Possible Desjardins Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.caribbeanpremierhotels .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.frostcatcher .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.oljka .com Domain"

• "ET SCAN MySQL Malicious Scanning 1"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onmypc .info Domain"

• "ET POLICY HTTP POST invalid method case outbound"

• "ET INFO DYNAMIC_DNS Query to a *.biometrika .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.issmarterthanyou .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.itekgroup .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mikata .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ryanandjen .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dailyview .tw Domain"

• "ET INFO Connectivity Check With Go User-Agent"

• "ET INFO DYNAMIC_DNS Query to a *.absl .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ssmailer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.windmillstravel .com Domain"

• "ET INFO Dotted Quad Host PDF Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ber-engineering .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.32-b .it Domain"

• "ET CURRENT_EVENTS SUSPICIOUS Java Request to NOIP Dynamic DNS Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ia .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.neoneptune .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hkieca .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsfailover .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ideaustry .sg Domain"

• "ET CURRENT_EVENTS Unknown Exploit Kit Exploit Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pii .at Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jonward .com Domain"

• "ET CURRENT_EVENTS Chase Phishing Landing 2018-02-07"

• "ET USER_AGENTS Observed Malicious User-Agent (FastInvoice)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.compy .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.drtonywang .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tscng .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.a4t .in Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fintech-llc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ecosys .eu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.motoretta .ca Domain"

• "ET WEB_CLIENT Possible Javascript obfuscation using app.setTimeOut in PDF in Order to Run Code"

• "ET INFO DYNAMIC_DNS Query to a *.tedfullwood .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mediatriumph .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.birdsofnorthamerica .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.novgaz-rzn .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alexandravlad .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.qlbv .vn Domain"

• "ET TROJAN Incorrectly formatted User-Agent string (dashes instead of semicolons) Likely Hostile"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.intercop .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.onedumb .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.swds .com .au Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-mi .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.argusdenshi .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.monopolepower .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blogdns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mathewparkin .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.falcongreenenergy .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.boldlygoingnowhere .org Domain"

• "ET POLICY DNS Query to DynDNS Domain *.pgafan .net"

• "ET INFO DYNAMIC_DNS HTTP Request to *.ontheweb.nu Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.groups .id Domain"

• "ET MALWARE BitCoinPlus Embedded site forcing visitors to mine BitCoins"

• "ET CURRENT_EVENTS SUSPICIOUS Java Request to ChangeIP Dynamic DNS Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chocolatespicacho .com Domain"

• "ET ATTACK_RESPONSE PowerShell NoProfile Command Received In Powershell Stagers"

• "ET INFO DYNAMIC_DNS Query to a *.kak .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mypi .co Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.line .pm Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xxxxx .tw Domain"

• "ET POLICY Possible WMI .mof Managed Object File Use Over SMB"

• "ET INFO DYNAMIC_DNS Query to a *.is-an-anarchist .com Domain"

• "ET INFO External IP Lookup Domain in DNS Lookup (ip .bablosoft .com)"

• "ET CURRENT_EVENTS Dropbox 000webhost Phishing Landing 2018-04-19"

• "ET INFO DYNAMIC_DNS Query to a *.bbs .io Domain"

• "ET INFO ZeroTier Related Activity (udp)"

• "ET INFO DYNAMIC_DNS Query to a *.smirt .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.afela .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ky .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fmg .co .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyn .ch Domain"

• "ET WEB_SERVER base64_decode in UA"

• "ET INFO Obfuscated Split String (Double Q) 3"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cky .cl Domain"

• "ET GAMES Growtopia Hack - WrongGrow CnC Activity"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.machinezdesign .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hioctanefuel .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.1cooldns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myftp .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.theoceanforest .com Domain"

• "ET POLICY HTTP Request to a *.cu.cc domain"

• "ET INFO DYNAMIC_DNS Query to a *.voltage .nz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nathan .to Domain"

• "ET POLICY DNS Query to DynDNS Domain *.webhop .me"

• "ET INFO HTTP Request to a *.xe.cx domain"

• "ET INFO DYNAMIC_DNS Query to a *.2dons .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.onmypc .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iugaming .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.serveusers .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-dc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.rr.nu Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.ghostnation .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.starnerd .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4irc.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pintravel .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.multiverso .info Domain"

• "ET DNS Query for Suspicious .cz.tf Domain"

• "ET INFO Microsoft Office User-Agent Requesting A Doc File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-photographer .com Domain"

• "ET CURRENT_EVENTS Possible Successful TSB Bank Phish 2018-05-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.changeip .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.root .sx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.2mydns .net Domain"

• "ET POLICY Vulnerable Java Version 1.7.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.read-books .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zoneitshop .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.findhere.org Domain (Sitelutions)"

• "ET CURRENT_EVENTS TDS Sutra - cookie set"

• "ET INFO Suspicious Windows NT version 7 User-Agent"

• "ET INFO Terse Request for Zip File (GET)"

• "ET INFO DYNAMIC_DNS Query to a *.sammah .org Domain"

• "ET INFO Microsoft Office User-Agent Requesting An Excel File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vpnx .nl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.iii .cl Domain"

• "ET WEB_CLIENT Possible # Encoded Iframe Tag"

• "ET INFO DYNAMIC_DNS Query to a *.dream .org .il Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tworiverssoftware .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsdojo .com Domain"

• "ET INFO Cloned Linkedin Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.staffpro .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.likudliberal .org Domain"

• "ET INFO External IP Lookup Domain Domain in DNS Lookup (ipbase .com)"

• "ET DOS DNS Amplification Attack Inbound"

• "ET INFO Obfuscated Split String (Single Q) 13"

• "ET INFO PSRC Powershell File Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.multicop .com .ar Domain"

• "ET INFO Possible Node.js REPL Shell Banner - Bind Shell"

• "ET INFO DYNAMIC_DNS Query to a *.ishevchenko .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-very-sweet .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pixelfucker .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jesus .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-remote .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.linux70 .ru Domain"

• "ET INFO Base64 Encoded ipconfig sent via HTTP POST M3"

• "ET INFO DYNAMIC_DNS Query to a *.kronosoft .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nufszone .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.seburn .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.satelit .org domain"

• "ET INFO DYNAMIC_DNS Query to a *.bnene .com Domain"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-05-02"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yasser .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-knight .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gets-it .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.img .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fxnxs .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.riaspengantinluwes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-work .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.basewisdom .com Domain"

• "ET DNS Query for .su TLD (Soviet Union) Often Malware Related"

• "ET WEB_SERVER SQL Errors in HTTP 200 Response (error in your SQL syntax)"

• "ET INFO DYNAMIC_DNS Query to a *.doesntexist .com Domain"

• "ET POLICY Vulnerable Java Version 13.0.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nhlfan .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-anarchist .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mine .bz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsalias .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jupiterns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a dns-stuff.com Domain *.dns-stuff.com"

• "ET INFO DYNAMIC_DNS Query to a *.ayso795 .org Domain"

• "ET INFO Generic IOT Downloader Malware in POST (Inbound)"

• "ET INFO DYNAMIC_DNS Query to a *.soapagent .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xst .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wild1 .net Domain"

• "ET INFO jpg download from fileupload .site"

• "ET SCAN Generic IDBTE4M Exploit Scanner (Outbound)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nda .dj Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pwm .hu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homeplex .org Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String (Single Q) 2"

• "ET INFO DYNAMIC_DNS Query to a *.in-the-band .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.niigeo .ru Domain"

• "ET POLICY HTTP traffic on port 443 (TRACE)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dougtreadwell .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kitayori .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-financialadvisor .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bakli .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.runyeard .com Domain"

• "ET DNS Query for Suspicious .eu.tf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shareroute .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tbt .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kirelli .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.boxathome .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.navigogroup .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.patelmortgage .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyn-o-saur .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.v0id .nl Domain"

• "ET DNS DNS Query for a Suspicious Malware Related Numerical .in Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dailyholycrap .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.qyiku .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.edns .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jasems .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nux .co .za Domain"

• "ET WEB_SERVER PHP tag in UA"

• "ET INFO DYNAMIC_DNS Query to a *.ambiserve .com Domain"

• "ET WEB_CLIENT Possible Malvertising FlashPost - POST to *.stats"

• "ET INFO DYNAMIC_DNS Query to a *.bagus .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.forumz .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.senaputra .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.energysemi .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.huepfler .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hec .to Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mnode .net Domain"

• "ET INFO Suspicious Registrar Nameservers in DNS Response (carbon2u)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.americanunfinished .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-nh .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ikoona .com Domain"

• "ET WEB_CLIENT Possible PDF Launch Function Remote Code Execution Attempt with Name Representation Obfuscation"

• "ET POLICY DNS Query to .onion proxy Domain (torsanctions.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.swe .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.paulsfamilyhistory .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.truewan .co .za Domain"

• "ET INFO DYNAMIC_DNS Query to a *.69 .mu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.erotikload .at Domain"

• "ET MALWARE Observed DNS Query to Known PUA Host Domain"

• "ET INFO DYNAMIC_DNS Query to a *.loscantarostemuco .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jcho .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.netlord .de Domain"

• "ET WEB_CLIENT Possible Microsoft Internet Explorer CSS Cross-Origin Theft Attempt"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yhoccotruyen .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.revitcity .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aksnapshots .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jungleheart .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sv-italia .it Domain"

• "ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse"

• "ET USER_AGENTS Observed Suspicious UA (xPCAP)"

• "ET INFO DYNAMIC_DNS Query to a *.cnstefancelmare .ro Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.libre)"

• "ET INFO DYNAMIC_DNS Query to a *.ayasophia .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sundby .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.efrati .org Domain"

• "ET INFO HTTP Request to Suspicious *.life Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-patsfan .org Domain"

• "ET INFO HTTP Connection To DDNS Domain Myvnc.com"

• "ET INFO DYNAMIC_DNS HTTP Request to *.athersite.com Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onmypc .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.edns .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.xcportugal .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.port0 .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hackerzinc .com Domain"

• "ET POLICY File Shared via Zoom"

• "ET WEB_SERVER WebShell - Symlink_Sa"

• "ET INFO DYNAMIC_DNS Query to a *.offbitch .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.castleman .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ftp1 .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gerastar .ru Domain"

• "ET INFO Cloned Telekom / Tmobile Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.spacetechnology .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.youramys .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sellsyourhome .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-geek .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.siasolution .com Domain"

• "ET CURRENT_EVENTS Possible Successful Remax Phish - AOL Creds Jun 23 2015"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.a4t .in Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-student .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ssl443 .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chekanov .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.boldlygoingnowhere .org Domain"

• "ET INFO Cloned CIBC Bank Page - Possible Phishing Landing M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lookids .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nex .sh Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.privatedns .org Domain"

• "ET ATTACK_RESPONSE Inbound PowerShell Checking for Virtual Host (Win32_PointingDevice WMI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.htpc .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.doomdns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gruppuso .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.minecraftpotato .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mysecondarydns .com Domain"

• "ET INFO Request To Suspicious Filename via Powershell (key)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dulcegarii-culinare .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cissp .or .id Domain"

• "ET INFO DYNAMIC_DNS Query to a *.3vm .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.edrennikov .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-an-accountant .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.antrak .org .tr Domain"

• "ET EXPLOIT Possible Zephyr RTOS ICMPv4 Stack Buffer Overflow"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fowlergo .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shogun .ca Domain"

• "ET USER_AGENTS Observed DPRK Related APT User-Agent (dafom)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ruok .org Domain"

• "ET INFO Suspicious Browser Plugin Detect - Observed in Phish Landings"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.robonauts .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blogdns .net Domain"

• "ET DOS DNS Amplification Attack Possible Inbound Windows Non-Recursive Root Hint Reserved Port"

• "ET INFO DYNAMIC_DNS Query to a *.etowns.net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.keine-panik .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mchini .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pakasak .com Domain"

• "ET WEB_CLIENT Hex Obfuscation of document.write % Encoding"

• "ET WEB_CLIENT SUSPICIOUS Possible automated connectivity check (www.google.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.falcongreen .com Domain"

• "ET CURRENT_EVENTS Free Mobile Phishing Landing 2018-08-07"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.elliotshoe .com Domain"

• "ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (leHQuRW5jb2) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fuettertdasnetz .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gotgeeks.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.leitud .ee Domain"

• "ET POLICY Observed DNS Query to DynDNS Domain (publicvm .com)"

• "ET CURRENT_EVENTS Linkedin Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lozan .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-therapist .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serveris .id .lv Domain"

• "ET INFO HTTP Request to a *.sg.tf domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (52b2tlLUNvbW1hbm) in DNS TXT Reponse"

• "ET INFO Collaboration/File Sharing Platform Domain in DNS Lookup (notion .so)"

• "ET INFO DYNAMIC_DNS Query to a *.dfdl .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-nd .com Domain"

• "ET INFO Cloud Storage API Related Domain in DNS Lookup (api .pcloud .com)"

• "ET INFO DYNAMIC_DNS Query to a *.serverpit .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cylone .net Domain"

• "ET INFO File Sharing Related Domain in DNS Lookup (zippyshare .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tenspot .net Domain"

• "ET USER_AGENTS Observed Uclient User-Agent"

• "ET INFO DYNAMIC_DNS Query to a *.bridge-club-hannover .de Domain"

• "ET POLICY DNS Query to .onion proxy Domain (tor2www.com)"

• "ET INFO DYNAMIC_DNS Query to a *.heatmypool .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zipper-maker .com Domain"

• "ET WEB_CLIENT eval String.fromCharCode String Which May Be Malicious"

• "ET INFO File Sharing Domain in DNS Lookup (roamresearch .com)"

• "ET INFO Observed AutoDesk Domain in TLS SNI (api .autodesk .com)"

• "ET INFO DYNAMIC_DNS Query to a *.dynip .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gruppuso .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.eternalimpressions .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.ddns .me"

• "ET CURRENT_EVENTS Impots Phishing Landing 2018-03-28"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.comapatecoman .gob .mx Domain"

• "ET CURRENT_EVENTS Possible Yahoo Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fiid .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.parikh .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nn-foto .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kbgz .com .my Domain"

• "ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddnsfree .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.run .place Domain"

• "ET INFO SUSPICIOUS SMTP EXE - ZIP file with .scr filename inside"

• "ET INFO DYNAMIC_DNS Query to a *.servebbs .org Domain"

• "ET CURRENT_EVENTS Ourtime Phishing Landing 2018-03-12"

• "ET INFO DYNAMIC_DNS Query to a *.stuff-4-sale .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gigaportal .pl Domain"

• "ET INFO IE7UA No Cookie No Referer"

• "ET INFO DYNAMIC_DNS Query to a *.nda .dj Domain"

• "ET INFO Observed External IP Lookup Domain (ip .cn in TLS SNI)"

• "ET INFO Applet Tag In Edwards Packed JavaScript"

• "ET POLICY DNS Query to DynDNS Domain *.viewdns .net"

• "ET POLICY HTTP traffic on port 443 (HEAD)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-nm .com Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.chan)"

• "ET CURRENT_EVENTS Microsoft Live Login Phishing Landing 2018-02-01"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.apostolof .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nswrogaining .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rtmuller .net Domain"

• "ET USER_AGENTS Observed Suspicious UA (Mozilla 6.0)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ptchat .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jaytex .ca Domain"

• "ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.southern .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.joeliriano .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.for-better .biz Domain"

• "ET WEB_SERVER WebShell Generic - wget http - POST"

• "ET INFO DYNAMIC_DNS Query to a *.cashit .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sdp-mos .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.yasser .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hitremixes .com Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.o)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alanbrothers .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.offbitch .com Domain"

• "ET INFO Suspicious GET Request for .arc File"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4twenty .us Domain"

• "ET INFO DNS Query Domain .bit"

• "ET INFO DYNAMIC_DNS Query to a *.kfco .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnet .hu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.joiavip .com .br Domain"

• "ET WEB_SERVER WebShell - Romanian Webshell"

• "ET INFO DYNAMIC_DNS Query to a *.yourspecialtee .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.djbomba .one .pl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fantasyleague .cc Domain"

• "ET WEB_SERVER PHP COOKIE SuperGlobal in POST"

• "ET INFO HTTP Request to a *.dtdns.net domain"

• "ET INFO DYNAMIC_DNS Query to a *.nokedli .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.galecsy .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.artisnotcrime .com Domain"

• "ET CURRENT_EVENTS Generic Phishing Landing M2 2018-01-29"

• "ET INFO DYNAMIC_DNS Query to a *.mchini .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ps .ai Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ddns .mobi Domain"

• "ET INFO SUSPICIOUS Java Request to DNSDynamic Dynamic DNS Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tombu .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.compucase .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jetos .com Domain"

• "ET INFO JAR Size Under 30K Size - Potentially Hostile"

• "ET CURRENT_EVENTS SEO Injection/Fraud DNS Lookup (count.trackstatisticsss .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to *.assexyas.com Domain (Sitelutions)"

• "ET INFO RedditSharp UA in POST (POST)"

• "ET TROJAN ETag HTTP Header Observed at JPCERT Sinkhole"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ldtp .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.htclink .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cspcorp .com Domain"

• "ET CURRENT_EVENTS Apple Phishing Landing 2018-01-29 M1"

• "ET INFO DYNAMIC_DNS Query to a *.toshibanetcam .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dogdammit .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ast .my Domain"

• "ET INFO Observed Pastebin Style Domain (pastetext .net in TLS SNI)"

• "ET INFO Request to .XYZ Domain with Minimal Headers"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.networkguru .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.handfolding .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lebtimnetz .de Domain"

• "ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.root .sx Domain"

• "ET INFO PS1XML Powershell File Request"

• "ET INFO DYNAMIC_DNS Query to a *.bradam .org Domain"

• "ET POLICY MAZE Ransomware Victim Publishing Site DNS Lookup (mazenews .top)"

• "ET INFO DYNAMIC_DNS Query to a *.jlengineering .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.angellombardi .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ryanandjen .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hackerzinc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.requitas .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fiid .net Domain"

• "ET CURRENT_EVENTS Microsoft Questionnaire Phishing Landing 2018-01-19"

• "ET INFO Inbound Powershell Creating .hta File"

• "ET INFO Dotted Quad Host DLL Request"

• "ET TROJAN Possible Ponmocup Driveby Download"

• "ET INFO DYNAMIC_DNS Query to a *.trickip .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ohbah .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.h4ck .me Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shaqnet .nu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-in .com Domain"

• "ET POLICY Query to a *.opengw.net Open VPN Relay Domain"

• "ET INFO DYNAMIC_DNS Query to a *.antiphone .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mysecuritycamera .net Domain"

• "ET INFO SSL/TLS Certificate Observed (OpenNIC Project API)"

• "ET INFO DYNAMIC_DNS Query to a *.bbgc .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mooo .info Domain"

• "ET INFO Suspicious services.exe in URI"

• "ET INFO DYNAMIC_DNS Query to a *.hmail .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mylogisoft .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.puffballofevil .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.entergod .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsalias .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tworiverssoftware .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (onion.lt)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.redsteedstudios .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.us .to Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lookids .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ca .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.n-e-t .name Domain"

• "ET INFO DYNAMIC_DNS Query to a *.uzhi .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsalias.ru Domain"

• "ET INFO Dotted Quad Host M2 (noalert)"

• "ET WEB_CLIENT PDF Name Representation Obfuscation of Action"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bmrresources .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gonnadoo .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wifizone .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.seasol .org Domain"

• "ET INFO Dotted Quad Host M6 (noalert)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homelinux .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ptchat .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.est-a-la-maison .com Domain"

• "ET INFO Suspicious winlogin.exe in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.elitter .net Domain"

• "ET CURRENT_EVENTS Possible Chalbhai (Multibrand) Phishing Landing 2018-05-10"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.corum .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.happyminecraft .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lanas .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.giantrobotfactory .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.funk .co .za Domain"

• "ET INFO DYNAMIC_DNS Query to a *.artitech .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homeip .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-at-work .com Domain"

• "ET INFO Cloned Westpac Bank Page - Possible Phishing Landing"

• "ET INFO Suspicious GET Request for .x64"

• "ET INFO DYNAMIC_DNS Query to a *.bisolta .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mysynology .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mynetav .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns .info Domain"

• "ET POLICY DNS Query to DynDNS Domain *.ddns .net"

• "ET POLICY DNS Query to DynDNS Domain *.privatizehealthinsurance .net"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-sc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.albertn .ru Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (dy1PYmplY3) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.e-m-a-i-l .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myftp .biz Domain"

• "ET CURRENT_EVENTS Bank of America Phishing Landing 2018-01-30"

• "ET INFO DYNAMIC_DNS Query to a *.skies .tw Domain"

• "ET INFO HTTP Request to a *.edu.tf domain"

• "ET INFO DYNAMIC_DNS Query to a *.toh .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.100mountain .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bbsindex.com Domain"

• "ET POLICY BSSID Location Lookup via api .mylnikov .org"

• "ET INFO Observed DNS Query to .fit TLD"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dixiesewing .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.homelinuxserver .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mine .nu Domain"

• "ET CURRENT_EVENTS Office 365 Phishing Landing 2018-02-22"

• "ET INFO DYNAMIC_DNS Query to a *.loseyourip .com Domain"

• "ET WEB_SERVER PHP SERVER SuperGlobal in URI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.georgiagun .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ycare .de Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M8 2018-08-30"

• "GPL ATTACK_RESPONSE id check returned nobody"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-01-29"

• "ET TROJAN Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)"

• "ET INFO Suspicious Self Signed SSL Certificate to 'My Company Ltd'"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nova-gns .com Domain"

• "ET DNS Query for Suspicious .at.tf Domain"

• "ET INFO DYNAMIC_DNS Query to a *.freeddns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.apocalypto .org .uk domain"

• "ET INFO HTTP Request to a *.de.ms domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.scottexteriors .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.actsministries .org Domain"

• "ET INFO Terse Request for EXE from DigitalOcean Spaces"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.giize .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jpleventos .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cloudwatch .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.soundrown .com Domain"

• "ET INFO Generic IOT Downloader Malware in POST (Outbound)"

• "ET CURRENT_EVENTS Facebook Mobile Phishing Landing 2018-02-26"

• "ET INFO DYNAMIC_DNS Query to a *.onmypc .biz Domain"

• "ET CURRENT_EVENTS Generic Multi-Email Phishing Landing 2018-08-30"

• "ET POLICY DNS Query to DynDNS Domain *.ufcfan .org"

• "ET INFO DYNAMIC_DNS Query to a *.servebbs .net Domain"

• "ET INFO Cloned EWE Telecom Page - Possible Phishing Landing"

• "ET POLICY WinRM wsman Access - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.limetropy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.malam .or .id Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.skc .su Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.uzhi .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.syntereo .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.maya .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.unibutton .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.d-n-s .org .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.v6 .navy Domain"

• "ET INFO DYNAMIC_DNS Query to a *.centrodiagnosticogenetico .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-designer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vix .ro Domain"

• "ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.droidtech .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.medbury .com Domain"

• "ET INFO Cloned Google Tools Page - Possible Phishing Landing"

• "ET CURRENT_EVENTS AT&T Phishing Landing 2018-08-30"

• "ET POLICY DNS Query to DynDNS Domain *.myactivedirectory .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsalias .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cloudbusinessportal .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.churchrez .org Domain"

• "ET POLICY HTTP traffic on port 443 (POST)"

• "ET INFO DYNAMIC_DNS HTTP Request to *.isgre.at Domain (Sitelutions)"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-02-13 M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.getmyip .com Domain"

• "ET INFO Observed Iperius Remote Domain in TLS SNI"

• "ET CURRENT_EVENTS OneDrive Phishing Landing 2018-03-08"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cascadesterling .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.enemyterritory .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pitam .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shitcunt .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cspcorp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.quilmes .gob .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-blog .com Domain"

• "ET WEB_SERVER PHP SESSION SuperGlobal in POST"

• "ET POLICY Possible winexe over SMB - Possible Lateral Movement"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.1cooldns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.myredirect.us Domain (Sitelutions)"

• "ET WEB_CLIENT Hex Obfuscation of substr % Encoding"

• "ET INFO DYNAMIC_DNS Query to a *.recyclesolutionsllc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lostgumball .com Domain"

• "ET INFO Compressed Executable SZDD Compress.exe Format Over HTTP"

• "ET INFO DYNAMIC_DNS Query to a *.linuxd1 .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.viktor .com .br Domain"

• "ET CURRENT_EVENTS LCL Banque Phishing Landing 2018-04-19"

• "ET INFO DYNAMIC_DNS Query to a Suspicious *.dyndns-web.com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bien .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.technopagans .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hioctanefuel .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sovich .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsfailover .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.boblove .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.baikabibai .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-musician .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-an-actor .com Domain"

• "ET POLICY Possible Powershell .ps1 Script Use Over SMB"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.keriss .co .id Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M6 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.btarena .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.buys .ru Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.oz)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.francemacau .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fearpenguins .com Domain"

• "ET INFO HTTP Request to Suspicious *.ryukyu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.celebsplay .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shit .vc Domain"

• "ET INFO Cloned Spotify Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS Query to a *.pixelfucker .com Domain"

• "ET INFO Java .jar request to dotted-quad domain"

• "ET CURRENT_EVENTS Possible DHL Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.liquidsphere .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servebbs .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-patsfan .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.allez .la Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyn .mk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mkahowes .com Domain"

• "ET INFO DYNAMIC_DNS Query to a Suspicious *.dnsalias.ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.clarkstock .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pce-cihazlari .com .tr Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dfdl .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lczipper .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.contem .bz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.autoroutedemorges .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-with-theband .com Domain"

• "ET CURRENT_EVENTS Mail Verification Phishing Landing 2018-04-18"

• "ET INFO DYNAMIC_DNS Query to a *.lflink .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ttkacz .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.quicksytes .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thebranleur .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .me Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.battlecore .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.on-the-web .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.breakingpar .com Domain"

• "ET CURRENT_EVENTS Possible Docusign Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS Query to a *.kyleconstance .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.whatajack .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vctel .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.navigogroup .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bhms .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-cubicle-slave .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mypicture .info Domain"

• "ET POLICY SMB Executable File Transfer"

• "ET EXPLOIT TLS HeartBeat Request (Client Initiated) fb set"

• "ET INFO DYNAMIC_DNS Query to a *.niigeo .ru Domain"

• "ET INFO URL Shortening Domain in DNS Lookup (da .gd)"

• "ET INFO DYNAMIC_DNS Query to a *.hbmc .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.blinklab .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fartit .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .biz Domain"

• "ET USER_AGENTS Observed Suspicious UA (justupdate)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dtdns.net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.v0x .eu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.smirt .ch Domain"

• "ET ATTACK_RESPONSE Obfuscated Eval String 6"

• "ET MALWARE Win/Malware.Filetour Variant Checkin M3"

• "ET POLICY HTTP Request to a *.ce.ms domain"

• "ET INFO DYNAMIC_DNS Query to a *.devicars .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.moabphoto .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.happyforever .com Domain"

• "ET MALWARE Win32/Xetapp Installer Checkin"

• "ET INFO DYNAMIC_DNS Query to a *.themcleans .us Domain"

• "ET INFO Non Standard Port DNS Query to google .com (udp)"

• "ET INFO DYNAMIC_DNS Query to a *.lamivolts .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (pay2tor.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vxe6 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jlengineering .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.forss .to Domain"

• "ET INFO Suspected Phishing Simulation Related Request (GET)"

• "ET INFO DYNAMIC_DNS Query to a *.is-an-engineer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cleansite .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.etowns.org Domain"

• "ET WEB_SERVER SQL Errors in HTTP 200 Response (pgsql_query)"

• "ET INFO DYNAMIC_DNS Query to a *.120v .ac Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sly .io Domain"

• "GPL ATTACK_RESPONSE file copied ok"

• "ET CURRENT_EVENTS Possible Chase Phishing Landing - Title over non SSL"

• "ET CURRENT_EVENTS Successful Paypal Phish Nov 24 2014"

• "ET INFO DYNAMIC_DNS Query to a *.adoubleu .de Domain"

• "ET INFO Suspicious GET Request for .sh4 File"

• "ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound M3"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mypi .co Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.est-a-la-maison .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tzafrir .org .il Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zelslonik .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sqlizer .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.florafamily .com Domain"

• "ET POLICY SMB NT Create AndX Request For an Executable File"

• "ET INFO DYNAMIC_DNS Query to a *.pushitlive .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fernando-botero-sculpture .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kyrgyzstan .kg Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.001www .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ext .io Domain"

• "ET INFO DYNAMIC_DNS Query to a *.vpndns .net Domain"

• "ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)"

• "ET DNS Query for .to TLD"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ghostnation .org Domain"

• "ET INFO Possible RTF File With Obfuscated Version Header"

• "ET INFO External IP Address Lookup Domain in DNS Lookup (geodatatool .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yihtah .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-geek .org Domain"

• "ET INFO DYNAMIC_DNS Query to local .gd Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-nv .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-co .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vankin .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.astrabus .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alphasoft .org Domain"

• "ET SQL MySQL mysql.user Dump (Used in Metasploit Auth-Bypass Module)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.milk .is Domain"

• "ET INFO DYNAMIC_DNS Query to a *.navnirwana .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shen .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xxuz .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-server .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gotdns .com Domain"

• "ET INFO Dotted Quad Host PS Request"

• "ET INFO DYNAMIC_DNS Query to a *.space-to-rent .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ruok .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wildsurf .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.for-our .info Domain"

• "ET CURRENT_EVENTS LinkedIn Phishing Landing 2018-02-09 M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.servehttp .com Domain"

• "ET INFO Suspicious lsass.exe in URI"

• "ET INFO DYNAMIC_DNS Query to a *.saves-the-whales .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.roig .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.coreytech .com Domain"

• "ET INFO Cloned ABSA Bank Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rude .li Domain"

• "ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.noamank .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.hopto .org"

• "ET INFO DYNAMIC_DNS Query to a *.ugli .se Domain"

• "ET POLICY DNS Query to DynDNS Domain *.servepics .com"

• "ET INFO DYNAMIC_DNS Query to a *.dubya .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.civvic .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.myfw.us Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chery .co .il Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hmsolucoes .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (walterwtor.com)"

• "ET INFO DYNAMIC_DNS Query to a *.litecsys .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vhfdental .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cobra200 .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hicam .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.k .vu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nullexistence .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.custom-gaming .net Domain"

• "ET INFO Terse DoH Style Query (GET)"

• "ET INFO DYNAMIC_DNS Query to a *.starscene .com Domain"

• "ET WEB_CLIENT Potential Data URI Phishing Oct 02 2015"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.afela .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.barvennon .com Domain"

• "ET CURRENT_EVENTS Document.write Long Backslash UTF-16 Encoded Content - Exploit Kit Behavior Flowbit Set"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yiff .fi Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bluejeanblues .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aussievitamin .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sportseducationinstructors .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ducklog .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.damnserver .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.usjepor .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.linux70 .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rebol .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nard .ca Domain"

• "ET CURRENT_EVENTS Generic Mailbox Phishing Landing 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.georgiagun .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.soussa-csc .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zeleznock .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynathome .net Domain"

• "ET INFO Base64 Encoded whoami in HTTP Server Response"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing mbeanserver Introspector"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.4rp .es Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.toythieves .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dekalo .net Domain"

• "ET WEB_CLIENT phoenix exploit kit - admin login page detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mkahowes .com Domain"

• "ET CURRENT_EVENTS Possible Nicepack EK Landing (Anti-VM)"

• "ET INFO DYNAMIC_DNS Query to a *.yiff .fi Domain"

• "ET TROJAN DNS Query Sinkhole Domain Various Families (Possible Infected Host)"

• "ET CURRENT_EVENTS Successful Bank of America Phish M1 Oct 01 2012"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.suns .si Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sexcuatui .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tallison .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.serveftp .com"

• "ET WEB_CLIENT Generic PhishKit Author Comment M4 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.albertn .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-sd .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsiskinky .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aptrc .tw Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pittentrepreneur .com Domain"

• "ET INFO SUSPICIOUS SMTP EXE - ZIP file with .com filename inside"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-landscaper .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.s4w .us Domain"

• "ET INFO DYNAMIC_DNS Query to a *.chimmychurry .com Domain"

• "ET INFO Suspicious GET To gate.php with no Referer"

• "ET INFO Suspicious Windows NT version 8 User-Agent"

• "ET INFO DYNAMIC_DNS Query to a *.prettyweak .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.toh .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ar .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.youpc .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.apostolof .org Domain"

• "ET CURRENT_EVENTS IRS Phishing Landing 2018-03-28"

• "ET INFO DYNAMIC_DNS Query to a *.kyrgyzstan .kg Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.irfna .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hicam .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.glengall .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.linkpc .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-designer .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tinosmarble .com Domain"

• "ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.hobby-site .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.iiiii .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.youpc .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-pa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ubernerden .com Domain"

• "ET POLICY HTTP connection to net78.net Free Web Hosting (Used by Various Trojans)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .uk Domain"

• "ET CURRENT_EVENTS Generic Popupwnd Phishing Landing 2018-04-19"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bridge-club-hannover .de Domain"

• "ET WEB_SERVER - EXE File Uploaded - Hex Encoded"

• "ET INFO DYNAMIC_DNS Query to a *.painefieldcap .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alanrjr .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ocean-nation .co .il Domain"

• "ET INFO Peer-to-Peer File Sharing Service Domain in DNS Lookup (ipfs .io)"

• "ET INFO DYNAMIC_DNS Query to a *.compuinter .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.carcano .me Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mediatriumph .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-vt .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.shacknet .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.my .to Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ladatap .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.mysecuritycamera .net"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dansted .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.spelar .se Domain"

• "ET INFO HTTP Request to Lockbit Ransomware Payment Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.queerline .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nufszone .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zoneitshop .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.smlsoft .com Domain"

• "ET CURRENT_EVENTS Probable Sakura Java applet with obfuscated URL Sep 21 2012"

• "ET INFO Possibly Suspicious Request for Putty.exe from Non-Standard Download Location"

• "ET INFO DYNAMIC_DNS Query to a *.sexidude .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dekalo .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsget .org Domain"

• "ET INFO Office User-Agent Requesting Non-Standard Filename"

• "ET POLICY Vulnerable Java Version 14.0.x Detected"

• "ET POLICY DNS Query to DynDNS Domain *.redirectme .net"

• "ET DNS Query to a *.top domain - Likely Hostile"

• "ET INFO External IP Lookup (keycdn .com)"

• "ET INFO DYNAMIC_DNS Query to a *.iantaylor .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jwork .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.evs .net .br Domain"

• "ET INFO HTTP Request to a *.cz.tf domain"

• "ET INFO DYNAMIC_DNS Query to a *.yozh .us Domain"

• "ET POLICY DNS Query to .onion proxy Domain (tor4pay.com)"

• "ET POLICY NSecSoft Remote Monitoring Update/Download Activity M1"

• "ET INFO DYNAMIC_DNS Query to a *.selfip .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.keecha .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cissp .or .id Domain"

• "ET INFO Cloned Godaddy Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to *.isthebe.st Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS Query to a *.lawsonengineers .co .uk Domain"

• "ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 3"

• "ET INFO Cloned NAB Page - Possible Phishing Landing"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.paulsfamilyhistory .com Domain"

• "ET INFO Possible Sharepoint Resource Infection"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hepcats .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sellsyourhome .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.inkcat .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.superizeme .com Domain"

• "ET INFO HTTP Request to a *.top domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.yurigoron .com Domain"

• "ET INFO Suspected Gamaredon Template Retrieval"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cnr .com .pk Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (dm9rZS1XbWlNZXRob2) in DNS TXT Reponse"

• "ET DNS DNS Query for a Suspicious *.co.tv domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.drm .hk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.joecampanaro .com Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (52b2tlLUNvbW1) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS Query to a *.guild-site .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sammah .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fragmentary .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.leitungsen .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.v6 .rocks Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.smh .com .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.adamhayward .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to *.bestdeals.at Domain (Sitelutions)"

• "ET INFO Dotted Quad Host M7 (noalert)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.on-the-web .tv Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.seahorsenet .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-ip .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.datacommunicationsinc .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.freedynamicdns .org"

• "ET INFO Obfuscated Split String (Double Q) 4"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.alphasoft .org Domain"

• "ET POLICY DNS Query to DynDNS Domain *.onthewifi .com"

• "ET INFO DYNAMIC_DNS Query to a *.8bit .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.changeip .co Domain"

• "ET INFO DYNAMIC_DNS Query to a Suspicious *.dns-free.ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-into-cars .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.oljka .com Domain"

• "ET WEB_CLIENT PDF Name Representation Obfuscation of /Subtype"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.generi .cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.weixservice .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.krnc .biz Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.showmyhomes .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.elliotshoe .com Domain"

• "ET POLICY HTTP Request to a *.gv.vg domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-player .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M7 2018-08-30"

• "ET POLICY DNS Query to DynDNS Domain *.mypsx .net"

• "ET INFO DYNAMIC_DNS Query to a *.chesta .com Domain"

• "ET CURRENT_EVENTS Possible Successful AOL Phish Nov 21 2012"

• "ET INFO DYNAMIC_DNS Query to a *.vxe6 .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ycare .de Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rebol .info Domain"

• "ET CURRENT_EVENTS Yahoo Phishing Landing 2018-02-20"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-chef .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.softwarefinesse .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (poltornik.com)"

• "ET WEB_SERVER SQL Errors in HTTP 500 Response (error in your SQL syntax)"

• "ET INFO DYNAMIC_DNS Query to a *.cleansite .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.winkel .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jundy .org Domain"

• "ET CURRENT_EVENTS Generic Multi-Email Phishing Landing 2018-01-25"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dorthel .com Domain"

• "ET POLICY MAZE Ransomware Victim Publishing Site DNS Lookup (newsmaze .top)"

• "ET INFO DYNAMIC_DNS Query to a *.efxs .ca Domain"

• "ET CURRENT_EVENTS Java Download non Jar file"

• "ET INFO DYNAMIC_DNS Query to a *.marieblazek .com Domain"

• "ET ATTACK_RESPONSE Inbound PowerShell Checking for Virtual Host (Win32_BaseBoard WMI)"

• "ET INFO DYNAMIC_DNS Query to a *.rebatesrule .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tribeoftwo .com domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sosfuvos .net Domain"

• "ET DNS DNS Query for Suspicious .co.cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.blacknapkins .org Domain"

• "ET INFO Cloned Itscom Page - Possible Phishing Landing"

• "ET INFO JAR Sent Claiming To Be Image - Likely Exploit Kit"

• "ET CURRENT_EVENTS Possible TSB Bank Phishing Landing 2018-05-07"

• "ET INFO DYNAMIC_DNS Query to a *.robinhud .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.esmtp .biz Domain"

• "ET POLICY DNS Query to .onion proxy Domain (jamator.com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.3d-game.com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.okzk .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.spottt .com Domain"

• "ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) to google.com.br possible Cache Poisoning Attempt"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.syntereo .com Domain"

• "ET INFO Observed Suspicious Request nc.exe in URI"

• "ET INFO DYNAMIC_DNS Query to a *.dnslive .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pleasecome .in Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO Obfuscated Split String (Double Q) 2"

• "ET USER_AGENTS Suspicious Custom Firefox UA Observed (Firefox...)"

• "ET INFO DYNAMIC_DNS Query to a *.k22 .su Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rav-kraski .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.benjamin .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnsrd .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.unusualperson .com"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kompaniet .nu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jaytex .org Domain"

• "ET POLICY DNS Query to .onion proxy Domain (vtorchike.com)"

• "ET INFO DYNAMIC_DNS Query to a *.wayner .ca Domain"

• "ET CURRENT_EVENTS Possible Excel Online Phishing Landing - Title over non SSL"

• "ET INFO Observed Suspicious Reversed String Inbound (StrReverse)"

• "ET INFO DYNAMIC_DNS Query to a *.info .gf Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.couchpotatofries .org Domain"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (dm9rZS1Db21) in DNS TXT Reponse"

• "ET INFO Suspicious Windows NT version 1 User-Agent"

• "ET INFO HTTP Request to a *.tw domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-found .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ownip .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-guru .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tbt .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-geek .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dyndns-at-home .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.be .sexy Domain"

• "ET INFO DYNAMIC_DNS Query to a *.e-cloud .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lebtimnetz .de Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hobby-site .com Domain"

• "ET INFO Dotted Quad Host M9 (noalert)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.monopolecorp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wileymetal .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-home .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pixelfucker .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nex .sh Domain"

• "ET INFO HTTP Request to a *.ca.tf domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sarah-lai .com Domain"

• "ET CURRENT_EVENTS LinkedIn Phishing Landing 2018-02-13"

• "ET WEB_CLIENT Generic PhishKit Author Comment M5 2018-08-30"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.siasolution .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.etsang .com Domain"

• "ET INFO DNS Query for Suspicious .gdn Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wildsurf .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zverovich .net Domain"

• "ET CURRENT_EVENTS Possible Chase Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.painefieldcap .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myphotos .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.17ping .cn Domain"

• "ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement"

• "ET INFO DYNAMIC_DNS Query to a *.dynserv .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thruhere .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.vicinanza .org Domain"

• "ET USER_AGENTS Suspicious User-Agent (VB OpenUrl)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.forgot .her .name Domain"

• "ET INFO DYNAMIC_DNS Query to a *.packeting .eu Domain"

• "ET INFO Cloned Cox Page - Possible Phishing Landing M1"

• "ET INFO DYNAMIC_DNS Query to a *.from-hi .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.myhomedns .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wo5m .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.qvd .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qlbv .vn Domain"

• "ET INFO Custom Endpoint Service Domain in DNS Lookup (run .mocky .io)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hopto .me Domain"

• "ET INFO Observed DNS Query to .world TLD"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.inkcat .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.farted .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lostgumball .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.myddns .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.inet2 .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.borkar .in Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hobby-site .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nethub .fi Domain"

• "ET SCAN Suspicious inbound to Oracle SQL port 1521"

• "ET INFO Suspicious Redirect to Download EXE from Bitbucket"

• "ET INFO DYNAMIC_DNS Query to a *.is-very-nice .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sazhenec .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kolody .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tobuy .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.veta .su Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cleansite .info Domain"

• "ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M9"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tinosmarble .com Domain"

• "ET POLICY SMB2 NT Create AndX Request For a Powershell .ps1 File"

• "ET INFO DYNAMIC_DNS Query to a *.castleman .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kaohsiung .tv Domain"

• "ET INFO File Retrieved from File Sharing Site (cloudme .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.notici .as Domain"

• "ET INFO Evernote Link/File Sharing Related Domain in DNS Lookup (t .mail-svc .evernote .com)"

• "ET INFO DYNAMIC_DNS Query to a *.authorizeddns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.apps .dj Domain"

• "ET INFO DYNAMIC_DNS Query to a *.uk .ms Domain"

• "ET USER_AGENTS Suspicious User-Agent (boostsoftware-urlexists)"

• "ET INFO Generic IOT Downloader Malware in GET (Inbound)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.soundcast .me Domain"

• "ET INFO Observed DNS Query to DDNS Domain .myfirewall .org"

• "ET INFO DYNAMIC_DNS Query to a *.proxydns .co .uk Domain"

• "ET CURRENT_EVENTS Outlook Web App Phishing Landing 2018-04-26"

• "ET INFO Dotted Quad Host PPTX Request"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jumpingcrab .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nullexistence .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.smelly .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ny .net Domain"

• "ET INFO Obfuscated Split String (Single Q) 3"

• "ET CURRENT_EVENTS Possible AOL Mail Phishing Landing - Title over non SSL"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gentile .cc Domain"

• "ET WEB_CLIENT Hex Obfuscation of document.write %u UTF-8 Encoding"

• "ET INFO DYNAMIC_DNS Query to a *.3d-game.com Domain"

• "ET INFO Out-of-Band Interaction Domain in DNS Lookup (oastify .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dns-stuff .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.appswiss .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.silexcorp .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ragtopvintage .com Domain"

• "ET INFO SPARC File Download Request from IP Address"

• "ET POLICY DNS Query to DynDNS Domain *.mymediapc .net"

• "ET INFO DYNAMIC_DNS Query to a *.partybag .com Domain"

• "ET EXPLOIT TLS HeartBeat Request (Server Initiated) fb set"

• "ET INFO DYNAMIC_DNS Query to a *.ax .lt Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ljhb .se Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dnsdojo .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cohens .org .il Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.melakaboy .com Domain"

• "ET WEB_CLIENT PDF Name Representation Obfuscation of Pages"

• "ET INFO PDF extension in DNS TXT Response"

• "ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (nZva2UtQ29tbW) in DNS TXT Reponse"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.litecsys .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.koellreutter .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.networkguru .com Domain"

• "ET INFO OpenDrive Cloud Storage Domain in DNS Lookup (od .lk)"

• "ET INFO DYNAMIC_DNS Query to a *.eiresol .com Domain"

• "ET ATTACK_RESPONSE Bash Script Inbound - Kill Coin Mining Related Processes"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.darktech.org Domain"

• "ET INFO Possible Chrome Plugin install"

• "ET INFO Base64 Encoded Server Response (success)"

• "ET CURRENT_EVENTS Facebook Phishing Landing 2018-02-09"

• "ET INFO DYNAMIC_DNS Query to a *.0bit .org Domain"

• "ET POLICY NSecSoft Remote Monitoring Update/Download Activity M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ext .io Domain"

• "ET POLICY HTTP Request to a *.ae.am domain"

• "ET CURRENT_EVENTS Generic Smail Phishing Landing 2018-01-29"

• "ET INFO DYNAMIC_DNS Query to a *.v0x .eu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.monopolecorp .com Domain"

• "ET INFO Base64 Encoded ipconfig sent via HTTP POST M1"

• "ET CURRENT_EVENTS Successful Paypal Phish Nov 24 2014"

• "ET USER_AGENTS Observed Suspicious UA (Http-connect)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tantrum .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.yhkrubber .com .my Domain"

• "ET INFO DYNAMIC_DNS Query to a *.xcv .cx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-libertarian .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.is-a-chef .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.unix .id .lv Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mynetav .com Domain"

• "ET INFO SUSPICIOUS SMTP EXE - RAR file with .com filename inside"

• "ET CURRENT_EVENTS Paypal Phishing Landing 2018-05-09"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.otzo .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fedea .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mefound .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sjschroeder .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-rockstar .com Domain"

• "ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stuns .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.emldn .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dnset .com Domain"

• "ET POLICY DNS Query to DynDNS Domain *.serveblog .net"

• "ET INFO DYNAMIC_DNS Query to a *.hot-hed .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mankenskiold .se Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.evs .net .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.merseine .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.trumpetx .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mtrshop .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rogerthedog .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.splinteredlightbooks .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ftpserver .biz Domain"

• "ET INFO HTTP Request to a *.upas.su domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-wi .com Domain"

• "ET CURRENT_EVENTS Possible Protonmail Phishing Domain in DNS Query"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.linuxd1 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mtrshop .com Domain"

• "ET INFO Observed DNS Query to .work TLD"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.asadanasemesta .co .id Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.writesthisblog .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sarah-lai .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mza .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.eolicatalinay .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.prettyweak .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.silksky .com Domain"

• "ET INFO Observed DNS Query to Commonly Abused Preview Domain (preview-domain .com)"

• "ET INFO DYNAMIC_DNS Query to *atthissite.com Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.peeramidspirits .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ct .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.annaffiare .org Domain"

• "ET USER_AGENTS Observed Suspicious User-Agent (altera forma)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pics .mu Domain"

• "ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)"

• "ET CURRENT_EVENTS Sakura Exploit Kit Landing Page Request"

• "ET INFO Suspicious Windows Commands in POST Body (nltest)"

• "ET INFO Gamaredon APT Style jpeg Request (GET)"

• "ET INFO DYNAMIC_DNS Query to a *.bloom .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wanip .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chesta .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ssl443 .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rwbcode .com Domain"

• "ET POLICY Inbound RDP Connection with Minimal Security Protocol Requested"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.propertyshots .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.better-than .tv Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wikaba .com Domain"

• "ET INFO DYNAMIC_DNS Query to *.kwik.to Domain (Sitelutions)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.onmypc .net Domain"

• "ET INFO Screenshot Uploaded to Discord"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dleon .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-very-good .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.humorvisite .eu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hin .tw Domain"

• "ET INFO DYNAMIC_DNS Query to a *.alte .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.freetcp .com Domain"

• "ET CURRENT_EVENTS Possible Facebook Help Center Phishing Landing - Title over non SSL"

• "ET INFO HTTP Connection To DDNS Domain Hopto.org"

• "ET POLICY SMB NT Create AndX Request For a Powershell .ps1 File"

• "ET DNS APT_NGO_wuaclt C2 Domain micorsofts.net"

• "ET INFO DYNAMIC_DNS Query to a *.networkindia .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pointto .us Domain"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.dyn)"

• "ET INFO DYNAMIC_DNS Query to a *.mutsuura .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ooguy .com Domain"

• "ET INFO Request for EXE via WinHTTP M3"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.from-ak .com Domain"

• "ET INFO WebDAV Retrieving .zip containing .exe"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.theworkpc .com Domain"

• "ET USER_AGENTS MSF Meterpreter Default User Agent"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fmg .co .id Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.recruitment7 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.estic .org Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M6"

• "ET INFO DYNAMIC_DNS Query to a *.jweststudio .com Domain"

• "ET POLICY DNS Query to .onion proxy Domain (torpovider.org)"

• "ET INFO Executable Requested from Evernote Link M3 (GET)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.seprotec .net .br Domain"

• "ET WEB_CLIENT Generic PhishKit Author Comment M9 2018-08-30"

• "ET INFO DYNAMIC_DNS Query to a *.tantrym .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sbinfo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.shogun .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.chrismac .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ssott .com Domain"

• "ET INFO Request to .GQ Domain with Minimal Headers"

• "ET INFO DYNAMIC_DNS Query to a *.pltimes .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ia .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ninth .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.railpage .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.qualitypoolsboulder .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-financialadvisor .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gnutella2 .info Domain"

• "ET POLICY [@Silv0123] Possible Fake Microsoft Office User-Agent Observed"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.serverpit .com Domain"

• "ET DNS Query for Suspicious .ru.tf Domain"

• "ET POLICY Executable served from Amazon S3"

• "ET INFO HTTP Request to a *.nl.ai domain"

• "ET WEB_CLIENT Obfuscated Javascript // ptth (escaped)"

• "ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing glassfish external statistics impl"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mindhackers .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.is-a-bulls-fan .com Domain"

• "ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-13"

• "ET INFO DYNAMIC_DNS Query to a *.radioimpactfm .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.from-ma .com Domain"

• "ET INFO Observed DNS Query to Dynamic DNS Service (giize .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nm7 .cc Domain"

• "ET INFO Observed Abused Redirect Service SSL Cert (svc .dynamics .com)"

• "ET INFO Observed DNS Query for OpenNIC Alternative DNS TLD (.geek)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.scorm .gr Domain"

• "ET INFO DYNAMIC_DNS Query to a Suspicious *.dyn-dns.ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.isa-geek .com Domain"

• "ET CURRENT_EVENTS Apple iTunes Phishing Landing (DE) 2018-01-31"

• "ET POLICY SMB2 NT Create AndX Request For a .bat File"

• "ET INFO DYNAMIC_DNS Query to a *.isa-geek .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.r-o-o-t .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wileymetal .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lwts .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rebatesrule .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.for-the .biz Domain"

• "ET INFO DYNAMIC_DNS Query to a *.homelinux .com Domain"

• "GPL ATTACK_RESPONSE command completed"

• "ET WEB_CLIENT SUSPICIOUS Possible Office Doc with Embedded VBA Project (Wide)"

• "ET CURRENT_EVENTS Craigslist Phishing Landing 2018-02-26"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bellywings .com Domain"

• "ET TROJAN Observed DNS Query to Known Knotweed/SubZero Domain"

• "ET INFO DYNAMIC_DNS Query to *.autoddns .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.daev .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.changeip .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pbohara .com Domain"

• "ET INFO SUSPICIOUS SMTP EXE - RAR file with .exe filename inside"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dynssl .com Domain"

• "ET CURRENT_EVENTS Hellion Postmaster Phishing Landing 2018-08-30"

• "ET POLICY DNS Query to DynDNS Domain *.zapto .org"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mcwrite .net Domain"

• "ET CURRENT_EVENTS Sparkasse Phishing Landing 2018-02-15"

• "ET INFO DYNAMIC_DNS Query to a *.voles35 .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.whyboner .com Domain"

• "ET TROJAN SpamTracker Domain in DNS Lookup (uxjxfg2ui8k5zk .com)"

• "ET INFO DYNAMIC_DNS Query to a * .dmtr .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .allaround .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.capnorthshore .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.pricemonkey .ca Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.neattogo .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.gierweb .nl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .ventapel .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.michiganbowling .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .gazmuri .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bakkoda .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.25u .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .pavlov .su Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ivc .org .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a * .hosts .name Domain"

• "ET INFO DYNAMIC_DNS Query to a * .backriverphotography .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.megajournal .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kje .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rdenham .co .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a *.bebecatalog .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fullsense .com .br Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ilja .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.boxiq .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .avtosnoj .si Domain"

• "ET TROJAN SecShow Domain DNS Lookup (secdns .site)"

• "ET INFO DYNAMIC_DNS Query to a * .ventapel .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .flexiblegeeks .com Domain"

• "ET TROJAN Trkcdn Domain in DNS Lookup (frotel .info)"

• "ET INFO DYNAMIC_DNS Query to a *.capnorthshore .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cachingtech .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .w6rob .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.z-imaging .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.toogoofy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.guitarasia .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.proheroeyewear .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ittqc .com Domain"

• "ET TROJAN Trkcdn Domain in DNS Lookup (vitrfar .info)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.swfin .net Domain"

• "ET INFO DYNAMIC_DNS Query to a * .gazmuri .cl Domain"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) M2"

• "ET INFO DYNAMIC_DNS Query to a *.tradevoip .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.topmoto .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.srmck .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.muguro .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.utdnews .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jackng .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pricemonkey .ca Domain"

• "ET INFO DYNAMIC_DNS Query to a *.danielaabrantes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tinysun .net Domain"

• "ET INFO Fake Game Cheat Related Domain (keyauth .win) in TLS SNI"

• "ET MOBILE_MALWARE Android/ProxyLib Related Domain (nsignal .net) in TLS SNI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.equalgrid .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.abl .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.zolik .com Domain"

• "ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M3"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .bamapos .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .arybarbosa .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .hosts .name Domain"

• "ET INFO DYNAMIC_DNS Query to a * .avtosnoj .si Domain"

• "ET INFO DYNAMIC_DNS Query to a *.largent .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mudonghoi .org Domain"

• "ET MOBILE_MALWARE Android/ProxyLib Related Domain in DNS Lookup (lumiapps .io)"

• "ET INFO DYNAMIC_DNS Query to a *.spanishlearning .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.zolik .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sunny-love .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.theyogaboutique .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kanacad .org Domain"

• "ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M2"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fsagc .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.900 .my Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.muguro .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mysaol .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .42 .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.freengers .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.macao .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .dmtr .ru Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sage .li Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kje .us Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .gingertom .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.doorsnknobs .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hillbrick .net Domain"

• "ET INFO Observed DNS Query to replit Hosting Domain (replit .dev)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.largent .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.smarter-homes .co .uk Domain"

• "ET TROJAN Trkcdn Domain in DNS Lookup (simitor .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.allisons .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.indforever .net Domain"

• "ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3"

• "ET INFO DYNAMIC_DNS Query to a *.lnbphotography .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.900 .my Domain"

• "ET INFO DYNAMIC_DNS Query to a * .elangtama .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hal .se Domain"

• "ET INFO Fake Game Cheat Related Domain (cheating .store) in TLS SNI"

• "ET INFO DYNAMIC_DNS Query to a *.stentwood .com .au Domain"

• "ET INFO DYNAMIC_DNS Query to a *.e-segurarse .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sabaenergy .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ittelecom .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.raulgarza .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.aybit .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ittelecom .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.smarter-homes .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mechtronics .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.k4ds .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.deance .org .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.danielaabrantes .com Domain"

• "ET MOBILE_MALWARE Android/ProxyLib Related Domain in DNS Lookup (nsignal .net)"

• "ET TROJAN Trkcdn Domain in DNS Lookup (vibnere .com)"

• "ET INFO DYNAMIC_DNS Query to a * .lscomm .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fsagc .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.anteroblue .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.e-segurarse .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .pavlov .su Domain"

• "ET TROJAN SecShow Domain DNS Lookup (secshow .net)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.meatbytes .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *. .lasboleras .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.surreyquays .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .hauganslekt .no Domain"

• "ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.maiaps .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.doorsnknobs .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.famsenden .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jerkface .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.telebazar .pl Domain"

• "ET USER_AGENTS websocket-sharp User-Agent Observed"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.abl .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.uwgraduation .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bakkoda .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.modernpotterystudio .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.anteroblue .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mambodev .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .lasboleras .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.oldsouthmarlinclub .com Domain"

• "ET INFO Suspicious Domain (polyfill .io) in TLS SNI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mega-link .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nimali .net Domain"

• "ET TROJAN Residential Proxy Service Domain (asocks .com) in TLS SNI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ivc .org .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .benabood .com Domain"

• "ET USER_AGENTS Observed Suspicious User-Agent (JWrapperDownloader)"

• "ET INFO DYNAMIC_DNS Query to a *.equalgrid .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.neattogo .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.airdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.medscience .cl Domain"

• "ET TROJAN SpamTracker Domain in DNS Lookup (8egub9e7s6cz7n .com)"

• "ET INFO DYNAMIC_DNS Query to a *.macao .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.allisons .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .elangtama .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hardsoft .nu Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.arkad .nu Domain"

• "ET INFO DYNAMIC_DNS Query to a * .elrecreo .com .mx Domain"

• "ET TROJAN Trkcdn Domain in DNS Lookup (edrefo .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a [Redacted - Vulgar] Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.strongson .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *. .lasboleras .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hal .se Domain"

• "ET TROJAN Residential Proxy Service Domain (broxy .one) in TLS SNI"

• "ET INFO DYNAMIC_DNS Query to a * .ekobilet .com .tr Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ssident .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.strongson .com Domain"

• "ET TROJAN SpamTracker Domain in DNS Lookup (cgb488dixfxjw7 .com)"

• "ET INFO DYNAMIC_DNS Query to a *.privateimport .jp Domain"

• "ET INFO DYNAMIC_DNS Query to a *.eduarmor .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.srmck .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.7s .com .tr Domain"

• "ET INFO Observed replit Domain (replit .dev in TLS SNI)"

• "ET MOBILE_MALWARE Android/ProxyLib Related Domain (lumiapps .io) in TLS SNI"

• "ET INFO Fake Game Cheat Related POST Request"

• "ET INFO DYNAMIC_DNS Query to a * .afaa .it Domain"

• "ET INFO DYNAMIC_DNS Query to a *.meatbytes .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.indforever .net Domain"

• "ET INFO DYNAMIC_DNS Query to a * .caminolafusta .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wawi .es Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.guitarasia .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mysaol .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mechtronics .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fatemokid .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ro0t .hm Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wawi .es Domain"

• "ET INFO DYNAMIC_DNS Query to a *.medscience .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a * .ridespirals .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cdpa .cc Domain"

• "ET INFO DYNAMIC_DNS Query to a *.teakwondo .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.megajournal .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sanluix .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.30x .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fapp .in Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.hatumena .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.garagesport .ch Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kingshing .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .i-taiwan .tv Domain"

• "ET INFO DYNAMIC_DNS Query to a *.deance .org .mx Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.oldsouthmarlinclub .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tradevoip .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.melaniebest .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fullsense .com .br Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pchelp-24 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.bebecatalog .com Domain"

• "ET INFO Suspected Andariel/TA430 Related Domain in TLS SNI"

• "ET INFO DYNAMIC_DNS Query to a *.fapp .in Domain"

• "ET INFO DYNAMIC_DNS Query to a *.jackng .net Domain"

• "ET INFO TinyURL to Netlify Redirect"

• "ET INFO DYNAMIC_DNS Query to a *.melaniebest .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mambodev .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cnew .ir Domain"

• "ET INFO DYNAMIC_DNS Query to a * .allaround .hk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.theyogaboutique .co .uk Domain"

• "ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M2"

• "ET INFO DYNAMIC_DNS Query to a *.proheroeyewear .com Domain"

• "ET TROJAN ClickFix Fake Update Related Domain in TLS SNI (pley .es)"

• "ET INFO DYNAMIC_DNS Query to a *.toogoofy .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ittqc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.legonas .net Domain"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) M4"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tharkad .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ethoscg .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.voorl .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.boxiq .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.uwgraduation .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.neighborhoodcloud .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.darkworlds .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sanluix .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.87 .org .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ssident .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.eduarmor .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.utdnews .com Domain"

• "ET INFO Windows Scheduled Task XML Response from Server"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.k4ds .org Domain"

• "ET INFO DYNAMIC_DNS Query to a * .i-taiwan .tv Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.7s .com .tr Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.telebazar .pl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wikilegia .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.manoahinvest .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .gingertom .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .icbcluj .ro Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.neighborhoodcloud .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .backriverphotography .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.arph .org Domain"

• "ET INFO Suspected Andariel/TA430 Related Domain in TLS SNI"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.spanishlearning .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.judysart .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.voorl .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .lscomm .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.raulgarza .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .flexiblegeeks .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .bamapos .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mji .ro Domain"

• "ET POLICY Vulnerable Java Version 22.0.x Detected"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.modernpotterystudio .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mudonghoi .org Domain"

• "ET INFO Observed File Sharing Service Domain (drive .filen .io in TLS SNI)"

• "ET INFO DYNAMIC_DNS Query to a *.hardsoft .nu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tinysun .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.it4e .co Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rugeleychessclub .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.teakwondo .one .pl Domain"

• "ET INFO DYNAMIC_DNS Query to a [Redacted - Vulgar] Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.25u .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cachingtech .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .itzzm .com Domain"

• "ET INFO DYNAMIC_DNS Query to a * .bal-tazaar .be Domain"

• "ET INFO DYNAMIC_DNS Query to a * .benabood .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nchez .mx Domain"

• "ET EXPLOIT Possible Uniview IPC2322lb updatecpld Restricted Shell Bypass Attempt"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ninehells .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.freengers .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.arph .org Domain"

• "ET TROJAN SpamTracker Domain in DNS Lookup (hjmpfsamfkj5m5 .com)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.manoahinvest .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .bal-tazaar .be Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cobos .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.gierweb .nl Domain"

• "ET INFO DYNAMIC_DNS Query to a * .lasboleras .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wolfdork .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rasenftinc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cdpa .cc Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lugaro .info Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.airdns .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.mji .ro Domain"

• "ET INFO Anonymous/Public File Sharing Service Domain in DNS Lookup (sftpcloud .io)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.pimp .co .za Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sunny-love .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.wolfdork .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.sabaenergy .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ethoscg .net Domain"

• "ET TROJAN ClickFix Fake Update Related Domain in DNS Lookup (pley .es)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.legonas .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.thebookllc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.topmoto .pl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .elrecreo .com .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rasenftinc .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.z-imaging .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.lnbphotography .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.thebookllc .com Domain"

• "ET TROJAN SpamTracker Domain in DNS Lookup (epyujbhfhbs35j .com)"

• "ET INFO DYNAMIC_DNS Query to a *.pimp .co .za Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.famsenden .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .itzzm .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.stentwood .com .au Domain"

• "ET INFO DYNAMIC_DNS Query to a *.wikilegia .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .hauganslekt .no Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.cobos .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a * .n-e-t .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.garagesport .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hatumena .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.tsurukawa .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .n-e-t .it Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ilja .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.lugaro .info Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kingshing .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.mega-link .cl Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.sage .li Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.surreyquays .com Domain"

• "ET INFO Fake Game Cheat Related Domain in DNS Lookup (keyauth .win)"

• "ET INFO DYNAMIC_DNS Query to a *.30x .ru Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.ro0t .hm Domain"

• "ET INFO DYNAMIC_DNS Query to a *.rdenham .co .uk Domain"

• "ET INFO Suspicious Domain (polyfill .io) in DNS Lookup"

• "ET INFO DYNAMIC_DNS HTTP Request to a [Redacted Vulgar] Domain"

• "ET INFO DYNAMIC_DNS Query to a *.hillbrick .net Domain"

• "ET INFO DYNAMIC_DNS Query to a [Redacted Vulgar] Domain"

• "ET TROJAN Trkcdn Domain in DNS Lookup (pordasa .info)"

• "ET INFO File Sharing Service Domain in DNS Lookup (drive .filen .io)"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.aybit .ch Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tsurukawa .org Domain"

• "ET INFO Lucy Security - Awareness Landing Page M2"

• "ET INFO DYNAMIC_DNS Query to a *.pchelp-24 .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .caminolafusta .cl Domain"

• "ET INFO DYNAMIC_DNS Query to a *.it4e .co Domain"

• "ET TROJAN Residential Proxy Service Domain in DNS Lookup (broxy .one)"

• "ET INFO DYNAMIC_DNS Query to a *.kalbas .com .vn Domain"

• "ET INFO DYNAMIC_DNS Query to a *.arkad .nu Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nchez .mx Domain"

• "ET INFO DYNAMIC_DNS Query to a *.cnew .ir Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.87 .org .uk Domain"

• "ET INFO DYNAMIC_DNS Query to a * .mrdev .com .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nyphp .com Domain"

• "ET TROJAN Residential Proxy Service Domain in DNS Lookup (asocks .com)"

• "ET INFO DYNAMIC_DNS Query to a *.maiaps .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .mrdev .com .ar Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fatemokid .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.fluxus .org Domain"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) M3"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.privateimport .jp Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.dearabba .org Domain"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) M1"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .w6rob .com Domain"

• "ET TROJAN SecShow Domain DNS Lookup (secshow .online)"

• "ET INFO DYNAMIC_DNS Query to a * .arybarbosa .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.kanacad .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .42 .ar Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.jerkface .net Domain"

• "ET INFO Fake Game Cheat Related Domain in DNS Lookup (cheating .store)"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .ridespirals .com Domain"

• "ET INFO Referrer-Policy set to unsafe-url"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.judysart .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.michiganbowling .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .ekobilet .com .tr Domain"

• "ET INFO DYNAMIC_DNS Query to a *.swfin .net Domain"

• "ET INFO DYNAMIC_DNS Query to a *.dearabba .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.rugeleychessclub .co .uk Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.fluxus .org Domain"

• "ET INFO DYNAMIC_DNS Query to a *.nyphp .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.nimali .net Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.kalbas .com .vn Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a *.darkworlds .org Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .icbcluj .ro Domain"

• "ET INFO DYNAMIC_DNS Query to a *.tharkad .com Domain"

• "ET INFO DYNAMIC_DNS Query to a *.ninehells .com Domain"

• "ET INFO DYNAMIC_DNS HTTP Request to a * .afaa .it Domain"

attempted-recon

• "ET SCAN Possible Mysqloit Operating System Fingerprint/SQL Injection Test Scan Detected"

• "ET SCAN Default Mysqloit User Agent Detected - Mysql Injection Takover Tool"

• "ET SCAN Medusa User-Agent"

• "ET VOIP Possible Modified Sipvicious OPTIONS Scan"

• "ET SCAN libwww-perl GET to // with specific HTTP header ordering without libwww-perl User-Agent"

• "ET SCAN Netsparker Default User-Agent"

• "ET USER_AGENTS SAP CVE-2020-6287 PoC UA Observed"

• "ET SCAN Wikto Backend Data Miner Scan"

• "ET SCAN Absinthe SQL Injection Tool HTTP Header Detected"

• "ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Admin Cores"

• "ET SCAN HID VertX and Edge door controllers discover"

• "ET SCAN Internet Scanning Project HTTP scan"

• "ET USER_AGENTS PyCurl Suspicious User Agent Outbound"

• "ET POLICY IP Check Domain (whatismyip in HTTP Host)"

• "ET EXPLOIT D-Link 850L Password Extract Attempt"

• "ET WEB_SERVER DFind w00tw00t GET-Requests"

• "ET POLICY python.urllib User Agent Web Crawl"

• "GPL RPC xdmcp info query"

• "ET SCAN DotDotPwn User-Agent"

• "ET WEB_SERVER cmd.exe In URI - Possible Command Execution Attempt"

• "ET SCAN Grendel-Scan Web Application Security Scan Detected"

• "ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Vulnerable Response"

• "ET SCAN Modified Sipvicious Sundayddr Scanner (sipsscuser)"

• "ET POLICY IP Check Domain (showmyip in HTTP Host)"

• "ET WEB_SPECIFIC_APPS Online Trade - Information Disclosure"

• "ET POLICY Python-urllib/ Suspicious User Agent"

• "ET WEB_SERVER Binget PHP Library User Agent Inbound"

• "ET SCAN Apache mod_proxy Reverse Proxy Exposure 1"

• "ET SCAN IBM NSA User Agent"

• "GPL SCAN nessus 2.x 404 probe"

• "ET SCAN Asp-Audit Web Scan Detected"

• "GPL DNS named authors attempt"

• "ET EXPLOIT Possible Vacron NVR Remote Command Execution"

• "GPL WEB_SERVER Tomcat server snoop access"

• "GPL SNMP SNMP NT UserList"

• "ET SCAN Tomcat Web Application Manager scanning"

• "ET SCAN Potential VNC Scan 5900-5920"

• "GPL MISC ident version request"

• "ET EXPLOIT Linksys Smart WiFi Information Disclosure Attempt Inbound"

• "ET WEB_SERVER Recon-ng User-Agent"

• "ET SCAN NMAP SIP Version Detect OPTIONS Scan"

• "ET WEB_SERVER PHP Easteregg Information-Disclosure (zend-logo)"

• "ET SCAN Inspathx Path Disclosure Scanner User-Agent Detected"

• "ET SCAN Skipfish Web Application Scan Detected (2)"

• "ET SCAN McAfee/Foundstone Scanner Web Scan"

• "ET USER_AGENTS EmailSiphon Suspicious User-Agent Inbound"

• "ET EXPLOIT AVTECH Authenticated Command Injection in CloudSetup.cgi (Outbound)"

• "ET WEB_SERVER .bash_history Detected in URI"

• "ET SCAN Arachni Scanner Web Scan"

• "ET SCAN Grendel Web Scan - Default User Agent Detected"

• "ET SCAN SQLNinja MSSQL Authentication Mode Scan"

• "ET EXPLOIT Netgear DGN Remote Command Execution"

• "ET SCAN Pavuk User Agent Detected - Website Mirroring Tool for Off-line Analysis"

• "ET SCAN WSFuzzer Web Application Fuzzing"

• "ET SCAN Metasploit WMAP GET len 0 and type"

• "ET USER_AGENTS EmailSiphon Suspicious User-Agent Outbound"

• "ET POLICY curl User-Agent Outbound"

• "ET USER_AGENTS Binget PHP Library User Agent Outbound"

• "ET EXPLOIT Possible Jira User Enumeration Attempts (CVE-2020-14181)"

• "ET SCAN SipCLI VOIP Scan"

• "ET EXPLOIT Attempted Directory Traversal via HTTP Cookie (CVE-2020-9484)"

• "ET SCAN Hmap Webserver Fingerprint Scan"

• "ET WEB_SERVER Outbound PHP User-Agent"

• "ET WEB_SERVER PHP Easteregg Information-Disclosure (php-logo)"

• "ET SCAN OpenVAS User-Agent Inbound"

• "ET POLICY Internal Host Retrieving External IP Via myip.ozymo.com"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Default Credentials"

• "ET SCAN WITOOL SQL Injection Scan"

• "ET SCAN Enumiax Inter-Asterisk Exchange Protocol Username Scan"

• "ET POLICY HTTPie User-Agent Outbound"

• "ET SCAN NMAP OS Detection Probe"

• "ET SCAN SIP erase_registrations/add registrations attempt"

• "ET WEB_SPECIFIC_APPS Possible Oracle GlassFish Server Administration Console Authentication Bypass Attempt"

• "ET SCAN Hello Peppa! Scan Activity"

• "ET SCAN Inspathx Path Disclosure Scan"

• "ET WEB_CLIENT Google Chrome Credential Stealing via SCF file Reflected Request"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Configuration Download"

• "ET SCAN Hydra User-Agent"

• "ET SCAN SQLNinja MSSQL Database User Rights Scan"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Configuration Download"

• "ET SCAN ntop-ng Authentication Bypass via Session ID Guessing"

• "ET SCAN Potential VNC Scan 5800-5820"

• "ET SCAN SQLix SQL Injection Vector Scan"

• "ET POLICY Internal Host Retrieving External IP via myip.dnsomatic.com"

• "ET SCAN Suspicious User-Agent Containing Web Scan/er Likely Web Scanner"

• "ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M2"

• "ET SCAN Wapiti Web Server Vulnerability Scan"

• "GPL SNMP SNMP trap Format String detected"

• "ET WEB_SERVER PHP Easteregg Information-Disclosure (funny-logo)"

• "ET WEB_SERVER pxyscand Suspicious User Agent Inbound"

• "ET WEB_SERVER Muieblackcat scanner"

• "ET WEB_SERVER /etc/passwd Detected in URI"

• "ET SCAN Nmap NSE Heartbleed Request"

• "ET SCADA [nsacyber/ELITEWOLF] Siemens S7 Redpoint NSE Request CPU Function Read SZL attempt"

• "ET SCAN External to Internal UPnP Request udp port 1900"

• "ET SCAN w3af Scan In Progress ARGENTINA Req Method"

• "ET WEB_SERVER Possible Successful Juniper NetScreen ScreenOS Firmware Version Disclosure Attempt"

• "ET SCAN Nessus FTP Scan detected (ftp_writeable_directories.nasl)"

• "ET SCAN FHScan core User-Agent Detect"

• "ET SCAN Potential SSH Scan OUTBOUND"

• "ET POLICY IP Check Domain (showip in HTTP Host)"

• "GPL DNS named iquery attempt"

• "GPL SCAN ssh-research-scanner"

• "GPL SCAN superscan echo"

• "ET EXPLOIT NEC SL2100 - Session Enumeration Attempt"

• "ET SCAN Sivus VOIP Vulnerability Scanner SIP Components Scan"

• "ET SCAN DCERPC rpcmgmt ifids Unauthenticated BIND"

• "ET SCAN Brutus Scan Outbound"

• "ET SCAN Voiper Fuzzing Scan"

• "ET EXPLOIT AVTECH Authenticated Command Injection in CloudSetup.cgi"

• "ET EXPLOIT AVTECH Unauthenticated Command Injection in DVR Devices"

• "ET POLICY POSSIBLE Crawl using Fetch"

• "GPL WEB_SERVER perl command attempt"

• "ET SCAN Suspicious User-Agent Containing SQL Inject/ion Likely SQL Injection Scanner"

• "ET WEB_SERVER /system32/ in Uri - Possible Protected Directory Access Attempt"

• "ET EXPLOIT Netgear ReadyNAS Surveillance Unauthenticated Remote Command Execution"

• "ET WEB_SPECIFIC_APPS Joomla Full Path Disclosure -- content.php"

• "ET SCAN Vega Web Application Scan"

• "ET WEB_SPECIFIC_APPS Joomla Full Path Disclosure -- ldap.php"

• "ET SCAN Grabber.py Web Scan Detected"

• "ET SCAN SQLBrute SQL Scan Detected"

• "ET SCAN Acunetix Accept HTTP Header detected scan in progress"

• "ET SCAN sipscan probe"

• "ET POLICY Cisco Data Center Network Manager - Vulnerable Version Detected 10.4"

• "ET SCAN DEBUG Method Request with Command"

• "GPL SNMP public access udp"

• "ET SCAN MS Terminal Server Traffic on Non-standard Port"

• "ET POLICY POSSIBLE Web Crawl using Curl"

• "ET SCAN Geutebrueck re_porter 7.8.974.20 Information Disclosure"

• "ET POLICY IP Check Domain (cmyip.com in HTTP Host)"

• "ET WEB_SPECIFIC_APPS Netgear WNR2000v5 Possible Serial Number Leak"

• "ET SCAN WebShag Web Application Scan Detected"

• "GPL SCAN webtrends scanner"

• "ET SCAN Modified Sipvicious User-Agent Detected (sundayddr)"

• "ET EXPLOIT TerraMaster TOS Information Leak Inbound (CVE-2022-24990)"

• "ET SCAN UPnP SUBSCRIBE Inbound - Possible CallStranger Scan (CVE-2020-12695)"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Attempt"

• "ET EXPLOIT D-Link DIR601 2.02 Credential Disclosure"

• "ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Config URL"

• "ET SCAN Port Unreachable Response to Xprobe2 OS Fingerprint Scan"

• "ET SCAN Springenwerk XSS Scanner User-Agent Detected"

• "ET POLICY IP Check Domain (icanhazip. com in HTTP Host)"

• "ET SCAN Voiper Toolkit Torturer Scan"

• "ET POLICY Cisco Data Center Network Manager - Vulnerable Version Detected 11.1"

• "ET SCAN Multiple FTP Administrator Login Attempts from Single Source - Possible Brute Force Attempt"

• "ET SCAN w3af User-Agent 2"

• "ET SCAN SFTP/FTP Password Exposure via sftp-config.json"

• "ET SCAN DirBuster Scan in Progress"

• "GPL WEB_SERVER .htaccess access"

• "ET SCAN External Host Probing for ChromeCast Devices"

• "ET WEB_SPECIFIC_APPS Vulnerable SAP NetWeaver Path Observed - Information Disclosure (CVE-2016-2388)"

• "ET SCAN Chroot-apache0day Unknown Web Scanner User Agent"

• "ET SCAN SQL Power Injector SQL Injection User Agent Detected"

• "ET WEB_SERVER Inbound PHP User-Agent"

• "ET SCAN Potential SSH Scan"

• "GPL SMTP expn root"

• "ET WEB_SERVER PyCurl Suspicious User Agent Inbound"

• "GPL SMTP vrfy root"

• "GPL SNMP public access tcp"

• "GPL SMTP vrfy decode"

• "ET WEB_SERVER Wordpress Login Bruteforcing Detected"

• "ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Probe"

• "ET SCAN Smap VOIP Device Scan"

• "ET SCAN NMAP SIP Version Detection Script Activity"

• "ET USER_AGENTS Atomic_Email_Hunter User-Agent Outbound"

• "ET SCAN Cisco Torch TFTP Scan"

• "GPL NETBIOS SMB startup folder access"

• "ET USER_AGENTS Atomic_Email_Hunter User-Agent Inbound"

• "ET EXPLOIT ownCloud Information Disclosure Attempt (CVE-2023-49103)"

• "ET SCAN SQLNinja MSSQL Version Scan"

• "ET SCAN Sipsak SIP scan"

• "ET WEB_SERVER DD-WRT Information Disclosure Attempt"

• "ET SCAN Sipp SIP Stress Test Detected"

• "ET SCAN HZZP Scan in Progress calc in Headers"

• "ET SCAN Acunetix Version 6 (Free Edition) Scan Detected"

• "ET SCAN Laravel Debug Mode Information Disclosure Probe Inbound"

• "ET SCAN External to Internal UPnP Request tcp port 2555"

• "ET SCAN Nessus User Agent"

• "ET SCAN FOCA uri"

• "ET SCAN Nessus Netbios Scanning"

• "ET SCAN Nessus FTP Scan detected (ftp_anonymous.nasl)"

• "ET SCAN Toata Scanner User-Agent Detected"

• "ET SCAN Possible SQLMAP Scan"

• "ET EXPLOIT Possible Cisco Data Center Network Manager - Log Retrieval (CVE-2019-1622)"

• "ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M1"

• "GPL DNS named version attempt"

• "ET SCAN Httprecon Web Server Fingerprint Scan"

• "ET POLICY Cisco Data Center Network Manager Version Check Inbound (flowbit set)"

• "ET VOIP Possible Inbound VOIP Scan/Misuse With User-Agent Zoiper"

• "ET SCAN Watchfire AppScan Web App Vulnerability Scanner"

• "ET SCAN Sivus VOIP Vulnerability Scanner SIP Scan"

• "ET WEB_SPECIFIC_APPS XML External Entity Information Disclosure"

• "ET EXPLOIT TP-Link Archer C2 and Archer C20i Remote Code Execution"

• "ET VOIP Modified Sipvicious Asterisk PBX User-Agent"

• "ET USER_AGENTS FOCA User-Agent"

• "GPL SNMP private access udp"

• "GPL NETBIOS SMB startup folder unicode access"

• "ET EXPLOIT Xiongmai/HiSilicon DVR - OpenTelnet Inbound - Possilbe CVE-2020-22253 Attempt"

• "ET SCAN Skipfish Web Application Scan Detected"

• "ET SCAN Automated Injection Tool User-Agent (AutoGetColumn)"

• "ET WEB_SERVER Automated Site Scanning for backupdata"

• "ET WEB_SERVER Automated Site Scanning for backup_data"

• "ET SCAN Multiple MySQL Login Failures Possible Brute Force Attempt"

• "ET SCAN Acunetix Version 6 Crawl/Scan Detected"

• "ET SCAN Apache mod_proxy Reverse Proxy Exposure 2"

• "ET SCAN RatProxy in-use"

• "GPL DNS named authors attempt"

• "ET SCAN Netsparker Scan in Progress"

• "ET POLICY libwww-perl User-Agent"

• "ET EXPLOIT AVTECH Authenticated Command Injection in adcommand.cgi"

• "ET POLICY Peach C++ Library User Agent Outbound"

• "ET WEB_SERVER /etc/shadow Detected in URI"

• "ET POLICY Possible Web Crawl using Wget"

• "GPL DNS zone transfer UDP"

• "ET SCAN Stompy Web Application Session Scan"

• "ET SCAN Observed Suspicious UA (Callstranger Vulnerability Checker)"

• "GPL DNS named version attempt"

• "ET SCAN Hikvision IP Camera 5.4.0 Information Disclosure"

• "ET SCAN Internal to Internal UPnP Request tcp port 2555"

• "ET SCAN Cisco Torch IOS HTTP Scan"

• "ET SCAN Multiple FTP Root Login Attempts from Single Source - Possible Brute Force Attempt"

• "ET SCAN Xenu Link Sleuth Scanner Outbound"

• "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan"

• "GPL NETBIOS NT NULL session"

• "GPL WEB_SERVER 403 Forbidden"

• "ET SCAN DavTest WebDav Vulnerability Scanner Default User Agent Detected"

• "ET POLICY IP Check Domain (whatismyip in HTTP Host)"

• "ET POLICY Inbound /uploadify.php Access"

• "ET SCAN SipCLI VOIP Scan - TCP"

• "ET WEB_SERVER /etc/hosts Detected in URI"

• "ET SCAN Wikto Scan"

• "ET SCAN Sqlmap SQL Injection Scan"

• "GPL SCAN ISS Pinger"

• "GPL NETBIOS SMB CD.."

• "ET POLICY ApacheBenchmark Tool User-Agent Detected"

• "ET SCAN Sipvicious Scan"

• "ET SCAN Mini MySqlatOr SQL Injection Scanner"

• "ET EXPLOIT AVTECH Authenticated Command Injection in PwdGrp.cgi"

• "ET SCAN Possible Fast-Track Tool Spidering User-Agent Detected"

• "GPL SMTP expn decode"

• "ET SCAN WhatWeb Web Application Fingerprint Scanner Default User-Agent Detected"

• "GPL WEB_SERVER /~root access"

• "ET POLICY MOBILE Apple device leaking UDID from SpringBoard via GET"

• "ET SCAN SQLNinja MSSQL XPCmdShell Scan"

• "ET SCAN SQLNinja MSSQL User Scan"

• "ET SCAN Paros Proxy Scanner Detected"

• "ET USER_AGENTS pxyscand/ Suspicious User Agent Outbound"

• "ET SCAN w3af User Agent"

• "ET WEB_SPECIFIC_APPS Joomla Full Path Disclosure -- php5x.php"

• "ET POLICY IP Check whatismyip.com Automation Page"

• "ET WEB_SERVER PHP Easteregg Information-Disclosure (phpinfo)"

• "ET WEB_SERVER Brutus Scan Inbound"

• "GPL NETBIOS RFParalyze Attempt"

• "ET POLICY Possible Web Crawl - libwww-perl User Agent"

• "ET SCAN Httprint Web Server Fingerprint Scan"

• "ET SCAN Possible DavTest WebDav Vulnerability Scanner Initial Check Detected"

• "ET SCAN FTPSync Settings Disclosure Attempt"

• "ET SCAN HP Enterprise VAN SDN Controller"

• "ET SCAN Amap UDP Service Scan Detected"

• "ET SCAN Positive Technologies XSpider Security Scanner User-Agent (PTX)"

• "ET WEB_SPECIFIC_APPS WordPress DB XML dump attempted access"

• "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)"

• "ET SCAN Goatzapszu Header from unknown Scanning Tool"

• "ET SCAN Nmap NSE Heartbleed Response"

• "GPL SNMP private access tcp"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Configuration Download"

• "GPL NETBIOS SMB CD..."

• "ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Config"

• "ET SCAN Amap TCP Service Scan Detected"

• "ET SCAN Possible WafWoof Web Application Firewall Detection Scan"

• "ET SCAN Non-Allowed Host Tried to Connect to MySQL Server"

• "ET POLICY Peach C++ Library User Agent Inbound"

• "ET WEB_SPECIFIC_APPS Checkpoint Quantum Security Gateway Arbitrary File Read Attempt (CVE-2024-24919)"

• "ET WEB_SPECIFIC_APPS Apache Flink Arbitrary File Read Attempt (CVE-2020-17519)"

• "ET INFO Selenium Server Grid Chrome 3.141.59 - Vulnerable Version Detected"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) - Vulnerability Check"

• "ET EXPLOIT HikVision Arbitrary Directory Traversal Attempt"

• "ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) - Vulnerability Check"

• "ET WEB_SPECIFIC_APPS CrushFTP working_dir Template Injection Attempt (CVE-2024-4040)"

policy-violation

• "ET POLICY Unsupported/Fake FireFox Version 2."

• "ET POLICY Cleartext WordPress Login"

• "ET P2P Bittorrent P2P Client User-Agent (FDM 3.x)"

• "ET GAMES Second Life setup download"

• "ET POLICY Observed DNS Query to Pastebin-style Service (wtools .io)"

• "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5."

• "ET POLICY Remote Access - RView - Host - *.rview.com"

• "ET POLICY DNS Query to .onion proxy domain (onion .ws)"

• "ET P2P Azureus P2P Client User-Agent"

• "ET POLICY check.torproject.org IP lookup/Tor Usage check over TLS with SNI"

• "ET P2P BitTorrent DHT announce_peers request"

• "ET P2P Bittorrent P2P Client User-Agent (Enhanced CTorrent 3.x)"

• "ET P2P BTWebClient UA uTorrent in use"

• "ET POLICY DNS Query to .onion proxy Domain (torgate.es)"

• "ET WEB_SERVER HTTPing Usage Inbound"

• "ET CHAT Facebook Chat (buddy list)"

• "ET CHAT Skype User-Agent detected"

• "GPL CHAT IRC DCC file transfer request"

• "ET CHAT GaduGadu Chat Keepalive PING"

• "ET POLICY Netviewer.com Remote Control Proxy Test"

• "ET POLICY Unsupported/Fake FireFox Version 0."

• "ET GAMES Nintendo Wii User-Agent"

• "ET POLICY Possible Autodiscover Credentials Leak via Basic Auth"

• "ET POLICY IncrediMail Install Callback"

• "GPL CHAT Yahoo IM conference message"

• "ET POLICY Mobile Device Posting Phone Number"

• "ET POLICY Office Document Containing AutoOpen Macro Via smtp"

• "ET POLICY eBook Generator User-Agent (EBook)"

• "ET POLICY Cryptexplorer API Check - Potential CoinMiner Traffic"

• "GPL CHAT Google Talk Version Check"

• "ET POLICY JavaClass Returned Via Anonymous Outbound LDAPv3 Bind Request"

• "ET POLICY FOX-SRT - Juniper ScreenOS SSH World Reachable"

• "ET POLICY DNS Query to .onion proxy Domain (torpaysolutions.com)"

• "ET POLICY Club World Casino Client in Use"

• "ET POLICY Suspicious Windows Installer UA for non-MSI"

• "ET POLICY External IP Lookup ip2nation.com"

• "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2."

• "ET P2P BitTorrent peer sync"

• "ET POLICY External IP Lookup via ad4989 .co .kr"

• "GPL CHAT Yahoo Messenger File Transfer Receive Request"

• "ET POLICY F5 BIG-IP Publicly Accessible Exposed REST API Detected"

• "ET POLICY IP Check Domain (address .works)"

• "ET POLICY AmeriTechnology Group - CHARM Client"

• "ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)"

• "ET POLICY External IP Address Lookup via vtransmit .com"

• "ET POLICY GIOP/IIOP Request Outbound"

• "ET POLICY DNS Query to .onion proxy domain (onion .pet)"

• "ET POLICY Onion2Web Tor Proxy Cookie"

• "ET POLICY Possible External IP Lookup myip.kz"

• "ET POLICY DNS Query to .onion proxy Domain (tormaster.fr)"

• "ET POLICY Pirate Browser Download"

• "ET POLICY CNET Custom Installer Possible Bundled Bloatware"

• "ET POLICY I2P Seeds File Download"

• "ET POLICY External IP Check myexternalip.com"

• "ET POLICY Dropbox.com Offsite File Backup in Use"

• "ET POLICY Office Document Download Containing AutoExec Macro"

• "ET P2P Vuze BT UDP Connection (2)"

• "ET TFTP Outbound TFTP Data Transfer"

• "ET INFO [ANY.RUN] DARKCLOUD Style External IP Check"

• "ET P2P Soulseek"

• "ET POLICY Observed DeepFreezeWeb User-Agent"

• "ET POLICY PE EXE or DLL Windows file download HTTP"

• "ET POLICY I2P Reseed Domain Lookup (uk.reseed.i2p2.no)"

• "ET POLICY External IP Lookup ip-score.com"

• "ET GAMES GameHouse License Check"

• "ET POLICY I2P Reseed Domain Lookup (i2p.mooo.com)"

• "ET POLICY CoinHive In-Browser Miner Detected"

• "ET POLICY Babylon User-Agent (Translation App Observed in PPI MALWARE)"

• "ET POLICY AskSearch Toolbar Spyware User-Agent (AskTBar) 2"

• "ET POLICY Possible Psiphon Proxy Tool traffic"

• "ET TFTP Outbound TFTP Read Request"

• "ET POLICY NetSupport GeoLocation Lookup Request"

• "ET P2P Gnutella TCP Ultrapeer Traffic"

• "ET P2P Limewire P2P UDP Traffic"

• "ET POLICY Observed Wifi Geolocation Domain (api .mylnikov .org in TLS SNI)"

• "ET POLICY gogo6/Freenet6 Authentication Attempt"

• "ET POLICY DNS Query to .onion proxy Domain (sshowmethemoney.com)"

• "ET POLICY Possible SSLv2 Negotiation in Progress Client Master Key SSL2_DES_64_CBC_WITH_MD5"

• "ET POLICY Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC4_128_WITH_MD5"

• "ET POLICY Maxmind geoip check to /app/geoip.js"

• "ET USER_AGENTS WildTangent User-Agent (WT Games App)"

• "ET POLICY Http Client Body contains pword= in cleartext"

• "ET POLICY DNS Query to DynDNS *.dyn-ip24 .de Domain"

• "ET P2P Ares Server Connection"

• "ET POLICY VMware User-Agent Outbound"

• "GPL CHAT Yahoo IM conference logon success"

• "ET CHAT GaduGadu Chat Keepalive PONG"

• "ET POLICY Burp Collaborator Domain in TLS SNI"

• "ET MALWARE Media Pass ActiveX Install"

• "ET POLICY Android Dalvik Executable File Download"

• "ET INFO Lets Encrypt Free SSL Cert Observed with IDN/Punycode Domain - Possible Phishing"

• "ET POLICY Privdog Checkin"

• "ET POLICY DNS Query for Invisible Internet Project Domain (I2P)"

• "ET POLICY HTTP POST to MEGA Userstorage"

• "ET P2P Vuze BT UDP Connection (3)"

• "ET POLICY 3proxy Domain Domain in DNS Lookup (3proxy .org)"

• "ET P2P LimeWire P2P Traffic"

• "ET POLICY Http Client Body contains upin= in cleartext"

• "ET POLICY External IP Lookup api.ipify.org"

• "ET POLICY Observed DNS Query to External IP Lookup Domain ( iplocation .truevue .org)"

• "ET P2P LimeWire P2P Traffic"

• "ET POLICY Request for Coinhive Browser Monero Miner M2"

• "ET POLICY I2P Retrieving reseed info"

• "ET POLICY IP Check (myip .com)"

• "ET POLICY File Sharing Site in DNS Lookup (satoshidisk .com)"

• "ET POLICY Internal Host Retrieving External IP Address (monip.outils-rezo. info)"

• "ET POLICY External IP Lookup sina.com.cn"

• "ET CHAT Gadu-Gadu IM Login Server Request"

• "GPL CHAT Yahoo IM voicechat"

• "ET POLICY Observed DNS Query to .burpcollector .net Domain"

• "ET POLICY Observed DNS Query to Free Hosting Domain (.free .bg)"

• "ET POLICY I2P Reseed Domain Lookup (us.reseed.i2p2.no)"

• "ET CHAT Google Talk (Jabber) Client Login"

• "ET POLICY Observed SSL Cert (DoH Service)"

• "ET DNS DNS Query for Illegal Drug Sales Site (SilkRoad)"

• "ET POLICY Possible ethereum traffic"

• "GPL CHAT IRC Channel join"

• "ET POLICY Observed Suspicious SSL Cert (Minerpool - CoinMining)"

• "ET POLICY TraceMyIP IP lookup"

• "ET POLICY DNS Query to .onion proxy Domain (onion.top)"

• "ET POLICY Android Adups Firmware DNS Query 4"

• "ET MALWARE Gator/Claria Data Submission"

• "ET POLICY Office Document Containing AutoOpen Macro Via smtp"

• "ET POLICY Android Adups Firmware DNS Query 2"

• "ET POLICY CommandCam Download"

• "ET POLICY NSISDL Iplookup.php IPCheck"

• "ET POLICY Softango.com Installer POSTing Data"

• "ET POLICY trymedia.com User-Agent (Macrovision_DM)"

• "ET POLICY Observed nc (netcat) EXE Inbound"

• "ET ATTACK_RESPONSE Weak Netbios Lanman Auth Challenge Detected"

• "ET P2P Morpheus Install ini Download"

• "ET POLICY Office Document Containing AutoExec Macro Via smtp"

• "ET POLICY Possible Grams DarkMarket Search DNS Domain Lookup"

• "ET POLICY DNS Query to .onion proxy Domain (torpayoptions.com)"

• "ET TROJAN IRC DCC chat request on non-standard port"

• "ET POLICY External Oracle T3 Requests Inbound"

• "ET POLICY Pandora Usage"

• "ET CHAT GaduGadu Chat Receive Message"

• "ET POLICY Microsoft Online Storage Client Hello TLSv1 Possible OneDrive (storage.msn .com)"

• "ET POLICY F5 BIG-IP Exposed REST API GET (flowbit set)"

• "ET POLICY External IP Lookup - ip.tyk.nu"

• "ET POLICY Google Desktop User-Agent Detected"

• "ET P2P eMule KAD Network Connection Request"

• "ET MALWARE ProxyGearPro Proxy Tool PUA"

• "ET CHAT Facebook Chat (send message)"

• "ET POLICY Logmein.com/Join.me SSL Remote Control Access"

• "ET P2P Morpheus Update Request"

• "ET POLICY Suspicious Malformed Double Accept Header"

• "ET POLICY Hotmail Compose Message Access"

• "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 1."

• "ET P2P ed2k file request answer"

• "ET MALWARE Simbar Spyware User-Agent Detected"

• "ET POLICY check.torproject.org IP lookup/Tor Usage check over HTTP"

• "ET POLICY Burp Collaborator Domain in DNS Query"

• "ET POLICY GNU/Linux YUM User-Agent Outbound likely related to package management"

• "ET POLICY possible OnePlus phone data leakage DNS"

• "ET CURRENT_EVENTS Possible Google Drive Phishing Landing 2015-07-13"

• "ET POLICY go-external-ip library User-Agent"

• "ET CHAT GaduGadu Chat Server Login OK Packet"

• "ET POLICY Hamas Terrorist Propaganda TV Channel (aqsatv.ps)"

• "ET POLICY ipchicken .com DNS Lookup"

• "ET POLICY Possible External IP Lookup ip.webmasterhome.cn"

• "ET POLICY DNS Query to .onion proxy Domain (torgateway.li)"

• "ET POLICY BingBar ToolBar User-Agent (BingBar)"

• "ET POLICY Logmein.com/Join.me SSL Remote Control Access"

• "ET POLICY DNS Query to .onion proxy Domain (marketcryptopartners.com)"

• "ET POLICY File Downloaded from Discord"

• "ET POLICY External IP Lookup (tinytools.nu)"

• "ET POLICY Netop Remote Control Usage"

• "ET POLICY Oracle T3 Response with CVE-2020-2551 Vulnerable Version (12.1.3)"

• "ET POLICY Executable and linking format (ELF) file download"

• "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 4."

• "ET POLICY Android Adups Firmware DNS Query 3"

• "ET POLICY [401TRG] DropBox Access via API (SNI)"

• "ET P2P Ocelot BitTorrent Server in Use"

• "GPL CHAT Jabber/Google Talk Outoing Message"

• "ET MALWARE Shop at Home Select Spyware User-Agent (SAH)"

• "ET TROJAN Observed CDC Ransomware User-Agent"

• "ET POLICY TOR Consensus Data Requested"

• "ET P2P eMule KAD Network Connection Request(2)"

• "ET CHAT GaduGadu Chat File Send Request"

• "ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)"

• "ET POLICY Unsupported/Fake Windows NT Version 4."

• "ET USER_AGENTS ESET Installer"

• "ET POLICY Successful GIOP/IIOP Request Outbound"

• "ET POLICY Observed SSL Cert (DNS Service)"

• "ET POLICY DNS Query to .onion proxy Domain (optionstopaytos.com)"

• "ET MALWARE Gator/Clarian Agent"

• "ET CHAT Facebook Chat using XMPP"

• "ET POLICY IPFS Domain (storage .snark .art in TLS SNI)"

• "ET POLICY Myspace Login Attempt"

• "ET P2P Ares traffic"

• "ET P2P GnucDNA UDP Ultrapeer Traffic"

• "ET P2P Vuze BT UDP Connection"

• "ET POLICY IP Check wtfismyip.com"

• "ET P2P Kazaa over UDP"

• "GPL P2P BitTorrent announce request"

• "ET POLICY Possible ProxyShell Hide IP Installation file download"

• "GPL CHAT MSN outbound file transfer rejected"

• "ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x)"

• "ET POLICY Disposable Email Provider Domain in DNS Lookup (www .yopmail .com)"

• "ET P2P BitTorrent - Torrent File Downloaded"

• "ET POLICY External IP Lookup"

• "ET POLICY Executable and linking format (ELF) file download Over HTTP"

• "ET P2P Libtorrent User-Agent"

• "ET POLICY IP Check Domain (myexternalip .com in TLS SNI)"

• "ET P2P Manolito Ping"

• "ET P2P Edonkey Publicize File ACK"

• "ET POLICY DNS Query to .onion proxy Domain (allepohelpto.com)"

• "ET MALWARE Shop at Home Select Spyware User-Agent (Bundle)"

• "GPL CHAT Jabber/Google Talk Logon Success"

• "ET POLICY Socks5 Proxy to Onion (set)"

• "ET POLICY IP Check Domain (freegeoip .live in TLS SNI)"

• "ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)"

• "ET TFTP Outbound TFTP Data Transfer With Cisco Config 2"

• "ET POLICY Privdog Update check"

• "ET CHAT GaduGadu Chat Server Login Failed Packet"

• "ET POLICY Owncloud Observed Self Signed TLS Certificate"

• "ET POLICY Observed Connection Manager Administration Kit (cmdl32.exe) User-Agent"

• "ET POLICY possible Xiaomi phone data leakage DNS"

• "ET POLICY Pastebin-style Service paste .c-net in DNS Query"

• "ET POLICY QQ Browser WUP Request - qbkpireportbakf.stat"

• "ET P2P Bittorrent P2P Client User-Agent (Deluge 1.x.x)"

• "ET POLICY SSL/TLS Certificate Observed (Free File Hosting Service (api .anonfiles .com))"

• "ET P2P eDonkey Server Status Request"

• "ET INFO curl UA Querying External IP (geoplugin .net)"

• "ET POLICY Successful LDAPSv3 LDAPS_START_TLS Request Outbound"

• "ET POLICY RMI Request Outbound"

• "ET POLICY DNS Query to .onion proxy Domain (optionstorpay22.com)"

• "GPL CHAT MSN user search"

• "ET POLICY Unsupported/Fake Internet Explorer Version MSIE 3."

• "ET TFTP Outbound TFTP Error Message"

• "ET POLICY External IP Lookup / Tor Checker Domain (bridges.torproject .org in DNS lookup)"

• "ET POLICY DNS Query to .onion proxy Domain (torstorm.org)"

• "ET POLICY External IP Lookup (avast .com)"

• "ET POLICY DNS Query to .onion proxy Domain (onion.am)"

• "ET POLICY OpenVPN Update Check"

• "ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted"

• "ET CHAT Yahoo IM Client Install"

• "ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)"

• "ET CHAT GaduGadu Chat File Send Accept"

• "ET POLICY Unsupported/Fake FireFox Version 1."

• "ET POLICY Exe32Pack Packed Executable Download"

• "ET CHAT ICQ Status Change (2)"

• "ET POLICY External IP Lookup - iplocation .truevue .org"

• "ET POLICY DNS Query to a Reverse Proxy Service Observed"

• "ET CHAT Yahoo IM voicechat"

• "ET TROJAN IRC Channel join on non-standard port"

• "ET P2P Vuze BT UDP Connection (5)"

• "ET POLICY Http Client Body contains pwd= in cleartext"

• "ET POLICY Proxy Judge Discovery/Evasion (prxjdg.cgi)"

• "ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set"

• "ET POLICY Observed iesnare/iovation Tracking Activity"

• "GPL CHAT Yahoo IM conference request"

• "ET POLICY localtunnel Connection Setup Attempt"

• "ET POLICY AOL Toolbar User-Agent (AOLToolbar)"

• "ET POLICY OnePlus phone data leakage"

• "ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System (Win98)"

• "ET POLICY CNET TechTracker User-Agent (CNET TechTracker)"

• "ET POLICY Possible External IP Lookup whoer.net"

• "ET POLICY Coral Web Proxy/Content Distribution Net Use"

• "ET POLICY Windows-Based OpenSSL Tunnel Connection Outbound 2"

• "ET POLICY Known External IP Lookup Service Domain in SNI"

• "ET POLICY Google Talk TLS Client Traffic"

• "ET GAMES MINECRAFT Server response inbound"

• "ET POLICY External IP Lookup (ipchicken .com)"

• "ET POLICY Outdated Flash Version M1"

• "ET P2P SoulSeek P2P Login Response"

• "ET POLICY IP Logger Redirect Domain in SNI"

• "ET POLICY Office Document Containing AutoExec Macro Via smtp"

• "ET GAMES STEAM Connection (v2)"

• "ET CHAT Yahoo IM Unavailable Status"

• "ET POLICY SSL/TLS Certificate Observed (Commercial Proxy Provider geosurf .io)"

• "ET POLICY Website Hosting Service Observed in DNS Query"

• "ET MALWARE Freeze.com Spyware/Adware (Install Registration)"

• "ET POLICY W32/Installiq.Adware Install Information Beacon"

• "ET POLICY Monitoring Software Domain (sneek .io) in TLS SNI"

• "ET CHAT ICQ Login"

• "ET POLICY HTTP Request to WebDAV CloudMe Service"

• "ET POLICY DNS Query to .onion proxy Domain (bolistatapay.com)"

• "ET POLICY Bitcoin Mining Server Stratum Protocol HTTP Header"

• "ET P2P Bittorrent P2P Client User-Agent (rTorrent)"

• "ET POLICY IP Check (rl. ammyy. com)"

• "ET POLICY localtunnel Reverse Proxy Domain (localtunnel .me in TLS SNI)"

• "ET P2P MS WUDO Peer Sync"

• "ET P2P ed2k request part"

• "ET P2P Soulseek Filesearch Results"

• "ET POLICY Http Client Body contains passphrase= in cleartext"

• "ET POLICY DNS Query to a *.neokred domain - Likely Hostile"

• "ET POLICY HTTP POST contains pass= in cleartext"

• "ET POLICY Observed IP Check Domain Domain (address .works in TLS SNI)"

• "ET P2P Bittorrent P2P Client User-Agent (BitTornado)"

• "ET POLICY Successful Anonymous LDAPv3 Bind Request Outbound"

• "ET POLICY HTTP Request to IP Logging Service (2no .co)"

• "ET GAMES Moonlight Hack Domain in DNS Lookup"

• "ET POLICY Cryptocurrency Miner Checkin"

• "ET POLICY Windows Quicktime User-Agent EOL With Known Bugs"

• "ET CHAT ICQ Status Change (1)"

• "ET POLICY DNS Query to .onion proxy Domain (effectwaytopay.com)"

• "ET GAMES Blizzard Downloader Client User-Agent (Blizzard Downloader 2.x)"

• "ET POLICY DNS Query to .onion proxy Domain (torinvestment2.com)"

• "GPL CHAT IRC DCC chat request"

• "ET POLICY External IP Lookup - free .ipwhois .io"

• "ET POLICY Observed External IP Lookup Domain (ipconfig .cf in TLS SNI)"

• "ET POLICY Observed MSI Download"

• "ET POLICY DNS Query to .onion proxy Domain (solutionstopaytor33.com)"

• "ET POLICY External IP Lookup (api .ipstack .com)"

• "ET POLICY Radmin Remote Control Session Setup Initiate OUTBOUND"

• "ET POLICY External IP Lookup trackip.net"

• "ET POLICY ToDesk Remote Access Control Tool"

• "ET POLICY Unsupported/Fake Windows NT Version 5.0"

• "ET POLICY IP Check (ip. jsontest .com)"

• "ET POLICY DNS Query to a Reverse Proxy Service Observed"

• "ET POLICY Observed IP Lookup Domain (formyip .com in DNS Lookup)"

• "ET POLICY Observed IP Lookup Domain (formyip .com in TLS SNI)"

• "ET P2P TOR 1.0 Server Key Retrieval"

• "ET POLICY DNS Query to a Reverse Proxy Service Observed"

• "ET POLICY Request to Suspicious Games at pcgame.gamedia.cn"

• "ET POLICY DNS Query to .onion proxy Domain (torwillsmith.com)"

• "ET POLICY Dropbox Client Broadcasting"

• "ET POLICY HTTP Outbound Request contains pw"

• "ET POLICY Smilebox Software/Adware Checkin"

• "ET POLICY Windows 3.1 User-Agent Detected - Possible Malware or Non-Updated System"

• "ET POLICY I2P Reseed Domain Lookup (reseed.i2p-projekt.de)"

• "ET CHAT GaduGadu Chat File Send Details"

• "ET P2P BitTorrent Traffic"

• "ET POLICY Observed SSL Cert (Pastebin-style Service nrecom)"

• "ET POLICY IP Check Domain (iplogger .org in DNS Lookup)"

• "ET P2P BitTorrent DHT find_node request"

• "ET POLICY Middle Earth Illegal Marketplace Tor Hidden Service DNS Query"

• "ET POLICY I2P Seeds File Request"

• "ET POLICY DNS Query to .onion proxy Domain (tostotor.com)"

• "ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"

• "ET POLICY myip.ru IP lookup"

• "GPL CHAT Google Talk Logon"

• "ET POLICY DNS Query for Observed CVE-2021-44228 Security Scanner Domain (dns .cyberwar .nl)"

• "ET POLICY Observed DNS Query to IP Lookup Domain (me .shodan .io)"

• "ET POLICY PrimeCoinMiner.Protominer"

• "ET POLICY OperaUnite URL Registration"

• "ET POLICY Privdog Activation"

• "ET POLICY DNS Query to .onion proxy Domain (dogotor.com)"

• "ET P2P Vuze BT Connection"

• "ET GAMES Guild Wars connection"

• "ET P2P eMule KAD Network Server Status Request"

• "ET POLICY Observed SSL Cert (Pastebin-style Service paste .c-net)"

• "ET P2P Edonkey Connect Request"

• "ET POLICY Metacafe.com Social Site Access"

• "ET POLICY DNS Query to .onion proxy Domain (welcome2tor.org)"

• "ET POLICY Outbound HTTP Request with BITS_POST Method"

• "ET POLICY External IP Lookup - ip2location.com"

• "ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR"

• "ET GAMES Blizzard Web Downloader Install Detected"

• "ET POLICY External IP Address Lookup via iplocation.com"

• "ET POLICY AOL Webmail Message Send"

• "ET POLICY Observed Filesharing Domain (privatlab .com in TLS SNI)"

• "ET POLICY Observed Potential Spyware Domain (app .hubstaff .com) in TLS SNI"

• "ET POLICY Carbonite.com Backup Software User-Agent (Carbonite Installer)"

• "ET POLICY DNS Query to .onion proxy Domain (bananator.com)"

• "ET POLICY Oracle T3 Response with CVE-2020-2551 Vulnerable Version (12.2.1)"

• "ET POLICY External IP Lookup Domain (up .jkc8 .com)"

• "ET POLICY Hotmail Inbox Access"

• "ET POLICY Observed SSL Cert (Tor Proxy Domain (.onion. ws))"

• "ET POLICY User-Agent (Launcher)"

• "ET P2P Pando Client User-Agent Detected"

• "ET P2P Gnutella Connect"

• "ET CURRENT_EVENTS Possible Successful Phish (Google/Dropbox/Netflix) 2015-07-11"

• "ET POLICY Request for Jsecoin Browser Miner M2"

• "ET POLICY Orkut.com Social Site Access"

• "ET POLICY External IP Lookup (api .ipaddress .com)"

• "ET POLICY IP Check Domain (iplogger .org in TLS SNI)"

• "ET POLICY Wifi Geolocation Lookup Attempt"

• "GPL P2P GNUTella client request"

• "ET POLICY DNS Query to .onion Proxy Domain (connect2tor.org)"

• "ET POLICY DNS Query to .onion proxy Domain (batmantor.com)"

• "ET POLICY Self Signed SSL Certificate (Snake Oil CA)"

• "ET CHAT GaduGadu Chat Send Message"

• "ET P2P Morpheus Install"

• "ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)"

• "ET POLICY Chisel SOCKS Proxy Startup Observed"

• "ET CURRENT_EVENTS Google Drive Phishing Landing Jul 10 2015"

• "ET POLICY DNS Query to .onion proxy Domain (clusterpaytor.com)"

• "ET P2P Bittorrent P2P Client User-Agent (KTorrent/3.x.x)"

• "ET POLICY External IP Lookup (moanmyip .com)"

• "ET TFTP Outbound TFTP Write Request"

• "ET P2P Tor Get Status Request"

• "ET POLICY Smilebox Spyware Download"

• "ET POLICY External IP Lookup Domain (curlmyip .net in DNS lookup)"

• "ET POLICY Possible SSLv2 Negotiation in Progress Server Hello"

• "ET POLICY External IP Lookup (ipify .org)"

• "ET POLICY SSL/TLS Certificate Observed (Free File Hosting Service (uplovd .com))"

• "ET POLICY possible Xiaomi phone data leakage HTTP"

• "ET POLICY DNS Query to .onion proxy Domain (onion . ly)"

• "ET POLICY External IP Lookup ipinfo.io"

• "ET POLICY External IP Lookup getip.pw"

• "ET P2P BitTorrent DHT get_peers request"

• "ET INFO External IP Address Lookup Domain SSL Cert (geodatatool .com)"

• "ET POLICY Skypool Coin Mining Pool DNS Lookup"

• "GPL CHAT Yahoo IM conference offer invitation"

• "ET POLICY onion.cab tor2web .onion Proxy domain in SNI"

• "ET POLICY External IP Lookup via 3322 .org"

• "ET SNMP Attempt to retrieve Cisco Config via TFTP (CISCO-CONFIG-COPY)"

• "ET POLICY IP Check Response (rl. ammyy. com)"

• "ET POLICY DNS Query to .onion proxy Domain (tor4free.org)"

• "ET POLICY iTunes User Agent"

• "GPL CHAT Yahoo IM conference watch"

• "ET POLICY Protocol 41 IPv6 encapsulation potential 6in4 IPv6 tunnel active"

• "ET POLICY External IP Lookup - Bravica"

• "ET TFTP Outbound TFTP Data Transfer with Cisco config"

• "ET P2P Bittorrent P2P Client User-Agent (BTSP)"

• "ET CURRENT_EVENTS Possible Google Drive/Dropbox Phishing Landing Jul 10 2015"

• "ET POLICY QQ Browser WUP Request - qbpcstatf.stat"

• "ET POLICY Xpopup Instant Messenger Downloading Configuration"

• "ET POLICY tor4u tor2web .onion Proxy DNS lookup"

• "ET POLICY Office Document Download Containing AutoOpen Macro"

• "ET POLICY Akamai NetSession Interface PUTing data"

• "ET P2P Edonkey Search Request (search by name)"

• "ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup)"

• "ET GAMES Moonlight Hack Actvity (GET)"

• "ET POLICY Centralops.net Domain Dossier Utility Probe"

• "GPL P2P GNUTella client request"

• "ET USER_AGENTS Steam HTTP Client User-Agent"

• "ET CHAT GaduGadu Chat File Send Begin"

• "ET P2P Client User-Agent (Shareaza 2.x)"

• "ET POLICY Burp Collaborator Certificate Inbound"

• "GPL CHAT Google Talk Startup"

• "ET POLICY DNS Query to .onion proxy Domain (optionsketchupay.com)"

• "ET GAMES Wolfteam HileYapak Server Response"

• "ET CHAT ICQ Status Invisible"

• "ET POLICY Hotmail Access Full Mode"

• "ET P2P Bittorrent P2P Client User-Agent (BitComet)"

• "GPL CHAT MSN login attempt"

• "ET POLICY Google Music Streaming"

• "ET POLICY Android Adups Firmware DNS Query 5"

• "ET POLICY External IP Lookup (whois .pconline .com .cn)"

• "ET USER_AGENTS Steam HTTP Client User-Agent"

• "ET POLICY .onion.ly Proxy domain in SNI"

• "ET POLICY Application Crash Report Sent to Microsoft"

• "ET POLICY Anonymous LDAPv3 Bind Request Outbound"

• "GPL CHAT Yahoo IM ping"

• "ET MALWARE ZCOM Adware/Spyware User-Agent (ZCOM Software)"

• "ET POLICY [401TRG] DropBox Access via API (Certificate)"

• "ET GAMES Gold VIP Club Casino Client in Use"

• "ET MALWARE Carder Card Checking Tool try2check.me SSL Certificate on Off Port"

• "ET POLICY IP Lookup Geoip.co.uk"

• "ET POLICY Hola VPN Activity - X-Hola-* Headers"

• "ET USER_AGENTS Non-standard User-Agent (PATCHER)"

• "ET POLICY DNS Query to .onion proxy Domain (statepaytor.com)"

• "ET POLICY InstallIQ Updater Software request"

• "ET POLICY request for hide-my-ip.com autoupdate"

• "ET POLICY TeamViewer Dyngate User-Agent"

• "ET POLICY Nimiq Miner Initiating Mining Session with Skypool"

• "ET POLICY DNS Query to .onion proxy Domain (paypartnerstodo.com)"

• "ET POLICY External IP Address Request via wttr .in"

• "ET POLICY External IP Lookup - ip-whois"

• "ET POLICY DNS Query For XXX Adult Site Top Level Domain"

• "ET TFTP Outbound TFTP ACK"

• "ET CHAT Google IM traffic Jabber client sign-on"

• "ET POLICY request to .xxx TLD"

• "ET POLICY I2P Reseed Domain Lookup (netdb.i2p2.no)"

• "ET POLICY ICP Email Send via HTTP - Often Trojan Install Reports"

• "ET POLICY NEPHILIM Ransomware Victim Publishing Site DNS Lookup (corpleaks .net)"

• "ET POLICY Suspicious User Agent (AskInstallChecker)"

• "ET POLICY LumOffice Uploading Screenshot"

• "ET POLICY DNS Query to .onion proxy Domain (partnersinvestpayto.com)"

• "ET POLICY Remote Access - RView - SSL Certificate Seen"

• "ET POLICY Possible SSLv2 Negotiation in Progress ClientMaster Key SSL2_IDEA_128_CBC_WITH_MD5"

• "ET INFO PUP/PUA OSSProxy HTTP Header"

• "ET POLICY Logmein.com Host List Download"

• "ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent"

• "ET POLICY Suspicious EXE Download Content-Type image/jpeg"

• "ET POLICY Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC2_128_CBC_EXPORT40_WITH_MD5"

• "ET POLICY Bitmessage Activity"

• "ET P2P BitTorrent Announce"

• "ET POLICY Possible Kali Linux hostname in DHCP Request Packet"

• "ET POLICY DNS Query to .onion proxy Domain (forkinvestpay.com)"

• "ET POLICY 3proxy Domain Domain in DNS Lookup (3proxy .ru)"

• "ET MALWARE Zenotecnico Adware 2"

• "ET POLICY OS X Software Update Request Outbound"

• "ET POLICY IP Check Domain (showmyipaddress .com in HTTP Host)"

• "ET MALWARE Deskwizz.com Spyware Install INI Download"

• "ET P2P BitTorrent DHT nodes reply"

• "ET P2P TOR 1.0 Outbound Circuit Traffic"

• "GPL CHAT Yahoo IM successful chat join"

• "ET POLICY Office Document Containing AutoExec Macro Via smtp"

• "ET TROJAN Possible Chimera Ransomware - Bitmessage Activity"

• "ET INFO Observed Interesting Content-Type Inbound (application/x-sh)"

• "ET POLICY Possible ProxyShell Anonymous Access Connection"

• "ET POLICY Softango.com Installer Checking For Update"

• "ET CHAT Skype VOIP Checking Version (Startup)"

• "ET POLICY Outdated Flash Version M2"

• "ET POLICY DNS Query to .onion proxy Domain (cheetosnotburitos.com)"

• "ET POLICY External IP Lookup ip-api.com"

• "GPL CHAT Jabber/Google Talk Incoming Message"

• "ET TROJAN BrushaLoader CnC Domain in SNI"

• "ET POLICY Hotmail Message Access"

• "ET POLICY Office Document Containing AutoOpen Macro Via smtp"

• "ET CHAT GaduGadu Chat Client Login Packet"

• "ET MALWARE Freeze.com Spyware/Adware (Install)"

• "ET POLICY Bomgar Remote Assistance Tool Download"

• "ET POLICY TOR .exit Pseudo TLD DNS Query"

• "ET GAMES Moonlight Hack Domain in DNS Lookup"

• "ET POLICY Successful LDAPSv3 LDAPS_START_TLS Request Outbound"

• "ET POLICY Possible External IP Lookup www.whatsmyip.us"

• "ET POLICY moanmyip .com DNS Lookup"

• "ET POLICY DNS Query to .onion proxy Domain (trusteetor.com)"

• "ET POLICY Http Client Body contains passwd= in cleartext"

• "ET POLICY Observed DNS Query for Suspicious TLD (.management)"

• "ET POLICY External IP Address Lookup - b4secure .com"

• "ET POLICY Geo Location IP info online service (geoiptool.com)"

• "ET POLICY CBS Streaming Video"

• "ET POLICY Pastebin-style Service (paste .ee) in TLS SNI"

• "ET POLICY External IP Lookup Domain (ipapi .co in DNS lookup)"

• "ET POLICY tor4u tor2web .onion Proxy domain in SNI"

• "ET POLICY Windows-Based OpenSSL Tunnel Outbound"

• "ET POLICY Bitcoin Mining Extensions Header"

• "ET POLICY Http Client Body contains pin= in cleartext"

• "ET POLICY TuneIn Internet Radio Usage Detected"

• "ET POLICY Possible EXE Download Request to ngrok"

• "GPL P2P BitTorrent transfer"

• "ET P2P KuGoo P2P Connection"

• "ET POLICY DNS Query to .onion proxy Domain (monsterbbc.com)"

• "ET POLICY External IP Lookup (www. netikus .net)"

• "ET POLICY External IP Lookup - ipecho.net"

• "ET POLICY NBC Streaming Video"

• "ET POLICY StumbleUpon Submission Detected"

• "ET POLICY DNS Query to .onion proxy Domain (tordomain.org)"

• "ET POLICY DNS Query to a *.ngrok domain (ngrok.com)"

• "ET POLICY DNS Query to .onion proxy Domain (anonym.to)"

• "ET P2P ThunderNetwork UDP Traffic"

• "ET POLICY DivX Client SSL Connection via Self-Signed SSL Cert"

• "ET POLICY External IP Lookup (ip .anysrc .net)"

• "ET P2P eMule KAD Network Firewalled Request"

• "ET P2P TOR 1.0 Inbound Circuit Traffic"

• "ET P2P Vagaa peer-to-peer (Transfer)"

• "ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile"

• "ET POLICY External IP Lookup Domain (ifconfig .me)"

• "ET POLICY External IP Lookup / Tor Checker Domain (check.torproject .org in DNS lookup)"

• "ET POLICY Download Request to Hotfile.com"

• "ET TROJAN IRC DNS request on non-standard port"

• "ET POLICY NEPHILIM Ransomware Victim Publishing Site DNS Lookup (hxt254aygrsziejn .onion) DNS Lookup"

• "ET POLICY External IP Lookup - www.ip.cn"

• "ET CHAT GaduGadu Chat Server Welcome Packet"

• "ET P2P BitTorrent DHT ping request"

• "ET POLICY Remote Desktop AeroAdmin handshake"

• "ET P2P TOR 1.0 Status Update"

• "ET POLICY Observed Suspicious SSL Cert (External IP Lookup - ident .me)"

• "ET POLICY I2P Reseed Domain Lookup (i2p-netdb.innovatio.no)"

• "ET POLICY HTTP Request to Illegal Drug Sales Site (SilkRoad)"

• "ET POLICY Nessus Vulnerability Scanner Plugins Update"

• "ET POLICY Logmein.com Update Activity"

• "ET POLICY Pastebin-style Service nrecom in DNS Query"

• "ET POLICY Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC2_128_CBC_WITH_MD5"

• "ET P2P Manolito Connection (1)"

• "ET MALWARE Carder Card Checking Tool try2check.me SSL Certificate"

• "ET POLICY DNS Query to .onion proxy Domain (solutionsaccountor.com)"

• "ET POLICY Quad9 DNS Over TLS Certificate Inbound"

• "ET P2P Octoshape P2P streaming media"

• "ET POLICY Microsoft Online Storage Client Hello TLSv1 Possible OneDrive (storage.live .com)"

• "ET POLICY External Geo IP Lookup (api .db-ip .com)"

• "ET POLICY Incoming Basic Auth Base64 HTTP Password detected unencrypted"

• "ET POLICY Observed SSL Cert (Tor Proxy Domain (.onion. pet))"

• "GPL CHAT ICQ access"

• "ET POLICY Windows-Based OpenSSL Tunnel Connection Outbound 3"

• "ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 6 or 7 set"

• "ET P2P Direct Connect Traffic (client-server)"

• "ET MALWARE Zenotecnico Spyware Install Report"

• "ET POLICY HotSpotShield Activity"

• "ET POLICY DropBox User Content Access over SSL"

• "ET POLICY 2Downloadz.com File Sharing User-Agent"

• "ET POLICY Cryptocurrency Miner Checkin M2"

• "ET P2P Vuze BT UDP Connection (4)"

• "ET POLICY Kindle Fire Browser User-Agent Outbound"

• "GPL CHAT MSN outbound file transfer request"

• "ET POLICY Android Adups Firmware DNS Query"

• "ET POLICY Dropbox DNS Lookup - Possible Offsite File Backup in Use"

• "ET POLICY XenArmor Password Recovery License Check"

• "ET POLICY localtunnel Reverse Proxy Domain (localtunnel .me in DNS Lookup)"

• "ET POLICY Observed ApoioViewer Remote Access Tool Domain (apoioviewer .com in TLS SNI)"

• "GPL CHAT MSN outbound file transfer accept"

• "ET P2P QVOD P2P Sharing Traffic detected (tcp)"

• "ET TROJAN Possible Emissary External IP Lookup"

• "ET P2P Gnutella TCP Traffic"

• "ET P2P Possible Torrent Download via HTTP Request"

• "ET POLICY Netflix Streaming Player Access"

• "ET GAMES Playit Activity (playit .gg)"

• "ET POLICY Possible HTTP-TUNNEL detected"

• "ET INFO Suspected PUP/PUA User-Agent (OSSProxy)"

• "ET POLICY External IP Lookup Attempt To Wipmania"

• "ET POLICY Oracle T3 Response with CVE-2020-2551 Vulnerable Version (10.3.6)"

• "ET POLICY Outbound SMTP NTLM Authentication Observed"

• "ET CHAT GaduGadu Chat Server Available Status Packet"

• "GPL P2P eDonkey server response"

• "ET POLICY CNET TechTracker Software Manager request"

• "ET POLICY External IP Lookup maxmind.com"

• "ET POLICY External IP Lookup - meuip.net.br"

• "ET POLICY DNS Query to .onion proxy Domain (onion.cab)"

• "ET POLICY External IP Lookup"

• "ET POLICY Possible IP Check api.ipify.org"

• "ET POLICY Android Download from Vshare Marketplace (Possible DarkSideLoading)"

• "ET P2P Tor Get Server Request"

• "ET P2P Bittorrent P2P Client User-Agent (Opera/10.x)"

• "ET POLICY Http Client Body contains otp= in cleartext"

• "ET POLICY External Timezone Check (earthtools.org)"

• "ET INFO Suspicious Use of rzd URL Shortener Service"

• "ET POLICY bridges.torproject.org over TLS with SNI"

• "ET POLICY External IP Lookup - checkip.dyndns.org"

• "ET POLICY localtunnel Sucessful Connection Setup"

• "GPL CHAT Yahoo IM conference invitation"

• "ET POLICY IOS Download from Vshare Marketplace (Possible DarkSideLoading)"

• "ET POLICY GeoIP Lookup (nydus.battle.net)"

• "ET P2P FFTorrent P2P Client User-Agent (FFTorrent/x.x.x)"

• "ET P2P Bittorrent P2P Client User-Agent (uTorrent)"

• "ET INFO External IP Lookup Domain in DNS Lookup (ipcalf .com)"

• "ET INFO Observed External IP Lookup Domain (ip-api .com) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (ifconfig .es)"

• "ET INFO Observed External IP Lookup Domain (ifconfig .co) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (wgetip .com) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (ifconfig .io) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (ipaddress .sh)"

• "ET INFO Observed External IP Lookup Domain (ip .tyk .nu) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (ipecho .net)"

• "ET INFO External IP Lookup Domain in DNS Lookup (ipaddr .site)"

• "ET INFO External IP Lookup Domain in DNS Lookup (ifconfig .co)"

• "ET INFO Observed External IP Lookup Domain (checkip .amazonaws .com) in TLS SNI"

• "ET INFO Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)"

• "ET INFO External IP Lookup Domain in DNS Lookup (echoip .de)"

• "ET INFO External IP Lookup Domain in DNS Lookup (whatismyipaddress .com)"

• "ET INFO Observed External IP Lookup Domain (ipecho .net) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (ident .me) in TLS SNI"

• "ET INFO Browser Automation Toolkit in TLS SNI (bablosoft .com)"

• "ET INFO Observed External IP Lookup Domain (ipaddr .site) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (tnx .nl)"

• "ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)"

• "ET INFO Fingerprinting Service in DNS Lookup (customfingerprints .bablosoft .com)"

• "ET INFO Browser Automation Toolkit in DNS Lookup (bablosoft .com)"

• "ET INFO External IP Lookup Domain in DNS Lookup (wgetip .com)"

• "ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)"

• "ET INFO External IP Lookup Domain in DNS Lookup (ifconfig .io)"

• "ET INFO External IP Lookup Domain in DNS Lookup (ident .me)"

• "ET INFO Observed External IP Lookup Domain (ipaddress .sh) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (tnx .nl) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (whatismyip .akamai .com) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (ip .liquidweb .com) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (ipcalf .com) in TLS SNI"

• "ET INFO Observed External IP Lookup Domain (curlmyip .net) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (2ip .ru)"

• "ET INFO External IP Lookup Domain in DNS Lookup (whatismyip .akamai .com)"

• "ET INFO Observed External IP Lookup Domain (ifconfig .es) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)"

• "ET INFO Observed External IP Lookup Domain (eth0 .me) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)"

• "ET INFO Observed External IP Lookup Domain (echoip .de) in TLS SNI"

• "ET INFO External IP Lookup Domain in DNS Lookup (ip .tyk .nu)"

• "ET INFO External IP Lookup Domain in DNS Lookup (ip .liquidweb .com)"

attempted-user

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow 2"

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow"

• "ET EXPLOIT Apache Struts Possible OGNL Java ProcessBuilder URI"

• "GPL SQL sp_start_job - program execution"

• "ET EXPLOIT Apache Struts Possible OGNL Java ProcessBuilder in client body"

• "ET WEB_SERVER Aribitrary File Upload Vulnerability in WP Mobile Detector"

• "GPL SQL dbms_repcat.alter_priority_raw buffer overflow attempt"

• "ET ACTIVEX Microsoft DirectX 9 ActiveX Control Format String Function Call"

• "ET WEB_SPECIFIC_APPS WordPress Plugin Job Manager Stored Cross-Site Scripting"

• "ET ACTIVEX Possible CA eTrust PestPatrol ActiveX Control Buffer Overflow"

• "ET ATTACK_RESPONSE Possible BeEF HTTP Headers Inbound"

• "GPL SQL dbms_offline_og.begin_load buffer overflow attempt"

• "ET WEB_SERVER WebShell - JSP File Admin - POST Structure - dir"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Disable Firewall"

• "GPL SQL dbms_repcat.purge_master_log buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Add Root Htpasswd"

• "GPL SQL from_tz buffer overflow attempt"

• "ET FTP Possible FTP Daemon Username UNION SELECT SQL Injection Attempt"

• "ET WEB_SPECIFIC_APPS Hadoop YARN ResourceManager Unauthenticated Command Execution"

• "ET MOBILE_MALWARE Possible Android CVE-2014-6041"

• "GPL SQL dbms_repcat.comment_on_repgroup buffer overflow attempt"

• "ET WEB_CLIENT Microsoft Windows MPEG Layer-3 Audio Decoder Buffer Overflow"

• "ET ACTIVEX Axis Media Controller ActiveX SetImage Method Remote Code Execution Attempt"

• "GPL SQL alter file buffer overflow attempt"

• "ET WEB_CLIENT Possible MacOSX HelpViewer 10.12.1 XSS Arbitrary File Execution and Arbitrary File Read (CVE-2017-2361)"

• "GPL SQL dbms_repcat.create_mview_repobject buffer overflow attempt"

• "GPL SQL dbms_repcat.begin_flavor_definition buffer overflow attempt"

• "ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 3"

• "GPL SQL TO_CHAR buffer overflow attempt"

• "ET ACTIVEX EdrawSoft Office Viewer Component ActiveX FtpUploadFile Format String Function Call Attempt"

• "GPL SQL register_user_repgroup ordered privilege_type buffer overflow attempt"

• "ET WEB_CLIENT Spectre Kernel Memory Leakage JavaScript"

• "ET ACTIVEX Dell Webcam CrazyTalk ActiveX Control BackImage Access Potential Buffer Overflow Attempt"

• "GPL SQL dbms_repcat.drop_mview_repobject buffer overflow attempt"

• "GPL SQL sys.dbms_repcat_conf.alter_site_priority_site buffer overflow attempt"

• "ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow 2"

• "ET WEB_CLIENT Adobe Reader and Acrobat U3D File Invalid Array Index Remote Code Execution Attempt"

• "ET WEB_SPECIFIC_APPS MicroFocus Secure Messaging Gateway SQL Injection"

• "ET EXPLOIT Possible dlink-DSL2640B DNS Change Attempt"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Add Admin Passwd"

• "ET NETBIOS SMB Trans2 Query_Fs_Attribute_Info SrvSmbQueryFsInformation Pool Buffer Overflow"

• "GPL SQL dbms_repcat.drop_column_group buffer overflow attempt"

• "ET EXPLOIT Apache Struts Possible OGNL Java WriteFile in client_body"

• "ET WEB_SERVER Generic PHP Remote File Include"

• "ET ACTIVEX Possible Autodesk MapGuide Viewer ActiveX LayersViewWidth Method Access Denial of Service 2"

• "ET ACTIVEX Possible BarCodeWiz (BARCODEWIZLib.BarCodeWiz) ActiveX Control Buffer Overflow"

• "ET EXPLOIT Possible CVE-2016-0777 Server Advertises Suspicious Roaming Support"

• "GPL SQL dbms_repcat.alter_site_priority buffer overflow attempt"

• "ET EXPLOIT Apache Struts Possible OGNL Java WriteFile in URI"

• "ET EXPLOIT Possible Linksys E1500/E2500 apply.cgi RCE Attempt"

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow 2"

• "GPL SQL dbms_repcat.alter_mview_propagation buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Geutebrueck re_porter 16 - Cross-Site Scripting 6"

• "GPL SQL dbms_repcat.comment_on_repsites buffer overflow attempt"

• "GPL SQL dbms_repcat.alter_snapshot_propagation buffer overflow attempt"

• "ET EXPLOIT Ghostscript illegal read undefinedfilename attempt"

• "GPL SQL numtoyminterval buffer overflow attempt"

• "ET ACTIVEX LEADTOOLS Imaging LEADSmtp ActiveX SaveMessage Method Vulnerability"

• "GPL SQL dbms_repcat.add_priority_varchar2 buffer overflow attempt"

• "ET EXPLOIT SAP NetWeaver AS Directory Traversal Attempt Inbound (CVE-2020-6286)"

• "GPL SQL dbms_repcat.alter_priority_nvarchar2 buffer overflow attempt"

• "ET EXPLOIT Cisco ASA/Firepower Unauthenticated File Read (CVE-2020-3452) M1"

• "ET EXPLOIT Nagios XI Remote Code Execution 3"

• "ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 9"

• "ET EXPLOIT Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution Unix"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Default User Account FTPUSER Login Attempt"

• "GPL SQL dbms_repcat.send_and_compare_old_values buffer overflow attempt"

• "ET CURRENT_EVENTS DRIVEBY Generic - 8Char.JAR Naming Algorithm"

• "ET WEB_CLIENT Possible Android RCE via XSS and Play Store XFO"

• "ET FTP Possible FTP Daemon Username UPDATE SET SQL Injection Attempt"

• "GPL SQL dbms_repcat.create_master_repobject buffer overflow attempt"

• "GPL SQL drop_master_repgroup ordered gname buffer overflow attempt"

• "ET ACTIVEX Tracker Software pdfSaver ActiveX StoreInRegistry Method Access Potential Buffer Overflow 2"

• "ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 11"

• "ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 2"

• "ET WEB_SPECIFIC_APPS Oracle WebLogic RCE Shell Inbound M2 (CVE-2020-14882)"

• "ET WEB_CLIENT QuickTime Remote Exploit (exploit specific)"

• "ET EXPLOIT Nagios XI Remote Code Execution"

• "ET ACTIVEX AVTECH Software ActiveX _DownloadPBControl Method Buffer Overflow Attempt"

• "ET WEB_SPECIFIC_APPS Geutebrueck re_porter 16 - Cross-Site Scripting 2"

• "ET WEB_SERVER Apache Continuum Arbitrary Command Execution"

• "ET WEB_CLIENT Microsoft Rich Text File download - SET"

• "ET SCADA SEIG SYSTEM 9 - Remote Code Execution"

• "ET ACTIVEX Possible WinZip FileView ActiveX CreateNewFolderFromName Method Access Buffer Overflow"

• "ET EXPLOIT xp_readerrorlogs access"

• "ET EXPLOIT Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution Windows"

• "GPL MISC rlogin bin"

• "ET EXPLOIT Zimbra <8.8.11 - XML External Entity Injection/SSRF Attempt (CVE-2019-9621)"

• "ET SCADA PcVue Activex Control Insecure method (GetExtendedColor)"

• "ET EXPLOIT Cisco Adaptive Security Appliance - Path Traversal"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 7"

• "ET ACTIVEX Possible AOL ICQ ActiveX Control DownloadAgent Method Access Arbitrary File Download and Execute"

• "ET ACTIVEX J-Integra ActiveX SetIdentity Buffer Overflow"

• "ET WEB_SERVER Adobe Flash Player Rosetta Flash compressed CWS in URI"

• "ET WEB_CLIENT Possible CVE-2013-1710/CVE-2012-3993 Firefox Exploit Attempt"

• "ET WEB_CLIENT Microsoft Excel file download - SET 1"

• "ET EXPLOIT Ghostscript illegal delete bindnow attempt (SMTP)"

• "GPL SQL dbms_repcat.drop_priority_nchar buffer overflow attempt"

• "ET WEB_CLIENT PWNJS JS Constructs"

• "ET EXPLOIT Zollard PHP Exploit Telnet Inbound"

• "ET WEB_CLIENT Oracle Java 6 Object Tag launchjnlp docbase Parameters Buffer Overflow"

• "GPL SQL dbms_repcat.comment_on_repobject buffer overflow attempt"

• "ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access"

• "ET EXPLOIT Adobe ColdFusion Deserialization of Untrusted Data (CVE-2023-26360) M2"

• "ET TROJAN Possible Backdoor.Adwind Download"

• "ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361"

• "GPL SQL dbms_repcat.drop_site_priority_site buffer overflow attempt"

• "ET WEB_SERVER WebShell - PHPShell - Haxplorer URI"

• "ET WEB_SPECIFIC_APPS Jenkins Script Console Usage (Can be Used to Spawn Shell)"

• "ET WEB_CLIENT Possible Adobe Acrobat and Reader Pushstring Memory Corruption Attempt"

• "ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 2"

• "ET WEB_SERVER WebShell - PHPShell - PHPKonsole URI"

• "ET NETBIOS PolarisOffice Insecure Library Loading - SMB Unicode"

• "ET ACTIVEX 2X Client for RDP ClientSystem Class ActiveX Control InstallClient Function Call Attempt"

• "ET EXPLOIT Apache Struts 2 REST Plugin (ProcessBuilder)"

• "ET WEB_CLIENT PowerShell call in script 1"

• "ET EXPLOIT Possible ZTE ZXV10 H108L Router Root RCE Attempt"

• "ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190)"

• "ET EXPLOIT Possible Android Stagefright MP4 (CVE 2016-3861) ROP"

• "GPL SQL user name buffer overflow attempt"

• "GPL SQL dbms_repcat.relocate_masterdef buffer overflow attempt"

• "ET EXPLOIT Possible Realtek SDK - formWlanMultipleAP Stack Buffer Overflow Inbound (CVE-2021-35393)"

• "ET EXPLOIT php script base64 encoded Remote Code Execution 2"

• "GPL SQL cancel_statistics ordered sname/oname buffer overflow attempt"

• "GPL SQL dbms_repcat.drop_priority_nvarchar2 buffer overflow attempt"

• "ET EXPLOIT AnyDesk UDP Discovery Format String (CVE-2020-13160)"

• "ET EXPLOIT Ghostscript LockDistillerParams type confusion attempt (SMTP)"

• "ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 2"

• "ET EXPLOIT Possible 2015-7547 Malformed Server response"

• "GPL SQL dbms_repcat_instantiate.instantiate_offline buffer overflow attempt"

• "ET ACTIVEX SoftArtisans XFile FileManager ActiveX Buildpath method stack overflow Attempt"

• "ET ACTIVEX AVTECH Software ActiveX SendCommand Method Buffer Overflow Attempt"

• "ET EXPLOIT VMware NSX SD-WAN Command Injection 2"

• "ET EXPLOIT TrendMicro node.js HTTP RCE Exploit Inbound (openUrlInDefaultBrowser)"

• "ET EXPLOIT VMware NSX SD-WAN Command Injection"

• "GPL SQL service_name buffer overflow attempt"

• "ET EXPLOIT Possible Belkin N600DB Wireless Router Request Forgery Attempt"

• "GPL SQL dbms_repcat.rename_shadow_column_group buffer overflow attempt"

• "GPL SQL snapshot.end_load ordered gname buffer overflow attempt"

• "ET WEB_CLIENT Microsoft Application Crash Report Indicates Potential VGX Memory Corruption 2"

• "ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query"

• "ET WEB_SERVER Possible Cisco Adaptive Security Appliance Web VPN FTP or CIFS Authentication Form Phishing Attempt"

• "ET ACTIVEX Magneto ICMP ActiveX ICMPSendEchoRequest Remote Code Execution Attempt"

• "ET WEB_CLIENT HTA File containing Wscript.Shell Call - Potential CVE-2017-0199"

• "ET WEB_SERVER ASP.NET Forms Authentication Bypass"

• "GPL SQL dbms_repcat.add_object_to_flavor buffer overflow attempt"

• "ET CURRENT_EVENTS Spelevo EK Landing M3"

• "ET WEB_CLIENT Google Chrome XSS (CVE-2017-5124)"

• "ET EXPLOIT Cisco Catalyst Remote Code Execution (CVE-2017-3881)"

• "GPL SQL dbms_repcat.generate_replication_trigger buffer overflow attempt"

• "ET EXPLOIT Apache Struts 2 REST Plugin (Runtime.Exec)"

• "ET TROJAN Kryptik Check-in"

• "ET EXPLOIT Possible Realtek SDK - formStaticDHCP Stack Buffer Overflow Inbound (CVE-2021-35393)"

• "ET CURRENT_EVENTS Metasploit Various Java Exploit Common Class name"

• "ET WEB_SERVER Possible Cookie Based BackDoor Used in Drupal Attacks"

• "ET WEB_SERVER Cisco BBSM Captive Portal AccesCodeStart.asp Cross-Site Scripting Attempt"

• "GPL SQL xp_cmdshell program execution"

• "ET ACTIVEX Possible Edraw Diagram Component 5 ActiveX LicenseName Access Potential buffer overflow DOS"

• "ET EXPLOIT MS-SQL SQL Injection closing string plus line comment"

• "GPL SQL sys.dbms_repcat_conf.add_priority_char buffer overflow attempt"

• "ET WEB_SERVER Possible WebLogic Monitor Login With Default Creds"

• "ET SCADA PcVue Activex Control Insecure method (LoadObject)"

• "ET EXPLOIT Oracle Weblogic Server Deserialization Remote Command Execution"

• "ET EXPLOIT Nagios XI SQL Injection"

• "ET WEB_SERVER Possible WebLogic Operator Login With Default Creds"

• "ET EXPLOIT SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution"

• "ET WEB_CLIENT Possible Adobe Reader and Acrobat Forms Data Format Remote Security Bypass Attempt"

• "GPL SQL dbms_repcat.add_priority_date buffer overflow attempt"

• "GPL SQL dbms_repcat_sna_utl.register_flavor_change buffer overflow attempt"

• "ET EXPLOIT HID VertX and Edge door controllers command_blink_on Remote Command Execution"

• "ET WEB_SPECIFIC_APPS ELF file magic encoded ASCII Inbound Web Servers Likely Command Execution 4"

• "ET WEB_CLIENT Microsoft Rich Text File download with vulnerable ActiveX control flowbit set 3"

• "ET EXPLOIT php script base64 encoded Remote Code Execution 3"

• "ET EXPLOIT Possible Linksys WAP54Gv3 Remote Debug Root Shell Exploitation Attempt"

• "ET WEB_CLIENT BeEF HTTP Get Outbound"

• "ET ACTIVEX Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code Execution Attempt"

• "GPL EXPLOIT rsh bin"

• "ET EXPLOIT Apache Struts 2 REST Plugin ysoserial Usage (B64) 2"

• "GPL SQL dbms_repcat.validate_for_local_flavor buffer overflow attempt"

• "ET EXPLOIT HP Enterprise VAN SDN Controller Install Backdoor"

• "ET WEB_CLIENT Possible Microsoft Edge Remote Command Execution PoC (CVE-2018-8495)"

• "ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt"

• "ET EXPLOIT Nagios XI Set DB User Root"

• "GPL SQL drop_mview_repgroup ordered gowner/gname buffer overflow attempt"

• "ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow 2"

• "GPL SQL dbms_repcat.create_master_repgroup buffer overflow attempt"

• "ET SCADA Sunway ForceControl Activex Control Remote Code Execution Vulnerability 2"

• "ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Auto-enable the Microhard Sh (msshc) service"

• "ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Function Call Attempt"

• "ET WEB_SERVER WebShell - zecmd - Form"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 2"

• "ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 5"

• "ET ACTIVEX Possible Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute"

• "ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow"

• "GPL MISC rsh echo + +"

• "ET WEB_CLIENT Possible Adobe Reader 9.4 this.printSeps Memory Corruption Attempt"

• "ET FTP Possible FTP Daemon Username SELECT FROM SQL Injection Attempt"

• "ET WEB_SERVER WebShell - Generic - c99shell based header w/colons"

• "ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 5"

• "ET WEB_CLIENT Spectre Kernel Memory Leakage JavaScript (POC Based)"

• "GPL SQL dbms_repcat_utl.drop_an_object buffer overflow attempt"

• "ET ACTIVEX Tracker Software pdfSaver ActiveX StoreInRegistry Method Access Potential Buffer Overflow"

• "ET ACTIVEX Viscom Movie Player Pro SDK ActiveX DrawText method Buffer Overflow Function Call"

• "ET EXPLOIT Cisco ASA/Firepower Unauthenticated File Read (CVE-2020-3452) M2"

• "ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Attachment_Times Method Access buffer overflow Attempt"

• "ET ACTIVEX Possible Ecava IntegraXor save method Remote ActiveX Buffer Overflow"

• "ET EXPLOIT Possible ImageMagick (7.1.0-49) Arbitrary Remote Leak PNG Upload Attempt (CVE-2022-44268)"

• "ET TROJAN CFR DRIVEBY CVE-2012-4792 DNS Query for C2 domain"

• "GPL SQL drop_site_instantiate ordered refresh_template_name buffer overflow attempt"

• "ET EXPLOIT TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (GET conf.bin)"

• "ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 4"

• "ET WEB_SPECIFIC_APPS OGNL Expression Injection (CVE-2017-9791)"

• "ET EXPLOIT Possible Firefox PDF.js Same-Origin-Bypass CVE-2015-4495 M2"

• "ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution"

• "ET SCADA SEIG Modbus 3.4 - Remote Code Execution"

• "ET WEB_SPECIFIC_APPS GitStack - Unsanitized Argument Remote Code Execution"

• "ET ACTIVEX Possible Crystal Reports Viewer Activex Control ServerResourceVersion Insecure Method Access"

• "ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M2"

• "GPL SQL dbms_repcat.drop_column_group_from_flavor buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS MicroFocus Secure Messaging Gateway Remote Code Execution"

• "ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M2"

• "ET WEB_SPECIFIC_APPS XML External Entity Remote Code Execution"

• "ET EXPLOIT Apache Struts 2 REST Plugin (B64) 6"

• "GPL SQL dbms_repcat.abort_flavor_definition buffer overflow attempt"

• "ET EXPLOIT CVE-2016-0189 Common Construct M1"

• "ET EXPLOIT PHP-CGI Query String Parameter Vuln Inbound (CVE-2012-2311)"

• "ET WEB_CLIENT Possible BeEF Default SSL Cert"

• "GPL SQL dbms_repcat.alter_priority_nchar buffer overflow attempt"

• "ET EXPLOIT Possible Microsoft Edge Chakra.dll Type Confusion (CVE-2016-7200 CVE-2016-7201) Observed in SunDown EK 1"

• "ET WEB_SPECIFIC_APPS Cisco Adaptive Security Appliance WebVPN Cross Site Scripting Attempt"

• "GPL SQL dbms_repcat.alter_priority_char buffer overflow attempt"

• "ET WEB_CLIENT Possible CVE-2014-4113 Exploit Download with Hurricane Panda IOC"

• "ET ATTACK_RESPONSE Windows SCM DLL Hijack Command (UTF-16) Inbound via HTTP M3"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Startup Script"

• "ET ACTIVEX Oracle AutoVue Activex Insecure method (ExportEdaBom)"

• "ET SCADA PROMOTIC ActiveX Control Insecure method (AddTrend)"

• "ET WEB_SERVER WebShell - Generic - c99shell based header"

• "GPL SQL instantiate_online ordered refresh_template_name buffer overflow attempt"

• "ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow"

• "ET ACTIVEX Possible KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability"

• "ET EXPLOIT MySQL Server for Windows Remote SYSTEM Level Exploit (Stuxnet Technique)"

• "ET WEB_CLIENT Apple Quicktime RTSP Content-Type overflow attempt"

• "ET WEB_SERVER PHP Crawler"

• "GPL SQL dbms_repcat.alter_priority_number buffer overflow attempt"

• "ET ACTIVEX Avaya CallPilot Unified Messaging ActiveX InstallFrom Method Access Attempt"

• "GPL SQL dbms_repcat.add_columns_to_flavor buffer overflow attempt"

• "ET ACTIVEX EdrawSoft Office Viewer Component ActiveX FtpUploadFile Stack Buffer Overflow"

• "ET ACTIVEX Possible Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution"

• "ET ACTIVEX Tom Sawyer Possible Memory Corruption Attempt Format String Function Call"

• "ET ACTIVEX Possible Autodesk MapGuide Viewer ActiveX LayersViewWidth Method Access Denial of Service"

• "ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack 2"

• "ET WEB_SPECIFIC_APPS Jenkins Script Console Usage (Metasploit Windows CMD Shell)"

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow 2"

• "ET EXPLOIT CVE-2018-8174 Common Construct B64 M2"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 3"

• "ET EXPLOIT JavaX Toolkit Posting Plugin-Detect Data"

• "ET WEB_CLIENT Firefox Interleaving document.write and appendChild Overflow (POC SPECIFIC)"

• "ET EXPLOIT Nagios XI Adding Administrative User"

• "ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Function Call Attempt"

• "ET EXPLOIT Nanopool Claymore Dual Miner Remote Code Execution Linux"

• "GPL SQL dbms_repcat.comment_on_delete_resolution buffer overflow attempt"

• "GPL SQL shellcode attempt"

• "ET WEB_SPECIFIC_APPS Possible Jenkins CLI RCE (CVE-2017-1000353)"

• "GPL SQL sp_adduser - database user creation"

• "ET WEB_SERVER WebShell - JSP File Admin"

• "ET ACTIVEX Gesytec ElonFmt ActiveX Component Format String Function Call"

• "ET WEB_SERVER Possible WebShell Access Inbound [upload] M1 (CISA AA21-259A)"

• "ET WEB_CLIENT Type Confusion Microsoft Edge (CVE-2017-11873)"

• "ET ACTIVEX Quest InTrust Annotation Objects ActiveX Control Add Access Potential Remote Code Execution"

• "ET SCADA PcVue Activex Control Insecure method (DeletePage)"

• "ET WEB_CLIENT Possible Foxit/Adobe PDF Reader Launch Action Remote Code Execution Attempt"

• "ET EXPLOIT bin bash base64 encoded Remote Code Execution 3"

• "ET SCADA PcVue Activex Control Insecure method (SaveObject)"

• "ET ACTIVEX Adobe browser document ActiveX DoS Attempt"

• "ET ACTIVEX Oracle AutoVue Activex Insecure method (SaveViewStateToFile)"

• "ET ACTIVEX IDrive Online Backup ActiveX control SaveToFile Insecure Method"

• "ET ACTIVEX Possible NET-i viewer ActiveX Control BackupToAvi Method Access Buffer Overflow"

• "GPL SQL dbms_repcat.cancel_statistics buffer overflow attempt"

• "ET CURRENT_EVENTS Spelevo EK Landing M2"

• "ET ACTIVEX SoftArtisans XFile FileManager ActiveX GetDriveName method stack overflow Attempt"

• "ET WEB_SERVER Possible Wordpress Super Cache Plugin PHP Injection mfunc"

• "GPL SQL drop_master_repobject ordered type buffer overflow attempt"

• "GPL SQL sys.dbms_repcat_conf.drop_priority_raw buffer overflow attempt"

• "ET WEB_SERVER WebShell - PHPShell - Comment"

• "ET EXPLOIT Apache Struts Possible OGNL AllowStaticMethodAccess in client body"

• "ET WEB_CLIENT Internet Explorer Memory Corruption Vulnerability (CVE-2015-2444)"

• "ET NETBIOS DCERPC SVCCTL - Remote Service Control Manager Access"

• "ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - Shell"

• "ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 3"

• "ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190)"

• "ET TROJAN Incognito Exploit Kit Checkin"

• "ET WEB_CLIENT Microsoft Application Crash Report Indicates Potential VGX Memory Corruption"

• "ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 8"

• "ET EXPLOIT Ghostscript setpattern type confusion attempt (SMTP)"

• "ET WEB_CLIENT Opera Window.Open document.cloneNode Null Pointer Deference Attempt"

• "ET WEB_SPECIFIC_APPS Symantec Messaging Gateway 9.5.3-3 - Arbitrary file download 2"

• "GPL SQL dbms_repcat.set_local_flavor buffer overflow attempt"

• "GPL SQL sp_delete_alert log file deletion"

• "ET ACTIVEX Possible IBM Rational ClearQuest Activex Control RegisterSchemaRepoFromFileByDbSet Insecure Method Access"

• "GPL SQL dbms_offline_snapshot.end_load buffer overflow attempt"

• "ET WEB_CLIENT Adobe Audition Malformed Session File Buffer Overflow Attempt"

• "GPL SQL alter_mview_propagation ordered gname buffer overflow attempt"

• "ET WEB_CLIENT Adobe Shockwave Director tSAC Chunk memory corruption Attempt"

• "ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 4"

• "ET WEB_SPECIFIC_APPS SaschArt SasCam Webcam Server ActiveX Buffer Overflow Function Call"

• "ET WEB_SPECIFIC_APPS GitList Argument Injection"

• "ET WEB_CLIENT Microsoft Office Visio DXF File Processing Remote Code Execution"

• "ET EXPLOIT Possible Redirect to SMB exploit attempt - 307"

• "ET EXPLOIT Unknown Command Injection Attempt Inbound (Possible Mirai Activity)"

• "ET EXPLOIT Generic ADSL Router DNS Change GET Request"

• "ET WEB_SPECIFIC_APPS Wordpress Arbitrary File Deletion 1"

• "ET EXPLOIT Possible Realtek SDK - formWlSiteSurvey Stack Buffer Overflow Inbound (CVE-2021-35393)"

• "ET EXPLOIT Possible Redirect to SMB exploit attempt - 303"

• "ET WEB_SPECIFIC_APPS Blind Server-Side Request Forgery"

• "GPL SQL dbms_repcat.unregister_mview_repgroup buffer overflow attempt"

• "ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI M2"

• "GPL SQL dbms_repcat.generate_snapshot_support buffer overflow attempt"

• "ET ACTIVEX Possible BarCodeWiz BarcodeWiz.dll ActiveX Control Barcode Method Remote Buffer Overflow Attempt"

• "ET WEB_CLIENT Foxit PDF Reader Title Stack Overflow"

• "ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - ROP"

• "ET EXPLOIT Apache Struts 2 REST Plugin ysoserial Usage (B64) 1"

• "GPL SQL dbms_repcat.add_update_resolution buffer overflow attempt"

• "ET WEB_CLIENT PolarisOffice Insecure Library Loading"

• "ET ACTIVEX Possible HP ALM XGO.ocx ActiveX Control SetShapeNodeType method Remote Code Execution"

• "ET WEB_CLIENT BeEF Cookie Outbound"

• "ET EXPLOIT Metasploit js_property_spray sprayHeap"

• "GPL SQL dbms_repcat.add_site_priority_site buffer overflow attempt"

• "ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt"

• "ET EXPLOIT FTPShell client Stack Buffer Overflow"

• "GPL SQL sp_delete_alert log file deletion"

• "GPL SQL dbms_repcat.add_unique_resolution buffer overflow attempt"

• "ET WEB_SERVER Joomla Upload File Filter Bypass"

• "ET SCADA PROMOTIC ActiveX Control Insecure method (SaveCfg)"

• "GPL SQL sys.dbms_repcat_fla_mas.publish_flavor_definition buffer overflow attempt"

• "ET TROJAN Possible STEADYPULSE Webshell Accessed M2"

• "ET EXPLOIT SugarCRM PHP Shell Upload Attempt"

• "GPL SQL dbms_repcat_admin.unregister_user_repgroup buffer overflow attempt"

• "GPL SQL dbms_repcat.drop_priority_raw buffer overflow attempt"

• "ET EXPLOIT Nagios XI SQL Injection 2"

• "ET WEB_CLIENT Adobe Shockwave Director tSAC Chunk memory corruption Attempt"

• "ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 1"

• "ET WEB_SERVER WebShell - JSP RAT"

• "ET ACTIVEX Possible WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow 2"

• "ET EXPLOIT Possible CVE-2018-4407 - Apple ICMP DoS PoC"

• "ET FTP Possible FTP Daemon Username INSERT INTO SQL Injection Attempt"

• "ET EXPLOIT ZTE Cable Modem RCE Attempt (CVE-2014-2321)"

• "ET EXPLOIT Possible Redirect to SMB exploit attempt - 301"

• "ET WEB_SPECIFIC_APPS Airties AIR5444TT - Cross-Site Scripting"

• "GPL SQL dbms_repcat_instantiate.drop_site_instantiation buffer overflow attempt"

• "ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - STSC"

• "ET ACTIVEX Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX Control PlayerPT.ocx Access 1"

• "ET ACTIVEX HP Easy Printer Care Software XMLCacheMgr ActiveX Control Remote Code Execution Attempt"

• "GPL SQL dbms_repcat.drop_master_repgroup buffer overflow attempt"

• "ET ACTIVEX Oracle Document Capture File Overwrite or Buffer Overflow Attempt"

• "ET FTP Possible FTP Daemon Username DELETE FROM SQL Injection Attempt"

• "ET ACTIVEX Possible Oracle AutoVue ActiveX SetMarkupMode Method Access Remote Code Execution"

• "ET ACTIVEX Possible Aloaha PDF Crypter activex SaveToFile method arbitrary file overwrite"

• "ET CURRENT_EVENTS Yszz JS/Encryption (Used in KaiXin Exploit Kit)"

• "ET WEB_CLIENT EMET Detection Via XMLDOM"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Service start"

• "ET WEB_SPECIFIC_APPS Roundcube Webmail XSS Attempt (CVE-2023-5631)"

• "ET EXPLOIT Apache Struts Possible OGNL Java Exec in client body"

• "GPL EXPLOIT xp_cmdshell program execution 445"

• "ET EXPLOIT TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (Reboot Router)"

• "GPL SQL dbms_repcat.alter_master_repobject buffer overflow attempt"

• "ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution"

• "ET SCADA DATAC RealWin SCADA Server Buffer Overflow"

• "ET SCADA ICONICS WebHMI ActiveX Stack Overflow"

• "GPL SQL dbms_repcat.add_grouped_column buffer overflow attempt"

• "GPL SQL dbms_repcat.comment_on_column_group buffer overflow attempt"

• "ET EXPLOIT Possible CVE-2015-7547 Long Response to A lookup"

• "ET NETBIOS Microsoft Windows SMB Client Race Condition Remote Code Execution"

• "ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt"

• "ET ACTIVEX Possible IBM Tivoli Provisioning Manager Express Isig.isigCtl.1 ActiveX RunAndUploadFile Method Overflow"

• "ET WEB_CLIENT BeEF Style Request (GET)"

• "ET ATTACK_RESPONSE Windows SCM DLL Hijack Command (UTF-16) Inbound via HTTP M1"

• "ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt"

• "ET ACTIVEX Possible Sony PC Companion Admin_RemoveDirectory Stack-based Unicode Buffer Overload SEH"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - User ACC Login Attempt"

• "ET CURRENT_EVENTS Possible Linux/Cdorked.A Incoming Command"

• "GPL SQL rectifier_diff ordered sname1 buffer overflow attempt"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 1"

• "ET CURRENT_EVENTS Sakura Exploit Kit Binary Load Request"

• "ET ACTIVEX Possible Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution 2"

• "ET EXPLOIT SonicWall Global Management System - XMLRPC set_time_zone Command Injection (CVE-2018-9866)"

• "GPL SQL xp_printstatements possible buffer overflow"

• "ET EXPLOIT Apache Struts 2 REST Plugin (B64) 4"

• "ET ACTIVEX Softek Barcode Reader Toolkit ActiveX Control Format String Function Call"

• "GPL SQL dbms_repcat.define_site_priority buffer overflow attempt"

• "ET WEB_CLIENT Microsoft Windows Media component specific exploit"

• "GPL SQL dbms_repcat.comment_on_update_resolution buffer overflow attempt"

• "ET EXPLOIT Adobe ColdFusion Deserialization of Untrusted Data (CVE-2023-26360) M1"

• "GPL SQL dbms_repcat.validate_flavor_definition buffer overflow attempt"

• "GPL SQL dbms_repcat.repcat_import_check buffer overflow attempt"

• "GPL SQL dbms_repcat.refresh_snapshot_repgroup buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Geutebrueck re_porter 16 - Cross-Site Scripting 4"

• "ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 4"

• "ET EXPLOIT Wscript Shell Run Attempt - Likely Hostile"

• "GPL SQL dbms_repcat.do_deferred_repcat_admin buffer overflow attempt"

• "GPL SQL sp_password password change"

• "ET WEB_CLIENT Microsoft Rich Text File download with vulnerable ActiveX control flowbit set 1"

• "ET EXPLOIT Exim Internet Mailer Remote Code Execution"

• "ET ACTIVEX Possible HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution 2"

• "ET ACTIVEX Possible IBM Tivoli Provisioning Manager Express Isig.isigCtl.1 ActiveX RunAndUploadFile Method Overflow 2"

• "ET ACTIVEX Possible NET-i viewer ActiveX Control BackupToAvi Method Access Buffer Overflow 2"

• "ET WEB_CLIENT Possible Internet Explorer VBscript CVE-2014-6332 multiple redim preserve"

• "ET EXPLOIT Possible Redirect to SMB exploit attempt - 302"

• "ET INFO PDF Containing Subform with JavaScript"

• "ET EXPLOIT Cisco ASA/Firepower Unauthenticated File Read (CVE-2020-3452) M3"

• "ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability 2"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 9"

• "GPL SQL dbms_repcat.make_column_group buffer overflow attempt"

• "ET ACTIVEX Possible Advantech Studio ISSymbol ActiveX Control Multiple Buffer Overflow Attempt"

• "ET ACTIVEX Possible WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow"

• "ET EXPLOIT Realtek SDK - Command Injection Inbound (CVE-2021-35395)"

• "ET WEB_CLIENT VBscript UAF (CVE-2018-8373)"

• "GPL SQL dbms_offline_og.end_load buffer overflow attempt"

• "ET EXPLOIT Apache Struts 2 REST Plugin (B64) 5"

• "GPL SQL dbms_repcat.drop_snapshot_repobject buffer overflow attempt"

• "ET WEB_CLIENT Possible Internet Explorer srcElement Memory Corruption Attempt"

• "ET ACTIVEX Quest InTrust Annotation Objects ActiveX Control Add Access Potential Remote Code Execution 2"

• "GPL SQL dbms_offline_snapshot.begin_load buffer overflow attempt"

• "ET EXPLOIT xdebug OS Command Execution"

• "ET EXPLOIT Possible Microsoft Edge Chakra.dll Type Confusion (CVE-2016-7200 CVE-2016-7201) Observed in SunDown EK 2"

• "ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow"

• "ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 10"

• "GPL SQL dbms_repcat.purge_statistics buffer overflow attempt"

• "ET ACTIVEX Oracle AutoVue Activex Insecure method (ExportEdaBom) Format String Function Call"

• "ET EXPLOIT SQL sp_configure attempt"

• "ET ACTIVEX AVTECH Software ActiveX _DownloadPBOpen Method Buffer Overflow Attempt"

• "GPL EXPLOIT xp_sprintf possible buffer overflow"

• "ET ACTIVEX Possible KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability 2"

• "ET WEB_SPECIFIC_APPS CMS Made Simple Remote Code Execution"

• "ET WEB_CLIENT Microsoft IE CSS Clip Attribute Memory Corruption (POC SPECIFIC)"

• "ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Import_Times Method Access buffer overflow Attempt"

• "ET WEB_SPECIFIC_APPS Elektronischer Leitz-Ordner 10 - SQL Injection"

• "ET ACTIVEX Possible Edraw Diagram Component 5 ActiveX LicenseName Access Potential buffer overflow DOS 2"

• "GPL SQL dbms_repcat.comment_on_unique_resolution buffer overflow attempt"

• "ET EXPLOIT Linksys Router Unauthenticated Remote Code Execution"

• "ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Remote File Overwrite Attempt"

• "ET EXPLOIT IE Scripting Engine Memory Corruption Vulnerability M2 (CVE-2019-0752)"

• "ET EXPLOIT Redfish API User Enumeration Attempt (CVE-2022-2827)"

• "ET ACTIVEX dBpowerAMP Audio Player 2 FileExists Method ActiveX Buffer Overflow"

• "ET ACTIVEX FathFTP 1.8 EnumFiles Method ActiveX Buffer Overflow"

• "ET WEB_CLIENT Possible Embedded NTLM Hash Theft Code"

• "ET ACTIVEX Possible AOL ICQ ActiveX Control DownloadAgent Method Access Arbitrary File Download and Execute 2"

• "GPL SQL comment_on_repobject ordered type buffer overflow attempt"

• "ET WEB_CLIENT Internet Explorer CTableRowCellsCollectionCacheItem.GetNext Memory Use-After-Free Attempt"

• "ET WEB_CLIENT Possible Internet Explorer VBscript failure to handle error case information disclosure obfuscated CVE-2014-6332"

• "ET WEB_CLIENT Adobe Acrobat newfunction Remote Code Execution Attempt"

• "ET EXPLOIT xp_enumerrorlogs access"

• "ET WEB_CLIENT PowerShell call in script 2"

• "GPL SQL ctx_output.start_log buffer overflow attempt"

• "ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 2"

• "ET WEB_SPECIFIC_APPS Fortify Software Security Center XML External Entity Injection 2"

• "ET ACTIVEX Possible Samsung Kies ActiveX PrepareSync method Buffer overflow"

• "ET WEB_CLIENT Malicious iframe guessing router password 1"

• "ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Function Name"

• "ET EXPLOIT Possible CVE-2015-7547 Long Response to AAAA lookup"

• "ET ACTIVEX Possible Crystal Reports Viewer Activex Control ServerResourceVersion Insecure Method Access 2"

• "ET WEB_CLIENT Adobe Acrobat Reader FlateDecode Stream Predictor Exploit Attempt"

• "ET WEB_SPECIFIC_APPS Nagios XI Network Monitor - OS Command Injection"

• "ET EXPLOIT Ghostscript LockDistillerParams type confusion attempt"

• "ET EXPLOIT ThinkPHP Attempted Bypass and Payload Retrieval"

• "ET WEB_CLIENT Adobe Acrobat Util.printf Buffer Overflow Attempt"

• "GPL SQL dbms_repcat_auth.revoke_surrogate_repcat buffer overflow attempt"

• "ET EXPLOIT Netgear R7000 Command Injection Exploit"

• "GPL SQL dbms_repcat.compare_old_values buffer overflow attempt"

• "GPL SQL dbms_repcat.switch_mview_master buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS ManageEngine Exchange Reporter Plus Remote Code Execution"

• "ET WEB_CLIENT Hostile Microsoft Rich Text File (RTF) with corrupted listoverride"

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow"

• "ET CURRENT_EVENTS NeoSploit - Version Enumerated - Java"

• "GPL SQL add_grouped_column ordered sname/oname buffer overflow attempt"

• "ET ACTIVEX Oracle AutoVue Activex Insecure method (Export3DBom)"

• "ET SCAN struts-pwn User-Agent"

• "ET ACTIVEX Possible WinZip FileView (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow 2"

• "ET WEB_SERVER Simple JSP WebShell Landing Page"

• "ET WEB_SPECIFIC_APPS Cisco BBSM Captive Portal AccesCodeStart.asp Cross-Site Scripting Attempt"

• "ET WEB_CLIENT Spectre Exploit Javascript"

• "GPL SQL sa login failed"

• "ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 1"

• "GPL SQL dbms_repcat.unregister_snapshot_repgroup buffer overflow attempt"

• "ET WEB_CLIENT RealPlayer FLV Parsing Integer Overflow Attempt"

• "ET EXPLOIT Apache Struts 2 REST Plugin ysoserial Usage (B64) 3"

• "ET EXPLOIT CVE-2018-8174 Common Construct B64 M1"

• "GPL SQL og.begin_load ordered gname buffer overflow attempt"

• "GPL SQL sys.dbms_repcat_conf.drop_priority_varchar2 buffer overflow attempt"

• "ET ACTIVEX Possible Cyme ChartFX client server ActiveX Control ShowPropertiesDialog arbitrary code execution"

• "ET ACTIVEX Possible Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow 2"

• "ET ACTIVEX Possible Camera Stream Client Possible ActiveX Control SetDirectory Method Access Buffer Overflow 2"

• "ET ACTIVEX Oracle AutoVue Activex Insecure method (Export3DBom) Format String Function Call"

• "ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M1"

• "GPL SQL dbms_repcat.alter_priority_varchar2 buffer overflow attempt"

• "ET EXPLOIT Apache Struts 2 REST Plugin XStream RCE (ProcessBuilder)"

• "GPL SQL dbms_rectifier_diff.rectify buffer overflow attempt"

• "ET EXPLOIT Apache Struts Possible OGNL AllowStaticMethodAccess in URI"

• "ET EXPLOIT Generic ADSL Router DNS Change Request"

• "GPL SQL dbms_repcat.resume_master_activity buffer overflow attempt"

• "ET ACTIVEX CygniCon CyViewer ActiveX Control SaveData Insecure Method Vulnerability"

• "ET EXPLOIT Possible Firefox PDF.js Same-Origin-Bypass CVE-2015-4495 M1"

• "ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow 2"

• "ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access 2"

• "ET WEB_CLIENT [Volex] Possible ColdFusion Unauthenticated Upload Attempt (CVE-2018-15961)"

• "ET EXPLOIT php script base64 encoded Remote Code Execution 1"

• "ET WEB_CLIENT DLL or EXE File From Possible WebDAV Share Possible DLL Preloading Exploit Attempt"

• "ET ACTIVEX Avaya CallPilot Unified Messaging ActiveX Function Call"

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow 2"

• "GPL SQL dbms_repcat.create_mview_repgroup buffer overflow attempt"

• "ET ACTIVEX Possible HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution"

• "ET EXPLOIT Ghostscript invalidcheck escape attempt"

• "GPL SQL dbms_repcat.drop_mview_repgroup buffer overflow attempt"

• "ET WEB_CLIENT Possible Microsoft Internet Explorer URI Validation Remote Code Execution Attempt"

• "ET EXPLOIT Possible CVE-2015-7547 Malformed Server Response A/AAAA"

• "ET WEB_CLIENT PDF With Adobe Audition Session File Handling Memory Corruption Attempt"

• "ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 3"

• "ET WEB_SERVER Possible Apache Struts OGNL in Dynamic Action"

• "ET MOBILE_MALWARE Possible Android CVE-2014-6041"

• "ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 3"

• "ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack"

• "ET ACTIVEX Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX Control PlayerPT.ocx Access 2"

• "ET EXPLOIT Possible SharePoint XSS (CVE-2017-8514) Inbound"

• "ET ACTIVEX SoftArtisans XFile FileManager ActiveX DriveExists method stack overflow Attempt"

• "ET ACTIVEX Possible beSTORM ActiveX (WinGraphviz.dll) Remote Heap Overflow"

• "ET WEB_CLIENT Internet Explorer execCommand function Use after free Vulnerability 0day Metasploit 2"

• "GPL SQL mdsys.sdo_admin.sdo_code_size buffer overflow attempt"

• "ET TROJAN Possible STEADYPULSE Webshell Accessed M1"

• "GPL SQL dbms_repcat.drop_delete_resolution buffer overflow attempt"

• "ET ACTIVEX ASUS Net4Switch ActiveX CxDbgPrint Format String Function Call Attempt"

• "ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 12"

• "ET WEB_SERVER Image Content-Type with Obfuscated PHP (Seen with C99 Shell)"

• "GPL SQL dbms_repcat.comment_on_mview_repsites buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Geutebrueck re_porter 16 - Cross-Site Scripting 3"

• "ET WEB_CLIENT Microsoft Visio 2003 mfc71enu.dll DLL Loading Arbitrary Code Execution Attempt"

• "ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M1"

• "GPL SQL dbms_repcat_rgt.drop_site_instantiation buffer overflow attempt"

• "GPL SQL dbms_repcat.execute_ddl buffer overflow attempt"

• "ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 6"

• "ET EXPLOIT Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution"

• "ET WEB_CLIENT Adobe Flash Player Rosetta Flash compressed FWS"

• "GPL NETBIOS xp_reg* - registry access"

• "ET CURRENT_EVENTS SUSPICIOUS DTLS 1.0 Fragmented Client Hello Possible CVE-2014-0195"

• "ET ACTIVEX Possible Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal Remote Registry Dump Vulnerability"

• "GPL SQL dbms_repcat.alter_site_priority_site buffer overflow attempt"

• "ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 2"

• "GPL SQL dbms_repcat.add_priority_raw buffer overflow attempt"

• "GPL SQL dbms_offline_og.begin_flavor_change buffer overflow attempt"

• "ET EXPLOIT Possible Inbound Flash Exploit (CVE-2018-15982)"

• "ET EXPLOIT SQL sp_configure - configuration change"

• "ET EXPLOIT D-Link DSL-2750B - OS Command Injection"

• "ET ACTIVEX AVTECH Software ActiveX _DownloadPBClose Method Buffer Overflow Attempt"

• "ET ACTIVEX Possible Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow"

• "GPL SQL create file buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS TimThumb Remote Command Execution"

• "GPL SQL dbms_repcat_instantiate.instantiate_online buffer overflow attempt"

• "GPL SQL dbms_offline_og.end_instantiation buffer overflow attempt"

• "ET EXPLOIT Possible 2015-7547 PoC Server Response"

• "ET ACTIVEX Multiple Altiris Products AeXNSConsoleUtilities.dll ActiveX Control BrowseAndSaveFile Method Buffer Overflow Attempt Function Call"

• "GPL SQL dbms_repcat.add_priority_nchar buffer overflow attempt"

• "ET WEB_CLIENT Possible BeEF Module in use"

• "ET FTP Possible FTP Daemon Username INTO OUTFILE SQL Injection Attempt"

• "GPL SQL dbms_repcat.drop_site_priority buffer overflow attempt"

• "ET ATTACK_RESPONSE Windows SCM DLL Hijack Command (UTF-16) Inbound via HTTP M2"

• "ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)"

• "GPL SQL dbms_repcat.define_column_group buffer overflow attempt"

• "GPL SQL dbms_repcat.refresh_mview_repgroup buffer overflow attempt"

• "GPL SQL dbms_repcat.suspend_master_activity buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Dicoogle PACS 2.5.0 - Directory Traversal"

• "ET WEB_CLIENT Adobe Acrobat PDF Reader use after free JavaScript engine (CVE-2017-16393)"

• "GPL SQL dbms_repcat.drop_priority_varchar2 buffer overflow attempt"

• "ET WEB_SERVER WSO WebShell Activity POST structure 2"

• "ET EXPLOIT TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (Add Port Forwarding)"

• "ET ACTIVEX Possible Honeywell Tema Remote Installer ActiveX DownloadFromURL method Remote Code Execution"

• "ET WEB_SPECIFIC_APPS Jenkins Script Console Usage (Metasploit Unix Shell)"

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow"

• "ET EXPLOIT Metasploit mstime_malloc no-spray"

• "ET ACTIVEX Possible AdminStudio Activex Control LaunchProcess Method Access Arbitrary Code Execution"

• "ET EXPLOIT Ghostscript illegal delete bindnow attempt"

• "ET ACTIVEX Possible Camera Stream Client Possible ActiveX Control SetDirectory Method Access Buffer Overflow"

• "ET ACTIVEX Possible McAfee Virtual Technician MVT.MVTControl.6300 ActiveX Control GetObject method Remote Code Execution"

• "ET WEB_CLIENT [TW] WEBDAV Requesting Startup Dir"

• "ET EXPLOIT Possible Realtek SDK - Stack Buffer Overflow via UPnP SUBSCRIBE Callback Header Inbound (CVE-2021-35393)"

• "ET EXPLOIT Possible Linksys WRT100/110 RCE Attempt (CVE-2013-3568)"

• "GPL SQL create_mview_repgroup ordered fname buffer overflow attempt"

• "ET EXPLOIT MS16-009 IE MSHTML Form Element Type Confusion (CVE-2016-0061)"

• "ET EXPLOIT Possible Internet Explorer Memory Corruption Vulnerability (CVE-2015-2444)"

• "ET WEB_SERVER SQL sp_delete_alert attempt"

• "GPL SQL dbms_repcat.create_snapshot_repgroup buffer overflow attempt"

• "GPL EXPLOIT xp_cmdshell - program execution"

• "ET ACTIVEX Possible Sony PC Companion CheckCompatibility method Stack-based Unicode Buffer Overload"

• "ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 1"

• "ET CURRENT_EVENTS DRIVEBY Incognito Payload Requested /getfile.php by Java Client"

• "ET EXPLOIT Nagios XI Remote Code Execution 2"

• "ET ACTIVEX 2X Client for RDP ClientSystem Class ActiveX Control InstallClient Download and Execute"

• "ET EXPLOIT CVE-2016-0189 Common Construct M2"

• "GPL SQL dbms_repcat.add_priority_nvarchar2 buffer overflow attempt"

• "ET EXPLOIT Possible Android Stagefright MP4 (CVE 2016-3861) Set"

• "GPL SQL sys.dbms_repcat_mas.create_master_repgroup buffer overflow attempt"

• "ET EXPLOIT Gitlab Login Attempt with hard-coded password (CVE-2022-1162)"

• "ET WEB_SERVER vonloesch JSP File Browser"

• "ET EXPLOIT Possible Inbound Flash Exploit with Stack-Based wininet"

• "ET EXPLOIT Possible Zyxel Authentication Bypass Inbound (CVE-2021-3297)"

• "GPL SQL dbms_offline_og.begin_instantiation buffer overflow attempt"

• "ET EXPLOIT Oracle WebLogic JNDI Injection RCE Attempt (CVE-2021-2109)"

• "ET CURRENT_EVENTS DRIVEBY Incognito Payload Download /load/*exe"

• "ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow 2"

• "ET WEB_CLIENT Adobe Flash Player Rosetta Flash compressed ZWS"

• "ET SCADA Sunway ForceControl Activex Control Vulnerability"

• "ET EXPLOIT IBM WebSphere - RCE Java Deserialization"

• "ET ACTIVEX Possible Microsoft WMI Administration Tools WEBSingleView.ocx ActiveX Buffer Overflow Attempt Function Call"

• "ET WEB_SPECIFIC_APPS Wordpress Arbitrary File Deletion 2"

• "ET WEB_CLIENT Possible Chrome WebEx Extension RCE Attempt"

• "ET WEB_SPECIFIC_APPS WordPress Plugin Advanced Custom Fields Remote File Inclusion"

• "ET EXPLOIT Possible Zoom Client Auto-Join (CVE-2019-13450)"

• "ET WEB_CLIENT Mozilla Firefox nsTreeSelection Element invalidateSelection Remote Code Execution Attempt"

• "ET WEB_SPECIFIC_APPS Fortify Software Security Center XML External Entity Injection 1"

• "ET EXPLOIT Ruckus vRIoT Command Injection Attempt Inbound (CVE-2020-26878)"

• "ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt"

• "ET EXPLOIT bin bash base64 encoded Remote Code Execution 1"

• "GPL SQL dbms_repcat.add_priority_char buffer overflow attempt"

• "ET WEB_SERVER WebShell - Generic - c99shell based POST structure w/multipart"

• "ET ACTIVEX ASUS Net4Switch ipswcom.dll ActiveX Stack Buffer Overflow"

• "ET ACTIVEX SoftArtisans XFile FileManager ActiveX stack overfow Function call Attempt"

• "ET ACTIVEX Possible Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal Remote Registry Dump Vulnerability 2"

• "GPL SQL instantiate_offline ordered refresh_template_name buffer overflow attempt"

• "ET EXPLOIT Ghostscript invalidcheck escape attempt (SMTP)"

• "GPL SQL dbms_repcat.send_old_values buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Start the Microhard Sh (msshc) service"

• "ET ACTIVEX Tracker Software pdfSaver ActiveX InitFromRegistry Method Access Potential Buffer Overflow"

• "ET WEB_CLIENT [TW] WEBDAV UA"

• "ET WEB_CLIENT BeEF Cookie (BEEFHOOK)"

• "ET EXPLOIT CVE-2018-8174 Common Construct B64 M3"

• "ET EXPLOIT Generic ADSL Router DNS Change POST Request"

• "ET WEB_CLIENT Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution Attempt"

• "ET ACTIVEX Possible NOS Microsystems Adobe Reader/Acrobat getPlus Get_atlcomHelper ActiveX Control Multiple Stack Overflows Remote Code Execution Attempt"

• "ET EXPLOIT D-LINK DIR-615 Cross-Site Request Forgery (CVE-2017-7398)"

• "ET EXPLOIT IBM QRadar SIEM Unauthenticated Remote Code Execution"

• "ET ACTIVEX Possible SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control Install3rdPartyComponent Method Buffer Overflow"

• "ET EXPLOIT Adobe ColdFusion Deserialization of Untrusted Data (CVE-2023-26360) M3"

• "ET WEB_CLIENT VLC Media Player .ass File Buffer Overflow Attempt"

• "ET CURRENT_EVENTS DoSWF Flash Encryption (Used in KaiXin Exploit Kit)"

• "ET WEB_CLIENT Adobe Flash Player Rosetta Flash compressed CWS"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Crontab"

• "ET WEB_SPECIFIC_APPS Yahoo CD Player ActiveX Open Stack Overflow Attempt"

• "ET ACTIVEX Possible Sony PC Companion Load method Stack-based Unicode Buffer Overload SEH"

• "ET WEB_CLIENT Mozilla Firefox mChannel Object Dangling Pointer Use-After-Free Memory Corruption Attempt"

• "ET EXPLOIT Possible WePresent WIPG1000 File Inclusion"

• "GPL SQL mdsys.md2.validate_geom buffer overflow attempt"

• "GPL SQL dbms_repcat.alter_priority buffer overflow attempt"

• "GPL SQL dbms_repcat.alter_priority_date buffer overflow attempt"

• "GPL SQL dbms_repcat.drop_unique_resolution buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Change Admin Passwd"

• "ET WEB_CLIENT Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt"

• "GPL SQL dbms_repcat.drop_priority_number buffer overflow attempt"

• "ET ACTIVEX Possible McAfee Virtual Technician MVT.MVTControl.6300 ActiveX Control GetObject method Remote Code Execution 2"

• "ET ACTIVEX Possible CommuniCrypt Mail SMTP ActiveX AddAttachments Method Access Stack Buffer Overflow"

• "ET EXPLOIT Gitlab Login Attempt with hard-coded password (CVE-2022-1162)"

• "ET WEB_CLIENT Possible BeEF Module in use"

• "ET EXPLOIT Jitsi Meet Plugin XSS Attempt (CVE-2021-26812)"

• "GPL SQL dbms_offline_og.end_flavor_change buffer overflow attempt"

• "ET EXPLOIT Possible CVE-2016-0777 Client Sent Roaming Resume Request"

• "ET WEB_CLIENT Malicious iframe guessing router password 2"

• "GPL SQL sp_password - password change"

• "GPL SQL dbms_repcat.set_columns buffer overflow attempt"

• "ET EXPLOIT Possible Cisco IKEv1 Information Disclosure Vulnerability CVE-2016-6415"

• "ET NETBIOS PolarisOffice Insecure Library Loading - SMB ASCII"

• "ET EXPLOIT Possible ShuttleTech 915WM DNS Change Attempt"

• "GPL SQL dbms_repcat_rgt.instantiate_offline buffer overflow attempt"

• "ET ACTIVEX Possible Quest vWorkspace Broker Client ActiveX Control SaveMiniLaunchFile Remote File Creation/Overwrite"

• "ET WEB_SPECIFIC_APPS Fortify Software Security Center XML External Entity Injection 3"

• "GPL SQL dbms_repcat.generate_replication_support buffer overflow attempt"

• "ET WEB_SERVER Possible Wordpress Super Cache Plugin PHP Injection dynamic-cached-content"

• "GPL SQL grant_surrogate_repcat ordered userid buffer overflow attempt"

• "ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M1"

• "ET WEB_CLIENT BeEF Framework Comment In Response"

• "ET WEB_SERVER SQL sp_start_job attempt"

• "ET ACTIVEX Possible NVIDIA Install Application ActiveX Control AddPackages Unicode Buffer Overflow"

• "GPL SQL unregister_user_repgroup ordered privilege_type buffer overflow attempt"

• "GPL SQL dbms_repcat.register_mview_repgroup buffer overflow attempt"

• "ET EXPLOIT Nanopool Claymore Dual Miner Remote Code Execution Windows"

• "ET WEB_CLIENT GENERIC Possible IE Memory Corruption CollectGarbage with DOM Reset"

• "ET WEB_CLIENT Android Webkit removeChild Use-After-Free Remote Code Execution Attempt"

• "GPL SQL mdsys.md2.sdo_code_size buffer overflow attempt"

• "GPL SQL dbms_repcat.publish_flavor_definition buffer overflow attempt"

• "ET WEB_SERVER Coldfusion cfcexplorer Directory Traversal"

• "GPL EXPLOIT sp_start_job - program execution"

• "ET EXPLOIT HP Smart Storage Administrator Remote Command Injection"

• "ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 5"

• "ET EXPLOIT TrendMicro node.js HTTP RCE Exploit Inbound (showSB)"

• "ET SCADA CitectSCADA ODBC Overflow Attempt"

• "ET ACTIVEX Dell Webcam CrazyTalk ActiveX Control BackImage Access Potential Buffer Overflow Attempt 2"

• "GPL SQL dbms_repcat.generate_replication_package buffer overflow attempt"

• "ET EXPLOIT Zollard PHP Exploit Telnet Outbound"

• "ET EXPLOIT MS-Officecmd Remote Code Execution Attempt"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 6"

• "GPL SQL time_zone buffer overflow attempt"

• "ET EXPLOIT Possible ZyXEL P660HN-T v1 RCE (CVE-2017-18368)"

• "GPL SQL dbms_repcat.drop_master_repobject buffer overflow attempt"

• "GPL SQL dbms_repcat_admin.register_user_repgroup buffer overflow attempt"

• "ET WEB_CLIENT GENERIC VB ShellExecute Function Inside of VBSCRIPT tag"

• "ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 3"

• "ET WEB_SERVER WebShell - Generic - c99shell based POST structure"

• "ET ACTIVEX Quest vWorkspace Broker Client ActiveX Control SaveMiniLaunchFile Remote File Creation/Overwrite 2"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Default Password otter"

• "ET ACTIVEX AVTECH Software ActiveX Snapshot Method Buffer Overflow Attempt"

• "ET CURRENT_EVENTS Spelevo EK Landing M1"

• "ET EXPLOIT Geutebruck Remote Command Execution"

• "ET ACTIVEX Chilkat Crypt ActiveX Control SaveDecrypted Insecure Method Vulnerability"

• "GPL SQL dbms_repcat.drop_priority_char buffer overflow attempt"

• "GPL SQL dbms_repcat.alter_master_propagation buffer overflow attempt"

• "ET EXPLOIT xp_enumdsn access"

• "GPL SQL dbms_repcat_rgt.check_ddl_text buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Fortify Software Security Center XML External Entity Injection 4"

• "ET WEB_SPECIFIC_APPS Attempted Symantec Secure Web Gateway RCE"

• "GPL SQL dbms_repcat.drop_columns_from_flavor buffer overflow attempt"

• "GPL SQL dbms_repcat.define_priority_group buffer overflow attempt"

• "GPL SQL dbms_repcat.register_snapshot_repgroup buffer overflow attempt"

• "ET ACTIVEX Adobe browser document ActiveX DoS Function call Attempt"

• "GPL SQL dbms_repcat.remove_master_databases buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Geutebrueck re_porter 16 - Cross-Site Scripting 1"

• "ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt"

• "ET WEB_CLIENT Firefox Proxy Prototype RCE Attempt (CVE-2014-8636)"

• "ET WEB_SPECIFIC_APPS Drupal RCE (CVE-2018-7602)"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 8"

• "ET EXPLOIT Possible Realtek SDK - formRebootCheck/formWsc Stack Buffer Overflow Inbound (CVE-2021-35392)"

• "GPL SQL dbms_repcat.comment_on_priority_group buffer overflow attempt"

• "ET WEB_CLIENT Microsoft Rich Text File download with vulnerable ActiveX control flowbit set 2"

• "GPL SQL dbms_repcat.drop_priority_date buffer overflow attempt"

• "GPL SQL dbms_repcat.generate_mview_support buffer overflow attempt"

• "ET ATTACK_RESPONSE WSO - WebShell Activity - WSO Title"

• "ET ACTIVEX AVTECH Software ActiveX Login Method Buffer Oveflow Attempt"

• "GPL SQL dbms_repcat.comment_on_site_priority buffer overflow attempt"

• "GPL SQL dbms_offline_og.resume_subset_of_masters buffer overflow attempt"

• "ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow"

• "GPL NETBIOS xp_reg* registry access"

• "GPL SQL dbms_rectifier_diff.differences buffer overflow attempt"

• "GPL SQL refresh_mview_repgroup ordered gowner buffer overflow attempt"

• "ET ACTIVEX Easewe FTP OCX ActiveX Control EaseWeFtp.ocx Remote Code Execution Attempt"

• "ET ACTIVEX Advanced File Vault Activex Heap Spray Attempt"

• "ET WEB_CLIENT IE Double Free (CVE-2018-8460)"

• "GPL SQL dbms_repcat.drop_snapshot_repgroup buffer overflow attempt"

• "ET EXPLOIT TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (Enable Guest Network)"

• "ET EXPLOIT HP Enterprise VAN SDN Controller Exec Backdoor"

• "GPL SQL dbms_repcat_sna_utl.create_snapshot_repgroup buffer overflow attempt"

• "ET WEB_CLIENT Apple Safari UXSS (CVE-2017-7089)"

• "ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution 2"

• "ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Remote File Overwrite Attempt"

• "ET EXPLOIT php script double base64 encoded Remote Code Execution 4"

• "GPL SQL dbms_repcat.drop_priority buffer overflow attempt"

• "ET WEB_CLIENT [TW] CAB From Possible WebDAV Share Possible DiagCab Abuse Attempt"

• "ET ACTIVEX Ubisoft CoGSManager ActiveX RunCore method Buffer Overflow Vulnerability"

• "ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)"

• "GPL SQL dbms_repcat.create_snapshot_repobject buffer overflow attempt"

• "ET EXPLOIT Ghostscript illegal read undefinedfilename attempt (SMTP)"

• "ET ACTIVEX Possible Kazaa Altnet Download Manager ActiveX Control Install Method Access Buffer Overflow"

• "GPL SQL dbms_repcat.obsolete_flavor_definition buffer overflow attempt"

• "ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M3"

• "ET SCADA PcVue Activex Control Insecure method (AddPage)"

• "ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 6"

• "GPL IMAP login buffer overflow attempt"

• "ET ATTACK_RESPONSE WSO - WebShell Activity - POST structure"

• "ET EXPLOIT Possible CVE-2016-10033 PHPMailer RCE Attempt"

• "GPL SQL dbms_repcat.drop_object_from_flavor buffer overflow attempt"

• "ET ACTIVEX Possible AOL SuperBuddy ActiveX Control Remote Code Execution Attempt"

• "GPL SQL dbms_repcat.switch_snapshot_master buffer overflow attempt"

• "ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability"

• "ET WEB_SERVER Possible Wordpress Super Cache Plugin PHP Injection mclude"

• "ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 5"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Service Enable"

• "ET ACTIVEX SoftArtisans XFile FileManager ActiveX DeleteFile method stack overflow Attempt"

• "GPL SQL dbms_repcat.add_column_group_to_flavor buffer overflow attempt"

• "ET ACTIVEX Microsoft Internet Explorer Tabular DataURL ActiveX Control Memory Corruption Attempt"

• "GPL SQL dbms_repcat.register_statistics buffer overflow attempt"

• "ET WEB_SPECIFIC_APPS Cacti Superlinks Plugin SQL Injection"

• "ET WEB_SPECIFIC_APPS Geutebrueck re_porter 16 - Cross-Site Scripting 5"

• "ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 7"

• "ET WEB_SERVER Possible WebShell Access Inbound [exec] M1 (CISA AA21-259A)"

• "ET WEB_CLIENT VLC Media Player smb URI Handling Remote Buffer Overflow Attempt"

• "ET WEB_CLIENT Microsoft Rich Text File .RTF File download with invalid listoverridecount"

• "GPL SQL dbms_repcat_rgt.instantiate_online buffer overflow attempt"

• "GPL SQL dbms_repcat.specify_new_masters buffer overflow attempt"

• "ET WEB_CLIENT Potential MSXML2.FreeThreadedDOMDocument Uninitialized Memory Corruption Attempt"

• "ET EXPLOIT TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (DMZ enable and Disable)"

• "ET EXPLOIT Possible Netgear DGN2200 RCE (CVE-2017-6334)"

• "ET WEB_CLIENT [TW] CAB From Possible WebDAV Share Possible DiagCab Abuse Attempt"

• "ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 1"

• "ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 1"

• "ET ACTIVEX Possible IBM Lotus iNotes Upload Module possible ActiveX Control Attachment_Times Method Access Buffer Overflow Attempt"

• "ET EXPLOIT Realtek SDK - Command Execution/Backdoor Access Inbound (CVE-2021-35395)"

• "ET WEB_SPECIFIC_APPS Possible CrushFTP as2-to Anonymous User Rename Attempt (CVE-2023-43177)"

• "GPL SQL repcat_import_check ordered gowner/gname buffer overflow attempt"

• "ET EXPLOIT bin bash base64 encoded Remote Code Execution 2"

• "ET ACTIVEX Ubisoft CoGSManager ActiveX Initialize method Buffer Overflow Vulnerability"

• "ET WEB_SERVER SQL sp_password attempt"

• "GPL SQL dbms_repcat.add_delete_resolution buffer overflow attempt"

• "ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI"

• "ET EXPLOIT Tomcat File Upload Payload Request (CVE-2017-12615)"

• "GPL SQL dbms_repcat.drop_update_resolution buffer overflow attempt"

• "ET EXPLOIT MySQL Server for Windows Remote SYSTEM Level Exploit (Stuxnet Techique DUMP INTO executable)"

• "GPL SQL dbms_repcat.purge_flavor_definition buffer overflow attempt"

• "ET EXPLOIT Possible Netgear DGN2200 RCE (CVE-2017-6077)"

• "ET EXPLOIT Ghostscript setpattern type confusion attempt"

• "ET EXPLOIT Apache Struts 2 REST Plugin XStream RCE (Runtime.Exec)"

• "ET WEB_SERVER Microsoft IIS Remote Code Execution (CVE-2017-7269)"

• "ET WEB_CLIENT Malicious SCF File Inbound"

• "ET ACTIVEX WMITools ActiveX Remote Code Execution"

• "ET ACTIVEX Oracle AutoVue Activex Insecure method (SaveViewStateToFile) Format String Function Call"

• "ET EXPLOIT HP Enterprise VAN SDN Controller Upload Backdoor"

• "ET ACTIVEX AVTECH Software ActiveX Buffer Overflow Function Call"

• "ET WEB_SPECIFIC_APPS JcomBand toolbar ActiveX Control isRegistered Property Buffer Overflow Attempt"

• "ET EXPLOIT Possible WINS Server Remote Memory Corruption Vulnerability"

• "ET WEB_CLIENT Suspected BeEF Related JS Activity M2"

• "ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M2"

• "ET WEB_CLIENT BeEF Related JS Activity M3"

• "ET WEB_CLIENT Suspected BeEF Related JS Activity (evercookie)"

• "ET WEB_CLIENT Suspected BeEF Related JS Activity (css history)"

• "ET EXPLOIT Adobe ColdFusion Unauthorized File Access (CVE-2024-20767)"

• "ET WEB_CLIENT Suspected BeEF Related JS Activity M1"

• "ET WEB_CLIENT BeEF Related JS Activity M4"

• "ET EXPLOIT Possible RoundCube Webmail Persistent XSS Attempt (CVE-2023-43770)"

protocol-command-decode

• "GPL NETBIOS SMB-DS ISystemActivator little endian andx bind attempt"

• "GPL NETBIOS SMB winreg create tree attempt"

• "ET POLICY Possible IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval RAKP message 1 with default BMC usernames (Admin|root|Administrator|USERID)"

• "GPL NETBIOS SMB-DS IActivation unicode andx bind attempt"

• "ET INFO SOCKSv4 HTTP Proxy Inbound Request (Linux Source)"

• "GPL SQL MYSQL root login attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian attempt"

• "GPL NETBIOS SMB-DS ADMIN$ unicode andx share access"

• "GPL NETBIOS SMB C$ unicode share access"

• "ET INFO SOCKSv5 Port 443 Inbound Request (Windows Source)"

• "GPL NETBIOS SMB NT Trans NT CREATE andx SACL overflow attempt"

• "GPL NETBIOS SMB winreg unicode andx create tree attempt"

• "GPL NETBIOS SMB ADMIN$ share access"

• "GPL NETBIOS DCERPC LSASS bind attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE andx DACL overflow attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode andx attempt"

• "GPL NETBIOS SMB-DS RemoteActivation unicode little endian attempt"

• "GPL NETBIOS SMB IActivation little endian bind attempt"

• "GPL NETBIOS SMB-DS irot unicode andx bind attempt"

• "GPL NETBIOS SMB-DS ADMIN$ share access"

• "ET INFO SOCKSv5 Port 25 Inbound Request (Linux Source)"

• "ET INFO SOCKSv4 Port 5050 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB-DS winreg unicode bind attempt"

• "GPL NETBIOS SMB InitiateSystemShutdown attempt"

• "GPL NETBIOS SMB-DS C$ unicode andx share access"

• "GPL NETBIOS SMB IActivation bind attempt"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown little endian andx attempt"

• "GPL NETBIOS SMB D$ unicode share access"

• "GPL NETBIOS SMB-DS llsrpc unicode andx bind attempt"

• "GPL NETBIOS SMB InitiateSystemShutdown andx attempt"

• "ET INFO Web Proxy Auto Discovery Protocol WPAD DHCP 252 option Possible BadTunnel"

• "GPL NETBIOS SMB msqueue unicode little endian andx bind attempt"

• "GPL NETBIOS SMB ISystemActivator unicode little endian andx bind attempt"

• "GPL NETBIOS SMB Session Setup NTMLSSP andx asn1 overflow attempt"

• "GPL NETBIOS SMB-DS winreg unicode little endian bind attempt"

• "ET INFO SOCKSv4 Port 443 Inbound Request (Windows Source)"

• "GPL NETBIOS DCERPC IActivation bind attempt"

• "GPL FTP CWD Root directory transversal attempt"

• "GPL NETBIOS DCERPC msqueue bind attempt"

• "GPL NETBIOS SMB-DS C$ share access"

• "GPL NETBIOS SMB-DS irot unicode little endian bind attempt"

• "GPL NETBIOS SMB-DS nddeapi andx bind attempt"

• "ET SCADA IEC-104 TESTFR (Test Frame) Confirmation"

• "GPL NETBIOS SMB IrotIsRunning unicode little endian andx attempt"

• "ET WEB_CLIENT Microsoft OLE Compound File With Flash"

• "ET ATTACK_RESPONSE Possible IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval RAKP message 2 status code Unauthorized Name"

• "GPL NETBIOS SMB-DS IActivation little endian andx bind attempt"

• "GPL NETBIOS SMB ISystemActivator bind attempt"

• "GPL NETBIOS SMB-DS C$ unicode share access"

• "GPL NETBIOS SMB RemoteActivation little endian andx attempt"

• "GPL NETBIOS SMB msqueue bind attempt"

• "ET SCADA IEC-104 STARTDT (Start Data Transfer) Confirmation"

• "GPL NETBIOS SMB-DS IPC$ unicode share access"

• "GPL NETBIOS SMB IrotIsRunning little endian andx attempt"

• "ET INFO SOCKSv5 DNS Inbound Request (Windows Source)"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE DACL overflow attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian andx attempt"

• "ET INFO PTUNNEL OUTBOUND"

• "GPL NETBIOS SMB-DS nddeapi unicode create tree attempt"

• "ET SCADA IEC-104 Station Interrogation - Global ASDU Broadcast"

• "GPL NETBIOS SMB-DS msqueue bind attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile andx attempt"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB-DS irot unicode little endian andx bind attempt"

• "ET INFO SOCKSv4 Port 5050 Inbound Request (Windows Source)"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt"

• "GPL SQL connect_data remote version detection attempt"

• "GPL NETBIOS SMB nddeapi bind attempt"

• "GPL NETBIOS SMB winreg unicode create tree attempt"

• "GPL NETBIOS SMB-DS winreg create tree attempt"

• "ET SCADA IEC-104 TESTFR (Test Frame) Activation"

• "GPL NETBIOS SMB-DS RemoteActivation little endian attempt"

• "GPL FTP invalid MODE"

• "GPL NETBIOS SMB winreg unicode andx bind attempt"

• "GPL NETBIOS SMB-DS irot unicode bind attempt"

• "GPL NETBIOS DCERPC IrotIsRunning little endian attempt"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown andx attempt"

• "GPL NETBIOS SMB-DS D$ unicode andx share access"

• "GPL NETBIOS SMB InitiateSystemShutdown unicode andx attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE andx oversized Security Descriptor attempt"

• "GPL NETBIOS SMB-DS IActivation unicode little endian andx bind attempt"

• "ET SCADA IEC-104 STARTDT (Start Data Transfer) Activation"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag true change port flag false)"

• "GPL NETBIOS SMB llsrpc bind attempt"

• "GPL NETBIOS SMB D$ share access"

• "ET INFO SOCKSv5 Port 25 Inbound Request (Windows Source)"

• "ET POLICY MS Remote Desktop POS User Login Request"

• "GPL NETBIOS SMB llsrpc andx bind attempt"

• "GPL NETBIOS SMB nddeapi unicode andx bind attempt"

• "GPL NETBIOS SMB irot unicode andx bind attempt"

• "GPL NETBIOS SMB IrotIsRunning unicode little endian attempt"

• "GPL NETBIOS SMB ISystemActivator unicode bind attempt"

• "GPL NETBIOS SMB-DS msqueue unicode bind attempt"

• "ET POLICY MS Remote Desktop Service User Login Request"

• "ET SCADA IEC-104 STOPDT (Stop Data Transfer) Activation"

• "ET SCADA IEC-104 Clock Synchronization Command"

• "GPL NETBIOS SMB-DS llsrpc bind attempt"

• "GPL NETBIOS SMB-DS RemoteActivation andx attempt"

• "GPL NETBIOS SMB-DS winreg bind attempt"

• "GPL NETBIOS SMB-DS llsrpc unicode little endian andx bind attempt"

• "GPL NETBIOS SMB IActivation andx bind attempt"

• "ET INFO SOCKSv5 Port 25 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB-DS msqueue little endian andx bind attempt"

• "GPL NETBIOS SMB IActivation little endian andx bind attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE SACL overflow attempt"

• "GPL NETBIOS SMB irot unicode bind attempt"

• "GPL NETBIOS SMB-DS ISystemActivator unicode andx bind attempt"

• "GPL NETBIOS SMB ISystemActivator little endian bind attempt"

• "GPL NETBIOS SMB InitiateSystemShutdown little endian attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE oversized Security Descriptor attempt"

• "GPL NETBIOS SMB-DS irot andx bind attempt"

• "GPL NETBIOS SMB-DS winreg andx create tree attempt"

• "GPL NETBIOS SMB-DS RemoteActivation unicode andx attempt"

• "GPL NETBIOS SMB IActivation unicode andx bind attempt"

• "GPL NETBIOS SMB msqueue little endian andx bind attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode attempt"

• "GPL NETBIOS SMB irot bind attempt"

• "GPL NETBIOS SMB-DS winreg unicode andx create tree attempt"

• "GPL NETBIOS SMB ISystemActivator little endian andx bind attempt"

• "GPL NETBIOS SMB-DS RemoteActivation unicode attempt"

• "GPL NETBIOS SMB llsrpc unicode little endian bind attempt"

• "GPL NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt"

• "GPL NETBIOS SMB nddeapi unicode andx create tree attempt"

• "GPL NETBIOS SMB Session Setup NTMLSSP unicode andx asn1 overflow attempt"

• "GPL NETBIOS SMB-DS msqueue unicode little endian andx bind attempt"

• "GPL NETBIOS SMB-DS IPC$ unicode andx share access"

• "GPL NETBIOS SMB-DS IActivation bind attempt"

• "GPL NETBIOS SMB llsrpc create tree attempt"

• "GPL NETBIOS SMB-DS winreg unicode create tree attempt"

• "GPL NETBIOS SMB-DS D$ share access"

• "GPL NETBIOS SMB winreg bind attempt"

• "GPL NETBIOS SMB RemoteActivation attempt"

• "GPL NETBIOS SMB irot andx bind attempt"

• "GPL NETBIOS DCERPC irot bind attempt"

• "ET INFO SOCKSv4 HTTP Proxy Inbound Request (Windows Source)"

• "GPL NETBIOS SMB llsrpc little endian bind attempt"

• "ET INFO SOCKSv4 Port 443 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB IPC$ share access"

• "GPL NETBIOS SMB-DS winreg unicode little endian andx bind attempt"

• "GPL NETBIOS SMB-DS llsrpc little endian bind attempt"

• "ET INFO SOCKSv4 Port 5190 Inbound Request (Windows Source)"

• "GPL NETBIOS SMB RemoteActivation little endian attempt"

• "GPL NETBIOS SMB winreg bind attempt"

• "GPL NETBIOS DCERPC IrotIsRunning attempt"

• "GPL NETBIOS SMB InitiateSystemShutdown unicode attempt"

• "GPL NETBIOS SMB-DS nddeapi unicode bind attempt"

• "GPL NETBIOS SMB-DS llsrpc unicode andx create tree attempt"

• "ET TROJAN MS Remote Desktop micros User Login Request"

• "ET SCAN MYSQL 4.0 brute force root login attempt"

• "GPL NETBIOS SMB llsrpc unicode bind attempt"

• "GPL NETBIOS SMB-DS msqueue little endian bind attempt"

• "GPL NETBIOS SMB-DS nddeapi unicode andx create tree attempt"

• "GPL NETBIOS SMB-DS msqueue unicode little endian bind attempt"

• "ET INFO SOCKSv5 Port 443 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB msqueue little endian bind attempt"

• "GPL NETBIOS SMB-DS IrotIsRunning unicode little endian andx attempt"

• "ET ATTACK_RESPONSE MySQL User Account Enumeration"

• "ET POLICY MS Terminal Server Root login"

• "GPL NETBIOS SMB InitiateSystemShutdown little endian andx attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB-DS ISystemActivator unicode little endian andx bind attempt"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown unicode andx attempt"

• "GPL NETBIOS SMB-DS D$ unicode share access"

• "GPL NETBIOS SMB IrotIsRunning unicode andx attempt"

• "GPL NETBIOS SMB-DS ISystemActivator little endian bind attempt"

• "GPL NETBIOS SMB winreg little endian andx bind attempt"

• "GPL NETBIOS SMB msqueue unicode bind attempt"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE unicode DACL overflow attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile little endian attempt"

• "GPL NETBIOS SMB-DS IrotIsRunning little endian andx attempt"

• "ET INFO SOCKSv5 Port 1863 Inbound Request (Windows Source)"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian andx attempt"

• "GPL NETBIOS SMB irot unicode little endian andx bind attempt"

• "GPL NETBIOS SMB-DS winreg unicode andx bind attempt"

• "ET INFO SOCKSv5 HTTP Proxy Inbound Request (Linux Source)"

• "GPL NETBIOS SMB-DS IActivation little endian bind attempt"

• "GPL NETBIOS SMB-DS IrotIsRunning unicode little endian attempt"

• "ET INFO SOCKSv4 Port 1863 Inbound Request (Windows Source)"

• "GPL NETBIOS SMB-DS llsrpc unicode bind attempt"

• "GPL NETBIOS SMB C$ share access"

• "GPL NETBIOS SMB-DS IActivation unicode bind attempt"

• "GPL NETBIOS SMB IrotIsRunning andx attempt"

• "GPL NETBIOS SMB llsrpc little endian andx bind attempt"

• "GPL NETBIOS SMB ISystemActivator andx bind attempt"

• "GPL NETBIOS SMB-DS nddeapi bind attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian attempt"

• "GPL NETBIOS SMB-DS ADMIN$ andx share access"

• "GPL NETBIOS SMB RemoteActivation andx attempt"

• "GPL NETBIOS SMB IActivation unicode bind attempt"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown unicode little endian attempt"

• "GPL NETBIOS SMB winreg unicode bind attempt"

• "GPL NETBIOS SMB winreg andx bind attempt"

• "GPL NETBIOS SMB InitiateSystemShutdown unicode little endian attempt"

• "GPL NETBIOS SMB-DS ADMIN$ unicode share access"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown unicode attempt"

• "GPL NETBIOS SMB-DS DCERPC ISystemActivator bind attempt"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown little endian attempt"

• "ET SCAN MYSQL MySQL Remote FAST Account Password Cracking"

• "ET INFO SOCKSv4 Port 5190 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB irot little endian andx bind attempt"

• "GPL NETBIOS SMB-DS Session Setup NTMLSSP unicode asn1 overflow attempt"

• "GPL NETBIOS SMB IrotIsRunning unicode attempt"

• "GPL NETBIOS SMB-DS IActivation andx bind attempt"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt"

• "ET INFO SOCKSv5 Port 5190 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB-DS IPC$ share access"

• "ET POLICY MS Remote Desktop Administrator Login Request"

• "GPL NETBIOS SMB-DS winreg unicode bind attempt"

• "GPL NETBIOS SMB msqueue unicode little endian bind attempt"

• "ET INFO SOCKSv5 Port 5190 Inbound Request (Windows Source)"

• "GPL NETBIOS SMB-DS IPC$ andx share access"

• "GPL NETBIOS SMB RemoteActivation unicode attempt"

• "GPL NETBIOS SMB ADMIN$ unicode share access"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile attempt"

• "GPL NETBIOS SMB winreg andx create tree attempt"

• "ET INFO SOCKSv5 Port 1863 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB IrotIsRunning little endian attempt"

• "GPL NETBIOS SMB llsrpc unicode andx bind attempt"

• "GPL NETBIOS SMB ISystemActivator unicode andx bind attempt"

• "GPL NETBIOS DCERPC msqueue little endian bind attempt"

• "GPL NETBIOS SMB nddeapi andx bind attempt"

• "ET SCAN MYSQL 4.1 brute force root login attempt"

• "GPL NETBIOS SMB winreg andx bind attempt"

• "GPL NETBIOS SMB-DS llsrpc little endian andx bind attempt"

• "GPL NETBIOS SMB-DS winreg little endian andx bind attempt"

• "GPL NETBIOS SMB-DS ISystemActivator unicode little endian bind attempt"

• "GPL NETBIOS SMB DCERPC LSASS direct bind attempt"

• "GPL NETBIOS SMB IPC$ unicode share access"

• "GPL NETBIOS SMB-DS winreg little endian bind attempt"

• "GPL NETBIOS SMB-DS ISystemActivator unicode bind attempt"

• "GPL NETBIOS SMB irot unicode little endian bind attempt"

• "ET INFO SOCKSv4 Port 1863 Inbound Request (Linux Source)"

• "GPL NETBIOS DCERPC irot little endian bind attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile little endian andx attempt"

• "GPL NETBIOS SMB-DS nddeapi create tree attempt"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown attempt"

• "GPL NETBIOS SMB-DS llsrpc unicode little endian bind attempt"

• "GPL FTP LIST directory traversal attempt"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag true)"

• "GPL NETBIOS SMB-DS llsrpc andx bind attempt"

• "GPL NETBIOS SMB winreg unicode little endian andx bind attempt"

• "GPL NETBIOS SMB-DS IrotIsRunning little endian attempt"

• "GPL NETBIOS SMB-DS msqueue andx bind attempt"

• "ET INFO WinHttp AutoProxy Request wpad.dat Possible BadTunnel"

• "GPL NETBIOS SMB winreg little endian bind attempt"

• "GPL NETBIOS SMB IActivation unicode little endian bind attempt"

• "GPL NETBIOS DCERPC IActivation little endian bind attempt"

• "GPL NETBIOS SMB-DS DCERPC LSASS bind attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode attempt"

• "GPL NETBIOS SMB-DS irot bind attempt"

• "GPL NETBIOS SMB IrotIsRunning attempt"

• "GPL NETBIOS SMB-DS IrotIsRunning attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB-DS InitiateSystemShutdown unicode little endian andx attempt"

• "GPL NETBIOS SMB nddeapi create tree attempt"

• "GPL NETBIOS SMB-DS IActivation unicode little endian bind attempt"

• "GPL NETBIOS SMB-DS RemoteActivation unicode little endian andx attempt"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag true change port flag true)"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)"

• "GPL NETBIOS SMB-DS nddeapi andx create tree attempt"

• "ET INFO PTUNNEL INBOUND"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE unicode andx SACL overflow attempt"

• "GPL NETBIOS SMB DCERPC LSASS bind attempt"

• "GPL NETBIOS SMB IActivation unicode little endian andx bind attempt"

• "GPL NETBIOS SMB-DS ISystemActivator bind attempt"

• "GPL NETBIOS SMB nddeapi unicode create tree attempt"

• "GPL NETBIOS SMB irot little endian bind attempt"

• "GPL NETBIOS SMB-DS winreg andx bind attempt"

• "GPL NETBIOS SMB-DS msqueue unicode andx bind attempt"

• "GPL NETBIOS SMB-DS RemoteActivation attempt"

• "GPL NETBIOS SMB winreg unicode andx bind attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile attempt"

• "GPL NETBIOS SMB nddeapi andx create tree attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE unicode DACL overflow attempt"

• "GPL NETBIOS SMB winreg unicode little endian bind attempt"

• "GPL NETBIOS SMB-DS winreg bind attempt"

• "GPL NETBIOS SMB InitiateSystemShutdown unicode little endian andx attempt"

• "ET SCADA IEC-104 STOPDT (Stop Data Transfer) Confirmation"

• "GPL NETBIOS SMB nddeapi unicode bind attempt"

• "GPL NETBIOS SMB msqueue unicode andx bind attempt"

• "ET INFO Session Traversal Utilities for NAT (STUN Binding Response)"

• "ET WEB_CLIENT Microsoft OLE Compound File Magic Bytes Flowbit Set"

• "GPL NETBIOS SMB NT Trans NT CREATE DACL overflow attempt"

• "ET INFO SOCKSv4 Port 25 Inbound Request (Windows Source)"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx attempt"

• "GPL NETBIOS SMB RemoteActivation unicode andx attempt"

• "GPL NETBIOS SMB-DS RemoteActivation little endian andx attempt"

• "ET INFO SOCKSv5 DNS Inbound Request (Linux Source)"

• "GPL NETBIOS SMB-DS DCERPC LSASS unicode bind attempt"

• "GPL NETBIOS SMB-DS IrotIsRunning unicode attempt"

• "GPL NETBIOS SMB-DS DCERPC LSASS direct bind attempt"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "GPL NETBIOS SMB-DS Session Setup NTMLSSP asn1 overflow attempt"

• "GPL NETBIOS SMB RemoteActivation unicode little endian attempt"

• "GPL NETBIOS DCERPC LSASS direct bind attempt"

• "GPL NETBIOS SMB-DS irot little endian andx bind attempt"

• "GPL NETBIOS SMB ISystemActivator unicode little endian bind attempt"

• "GPL NETBIOS SMB-DS winreg unicode andx bind attempt"

• "ET INFO SOCKSv5 Port 5050 Inbound Request (Windows Source)"

• "ET INFO NBNS Name Query Response Possible WPAD Spoof BadTunnel"

• "GPL NETBIOS SMB winreg unicode bind attempt"

• "GPL NETBIOS SMB llsrpc unicode little endian andx bind attempt"

• "ET INFO SOCKSv5 HTTP Proxy Inbound Request (Windows Source)"

• "GPL NETBIOS SMB-DS IrotIsRunning unicode andx attempt"

• "ET TROJAN MS Remote Desktop edc User Login Request"

• "ET INFO SOCKSv5 Port 5050 Inbound Request (Linux Source)"

• "GPL NETBIOS SMB-DS IrotIsRunning andx attempt"

• "GPL NETBIOS SMB-DS CoGetInstanceFromFile andx attempt"

• "GPL NETBIOS SMB-DS nddeapi unicode andx bind attempt"

• "GPL FTP large PWD command"

• "GPL NETBIOS SMB-DS irot little endian bind attempt"

• "GPL NETBIOS SMB msqueue andx bind attempt"

• "GPL NETBIOS SMB-DS NT Trans NT CREATE unicode SACL overflow attempt"

• "GPL NETBIOS SMB-DS ISystemActivator andx bind attempt"

• "GPL NETBIOS SMB CoGetInstanceFromFile unicode andx attempt"

• "GPL NETBIOS SMB RemoteActivation unicode little endian andx attempt"

• "GPL NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt"

• "GPL SQL MYSQL show databases attempt"

denial-of-service

• "ET EXPLOIT Possible OpenSSL Infinite Loop Inducing Cert Inbound via TCP (CVE-2022-0778)"

• "ET EXPLOIT CHIYU IoT Devices - Denial of Service"

• "ET EXPLOIT Possible OpenSSL Infinite Loop Inducing Cert Inbound via UDP (CVE-2022-0778)"

• "GPL FTP CWD ~ attempt"

• "ET DOS User-Agent used in known DDoS Attacks Detected outbound"

• "ET DOS User-Agent used in known DDoS Attacks Detected outbound 2"

• "ET DOS Inbound GoldenEye DoS attack"

• "GPL FTP CWD .... attempt"

• "ET DOS User-Agent used in known DDoS Attacks Detected inbound"

• "ET SCADA DATAC RealWin SCADA Server 2 On_FC_CONNECT_FCS_a_FILE Buffer Overflow Vulnerability"

• "ET DOS User-Agent used in known DDoS Attacks Detected inbound 2"

• "ET SCADA Siemens FactoryLink 8 CSService Logging Buffer Overflow Vulnerability"

• "GPL FTP CWD ~ attempt"

• "ET SCADA Golden FTP Server PASS Command Remote Buffer Overflow Attempt"

• "ET ACTIVEX - DNS Response containing multiple DNSSEC RRSIG Entries (Algorithm 14) - Possible CVE-2023-50387 Activity"

suspicious-login

• "GPL FTP saint scan"

• "GPL TELNET root login"

• "GPL FTP iss scan"

• "GPL SMTP AUTH LOGON brute force attempt"

• "ET EXPLOIT Pwdump4 Session Established GetHash port 445"

• "ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445"

• "GPL FTP piss scan"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-series Dropbear SSH Banner - Possible SSH Login attempt"

• "GPL FTP satan scan"

• "GPL FTP pass wh00t"

• "ET INFO Suspicious Fake Login - Possible Phishing - 2018-12-31"

• "ET EXPLOIT Pwdump3e Session Established Reg-Entry port 139"

• "GPL SCAN adm scan"

• "ET EXPLOIT Pwdump4 Session Established GetHash port 139"

rpc-portmap-decode

• "GPL RPC portmap yppasswd request TCP"

• "GPL RPC portmap cmsd request TCP"

• "GPL RPC portmap espd request UDP"

• "GPL RPC portmap admind request UDP"

• "GPL RPC portmap admind request TCP"

• "GPL RPC portmap rstatd request UDP"

• "GPL RPC portmap cachefsd request UDP"

• "GPL RPC portmap status request TCP"

• "GPL RPC portmap rexd request TCP"

• "GPL RPC portmap amountd request UDP"

• "GPL RPC portmap kcms_server request TCP"

• "GPL RPC portmap sadmind request TCP"

• "GPL RPC portmap RQUOTA request UDP"

• "GPL RPC portmap selection_svc request TCP"

• "GPL RPC portmap nisd request TCP"

• "GPL RPC portmap snmpXdmi request UDP"

• "GPL RPC portmap bootparam request UDP"

• "GPL RPC portmap cachefsd request TCP"

• "GPL RPC portmap NFS request TCP"

• "GPL RPC portmap SET attempt TCP 111"

• "GPL RPC portmap SET attempt UDP 111"

• "GPL RPC portmap listing TCP 111"

• "GPL RPC portmap ypserv request UDP"

• "GPL RPC portmap rwalld request TCP"

• "GPL RPC portmap selection_svc request UDP"

• "GPL RPC portmap rexd request UDP"

• "GPL RPC portmap ypupdated request TCP"

• "GPL RPC portmap rstatd request TCP"

• "GPL RPC portmap proxy attempt UDP"

• "GPL RPC portmap status request UDP"

• "GPL RPC portmap pcnfsd request TCP"

• "GPL RPC portmap cmsd request UDP"

• "GPL RPC portmap ypupdated request UDP"

• "GPL RPC portmap sadmind request UDP"

• "GPL RPC portmap amountd request TCP"

• "GPL RPC portmap UNSET attempt UDP 111"

• "GPL RPC portmap RQUOTA request TCP"

• "GPL RPC portmap listing UDP 111"

• "GPL RPC portmap kcms_server request UDP"

• "GPL RPC portmap rusers request UDP"

• "GPL RPC portmap rpc.xfsmd request TCP"

• "GPL RPC portmap ttdbserv request UDP"

• "GPL RPC portmap nisd request UDP"

• "GPL RPC portmap NFS request UDP"

• "GPL RPC portmap proxy attempt TCP"

• "GPL RPC portmap network-status-monitor request TCP"

• "GPL RPC portmap pcnfsd request UDP"

• "GPL RPC portmap espd request TCP"

• "GPL RPC portmap mountd request UDP"

• "GPL RPC portmap rusers request TCP"

• "GPL RPC portmap UNSET attempt TCP 111"

• "GPL RPC portmap bootparam request TCP"

• "GPL RPC portmap yppasswd request UDP"

• "GPL RPC portmap rwalld request UDP"

• "GPL RPC portmap snmpXdmi request TCP"

• "GPL RPC yppasswd username overflow attempt UDP"

• "GPL RPC portmap ypserv request TCP"

• "GPL RPC portmap proxy integer overflow attempt TCP"

• "GPL RPC portmap ttdbserv request TCP"

• "GPL RPC portmap network-status-monitor request UDP"

successful-admin

• "ET WEB_SERVER LEMURLOOT WebShell Interaction Header (X-siLock-Comment) - Observed in MOVEit File Transfer - OUTBOUND (Active Compromise)"

• "ET WEB_SERVER PHP WebShell Embedded In PNG (INBOUND)"

• "ET ATTACK_RESPONSE Windows 7 CMD Shell from Local System"

• "ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Auth - Possilbe CVE-2020-22253 Attempt"

• "ET EXPLOIT Bonitasoft Successful Default User Login Attempt (Possible Staging for CVE-2022-25237)"

• "GPL TFTP GET passwd"

• "GPL EXPLOIT Microsoft cmd.exe banner"

• "ET ATTACK_RESPONSE Microsoft Powershell Banner Outbound"

• "ET EXPLOIT Citrix ADC and NetScaler Gateway Information Disclosure - Successful Response (CVE-2023-4966)"

• "GPL TFTP GET Admin.dll"

• "ET SCAN Tomcat upload from external source"

• "ET ATTACK_RESPONSE Apache Spark RPC - Unauthenticated RegisterApplication - Successfully Registered (CVE-2020-9480)"

• "ET POLICY Dameware Remote Control Service Install"

• "ET WEB_SERVER PHP WebShell Embedded In JPG (OUTBOUND)"

• "ET WEB_SERVER WEBSHELL JSP/Backdoor Shell Access"

• "ET WEB_SERVER Successful FortiOS Auth Bypass Attempt - SSH Key Upload (CVE-2022-40684)"

• "ET CURRENT_EVENTS Open MGate Device"

• "ET EXPLOIT Cisco REST API Container for Cisco IOS XE Software Authentication Bypass - Successful Exploit (CVE-2019-12643)"

• "ET INFO F5 BIG-IP - Successful Password Reset Attempt - Observed Post CVE-2023-46747 Activity"

• "ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -1 Data Exfil Response - Observed in MOVEit File Transfer - OUTBOUND (Active Compromise)"

• "ET ATTACK_RESPONSE Possible MS CMD Shell opened on local system"

• "ET ATTACK_RESPONSE SysInternals sc.exe Output Outbound"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Success"

• "ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Telnet Opening - Successful CVE-2020-22253 Attempt"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Success"

• "ET INFO F5 BIG-IP - Successful Command Execution via util/bash"

• "ET WEB_SERVER Successful FortiOS Auth Bypass Attempt - Administrative Details Leaked (CVE-2022-40684)"

• "ET WEB_SPECIFIC_APPS WordPress Plugin - Essential Addons for Elementor - Successful Password Reset (CVE-2023-32243)"

• "ET WEB_SERVER WEBSHELL CFM Shell Access"

• "ET ATTACK_RESPONSE Microsoft Netsh Firewall Disable Output Outbound"

• "ET ATTACK_RESPONSE Interactive Reverse Shell Without TTY (Outbound)"

• "ET EXPLOIT JetBrains TeamCity Auth Bypass Successful Attempt (CVE-2023-42793)"

• "GPL TFTP GET shadow"

• "ET ATTACK_RESPONSE Microsoft CScript Banner Outbound"

• "GPL TFTP GET nc.exe"

• "ET WEB_SERVER Successful FortiOS Auth Bypass Attempt - Config Leaked (CVE-2022-40684)"

• "ET WEB_SERVER PHP WebShell Embedded In PNG (OUTBOUND)"

• "ET EXPLOIT Successful ownCloud Remote Improper Authentication Attempt (CVE-2023-49105)"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL Calibration Access Level Login Success"

• "ET WEB_SERVER PHP WebShell Embedded In JPG (INBOUND)"

• "ET ATTACK_RESPONSE Non-Local Burp Proxy Error"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful CSRF Token Request on guestaccess.aspx - CVE-2023-34362 Stage 1b"

• "ET WEB_SERVER PHP WebShell Embedded In GIF (INBOUND)"

• "ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)"

• "ET WEB_SERVER PHP WebShell Embedded In GIF (OUTBOUND)"

• "ET ATTACK_RESPONSE Possible MS CMD Shell opened on local system 2"

• "ET ATTACK_RESPONSE Microsoft WMIC Prompt Outbound"

• "ET WEB_SPECIFIC_APPS ConnectWise ScreenConnect - Successful User Creation via SetupWizard with Auth Bypass CWE-288 (CVE-2024-1709)"

• "ET EXPLOIT Selenium Server Grid Chrome 3.141.59 Remote Code Execution - Successful"

• "ET WEB_SPECIFIC_APPS ConnectWise ScreenConnect - Successful SetupWizard Auth Bypass CWE-288 (CVE-2024-1709)"

shellcode-detect

• "GPL SHELLCODE Linux shellcode"

• "ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0d0d0d0d"

• "ET SHELLCODE Possible %u41%u41%u41%u41 UTF-8 Heap Spray Attempt"

• "ET SHELLCODE Possible Call with No Offset TCP Shellcode"

• "GPL SHELLCODE sparc NOOP"

• "GPL SHELLCODE Digital UNIX NOOP"

• "GPL SQL MSSQL shellcode attempt 2"

• "ET SHELLCODE Possible 0x0d0d0d0d Heap Spray Attempt"

• "ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript NOP SLED"

• "GPL SHELLCODE AIX NOOP"

• "ET SHELLCODE Possible UTF-16 %u9090 NOP SLED"

• "ET SHELLCODE Common 0a0a0a0a Heap Spray String"

• "ET SHELLCODE Possible %0d%0d%0d%0d Heap Spray Attempt"

• "ET SHELLCODE Possible Call with No Offset UDP Shellcode"

• "ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 41414141"

• "ET SHELLCODE Common %0c%0c%0c%0c Heap Spray String"

• "GPL SQL shellcode attempt"

• "ET SHELLCODE Common %u0c%u0c%u0c%u0c UTF-8 Heap Spray String"

• "ET SHELLCODE Execve(/bin/sh) Shellcode"

• "GPL EXPLOIT kadmind buffer overflow attempt"

• "GPL EXPLOIT kadmind buffer overflow attempt"

• "ET SHELLCODE Possible 0x0c0c0c0c Heap Spray Attempt"

• "ET SHELLCODE Unescape Hex Obfuscated Content"

• "ET SHELLCODE Possible Unescape Encoded Content With Split String Obfuscation 2"

• "ET SHELLCODE Possible %u0d0d%u0d0d UTF-16 Heap Spray Attempt"

• "ET SHELLCODE Possible %u0d%u0d%u0d%u0d UTF-8 Heap Spray Attempt"

• "ET SHELLCODE Possible 0x0b0b0b0b Heap Spray Attempt"

• "ET SHELLCODE Unescape Variable Unicode Shellcode"

• "GPL SHELLCODE x86 0xEB0C NOOP"

• "ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt"

• "ET SHELLCODE Possible Call with No Offset UDP Shellcode"

• "ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0c0c0c0c"

• "ET SHELLCODE Possible 0x0a0a0a0a Heap Spray Attempt"

• "ET INFO Possible Hex Obfuscated JavaScript Heap Spray 0a0a0a0a"

• "ET SHELLCODE Bindshell2 Decoder Shellcode (UDP)"

• "ET SHELLCODE Common %u0a0a%u0a0a UTF-16 Heap Spray String"

• "ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0d0d0d0d"

• "ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0a0a0a0a"

• "ET SHELLCODE Possible UTF-8 %u90 NOP SLED"

• "ET SHELLCODE Hex Obfuscated JavaScript NOP SLED"

• "GPL SHELLCODE sparc NOOP"

• "ET SHELLCODE Common %u0c0c%u0c0c UTF-16 Heap Spray String"

• "GPL SHELLCODE x86 0x71FB7BAB NOOP unicode"

• "ET SHELLCODE Linux/x86-64 - Polymorphic Setuid(0) & Execve(/bin/sh) Shellcode"

• "ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0b0b0b0b"

• "GPL SHELLCODE SGI NOOP"

• "ET SHELLCODE Possible Encoded %90 NOP SLED"

• "GPL EXPLOIT kadmind buffer overflow attempt"

• "ET SHELLCODE Possible Unescape Encoded Content With Split String Obfuscation"

• "ET SHELLCODE Possible Call with No Offset TCP Shellcode"

• "ET SHELLCODE Common %u0a%u0a%u0a%u0a UTF-8 Heap Spray String"

• "ET SHELLCODE Possible Backslash Unicode Heap Spray Attempt"

• "ET SHELLCODE Linux/x86-64 - Polymorphic Flush IPTables Shellcode"

• "ET SHELLCODE Possible %u4141%u4141 UTF-16 Heap Spray Attempt"

• "GPL SHELLCODE x86 0x71FB7BAB NOOP"

• "ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0c0c0c0c"

• "ET SHELLCODE Javascript Split String Unicode Heap Spray Attempt"

• "ET SHELLCODE Possible UTF-16 u9090 NOP SLED"

• "GPL SHELLCODE HP-UX NOOP"

• "ET SHELLCODE Possible Vertical Slash Unicode Heap Spray Attempt"

• "ET SHELLCODE Rothenburg Shellcode"

• "ET SHELLCODE Linux/x86-64 - Reverse Shell Shellcode"

• "GPL SHELLCODE MSSQL shellcode attempt"

• "ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0b0b0b0b"

• "GPL EXPLOIT kadmind buffer overflow attempt"

• "GPL SHELLCODE HP-UX NOOP"

• "GPL SHELLCODE sparc NOOP"

string-detect

• "ET ATTACK_RESPONSE FTP inaccessible directory access COM1"

• "ET ATTACK_RESPONSE FTP inaccessible directory access NULL"

• "ET ATTACK_RESPONSE FTP inaccessible directory access COM4"

• "ET ATTACK_RESPONSE FTP inaccessible directory access COM3"

• "ET ATTACK_RESPONSE FTP inaccessible directory access COM2"

• "ET ATTACK_RESPONSE FTP inaccessible directory access LPT3"

• "ET ATTACK_RESPONSE FTP inaccessible directory access LPT4"

• "ET ATTACK_RESPONSE FTP inaccessible directory access AUX"

• "ET ATTACK_RESPONSE FTP inaccessible directory access LPT1"

• "ET ATTACK_RESPONSE FTP inaccessible directory access LPT2"

web-application-activity

• "ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source)"

• "ET INFO Apache Solr System Information Request"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - TCP Statistics"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M1 Version 1.x-6.x"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-2488 Possible Unauthorized Access Attempt - Request for /scripts/dScripts.sel"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 7.x M2"

• "GPL WEB_SERVER service.cnf access"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M2"

• "ET SCAN Core-Project Scanning Bot UA Detected"

• "GPL WEB_SERVER Oracle Java Process Manager access"

• "ET INFO Spring Boot Actuator Health Check Request"

• "ET TROJAN Jembot PHP Webshell (system command)"

• "ET SCAN COMMIX Command injection scan attempt"

• "ET WEB_SERVER Weevely PHP backdoor detected (proc_open() function used)"

• "ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (backendjs .org)"

• "ET WEB_SPECIFIC_APPS Atlassian Bitbucket CVE-2022-1471 Vulnerable Server Detected Version 7.17.x - 7.21.15"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - HTTP POST to /api/v1/folders (CVE-2023-34362)"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M2 Version 1.x-6.x"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Chassis Detail Request"

• "ET WEB_CLIENT Samsung Galaxy Knox Android Browser RCE smdm attempt"

• "ET WEB_SERVER log4jAdmin access from non-local network (can modify logging levels)"

• "ET WEB_SERVER Weevely PHP backdoor detected (popen() function used)"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - System List"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Vulnerable Server Detected M1"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Folder Request - CVE-2023-34362 Stage 4"

• "GPL WEB_SERVER services.cnf access"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Statistics"

• "ET WEB_SERVER FaTaLisTiCz_Fx Webshell Detected"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Memory Statistics"

• "ET INFO PHP Xdebug Extension Query Parameter (XDEBUG_SESSION_START)"

• "ET WEB_SPECIFIC_APPS Miva Merchant Cross Site Scripting Attack"

• "ET WEB_SPECIFIC_APPS WordPress - Attempted Check for Malicious posts-layout (post-layout Doppelganger) Plugin"

• "ET WEB_SERVER MSSQL Server OLEDB asp error"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x"

• "ET WEB_SERVER Weevely PHP backdoor detected (pcntl_exec() function used)"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ICMP Statistics"

• "ET WEB_SERVER WeBaCoo Web Backdoor Detected"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - UDP Statistics"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Payload Trigger Request - CVE-2023-34362 Stage 5b"

• "ET WEB_SPECIFIC_APPS Wordpress - Successful Check for Malicious posts-layout (post-layout Doppelganger) Plugin - Infected Web Server"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Vulnerable Server Detected M2"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M1"

• "GPL WEB_SERVER apache ?M=D directory list attempt"

• "ET WEB_SERVER WebShell - Unknown - self-kill"

• "ET WEB_SERVER JBoss jmx-console Access Control Bypass Attempt"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 8.x M2"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server"

• "GPL WEB_SERVER author.exe access"

• "GPL WEB_SERVER mod_gzip_status access"

• "ET WEB_SERVER WebShell - PHP eMailer"

• "GPL WEB_SERVER authors.pwd access"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation System Data Details Information Disclosure Attempt"

• "GPL WEB_SERVER printenv access"

• "GPL WEB_SERVER globals.pl access"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Heap Memory Statistics"

• "ET WEB_SERVER Weevely PHP backdoor detected (passthru() function used) M1"

• "ET SCAN Nikto Scan Remote File Include Retrieval"

• "ET WEB_SERVER Weevely PHP backdoor detected (perl->system() function used)"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful Folder Request - CVE-2023-34362 Stage 4"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 7.x M2"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 7.x M1"

• "GPL EXPLOIT fpcount access"

• "ET WEB_SERVER log4jAdmin access from non-local network Page Body (can modify logging levels)"

• "ET ATTACK_RESPONSE x2300 phpshell detected"

• "ET WEB_SERVER Unusually Fast HTTP Requests With Referer Url Matching DoS Tool"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-2488 Possible Unauthorized Access Attempt - Request for /css/sel.css"

• "GPL WEB_SERVER DELETE attempt"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 7.x M1"

• "GPL EXPLOIT ISAPI .idq access"

• "ET WEB_CLIENT Observed JavaScript Event Listener with Clipboard Data"

• "GPL EXPLOIT /iisadmpwd/aexp2.htr access"

• "GPL WEB_SERVER service.pwd"

• "ET WEB_SPECIFIC_APPS Atlassian Jira CVE-2022-1471 Vulnerable Server Detected Version 9.4 - 9.11.1 M2"

• "ET SCAN Web Scanner - Fuzz Faster U Fool (Inbound)"

• "GPL MISC HP Web JetAdmin file write attempt"

• "ET WEB_SERVER Weevely PHP backdoor detected (python_eval() function used)"

• "ET WEB_SERVER Weevely PHP backdoor detected (exec() function used)"

• "ET WEB_SPECIFIC_APPS Atlassian Bitbucket CVE-2022-1471 Vulnerable Server Detected Version 8.0 - 8.12.0"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M1"

• "GPL EXPLOIT .htr access"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ARP Statistics"

• "GPL EXPLOIT site/iisamples access"

• "ET WEB_SERVER JBoss jmx-console Probe"

• "ET WEB_SPECIFIC_APPS Atlassian Jira CVE-2022-1471 Vulnerable Server Detected Version 9.4 - 9.11.1 M1"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 8.0 - 8.3 M1"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Browse Chasis"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 8.0 - 8.3 M2"

• "ET INFO Liferay JSON Web Services Invoker"

• "ET WEB_SERVER Weevely PHP backdoor detected (passthru() function used) M2"

• "ET WEB_SERVER DataCha0s Web Scanner/Robot"

• "GPL MISC HP Web JetAdmin remote file upload attempt"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Possible Unauthorized Access Attempt - Request for radevice.css"

• "ET SCADA [nsacyber/ELITEWOLF] Possible Siemens S7-1200 Unauthorized Access Attempt - Request for /Images/CPU1200/"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful API Token Request - CVE-2023-34362 Stage 3"

• "ET SCADA [nsacyber/ELITEWOLF] Possible Siemens S7-1200 Unauthorized Access Attempt - Request for /CSS/S7Web.css"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-series Possible Unauthorized Access - Request for home.sel"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Crashdump Display"

• "GPL EXPLOIT .cnf access"

• "ET WEB_SERVER WebShell - Unknown - .php?x=img&img="

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IGMP Statistics"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M2"

• "GPL MISC HP Web JetAdmin setinfo access"

• "ET SCAN w3af Scan Remote File Include Retrieval"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - Interface Statistics"

• "ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - HTTP POST to /guestaccess.aspx (CVE-2023-34362)"

• "ET WEB_SERVER Weevely PHP backdoor detected (shell_exec() function used)"

• "ET SCAN bsqlbf Brute Force SQL Injection"

• "GPL EXPLOIT administrators.pwd access"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - HTTP POST to /moveitaspi.dll (CVE-2023-34362)"

• "ET ATTACK_RESPONSE r57 phpshell footer detected"

• "ET TROJAN Jembot PHP Webshell (file upload)"

• "ET WEB_SERVER Weevely PHP backdoor detected (passthru() function used) M3"

• "GPL WEB_SERVER writeto.cnf access"

• "GPL WEB_SERVER global.asa access"

• "ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Routing Data"

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-series Possible Unauthorized Access Attempt - Request for err401.sel"

• "ET WEB_SPECIFIC_APPS MOVEit File Transfer - API Token Request - CVE-2023-34362 Stage 3"

• "GPL EXPLOIT ISAPI .ida access"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 8.x M1"

• "ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x"

• "ET WEB_SERVER Weevely PHP backdoor detected (system() function used)"

• "ET WEB_SPECIFIC_APPS ConnectWise ScreenConnect - SetupWizard Auth Bypass Vulnerable Version Detected (CVE-2024-1709 CVE-2024-1708)"

• "ET TROJAN Suspected Generic PHP Backdoor Activity M1"

• "ET TROJAN Generic PHP Backdoor CnC Response"

• "ET TROJAN Suspected Generic PHP Backdoor Activity M2"

misc-attack

• "GPL NETBIOS DCERPC Workstation Service direct service access attempt"

• "GPL FTP RNFR ././ attempt"

• "ET ATTACK_RESPONSE Obfuscated Batch Script Inbound M1"

• "GPL MISC CVS invalid module response"

• "ET SNMP missing community string attempt 1"

• "GPL IMAP unsubscribe literal overflow attempt"

• "ET POLICY Possible Windows Binary Observed in SSL/TLS Certificate"

• "GPL MISC CVS double free exploit attempt response"

• "ET VOIP Possible Misuse Call from MERA RTU"

• "ET WEB_SERVER Double Encoded Characters in URI (../)"

• "GPL RPC CMSD TCP CMSD_INSERT buffer overflow attempt"

• "GPL MISC UPnP Location overflow"

• "GPL MISC CVS invalid user authentication response"

• "ET EXPLOIT Pwdump3e Password Hash Retrieval port 139"

• "ET EXPLOIT Pwdump3e pwservice.exe Access port 445"

• "GPL FTP SITE CPWD overflow attempt"

• "GPL MISC CVS invalid directory response"

• "ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M1"

• "GPL IMAP subscribe overflow attempt"

• "GPL RPC sadmind query with root credentials attempt TCP"

• "GPL NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt"

• "ET WEB_CLIENT Winzip 15.0 WZFLDVW.OCX IconIndex Property Denial of Service"

• "GPL VOIP EXPLOIT SIP UDP Softphone overflow attempt"

• "GPL RPC tooltalk TCP overflow attempt"

• "ET SNMP missing community string attempt 4"

• "GPL MISC CVS invalid repository response"

• "GPL IMAP subscribe literal overflow attempt"

• "GPL RPC sadmind query with root credentials attempt UDP"

• "GPL IMAP append overflow attempt"

• "ET EXPLOIT CISCO FIREWALL SNMP Buffer Overflow Extrabacon (CVE-2016-6366)"

• "GPL RPC mountd UDP mount path overflow attempt"

• "GPL NETBIOS SMB DCERPC Workstation Service unicode bind attempt"

• "GPL IMAP copy literal overflow attempt"

• "GPL RPC mountd TCP mount path overflow attempt"

• "ET EXPLOIT Observed Mirai/Gafgyt Post Brute Force Activity (GET)"

• "ET EXPLOIT Pwdump3e Password Hash Retrieval port 445"

• "GPL IMAP auth overflow attempt"

• "ET SNMP missing community string attempt 2"

• "ET EXPLOIT [Rapid7] Zyxel ZTP setWanPortSt mtu Parameter Exploit Attempt (CVE-2022-30525)"

• "GPL IMAP unsubscribe overflow attempt"

• "ET EXPLOIT FireEye Detection Evasion %temp% attempt - Inbound"

• "ET ATTACK_RESPONSE Possible PowerShell AMSI Bypass Inbound"

• "GPL RPC tooltalk UDP overflow attempt"

• "GPL SQL Slammer Worm propagation attempt"

• "ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M2"

• "GPL IMAP authenticate overflow attempt"

• "GPL NETBIOS DCERPC Workstation Service direct service bind attempt"

• "GPL IMAP find overflow attempt"

• "GPL RPC kcms_server directory traversal attempt"

• "GPL NETBIOS SMB-DS DCERPC Workstation Service unicode bind attempt"

• "GPL MISC rwhoisd format string attempt"

• "ET INFO Generic 000webhostapp.com POST 2018-09-27 (set)"

• "GPL SNMP PROTOS test-suite-trap-app attempt"

• "GPL RPC RQUOTA getquota overflow attempt UDP"

• "ET WEB_CLIENT Winzip 15.0 WZFLDVW.OCX Text Property Denial of Service"

• "GPL IMAP fetch overflow attempt"

• "ET EXPLOIT Pwdump3e pwservice.exe Access port 139"

• "ET ATTACK_RESPONSE Obfuscated Batch Script Inbound M2"

• "GPL IMAP status overflow attempt"

• "ET SCAN ProxyReconBot CONNECT method to Mail"

• "GPL MISC UPnP malformed advertisement"

• "GPL IMAP examine overflow attempt"

• "ET CURRENT_EVENTS Successful International Card Services Credential Phish 2023-04-20"

• "GPL IMAP delete overflow attempt"

• "ET WEB_SPECIFIC_APPS Webmin Directory Traversal"

• "GPL NETBIOS SMB DCERPC Workstation Service bind attempt"

• "GPL NETBIOS SMB-DS DCERPC Workstation Service bind attempt"

• "ET VOIP Possible Misuse Call from Cisco ooh323"

• "ET SCAN Redis SSH Key Overwrite Probing"

• "GPL IMAP EXPLOIT partial body overflow attempt"

• "GPL WORM Slammer Worm propagation attempt OUTBOUND"

• "ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Lateral Movement Activity"

• "GPL MISC CVS missing cvsroot response"

• "GPL SNMP null community string attempt"

• "GPL IMAP rename overflow attempt"

• "GPL FTP PORT bounce attempt"

• "ET EXPLOIT Exploit MS05-002 Malformed .ANI stack overflow attack"

• "GPL MISC CVS non-relative path error response"

• "ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2024-23108"

• "ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992"

• "ET EXPLOIT CVE-2024-25600 Bricks Exploitation Attempt"

not-suspicious

• "ET SCAN Bing Webcrawler User-Agent (BingBot)"

• "ET INFO JSCAPE MFT - HTTP Management Service Detected via Set-Cookie"

• "ET INFO WinHttpRequest (flowbits no alert)"

• "ET POLICY Cisco Device in Config Mode"

• "ET SMTP Sorbs.net Block Message"

• "ET POLICY SSL MiTM Vulnerable iOS 4.x CDMA iPhone device"

• "ET INFO Opera Adblocker Update Flowbit Set"

• "ET INFO maas.io Image Download Flowbit Set"

• "ET POLICY Outgoing Chromoting Session Response"

• "ET INFO JAVA - Java Archive Download"

• "ET SCAN PRO Search Crawler Probe"

• "ET POLICY Dyndns Client IP Check"

• "ET WEB_CLIENT DXF Extension File Detection Access Flowbit Set"

• "ET INFO JSCAPE MFT - Binary Management Service Default TLS Certificate"

• "ET INFO McAfee AV Download - Set"

• "ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)"

• "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)"

• "ET POLICY Ask Webcrawler User-Agent"

• "GPL CHAT Jabber/Google Talk Outgoing Traffic"

• "ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)"

• "ET POLICY COCCOC Browser (VN) Installed"

• "ET INFO Adobe Flash Uncompressed in HTTP Flowbit Set"

• "ET POLICY Dell MyWay Remote control agent"

• "ET INFO MP4 in HTTP Flowbit Set M2"

• "ET POLICY Suspicious User-Agent (XXX) Often Sony Update Related"

• "ET SCAN AOL Webcrawler User-Agent"

• "ET SCAN Exabot Webcrawler User Agent"

• "ET WEB_CLIENT HTA File Download Flowbit Set"

• "ET INFO Possible GoCD Authentication Bypass URI Path - cruise_config (SET)"

• "ET CURRENT_EVENTS Successful Generic .EDU.BR Phish (Legit Set)"

• "ET WEB_CLIENT Oracle Java 6 Object Tag launchjnlp docbase Parameters Flowbits Set"

• "ET INFO Possible .jpg download by VBA macro (SET) M2"

• "ET POLICY external cPanel login"

• "ET DOS Microsoft Remote Desktop (RDP) Syn/Ack Outbound Flowbit Set"

• "ET POLICY Cisco Device New Config Built"

• "ET SCAN DuckDuckGo Webcrawler User-Agent (DuckDuckBot)"

• "ET SMTP Spamcop.net Block Message"

• "ET INFO MP4 in HTTP Flowbit Set"

• "ET POLICY Radmin Remote Control Session Authentication Response"

• "ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)"

• "ET POLICY Windows Update P2P Activity"

• "ET CURRENT_EVENTS Successful Generic .EDU.TW Phish (Legit Set)"

• "ET INFO ATF file in HTTP Flowbit Set"

• "ET INFO MP4 in HTTP Flowbit Set M3"

• "ET INFO Apache Spark RPC - Auth Request (set)"

• "ET POLICY external cPanel password change"

• "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management"

• "ET WEB_CLIENT AVI RIFF Chunk Access Flowbit Set"

• "ET INFO JAVA - Java Class Download"

• "ET INFO Adobe FDF in HTTP Flowbit Set"

• "ET POLICY Dyndns Client User-Agent"

• "ET INFO McAfee AV Download (set)"

• "ET INFO PhishingBox Landing Page - Phishing Simulation"

• "ET INFO Set flow on bmp file get"

• "ET INFO form-data flowbit set (noalert)"

• "ET INFO Apache Spark RPC - CheckExistence Request (set)"

• "ET INFO PhishingBox Landing Page - Phishing Simulation"

• "ET POLICY Splashtop Remote Control Session Keepalive Response"

• "ET INFO Adobe PDF in HTTP Flowbit Set"

• "ET INFO MP3 with ID3 in HTTP Flowbit Set"

• "ET INFO Windows Update/Microsoft FP Flowbit"

• "ET INFO turbo.net SSL/TLS Certificate Observed (VDI and App Virtualization Service)"

• "ET POLICY Splashtop Remote Control Session Start Request"

• "ET INFO Windows Powershell User-Agent Usage"

• "ET INFO Possible .jpg download by VBA macro (SET) M1"

• "ET POLICY Splashtop Remote Control Checkin"

• "ET POLICY Radmin Remote Control Session Authentication Initiate"

• "ET CURRENT_EVENTS Successful Generic .EDU Phish (Legit Set)"

• "ET SCAN Naver Webcrawler User-Agent (Naver.me)"

• "ET TROJAN Suspicious Accept-Language HTTP Header zh-cn likely Kernelbot/Conficker Trojan Related"

• "ET SMTP Abuseat.org Block Message"

• "ET POLICY Incoming Chromoting Session Response"

• "ET POLICY Executable Download From DropBox"

• "ET INFO JAVA - Java Serialized Data Download"

• "ET POLICY Windows Mobile 7.0 User-Agent detected"

• "ET SMTP Robtex.com Block Message"

• "ET POLICY Splashtop Remote Control Session Keepalive"

• "ET WEB_CLIENT VLC Media Player Aegisub Advanced SubStation (.ass) File Request flowbit set"

• "ET POLICY Maxthon Browser Background Agent UA (MxAgent)"

• "ET CURRENT_EVENTS Successful Generic .EDU.CO Phish (Legit Set)"

• "ET INFO Secondary Flash Request Seen (no alert)"

• "ET POLICY Spotify P2P Client"

• "ET SCAN Yandex Webcrawler User-Agent (YandexBot)"

attempted-dos

• "ET VOIP Multiple Unauthorized SIP Responses UDP"

• "GPL NETBIOS SMB DCERPC invalid bind attempt"

• "GPL NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt"

• "GPL NETBIOS DCERPC invalid bind attempt"

• "ET EXPLOIT Win32/Industroyer DDOS Siemens SIPROTEC (CVE-2015-5374)"

• "ET DOS High Orbit Ion Cannon (HOIC) Attack Inbound Generic Detection Double Spaced UA"

• "ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M4"

• "ET DOS Possible Sentinal LM Amplification attack (Response) Inbound"

• "ET DOS Likely NTP DDoS In Progress PEER_LIST Response to Non-Ephemeral Port IMPL 0x03"

• "ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x02"

• "ET DOS Possible Sentinal LM Application attack in progress Outbound (Response)"

• "ET EXPLOIT Possible ImageMagick (7.1.0-49) DOS PNG Observed Inbound (CVE-2022-44267)"

• "ET VOIP REGISTER Message Flood TCP"

• "ET DOS Likely NTP DDoS In Progress GET_RESTRICT Response to Non-Ephemeral Port IMPL 0x02"

• "GPL FTP SITE NEWER attempt"

• "ET DOS Likely NTP DDoS In Progress MON_LIST Response to Non-Ephemeral Port IMPL 0x02"

• "ET DOS Terse HTTP GET Likely GoodBye 5.2 DDoS tool"

• "ET DOS Possible Memcached DDoS Amplification Query (set)"

• "ET DOS Possible WordPress Pingback DDoS in Progress (Inbound)"

• "ET WEB_CLIENT Great Cannon DDoS JS M2"

• "ET DOS Microsoft Windows LSASS Remote Memory Corruption (CVE-2017-0004)"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Service Stop"

• "ET DOS CallStranger - Attempted UPnP Reflected Amplified TCP with Multiple Callbacks (CVE-2020-12695)"

• "ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M1"

• "ET DOS Likely NTP DDoS In Progress MON_LIST Response to Non-Ephemeral Port IMPL 0x03"

• "ET DOS Likely NTP DDoS In Progress PEER_LIST_SUM Response to Non-Ephemeral Port IMPL 0x02"

• "ET DOS MC-SQLR Response Outbound Possible DDoS Participation"

• "ET SCAN Kingcope KillApache.pl Apache mod_deflate DoS attempt"

• "ET WEB_SERVER Possible Cherokee Web Server GET AUX Request Denial Of Service Attempt"

• "ET DOS LOIC Javascript DDoS Outbound"

• "ET DOS Terse HTTP GET Likely AnonMafiaIC DDoS tool"

• "ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x02"

• "ET DOS CLDAP Amplification Reflection (PoC based)"

• "ET WEB_SERVER PHP Large Subnormal Double Precision Floating Point Number PHP DoS in URI"

• "ET DOS HTTP GET AAAAAAAA Likely FireFlood"

• "ET DOS Potential CLDAP Amplification Reflection"

• "ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x03"

• "ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x02"

• "ET DOS Likely NTP DDoS In Progress PEER_LIST Response to Non-Ephemeral Port IMPL 0x02"

• "ET WEB_SERVER LOIC Javascript DDoS Inbound"

• "ET SCADA RealWin SCADA System Buffer Overflow"

• "ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - System Restart Request"

• "ET DOS Linux/Tsunami DOS User-Agent (x00_-gawa.sa.pilipinas.2015) INBOUND"

• "ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST Requests IMPL 0x02"

• "ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Process Kill"

• "ET DOS Likely NTP DDoS In Progress GET_RESTRICT Response to Non-Ephemeral Port IMPL 0x03"

• "ET DOS Possible NTP DDoS Inbound Frequent Un-Authed GET_RESTRICT Requests IMPL 0x02"

• "ET EXPLOIT Possible ImageMagick (7.1.0-49) DOS PNG Upload Attempt (CVE-2022-44267)"

• "GPL NETBIOS DOS RFPoison"

• "GPL NETBIOS SMB NTLMSSP invalid mechlistMIC attempt"

• "ET WEB_SERVER Apache APR apr_fnmatch Stack Overflow Denial of Service"

• "ET WEB_SERVER Possible Apache DDos UA Observed (DDos Apache) Outbound"

• "ET EXPLOIT Netgear Seventh Inferno CVE-2021-41314 (new line injection)"

• "ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M3"

• "GPL VOIP SIP 401 Unauthorized Flood"

• "ET WEB_CLIENT Possible Apache DDos UA Observed (DDos Apache) Inbound"

• "ET DOS Possible SSDP Amplification Scan in Progress"

• "ET DOS Likely NTP DDoS In Progress Multiple UNSETTRAP Mode 6 Responses"

• "ET VOIP INVITE Message Flood UDP"

• "GPL EXPLOIT NTLM ASN.1 vulnerability scan attempt"

• "ET WEB_SERVER PHP Large Subnormal Double Precision Floating Point Number PHP DoS Inbound"

• "ET DOS Bittorrent User-Agent inbound - possible DDOS"

• "ET SCAN Apache mod_deflate DoS via many multiple byte Range values"

• "ET DOS MC-SQLR Response Inbound Possible DDoS Target"

• "ET VOIP Multiple Unauthorized SIP Responses TCP"

• "ET DOS Possible Memcached DDoS Amplification Inbound"

• "GPL VOIP SIP 407 Proxy Authentication Required Flood"

• "ET DOS Terse HTTP GET Likely AnonGhost DDoS tool"

• "ET DOS Possible NTP DDoS Inbound Frequent Un-Authed GET_RESTRICT Requests IMPL 0x03"

• "ET DOS Possible Memcached DDoS Amplification Response Outbound"

• "GPL VOIP SIP INVITE message flooding"

• "ET DOS Excessive Large Tree Connect Response"

• "ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x03"

• "ET VOIP INVITE Message Flood TCP"

• "ET DOS SMB Tree_Connect Stack Overflow Attempt (CVE-2017-0016)"

• "ET WEB_CLIENT Great Cannon DDoS JS M1"

• "ET VOIP REGISTER Message Flood UDP"

• "ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST Requests IMPL 0x03"

• "ET DOS Possible Sentinal LM Amplification attack (Request) Inbound"

• "ET WEB_CLIENT Great Cannon DDoS JS M3"

• "ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - EEPROM Reset"

• "ET DOS Trojan.BlackRev V1.Botnet HTTP Login POST Flood Traffic Inbound"

• "ET DOS Likely NTP DDoS In Progress PEER_LIST_SUM Response to Non-Ephemeral Port IMPL 0x03"

• "ET WEB_CLIENT Great Cannon DDoS JS M4"

• "ET EXPLOIT Possible MicroLogix 1100 PCCC DoS Condition (CVE-2017-7924)"

• "ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M2"

• "ET DOS Terse HTTP GET Likely LOIC"

• "ET SCADA Rockwell RNA Message Large Header Length - 8Kb"

successful-recon-limited

• "ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M2"

• "ET WEB_SERVER Successful DD-WRT Information Disclosure"

• "ET EXPLOIT Successful ownCloud Information Disclosure Attempt (CVE-2023-49103) M2"

• "ET ATTACK_RESPONSE Possible arp command output via HTTP (Linux Style)"

• "ET ATTACK_RESPONSE passwd file Outbound from WEB SERVER Linux"

• "ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M1"

• "ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M4"

• "ET ATTACK_RESPONSE Possible /etc/passwd via SMTP (BSD style)"

• "ET POLICY WebRTC IP tracking Javascript"

• "ET ATTACK_RESPONSE Possible arp command output via HTTP (MacOS Style)"

• "ET ATTACK_RESPONSE Possible /etc/passwd via HTTP (linux style)"

• "ET ATTACK_RESPONSE Possible hosts File Output via HTTP (Windows Style)"

• "ET ATTACK_RESPONSE Possible hosts File Output via HTTP (Linux Style)"

• "ET ATTACK_RESPONSE Possible /etc/passwd via SMTP (linux style)"

• "ET WEB_SPECIFIC_APPS Metabase Setup-Token Information Disclosure - Required for CVE-2023-38646"

• "ET ATTACK_RESPONSE Possible /etc/passwd via HTTP (BSD style)"

• "ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M3"

• "ET ATTACK_RESPONSE Possible arp command output via HTTP (Windows Style)"

• "ET WEB_SERVER WEB-PHP phpinfo access"

• "ET EXPLOIT Successful ownCloud Information Disclosure Attempt (CVE-2023-49103) M1"

unknown

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M5"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M4"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M2"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M7"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M6"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M6"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M7"

• "ET INFO Double Extension ZIP File Downloaded from Discord (Request)"

• "ET INFO Double Extension PIF File Downloaded from Discord (Request)"

• "ET INFO Possible Telegram Proxy Site (sendDocument)"

• "ET INFO Possible UPnP UUID Overflow Exploit Attempt from Internal Host - SUBSCRIBE/UNSUBSCRIBE"

• "ET INFO Possible Telegram Proxy Site (getUpdates)"

• "ET INFO Possible UPnP UUID Overflow Exploit Attempt from Internal Host - NOTIFY"

• "ET INFO Suspicious Empty Accept-Encoding Header"

• "ET INFO Double Extension VBS File Downloaded from Discord (Request)"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M9"

• "ET INFO Base64 Encoded ipconfig sent via HTTP URI M3"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M3"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M8"

• "ET INFO Possible UPnP UUID Overflow Exploit Attempt from External Host - NOTIFY"

• "ET INFO Base64 Encoded ipconfig sent via HTTP URI M1"

• "ET INFO SUSPICIOUS .LNK File Inside of Zip"

• "ET INFO Base64 Encoded ipconfig sent via HTTP URI M2"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M9"

• "ET INFO Possible UPnP UUID Overflow Exploit Attempt from External Host - SUBSCRIBE/UNSUBSCRIBE"

• "ET INFO Double Extension EXE File Downloaded from Discord (Request)"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M8"

• "ET USER_AGENTS Node XMLHTTP User-Agent"

• "ET INFO Base64 Encoded ipconfig In Server Response M3"

• "ET INFO Base64 Encoded ipconfig In Server Response M2"

• "ET INFO Possible Telegram Proxy Site (sendMessage)"

• "ET USER_AGENTS User-Agent (TEST)"

• "ET INFO Suspicious Empty User-Agent"

• "ET INFO Base64 Encoded ipconfig In Server Response M1"

• "ET GAMES Multiple Game Cheat Application Related Activity"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP URI M5"

• "ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M1"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M2"

• "ET INFO Curl User-Agent Observed to Telegram"

• "ET INFO Double Base64 Encoded ipconfig sent via HTTP Requset Body M4"

network-scan

• "ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Inbound)"

• "ET SCAN Grim's Ping ftp scanning tool"

• "ET SCAN NETWORK Outgoing Masscan detected"

• "ET SCAN RDP Connection Attempt from Nmap"

• "ET SCAN H.323 Scanning device"

• "GPL SCAN SSH Version map attempt"

• "ET WEB_SERVER IIS 8.3 Filename With Wildcard (Possible File/Dir Bruteforce)"

• "ET SCAN ICMP =XXXXXXXX Likely Precursor to Scan"

• "ET SCAN crimscanner User-Agent detected"

• "ET SCAN DNS Query for allports.exposed"

• "ET FTP Vulnerable WS_FTP Version in FTP Banner Response (CVE-2023-40044)"

• "GPL SCAN SolarWinds IP scan attempt"

• "ET SCAN NYU Internet Census UA Inbound"

• "ET SCAN SSH BruteForce Tool with fake PUTTY version"

• "ET WEB_SERVER Fake Googlebot UA 2 Inbound"

• "ET POLICY ASafaWeb Scan User-Agent (asafaweb.com)"

• "ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML"

• "ET SCAN Zmap User-Agent (Inbound)"

• "ET SCAN NETWORK Incoming Masscan detected"

• "ET TROJAN IP Scanner Tool Update Request (GET)"

successful-user

• "ET TROJAN Metasploit Meterpreter stdapi_* Command Request"

• "ET ATTACK_RESPONSE Metasploit Meterpreter Registry Interation Detected"

• "ET TROJAN Metasploit Meterpreter stdapi_* Command Response"

• "ET ATTACK_RESPONSE Net User Command Response"

• "ET TROJAN Metasploit Meterpreter core_channel_* Command Response"

• "ET TROJAN Metasploit Meterpreter core_channel_* Command Request"

• "ET WEB_SERVER RFI Scanner Success (Fx29ID)"

• "ET ATTACK_RESPONSE net user Command Output via HTTP POST"

successful-recon-largescale

• "ET WEB_SPECIFIC_APPS WordPress DB XML dump successful leakage"

• "ET INFO Server Responded with Vulnerable OpenSSH Version (CVE-2024-6409)"

unsuccessful-user

• "ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-series Possible Unauthorized Access - Request for default.sel"

• "GPL SQL sa login failed"

• "GPL RPC rlogin login failure"

• "GPL RPC rexec username too long response"

• "GPL RPC rlogin login failure"

• "GPL POLICY PCAnywhere Failed Login"

• "GPL MISC Invalid PCAnywhere Login"

• "GPL NETBIOS SMB-DS repeated logon failure"

• "ET SCAN Potential FTP Brute-Force attempt response"

• "GPL SQL sa brute force failed login unicode attempt"

• "GPL SQL sa brute force failed login attempt"

• "GPL NETBIOS SMB repeated logon failure"

suspicious-filename-detect

• "ET INFO HTTP GET Request for dotnetzip.dll - Possible Infostealer Activity"

• "ET INFO HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity"

• "ET EXPLOIT Pwdump6 Session Established test file created on victim"

• "ET INFO HTTP GET Request for msvcp40.dll - Possible Infostealer Activity"

• "ET INFO Terse Named Filename EXE Download - Possibly Hostile"

• "ET INFO Generic - *.com.exe HTTP Attachment"

• "GPL FTP .forward"

• "ET INFO HTTP GET Request for PSSQLite.zip - Possible Infostealer Activity"

• "ET INFO HTTP GET Request for mozglue.dll - Possible Infostealer Activity"

• "GPL FTP shadow retrieval attempt"

• "ET POLICY RemoteControlX rctrlx service created"

• "ET INFO HTTP GET Request for AutoItX3"

• "ET TELNET SUSPICIOUS Path to BusyBox"

• "GPL FTP authorized_keys file transferred"

• "ET INFO HTTP GET Request for softokn3.dll - Possible Infostealer Activity"

• "ET INFO HTTP GET Request for system.data.sqlite.dll - Possible Infostealer Activity"

• "ET EXPLOIT PWDump4 Password dumping exe copied to victim"

• "GPL FTP passwd retrieval attempt"

• "ET INFO HTTP GET Request for sqlite3.dll - Possible Infostealer Activity"

• "ET INFO HTTP GET Request for freebl3.dll - Possible Infostealer Activity"

• "ET INFO Generic CollectGarbage in Hex"

• "ET INFO HTTP GET Request for nss3.dll - Possible Infostealer Activity"

• "ET INFO HTTP GET Request for sqlite.interop.dll - Possible Infostealer Activity"

• "ET INFO HTTP GET Request for newtonsoft.json.dll - Possible Infostealer Activity"

• "ET INFO HTTP GET Request for bouncycastle.crypto.dll - Possible Infostealer Activity"

• "ET POLICY PsExec service created"

default-login-attempt

• "GPL POLICY Linksys router default password login attempt"

• "GPL POLICY Linksys router default username and password login attempt"

• "ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound"

• "GPL POLICY Sun JavaServer default password login attempt"

• "ET EXPLOIT HiSilicon DVR - Default Application Backdoor Password"

system-call-detect

• "GPL SHELLCODE sparc setuid 0"

unusual-client-port-connection

• "ET POLICY IRC Channel JOIN on non-standard port"

non-standard-protocol

• "ET POLICY IRC DCC file transfer request on non-std port"

• "ET POLICY Suspicious FTP 220 Banner on Local Port (-)"