Gozi IOC following Hancitor infection

Gozi following Hancitor infection:
amp.sorna.at
api.sorna.at
api2.voxder.at
apt.melotor.at
chat.iqwoot.at
chat2.loop1000.at
rest.relonter.at
vi.relonter.at
api.voxder.at
chat.loop1000.at
io.taqirok.at
webapi.taqirok.at
api.iqwoot.at
supp.rivier.at

IPs:
47.88.51.211
47.88.220.176
47.90.255.11
47.254.75.177
47.254.144.191