# Copyright (c) 2014-2018 Miroslav Stampar (@stamparm)
# See the file 'LICENSE' for copying permission

# Reference: https://github.com/eset/malware-ioc/blob/master/turla/README.adoc

www.shoppingexpert.it/wp-content/gallery/
soheylistore.ir/modules/mod_feed/feed.php
tazohor.com/wp-includes/feed-rss-comments.php
jucheafrica.com/wp-includes/class-wp-edit.php
61paris.fr/wp-includes/ms-set.php
doctorshand.org/wp-content/about/
www.lasac.eu/credit_payment/url/

# Reference: https://www.welivesecurity.com/2018/01/09/turlas-backdoor-laced-flash-player-installer/

smallcloud.ga
fleetwood.tk
adstore.twilightparadox.com
bigpen.ga
ebay-global.publicvm.com
psychology-blog.ezua.com
agony.compress.to
gallop.mefound.com
auberdine.etowns.net
skyrim.3d-game.com
officebuild.4irc.com
sendmessage.mooo.com
robot.wikaba.com
tellmemore.4irc.com

# Reference: http://info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.pdf

arctic-zone.bbsindex.com
cars-online.zapto.org
eunews-online.zapto.org
fifa-rules.25u.com
forum.sytes.net
franceonline.sytes.net
freeutils.3utilities.com
health-everyday.faqserv.com
nhl-blog.servegame.com
olympik-blog.4dq.com
pockerroom.servebeer.com
pressforum.serveblog.net
scandinavia-facts.sytes.net
sportmusic.servemp3.com
stockholm-blog.hopto.org
supernews.sytes.net
sweeden-history.zapto.org
tiger.got-game.org
top-facts.sytes.net
weather-online.hopto.org
wintersport.sytes.net
x-files.zapto.org
forum.4dq.com
forum.acmetoy.com
marketplace.servehttp.com
music-world.servemp3.com
newutils.3utilities.com
interesting-news.zapto.org
academyawards.effers.com
cheapflights.etowns.net
toolsthem.xp3.biz
softprog.freeoda.com
euassociate.6te.net
euland.freevar.com
communityeu.xp3.biz
swim.onlinewebshop.net
july.mypressonline.com
eu-sciffi.99k.org

# Reference: https://www.symantec.com/security-center/writeup/2014-011316-1921-99?tabid=2

nightday.comxa.com
sanky.sportsontheweb.net
tiger.netii.net
north-area.bbsindex.com

# Reference: http://artemonsecurity.com/snake_whitepaper.pdf

academyawards.effers.com
arctic-zone.bbsindex.com
cars-online.zapto.org
cheapflights.etowns.net
communityeu.xp3.biz
eu-sciffi.99k.org
euassociate.6te.net
euland.freevar.com
eunews-online.zapto.org
fifa-rules.25u.com
forum.4dq.com
forum.acmetoy.com
forum.sytes.net
franceonline.sytes.net
freeutils.3utilities.com
health-everyday.faqserv.com
interesting-news.zapto.org
july.mypressonline.com
marketplace.servehttp.com
music-world.servemp3.com
newutils.3utilities.com
nhl-blog.servegame.com
north-area.bbsindex.com
olympik-blog.4dq.com
pockerroom.servebeer.com
pressforum.serveblog.net
scandinavia-facts.sytes.net
softprog.freeoda.com
sportmusic.servemp3.com
stockholm-blog.hopto.org
supernews.sytes.net
sweeden-history.zapto.org
swim.onlinewebshop.net
tiger.got-game.org
toolsthem.xp3.biz
top-facts.sytes.net
weather-online.hopto.org
winter.site11.com
wintersport.sytes.net
x-files.zapto.org

# Reference: https://github.com/eset/malware-ioc/tree/master/turla

http://www.shoppingexpert.it/wp-content/gallery/
http://soheylistore.ir/modules/mod_feed/feed.php
http://tazohor.com/wp-includes/feed-rss-comments.php
http://jucheafrica.com/wp-includes/class-wp-edit.php
http://61paris.fr/wp-includes/ms-set.php
http://doctorshand.org/wp-content/about/
http://www.lasac.eu/credit_payment/url/
http://daybreakhealthcare.co.uk/wp-includes/themees.php
http://simplecreative.design/wp-content/plugins/calculated-fields-form/single.php
http://169.255.137.203/rss_0.php
http://outletpiumini.springwaterfeatures.com/wp-includes/pomo/settings.php
http://zerogov.com/wp-content/plugins.deactivate/paypal-donations/src/PaypalDonations/SimpleSubsribe.php
http://ales.ball-mill.es/ckfinder/core/connector/php/php4/CommandHandler/CommandHandler.php
http://dyskurs.com.ua/wp-admin/includes/map-menu.php
http://warrixmalaysia.com.my/wp-content/plugins/jetpack/modules/contact-form/grunion-table-form.php
http://217.171.86.137/config.php
http://217.171.86.137/rss_0.php
http://shinestars-lifestyle.com/old_shinstar/includes/old/front_footer.old.php
http://www.aviasiya.com/murad.by/life/wp-content/plugins/wp-accounting/inc/pages/page-search.php
http://baby.greenweb.co.il/wp-content/themes/san-kloud/admin.php
http://soligro.com/wp-includes/pomo/db.php
http://giadinhvabe.net/wp-content/themes/viettemp/out/css/class.php
http://tekfordummies.com/wp-content/plugins/social-auto-poster/includes/libraries/delicious/Delicious.php
http://kennynguyen.esy.es/wp-content/plugins/wp-statistics/vendor/maxmind-db/reader/tests/MaxMind/Db/test/Reader/BuildTest.php
http://sonneteck.com/wp-content/plugins/yith-woocommerce-wishlist/plugin-fw/licence/templates/panel/activation/activation.php
http://chagiocaxuanson.esy.es/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/ngglegacy/admin/templates/manage_gallery/gallery_preview_page_field.old.php
http://hotnews.16mb.com/wp-content/themes/twentysixteen/template-parts/content-header.php
http://zszinhyosz.pe.hu/wp-content/themes/twentyfourteen/page-templates/full-hight.php
http://weandcats.com/wp-content/plugins/broken-link-checker/modules/checkers/http-module.php
smallcloud.ga
fleetwood.tk
adstore.twilightparadox.com
bigpen.ga
ebay-global.publicvm.com
psychology-blog.ezua.com
agony.compress.to
gallop.mefound.com
auberdine.etowns.net
skyrim.3d-game.com
officebuild.4irc.com
sendmessage.mooo.com
robot.wikaba.com
tellmemore.4irc.com

# Reference: https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf

eu-sciffi.99k.org
fifa-rules.25u.com
franceonline.sytes.net
greece-travel.servepics.com
hockey-news.servehttp.com
marketplace.servehttp.com
musicplanet.servemp3.com
music-world.servemp3.com
newutils.3utilities.com
nightday.comxa.com
north-area.bbsindex.com
olympik-blog.4dq.com
pokerface.servegame.com
pressforum.serveblog.net
sanky.sportsontheweb.net
softprog.freeoda.com
tiger.got-game.org
tiger.netii.net
toolsthem.xp3.biz
top-facts.sytes.net
weather-online.hopto.org
wintersport.sytes.net
world-weather.zapto.org
x-files.zapto.org
booking.etowns.org
easports.3d-game.com
cheapflights.etowns.net
academyawards.effers.com
te4step.tripod.com
scifi.pages.at
support4u.5u.com
eu-sciffi.99k.org
swim.onlinewebshop.net
winter.site11.com
july.mypressonline.com
soheylistore.ir
tazohor.com
jucheafrica.com
61paris.fr
