WatchmanHQ

Compromise check: look back, don't block

Release 20261015T091323Z · built 2026-10-15 09:13 UTC · valid until 2026-10-18 09:13 UTC

Domains that research teams reported as malicious, which are now suspended by the registrar or registry, or sinkholed: taken over by researchers, whose server now answers instead of the attacker's. Malware keeps looking up its old domains. So if one of your devices looked one up, it is probably infected.

The compromise check is part of Hunting: every entry here is on the Hunting list too.

Why look, but never block

Blocking these does little. A suspended domain doesn't work at all, and a sinkholed one is already out of the attacker's hands. What they can still tell you is which of your devices tried to reach them. If a domain is released or registered again, it goes back through our checks within a week.

  1. Get the list. Download plain-domains.txt: one name per line, nothing else, ready for a search.
  2. Look 30 to 90 days back. Search your DNS logs for those names: Pi-hole, AdGuard Home, your firewall or your DNS server. Search proxy logs for the URLs.
  3. Treat a hit as a device to check. Find the device that made the lookup. Scan it for malware, look at what starts up with it, see what else it has been talking to. Re-image it if in doubt.
  4. One lookup isn't proof. Someone on your team may have checked a name from a report. A device that keeps asking is the one to worry about.

Ready-to-run commands for Pi-hole, text query logs and SIEMs are in How to block.

Downloads

FileWhat it is
plain-domains.txtDomains and exact host names, no comment lines: the one to search with
domains.txt 318Domains: a lookup of any subdomain counts too
hosts.txt 78Exact host names
urls.txt 13Full URLs, for proxy logs
plain-urls.txtFull URLs, no comment lines

The entries

409 entries in this release: 405 suspended, 4 sinkholed. Numbers in the Sources column link to the original reports.

Indicator (defanged)TypeReported asNowFirst reportedSources
joinquest[.]cfdDomainPhishingSuspended2026-10-14Malwarebytes Labs [1]
claude-setup[.]comDomainListed by researchersSuspended2026-10-14ANY.RUN [1]
codex-console[.]comDomainListed by researchersSuspended2026-10-14ANY.RUN [1]
openclaw-setup[.]netDomainListed by researchersSuspended2026-10-14ANY.RUN [1]
setup-code[.]comDomainListed by researchersSuspended2026-10-14ANY.RUN [1]
use-code[.]comDomainListed by researchersSuspended2026-10-14ANY.RUN [1]
update[.]apex-arena-router[.]comDomainListed by researchersSuspended2026-10-12Elastic Security Labs [1]
hxxps://update[.]apex-arena-router[.]com/loader[.]shURLMalware downloadSuspended2026-10-12Elastic Security Labs [1]
jgkawdq[.]cloudDomainCommand and controlSuspended2026-10-08Gen Digital [1]
kaliop-weda[.]clubDomainCommand and controlSuspended2026-10-08Gen Digital [1]
systemformating[.]restDomainCommand and controlSuspended2026-10-08Gen Digital [1]
0aa0cf0637d66c0d[.]comDomainListed by researchersSinkholed2026-10-08Bitdefender Labs [1]
442fe7151fb1e9b5[.]comDomainListed by researchersSinkholed2026-10-08Bitdefender Labs [1]
aa86a52a98162b7d[.]comDomainListed by researchersSinkholed2026-10-08Bitdefender Labs [1]
v46wd6uramzkmeeo[.]inDomainListed by researchersSinkholed2026-10-08Bitdefender Labs [1]
escofiringbijou[.]comDomainCommand and controlSuspended2026-10-07Censys [1]
onthegotree[.]siteDomainListed by researchersSuspended2026-10-07Huntress [1]
cloud[.]g-drive[.]camDomainPhishingSuspended2026-10-06Unit 42 [1]
googeldrive[.]camDomainPhishingSuspended2026-10-06Unit 42 [1]
googelmeet[.]onlineDomainPhishingSuspended2026-10-06Unit 42 [1]
hxxps://cloud[.]g-drive[.]cam/signin/v2/identifier?from=landingURLMalware downloadSuspended2026-10-06Unit 42 [1]
sitemufl06qs0r4o[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemui6m6bbj1bd[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemui8go6g99bb[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemuif3pa5k4eh[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemuife3h91vjj[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemuizkhpdbjnv[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemuj1xencnin8[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujbcz1nas1x[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujffobdhxgj[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujoqrmsm0et[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujrfn7witew[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujtcvh5q9fj[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujtdkvy6c7n[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujumvtmjaf1[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujuncdlpnng[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemujuno47vpud[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemukpy2hpmpwv[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemukrod1am6ez[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemukwxih8302f[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemul95pxqgmm8[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemulpnff7964j[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
sitemulr9d1dg77r[.]xyzDomainListed by researchersSuspended2026-10-01Malwarebytes Labs [1]
heritiage[.]orgDomainListed by researchersSuspended2026-10-01Proofpoint Threat Insight [1]
documentsonitustechnologies[.]sbsDomainMalware downloadSuspended2026-09-22ANY.RUN [1]
sharepointer-dr[.]comDomainMalware downloadSuspended2026-09-22ANY.RUN [1]
analysis-id-lfg[.]infoDomainCommand and controlSuspended2026-09-14Sekoia [1]
cloudflare-check[.]netDomainCommand and controlSuspended2026-09-14Sekoia [1]
flarclod[.]topDomainCommand and controlSuspended2026-09-14Sekoia [1]
id-ll[.]comDomainMalware downloadSuspended2026-09-14Sekoia [1]
jumppopdownloadsecret[.]monsterDomainCommand and controlSuspended2026-09-14Sekoia [1]
kawaiininjaclub[.]cfdDomainCommand and controlSuspended2026-09-14Sekoia [1]
verification-js-cdn[.]boatsDomainCommand and controlSuspended2026-09-14Sekoia [1]
connection[.]upgradeonline[.]siteDomainMalware downloadSuspended2026-09-14Elastic Security Labs [1]
seguranca[.]versionnova[.]siteDomainListed by researchersSuspended2026-09-14Elastic Security Labs [1]
domainlify[.]netDomainListed by researchersSuspended2026-09-10Microsoft Threat Intelligence [1]
service-nowinc[.]comDomainPhishingSuspended2026-09-10Microsoft Threat Intelligence [1]
company-name[.]integratedsso[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
company-name[.]secure-passkey[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
integratedsso[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
oskeyregister[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
oskeysetup[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
setupmypasskey[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
syncmykey[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
validationsetupac[.]comDomainListed by researchersSuspended2026-09-09Microsoft Threat Intelligence [1]
achievershelf[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
activitymeal[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
adviceturn[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
afternoonscrew[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
airtwig[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
animalrecord[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
apparelplate[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
archairport[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
babyvein[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
badgewing[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
bagcare[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
basinpleasure[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
basketballyear[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
baskethumor[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
bedroomdesire[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
beliefpicture[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
bellplayground[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
birthdaymagic[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
boatthought[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
boundarychickens[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
boytank[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
branchmorning[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
bubbleslip[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
cabbagemeasure[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
cardgrape[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
cattlegold[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
celeryerror[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
centscarf[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
chalkprose[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
chesstail[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
churchpail[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
clothcrib[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
coatberry[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]activitykitty[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]armcard[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]badgeterritory[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]baitmetal[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]believesisters[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]boundaryfly[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]chinexpert[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]dresstent[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]dropjeans[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]edgeplayground[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]fangstitch[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]forkcountry[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]geesepurpose[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]giraffetoothpaste[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]guitarrobin[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]harborclam[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]prosesalt[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]quiltgirls[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]rewardrun[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]thingbrass[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]thoughtslave[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
connect[.]zebratransport[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
controlprice[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
countrypipe[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
cowsfoot[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
crackfood[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
creamfurniture[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
creditchickens[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
crimestreet[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
curvebite[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
deathshop[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
decisionreaction[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
distancebedroom[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
dolldebt[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
fallbeginner[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
fangbear[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
flavorwood[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
fleshfrog[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
forkmice[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
geeseairport[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
glassmove[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
grandfatherquiver[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
gripsleep[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
gunbear[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
hairreward[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
healthiron[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
holemuscle[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
homefireman[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
honeyfear[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
instrumentvolcano[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
kittenschalk[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
landerror[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
liquidtoes[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
lockettrail[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
memorycompany[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
micesisters[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
milkname[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
minuteblade[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
northbox[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
partpipe[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
peacetongue[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
petminister[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
pizzasthread[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
popcornregret[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
powerbushes[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
profitfact[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
prosetoothbrush[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
quincepage[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
raintexture[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
rakepurpose[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
readingscience[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
reasonachiever[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
recessgiraffe[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
recordhistory[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
regretsquirrel[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
ricestar[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
rifledog[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
ringsparcel[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
roadyear[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
roofbattle[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
roofreaction[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
rosegrip[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
routeletters[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
runhouses[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
scarecrowcare[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
screwbirth[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
seaword[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
servantadvice[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
shirtexample[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
sinkwash[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
skirtloss[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
slipvegetable[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
smokecar[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
songtheory[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
spadeleg[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
sparkrice[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
springdogs[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
spybaseball[.]spaceDomainListed by researchersSuspended2026-09-09Unit 42 [1]
statementservant[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
statementtouch[.]xyzDomainCommand and controlSuspended2026-09-09Unit 42 [1]
stopzinc[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
structurelinen[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
stryper[.]infoDomainCommand and controlSuspended2026-09-09Unit 42 [1]
suggestioncemetery[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
suitsoap[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
swimrest[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
tailsilk[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
territorycaption[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
texturebadge[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
thrillducks[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
throneback[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
toespiders[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
toothpastesense[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
toothpastesun[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
townquiver[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
treesboard[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
truckshat[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
turnclass[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
umbrellavessel[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
vacationengine[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
volcanopin[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
wastereading[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
wasteturkey[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
wastewine[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
whistlesong[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
wormspark[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
woundsecretary[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
wrenobservation[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
yamsmell[.]xyzDomainListed by researchersSuspended2026-09-09Unit 42 [1]
hxxps://stryper[.]info/aa[.]jsURLMalware downloadSuspended2026-09-09Unit 42 [1]
hxxps://stryper[.]info/t[.]ps1URLMalware downloadSuspended2026-09-09Unit 42 [1]
authorized-logins[.]netDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
grande-luna[.]topDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
human-check[.]topDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
mail[.]authorized-logins[.]netDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
mueleer[.]comDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
ninetyorigins[.]comDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
php[.]authorized-logins[.]netDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
sss[.]authorized-logins[.]netDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
w3xasv14culvnqj[.]topDomainListed by researchersSuspended2026-09-03Symantec Threat Intelligence [1]
config[.]hubdisplay[.]lolDomainCommand and controlSuspended2026-09-02Elastic Security Labs [1]
health[.]journal-metric[.]lolDomainCommand and controlSuspended2026-09-02Elastic Security Labs [1]
lifespotify[.]comDomainListed by researchersSuspended2026-09-01Securelist [1]
app[.]shuchipharmacy[.]comDomainCommand and controlSuspended2026-09-01Huntress [1]
static[.]ariesglobalsoft[.]comDomainCommand and controlSuspended2026-09-01Huntress [1]
static[.]trythecrowdmakers[.]comDomainCommand and controlSuspended2026-09-01Huntress [1]
dev-tools[.]cfdDomainCommand and controlSuspended2026-08-26ReversingLabs [1]
softwareguard[.]cfdDomainCommand and controlSuspended2026-08-26ReversingLabs [1]
sys-tools[.]cfdDomainCommand and controlSuspended2026-08-26ANY.RUN, ReversingLabs [1] [2]
contabilidad[.]icuDomainCommand and controlSuspended2026-08-26Arctic Wolf [1]
documentodigital[.]cloudDomainCommand and controlSuspended2026-08-26Arctic Wolf [1]
soportedigital[.]cloudDomainCommand and controlSuspended2026-08-26Arctic Wolf [1]
visualizarpdf[.]onlineDomainCommand and controlSuspended2026-08-26Arctic Wolf [1]
5orka[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
au1[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
bel1[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
bridge1[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
can2[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
cloud[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
jp2[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
sau1[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
sau2[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
sau3[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae1[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae10[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae11[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae12[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae13[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae14[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae2[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae3[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae4[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae5[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae6[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae7[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae8[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uae9[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uk1[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
uk2[.]tiktok-u[.]sbsDomainListed by researchersSuspended2026-08-26Group-IB [1]
havijmail[.]comDomainMalware downloadSuspended2026-08-25Censys [1]
www[.]racon[.]onlineDomainMalware downloadSuspended2026-08-25Censys [1]
mornixa[.]cfdDomainListed by researchersSuspended2026-08-25ANY.RUN [1]
voretix[.]icuDomainListed by researchersSuspended2026-08-25ANY.RUN [1]
4jio[.]comDomainMalware downloadSuspended2026-08-24The DFIR Report [1]
pltechoo[.]proDomainMalware downloadSuspended2026-08-24The DFIR Report [1]
q82[.]netDomainMalware downloadSuspended2026-08-24The DFIR Report [1]
ustechnio[.]comDomainMalware downloadSuspended2026-08-24The DFIR Report [1]
dtm[.]kijangturbo88[.]topDomainCommand and controlSuspended2026-08-23Darktrace [1]
micronsoftwares[.]comDomainMalware downloadSuspended2026-08-23Darktrace [1]
1foqo[.]latDomainMalware downloadSuspended2026-08-19Huntress [1]
docsend[.]onlineDomainMalware downloadSuspended2026-08-19Huntress [1]
hxxps://1foqo[.]lat/core4URLMalware downloadSuspended2026-08-19Huntress [1]
hxxps://docsend[.]online/download/driversURLMalware downloadSuspended2026-08-19Huntress [1]
adp[.]pslcertlive[.]siteDomainPhishingSuspended2026-08-18ANY.RUN [1]
ars[.]greebys[.]comDomainPhishingSuspended2026-08-18ANY.RUN [1]
bsf[.]allmetreod[.]comDomainPhishingSuspended2026-08-18ANY.RUN [1]
bverster[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
cer[.]septey[.]shopDomainPhishingSuspended2026-08-18ANY.RUN [1]
cer[.]verpox[.]shopDomainPhishingSuspended2026-08-18ANY.RUN [1]
cureaveritax[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
dverster[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
everster[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
fureaveritax[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
fverster[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
gverster[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
hpn[.]bandhiem[.]comDomainPhishingSuspended2026-08-18ANY.RUN [1]
iverster[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
jureaveritax[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
jverster[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
pureaveritax[.]storeDomainPhishingSuspended2026-08-18ANY.RUN [1]
ver[.]verpox[.]shopDomainPhishingSuspended2026-08-18ANY.RUN [1]
vrf[.]atskinsonel[.]comDomainPhishingSuspended2026-08-18ANY.RUN [1]
vrf[.]iar0nline[.]comDomainPhishingSuspended2026-08-18ANY.RUN [1]
wes[.]cadsta[.]onlineDomainPhishingSuspended2026-08-18ANY.RUN [1]
cel-robox[.]comDomainCommand and controlSuspended2026-08-13Infoblox Threat Intel [1]
enveil[.]onlineDomainCommand and controlSuspended2026-08-11Check Point Research [1]
envell[.]xyzDomainCommand and controlSuspended2026-08-11Check Point Research [1]
activatemypasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
activatepasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
activatepasskeyportal[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
add-passkey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
addoktapasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
addpasskey2fa[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
addyourpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
assignpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
checkpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
createmfa[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
createmypasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
createpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
createssopasskey[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
deploypasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
enablepasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
enablepasskey2fa[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
enrollpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
hubpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
idokta[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
keyokta[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
keysyncos[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
makepasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
mspasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
myaccountsecurity[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
myconnectkey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
mynewpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
mypasskeyid[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
mypasskeysso[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
mysecurepasskey[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
myssopasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
newpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
oktaenroll[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
oktaportalsso[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
oskeyconnect[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
oskeysync[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
passkey-check[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkey-connect[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkey-enable[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkey-portal[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyactivation[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeycenter[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeycreate[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeycreator[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeydeploy[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyenable[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyenroll[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyhelpdesk[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
passkeymfa[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyms[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyokta[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyportal[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyportalsetup[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyregister[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyregistration[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyrollout[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeyset[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeystatus[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
passkeysupport[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
portalsetuphub[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
registerpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
secure-passkey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
secureauthpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
setpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
setupsso[.]comDomainPhishingSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
setupssopasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
sqfepjvmrd[.]xyzDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
ssopasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
startpasskey[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
startpasskeysetup[.]comDomainListed by researchersSuspended2026-08-06Google Threat Intelligence / Mandiant [1]
filecedarwallet[.]onlineDomainListed by researchersSuspended2026-08-05Microsoft Threat Intelligence [1]
filecrimsonsignal[.]onlineDomainListed by researchersSuspended2026-08-05Microsoft Threat Intelligence [1]
kleinschnitg[.]comDomainListed by researchersSuspended2026-08-04Huntress [1]
www[.]wangmeng[.]xyzDomainListed by researchersSuspended2026-08-04Fortinet Threat Research [1]
hxxps://kleinschnitg[.]com/F3bebOag/?id=emailURLListed by researchersSuspended2026-08-04Huntress [1]
npm-cache[.]comDomainCommand and controlSuspended2026-08-04Datadog Security Labs, Elastic Security Labs, Microsoft Threat Intelligence +2 [1] [2] [3] [4] [5]
hxxps://npm-cache[.]com:443/routerURLCommand and controlSuspended2026-08-04Datadog Security Labs, Microsoft Threat Intelligence, Unit 42 +1 [1] [2] [3] [4]
hxxps://download[.]alertbh[.]info/BH-Alert[.]apkURLPhishingSuspended2026-08-03K7 Labs [1]
ng28jt[.]xyzDomainPhishingSuspended2026-07-31Censys [1] [2]
digital[.]leroymerling[.]comDomainCommand and controlSuspended2026-07-30Securelist [1]
agenticsora[.]comDomainMalware downloadSuspended2026-07-29Huntress [1]
main[.]southcarolinacounselor[.]comDomainPhishingSuspended2026-07-29Huntress [1]
southcarolinacounselor[.]comDomainMalware downloadSuspended2026-07-29Huntress [1]
hxxp://agenticsora[.]com/curl/URLMalware downloadSuspended2026-07-29Huntress [1]
hxxp://agenticsora[.]com/dynamic?txd=URLCommand and controlSuspended2026-07-29Huntress [1]
hxxps://agenticsora[.]com/loader/agent/URLMalware downloadSuspended2026-07-29Huntress [1]
hxxps://agenticsora[.]com/loader/capture-agent/URLMalware downloadSuspended2026-07-29Huntress [1]
golinked[.]netDomainPhishingSuspended2026-07-23Red Canary [1]
gouvvbo[.]topDomainCommand and controlSuspended2026-07-23Group-IB [1]
dewdhurstlobl[.]comDomainListed by researchersSuspended2026-07-21ANY.RUN [1]
wellpults[.]comDomainListed by researchersSuspended2026-07-21ANY.RUN [1]
fiusyevr[.]liveDomainListed by researchersSuspended2026-07-20Proofpoint Threat Insight [1]
svuatwea[.]loveDomainListed by researchersSuspended2026-07-20Proofpoint Threat Insight [1]
vusuydryt[.]loveDomainListed by researchersSuspended2026-07-20Proofpoint Threat Insight [1]