# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: Candiru, DevilsTongue

# Reference: https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/ (# CVE-2021-31979, CVE-2021-33771, CVE-2021-21166, CVE-2021-30551, CVE-2021-33742)
# Reference: https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
# Reference: https://otx.alienvault.com/pulse/60f05cb87f7c642309de71ef

adtracker.link
amazon-cz.eu
amnestyreports.com
apple-updates.online
armenpress.net
backxercise.com
bitly.tel
blacklivesmatters.info
cdnmobile.io
cnn24-7.online
codeingasmylife.com
colorpallatess.com
cortanaupdates.com
cyprusnet.tk
drpbx-update.net
dw-arabic.com
eulenformacion.com
euro-news.online
faceb00k-live.com
fbcdnads.live
france-24.news
genderconference.org
googlplay.store
grayhornet.com
hilocake.info
indoprogress.co
instagrarn.co
johnshopkin.net
kenoratravels.com
konferenciya-zoom.com
kupony-rohlik.cz
lenovo-setup.tk
library-update.com
linkedin-jobs.com
llink.link
lwaeh-iteham-alasra.com
mbsmetoo.com
minstagram.net
msstore.io
nmcyclingexperience.com
noc-service-streamer.com
oiip.org
online-affiliate-mon.com
online-source-validate.com
osesgy-unmissions.org
pochtarossiy.info
rasef22.com
refugeeinternational.org
service-deamon.com
tehrantimes.org
total-slovenia-news.net
twitt-live.com
un-asia.co
url-tiny.co
useproof.cc
vesteldefnce.io
vfsglobal.fr
weathercheck.digital
whoint.co
wikipediaathome.net
winmslaf.xyz
womanstudies.co
yeni-safak.com
youtubee.life
zcombinator.co

# Reference: https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/
# Reference: https://otx.alienvault.com/pulse/6194c2377054cd0b3046ca6c

addthis.events
bit-ly.site
bitly.bz
bitly.tw
bitly.zone
bootstrapcdn.net
code-afsanalytics.com
cuturl.space
doubleclick.ac
engagebay.cc
fonts-gstatic.net
livesesion.bid
livesession.bid
medica-tradefair.co
moatads.co
piwiks.com
rebrandly.site
sherathis.com
shortlinkcut.link
site-improve.net
sitei-mprove.net
static-doubleclick.net
tinyurl.bz
tinyurl.ist
tinyurl.one
tinyurl.photos
tinyurl.plus
webfex.bz
webfx.cc
yektenet.com

# Reference: https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/

stat.email

# Reference: https://twitter.com/felixaime/status/1550443808709611522

7aqibatmosafer.com
aqaf.net
babiesfood.org
checkhotel.net
clicks.email
covid19sorgu.com
cuisinewithpaula.com
datanalytic.org
externalcloud.org
extremebirdwatching.com
fatura-sorgu.com
gelora.org
gerillaonline.net
gundeminfo.com
haqqin-news.com
justiceukraine.com
kazatutanagi.net
mailclick.info
mathsolve.info
myems-express.info
mylastnews.com
nusantaraqurban.com
only-music.net
oxu-xeber.com
padpay.org
pinkbulldoginu.com
pinkbulldoginu.net
pinkbulldoginu.org
proqnoz24.com
querylight.net
qurbanbandung.net
reporttoday.org
savealltrees.com
servers-mail.net
shippingnow.org
shopscreen.org
supportservicespro.com
syrianinfo.com
techmails.net
tennnisfield.com
updatenewsletters.com
usb-shops.com
uyapsorgulama.net
xeberim24.info
yeni-elan.com

# Reference: https://twitter.com/r0ny_123/status/1550461250928144384

getscreensupport.com
uavboss.com

# Reference: https://twitter.com/blackorbird/status/1550647971599233025

stylishblock.com

# Reference: https://twitter.com/sekoia_io/status/1601166853673431040

captivelogin.net
koronamiyim.com
olkem.net
opinionlimit.org
parkdev.net
seffafxeber.com
vergisorgula.com

# Reference: https://x.com/blackorbird/status/1952961941649199570
# Reference: https://github.com/blackorbird/APT_REPORT/blob/master/Candiru/Tracking%20Candiru%E2%80%99s%20DevilsTongue%20Spyware%20in%20Multiple%20Countries.pdf

ambiguouscommerce.com
antperspective.com
aperturebelt.com
asknapkin.com
barnsecret.com
baseagriculture.com
basicstraw.com
basinapposite.com
beneathbreadth.com
bizarreclassify.com
blockroster.net
bondmuscle.com
breadgroomer.com
bronzemonth.com
browniebell.com
bypassbirch.com
bypasscalculate.com
bypasscommerce.com
calmbase.org
cartoondrop.net
chickenstrawberry.com
citecivilization.com
closetmeat.com
commonclever.com
concretebottle.com
conquerconfess.com
containsnow.com
contradictionblindness.com
convincechaotic.com
cooperatedisinfect.net
cottonbread.com
cranberrybear.com
cropcritique.com
crossoverdue.com
damageconsider.com
deardrill.com
dediccatedconsideration.com
deducedefend.com
deliverconcern.net
densefoot.com
desireeclipse.com
detaincharity.net
deterdiffusion.com
devotionbelief.com
distractionfar.com
drivesplash.com
drummerjourney.com
dumplingbell.com
electric-prime.com
elifluousscintillam.com
eminententwine.com
exhibitexpanse.com
fallaciousessential.net
fearevolve.com
fileswaper.com
finalsalami.com
flexibleelevator.com
foamdirection.com
forecastgarden.com
goatsandals.com
golfconcert.com
groundbreakinginitative.com
guitarcalculate.com
hostilefauna.com
isolatelecture.com
jellybat.net
jobmarcher.com
journeyjest.net
kartingrumble.com
labyrinthextravagance.org
leafconfuse.net
lessonhandle.com
macrodrop.net
macromint.net
maturitygenesis.com
measurecabin.com
mushroompalm.com
notableexam.org
notionnowadays.com
outdooutcome.com
parkourbus.com
patternperiod.com
penslice.com
pepperdominate.com
prawnbasket.com
predictproper.com
pressaviation.com
profligatecensure.com
rollstrech.com
romancedrum.com
sacrificeprincipal.net
salmonpride.net
scoreparade.com
selectedpazzle.com
shareitwork.com
signifyslight.com
spongefruit.com
stablesurface.com
strangegarden.org
stylebrakedown.com
suggestutterly.com
sunsetpotential.com
tacticscheap.net
tidalscreen.com
tubeshape.com
ultimatematter.info
velvetpremier.com
windomination.com
