# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: vampirebot

# Reference: https://x.com/Thisism23567356/status/1861367550774292804
# Reference: https://x.com/DaveLikesMalwre/status/1861387766812078398
# Reference: https://www.virustotal.com/gui/file/14aa9c1113184d439d6f65c6c55c1bfa3654c113f7ed164d92f0b439e2134342/detection

5.252.235.172:4449
djactuallsbuilds.com
ftp.spaceq.ovh
get-reponse-subt1.duckdns.org
get-reponse-subt2.duckdns.org
get-reponse-subt3.duckdns.org
get-reponse-subt4.duckdns.org
mysupportnetflix.com
samsung-work.com
samsungcareers.work
spaceq.ovh
api.samsungcareers.work
api3.samsungcareers.work
img.samsungcareers.work
panel2.samsungcareers.work

# Reference: https://x.com/blackorbird/status/1975811759610208662
# Reference: https://github.com/blackorbird/APT_REPORT/blob/master/cybercrime/BatShadow/batshadow-vietnamese-threat-group-vampire-bot-report.pdf
# Reference: https://www.virustotal.com/gui/ip-address/103.124.95.115/relations
# Reference: https://www.virustotal.com/gui/ip-address/103.124.95.161/relations
# Reference: https://www.virustotal.com/gui/file/afed785aef35e7997e2208e45b2f91a5110d246bc282e0d9a3f6b0698cb871d6/detection
# BANNER_0_HASH-HOST=b6b85367b8fe70ea18db447d9655b2ec

jobs-infomarriott.com
jobs-marriott.com
jobswork.vn
workjobs.net
mail.jobs-infomarriott.com
mail.jobs-marriott.com
mail.jobswork.vn
