# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: rustystealer

# Reference:  https://www.virustotal.com/gui/file/01caca23428e0f6d56feda4b411d989f4b0c8ad4dd28664f5f2b7de428b76004/detection

cookchildren.online
kapetownlink.com
planewool.xyz
prosefriend.online
tripsilver.xyz
send.planewool.xyz
x.prosefriend.online

# Reference: https://www.virustotal.com/gui/file/09d0cdc348159d318c85d24df59f9e6eef87378b5db0928098bfbead2001b0fe/detection
# Reference: https://www.virustotal.com/gui/file/1cb1a21abafc822d404532d535efe11cb0a6b48dcff8777918f1dc93526bcf44/detection
# Reference: https://www.virustotal.com/gui/file/4d65d18ae8bc2f0d964c4bd3edf69eaf3ebe0ff096c5c34a264d00250083e8db/detection
# Reference: https://www.virustotal.com/gui/file/60f42886a42faba991a42281867ad534f7941cf084bf2499f3207d92fdd8fdb9/detection
# Reference: https://www.virustotal.com/gui/file/d1fc40640387f0e0a1cc8b2ac456df926e7a5da518c06105c5e31ad47c130e4d/detection
# Reference: https://www.virustotal.com/gui/file/a426556070e6041b959712e0565f7659bd23c8b26fe6ab33f3ef4142110b7483/detection
# Reference: https://www.virustotal.com/gui/file/007e2862e63ee27c6e3648872ca75f72f7ae89a38345acff920af9d771545530/detection

antsmemory.xyz
beadhouse.xyz
blowaunt.xyz
clamwire.xyz
destructionheat.site
doorthing.website
jumpweight.website
mealcat.online
railthrill.xyz
rathobbies.xyz
restfork.website
seedcake.website
sidemark.xyz
theoryconnection.website
veinplantation.website
windactivity.online
231005002055611.bcn.lca62.shop

# Reference: https://www.virustotal.com/gui/ip-address/37.1.198.251/relations

ambadevgroup.info
haveastory.info
ilyincompany.com
mysoft.lol
mysoftwareusa.info
s63b44.info
safestatsapihost.info
shkiperlol.info
superload.info
usandeu.info
xlavaproduction.info

# Reference: https://www.virustotal.com/gui/ip-address/193.233.133.148/relations

bakbakbak.info
lavaproduction.info
mihomeme.info

# Reference: https://www.virustotal.com/gui/ip-address/92.246.136.253/relations

mydomen2.info

# Reference: https://www.virustotal.com/gui/file/4913d89ba0123fc0b260b78caf10bc858bd9a80acc93cdd71a3e4c46fb722935/detection

http://38.180.21.8

# Reference: https://x.com/JAMESWT_WT/status/1953054444658082228
# Reference: https://www.virustotal.com/gui/file/19d0c555a01d598acd0758ed2dd2fe11f0463c69fb2841142f5650ec594a9c53/detection

stoveweather.info
yarncontool.icu

# Reference: https://www.virustotal.com/gui/file/d33dec5994f60f81a577ac0b1014ba12cfa72d2f519c86803ae41814cd994ca3/detection

skintemper.xyz
toothbrushkettle.icu

# Reference: https://www.virustotal.com/gui/file/e7fae3501be53731b6da813ee2f8bd3cf33058393974d4d26ba6bd019a94d403/detection

ministerkiss.xyz
teethelbow.icu

# Reference: https://app.validin.com/detail?find=02c833a2ee65e620c245b2112086e3ee&type=hash&ref_id=e2bbd6709b6#tab=host_pairs (# 2025-08-06)

achieverart.space
airplanemove.info
airporticicle.info
api.phoenixgps.in
atlantichockey.org
baitstring.xyz
bangkok-service.net
bb.handssurprise.website
bhatkalnews.com
biketoes.xyz
birthdayreward.xyz
biteducks.sbs
bloodcrown.xyz
boneyarn.xyz
brand-award.com
bucketdeer.info
bulbname.xyz
buttoncamera.sbs
buttonsize.xyz
cableword.cfd
cakestoothbrush.icu
celestialvault.org
chalkrose.sbs
chalkwriting.space
chancethroat.icu
coilfood.xyz
coilwood.info
committeedinner.icu
committeegovernor.icu
crackarithmetic.icu
creampump.info
creatorbedroom.cfd
crimeauthority.cfd
crownsmoke.xyz
crowsalt.icu
crowstop.icu
dam.silkjam.online
daughtercemetery.xyz
detailminister.sbs
digitaltokens.xyz
distancesnails.cfd
distributioncurrent.icu
doctorframe.sbs
dogsjar.xyz
dropcoast.icu
e.spadesheep.xyz
echeloncasualmembership.com
eventauthority.info
everbodys.net
eyessock.info
ezrastorah.org
factlow.xyz
fairiespet.icu
fhand.com
flocksnakes.website
fronteranetworks.com
gavinouyang.com
gc-consortium.com
german.brand-award.com
governmentmoney.icu
grainink.website
grainsleet.cfd
grapecub.sbs
guidefrog.sbs
hairteeth.icu
hallchance.xyz
handsound.info
handssurprise.website
harmonybear.sbs
hkdgames.com
hotgrandfather.icu
houseshot.icu
houseslake.xyz
hydrantworm.icu
ikhtiarumrah.id
insectcrow.sbs
ironwealth.sbs
kalakrutiengineers.com
konverzija.si
laughincome.icu
leechall.com
lockplay.sbs
locksea.website
lotussglestari.com
magicvan.icu
meetingclover.xyz
memoryneck.info
mintborder.icu
mombike.cfd
mverp.com
navrang.com
neckrun.xyz
nervedime.website
newyearconcert.com
njathleticclub.net
nutkittens.info
onesmartmove.ca
pearactivity.xyz
personteam.cfd
picklebucket.xyz
playgroundstone.cfd
plotcake.icu
pointdinosaurs.xyz
pointrespect.xyz
potlove.xyz
powerpin.icu
powersmoke.xyz
producesound.xyz
proseharbor.xyz
punishmentslave.info
quincepart.icu
radioactivity.fm
railwaytime.xyz
rainrice.sbs
rainroad.icu
religionhome.icu
reststeel.website
robinkiss.info
robinrail.xyz
roofspade.info
roomside.sbs
rootflock.icu
seabusiness.xyz
shadeinsect.icu
shapework.cfd
shirtdowntown.xyz
sidefog.xyz
silkjam.online
silverbox.cfd
sisterobservation.icu
sistershook.icu
smellstamp.icu
sonplane.info
spacecondition.icu
spadesheep.xyz
sparkdonkey.icu
spoonkittens.sbs
spoonporter.xyz
stacjacafe.pl
steelactivity.website
steelteam.xyz
strawtalk.website
streetpage.icu
theoryquarter.cfd
thingspies.info
thrillcondition.xyz
tiagopremios01.com.br
toothbrushdoctor.xyz
totalweather.net
trainsrub.icu
tripshape.xyz
truckobservation.icu
try2dev.com
vasebird.xyz
visitorboy.info
volcanostop.xyz
volleyballsong.xyz
washlumber.icu
wavailability.com
weekinsurance.xyz
wildernessweight.cfd
winedebt.info
x8cut.com
yamhot.icu
yarncontrol.icu
yearducks.info
yxwdrama.com

# Generic

/api_pedl.php
/api_pedl.php?spot=
/track_inl2EU.php
/track_inl2EU.php?tim=
/pe/build.php?pe=n
/pe/buildIN.php
/pe/buildIN.php?sub=
/plo.php?spot=
/plopp.php?fz=
/ploss.php?a=
/tracker/thank_you.php?trk=
