Ursnif Italy IOC

URL examples:
hxxp://dod.suze10n1[.]com/pagjory63.php
hxxp://dod.suzienow[.]com/jogghfptu=w?bqa=3

Domains staged on legitimate hostings:
9monthstobaby.com
albertmuzaurieta.com
albertmuzaurieta.net
albertmuzaurieta.org
bharatbioscience.in
bloodpressurepatient.com
breastcancerpatient.net
dentalhealthpatient.com
duvalcountyapartment.com
episcopalianstay.com
estimateyourworth.com
goodappledigital.com
heartdiseasepatient.com
irritablebowelsyndromepatient.com
jacksonvillerentalcommunity.com
jaipurmurtibhandar.in
latterydaysaintstay.com
mysouthmiamiapartment.com
officialrentersinsurance.com
pichvaitraditionandbeyond.com
pichwaitraditionandbeyond.com

Dropping malicious subdomains:
dod.suze10n1.com
dod.suzienow.com
munosi.acnepatient.com
munosi.adderallpatient.com
munosi.addpatient.com
munosi.albertmuzaurieta.com
munosi.allergypatient.net
munosi.anxietypatient.com
munosi.bharatbioscience.in
munosi.buddhiststay.com
munosi.catsdogsbaby.com
munosi.civilexpo.in
munosi.codeconcepts.co
munosi.codeconcepts.in
munosi.divineeyogaa.com
munosi.goodappledigital.com
munosi.hairlosspatient.com
munosi.icesurat.org
munosi.ihavedryskin.com
munosi.insomniapatient.com
munosi.irritablebowelsyndromepatient.com
munosi.jacksonvillerentalcommunity.com
munosi.jaipurmurtibhandar.in
munosi.lupusinfotech.com
munosi.mepex.in
munosi.pichwaitraditionandbeyond.com
munosi.shivionexchange.com
ortusi.acnepatient.com
ortusi.adderallpatient.com
ortusi.albertmuzaurieta.com
ortusi.albertmuzaurieta.net
ortusi.allergypatient.net
ortusi.anxietypatient.com
ortusi.baptiststay.com
ortusi.bharatbioscience.in
ortusi.catsdogsbabies.com
ortusi.catsdogsbaby.com
ortusi.christianstay.com
ortusi.civilexpo.in
ortusi.codeconcepts.co
ortusi.codeconcepts.in
ortusi.divineeyogaa.com
ortusi.goodappledigital.com
ortusi.hairlosspatient.com
ortusi.headachepatient.com
ortusi.icesurat.org
ortusi.ihavedryskin.com
ortusi.insomniapatient.com
ortusi.irritablebowelsyndromepatient.com
ortusi.jacksonvillerentalcommunity.com
ortusi.jaipurmurtibhandar.in
ortusi.lupusinfotech.com
ortusi.mysouthmiamiapartment.com
ortusi.pichvaitraditionandbeyond.com
ortusi.pichwaitraditionandbeyond.com
solini.acnepatient.com
solini.albertmuzaurieta.com
solini.albertmuzaurieta.net
solini.anxietypatient.com
solini.baptiststay.com
solini.bharatbioscience.in
solini.buddhiststay.com
solini.catholicstay.com
solini.catsdogsbabies.com
solini.catsdogsbaby.com
solini.christianstay.com
solini.civilexpo.in
solini.codeconcepts.co
solini.codeconcepts.in
solini.divineeyogaa.com
solini.goodappledigital.com
solini.hairlosspatient.com
solini.icesurat.org
solini.ihavedryskin.com
solini.insomniapatient.com
solini.irritablebowelsyndromepatient.com
solini.jacksonvillerentalcommunity.com
solini.jaipurmurtibhandar.in
solini.lupusinfotech.com
solini.mepex.in
solini.pichvaitraditionandbeyond.com
solini.pichwaitraditionandbeyond.com
sortini.addpatient.com
sortini.albertmuzaurieta.net
sortini.anxietypatient.com
sortini.baptiststay.com
sortini.buddhiststay.com
sortini.catholicstay.com
sortini.catsdogsbabies.com
sortini.christianstay.com
sortini.divineeyogaa.com
sortini.goodappledigital.com
sortini.hairlosspatient.com
sortini.headachepatient.com
sortini.icesurat.org
sortini.ihavedryskin.com
sortini.insomniapatient.com
sortini.irritablebowelsyndromepatient.com
sortini.jacksonvillerentalcommunity.com
sortini.jorgetonarely.com
sortini.mysouthmiamiapartment.com
sortini.officialrentersinsurance.com
sortini.pichvaitraditionandbeyond.com
sortini.pichwaitraditionandbeyond.com
sortini.shivionexchange.com
sutori.acnepatient.com
sutori.allergypatient.net
sutori.anxietypatient.com
sutori.bharatbioscience.in
sutori.catsdogsbabies.com
sutori.catsdogsbaby.com
sutori.christianstay.com
sutori.codeconcepts.co
sutori.codeconcepts.in
sutori.divineeyogaa.com
sutori.goodappledigital.com
sutori.headachepatient.com
sutori.icesurat.org
sutori.ihavedryskin.com
sutori.insomniapatient.com
sutori.irritablebowelsyndromepatient.com
sutori.jaipurmurtibhandar.in
sutori.lupusinfotech.com
sutori.pichvaitraditionandbeyond.com
munosi.albertmuzaurieta.net
munosi.baptiststay.com
munosi.catholicstay.com
munosi.catsdogsbabies.com
munosi.christianstay.com
munosi.headachepatient.com
munosi.jorgetonarely.com
munosi.mysouthmiamiapartment.com
munosi.pichvaitraditionandbeyond.com
ortusi.buddhiststay.com
ortusi.mepex.in
solini.adderallpatient.com
solini.allergypatient.net
solini.headachepatient.com
solini.mysouthmiamiapartment.com
sortini.acnepatient.com
sortini.adderallpatient.com
sortini.albertmuzaurieta.com
sortini.allergypatient.net
sortini.bharatbioscience.in
sortini.catsdogsbaby.com
sortini.civilexpo.in
sortini.codeconcepts.co
sortini.ihavebackpain.com
sortini.jaipurmurtibhandar.in
sortini.lupusinfotech.com
sortini.mepex.in
sutori.adderallpatient.com
sutori.albertmuzaurieta.com
sutori.baptiststay.com
sutori.civilexpo.in
sutori.hairlosspatient.com
sutori.jacksonvillerentalcommunity.com
sutori.mepex.in
sutori.mysouthmiamiapartment.com
sutori.pichwaitraditionandbeyond.com
bob.suzetrust.com
bubin.acnepatient.com
bubin.adderallpatient.com
bubin.addpatient.com
bubin.albertmuzaurieta.com
bubin.albertmuzaurieta.net
bubin.anxietypatient.com
bubin.baptiststay.com
bubin.bharatbioscience.in
bubin.buddhiststay.com
bubin.catholicstay.com
bubin.catsdogsbabies.com
bubin.christianstay.com
bubin.civilexpo.in
bubin.codeconcepts.co
bubin.codeconcepts.in
bubin.divineeyogaa.com
bubin.goodappledigital.com
bubin.hairlosspatient.com
bubin.headachepatient.com
bubin.ihavedryskin.com
bubin.insomniapatient.com
bubin.irritablebowelsyndromepatient.com
bubin.jacksonvillerentalcommunity.com
bubin.jaipurmurtibhandar.in
bubin.jorgetonarely.com
bubin.lutheranstay.com
bubin.mormonstay.com
bubin.mysouthmiamiapartment.com
bubin.officialrentersinsurance.com
bubin.pichvaitraditionandbeyond.com
bubin.pichwaitraditionandbeyond.com
bubin.pranavashram.in
bubin.shivionexchange.com
gudint.9monthstobaby.com
gudint.acnepatient.com
gudint.adderallpatient.com
gudint.albertmuzaurieta.com
gudint.albertmuzaurieta.net
gudint.allergypatient.net
gudint.anglicanstay.com
gudint.aninik.me
gudint.anxietypatient.com
gudint.asthmapatient.com
gudint.baptiststay.com
gudint.bharatbioscience.in
gudint.buddhiststay.com
gudint.catholicstay.com
gudint.catsdogsbabies.com
gudint.catsdogsbaby.com
gudint.christianstay.com
gudint.civilexpo.in
gudint.codeconcepts.co
gudint.codeconcepts.in
gudint.divineeyogaa.com
gudint.goodappledigital.com
gudint.hairlosspatient.com
gudint.headachepatient.com
gudint.icesurat.org
gudint.ihavedryskin.com
gudint.insomniapatient.com
gudint.irritablebowelsyndromepatient.com
gudint.jaipurmurtibhandar.in
gudint.jesusstay.com
gudint.jorgetonarely.com
gudint.latterydaysaintstay.com
gudint.lutheranstay.com
gudint.mepex.in
gudint.methodiststay.com
gudint.migrainepatient.com
gudint.mysouthmiamiapartment.com
gudint.pichvaitraditionandbeyond.com
gudint.pranavashram.in
gudint.shivionexchange.com
gupoty.9monthstobaby.com
gupoty.acnepatient.com
gupoty.adderallpatient.com
gupoty.addpatient.com
gupoty.albertmuzaurieta.com
gupoty.albertmuzaurieta.net
gupoty.allergypatient.net
gupoty.aninik.me
gupoty.baptiststay.com
gupoty.bharatbioscience.in
gupoty.buddhiststay.com
gupoty.catholicstay.com
gupoty.catsdogsbabies.com
gupoty.catsdogsbaby.com
gupoty.christianstay.com
gupoty.civilexpo.in
gupoty.codeconcepts.co
gupoty.divineeyogaa.com
gupoty.headachepatient.com
gupoty.icesurat.org
gupoty.ihavedryskin.com
gupoty.insomniapatient.com
gupoty.irritablebowelsyndromepatient.com
gupoty.jacksonvillerentalcommunity.com
gupoty.jaipurmurtibhandar.in
gupoty.lutheranstay.com
gupoty.mepex.in
gupoty.mormonstay.com
gupoty.mysouthmiamiapartment.com
gupoty.pichvaitraditionandbeyond.com
gupoty.pranavashram.in
gupoty.shivionexchange.com
imagfi.acnepatient.com
imagfi.adderallpatient.com
imagfi.addpatient.com
imagfi.albertmuzaurieta.com
imagfi.albertmuzaurieta.net
imagfi.allergypatient.net
imagfi.anglicanstay.com
imagfi.aninik.me
imagfi.anxietypatient.com
imagfi.baptiststay.com
imagfi.bharatbioscience.in
imagfi.buddhiststay.com
imagfi.catholicstay.com
imagfi.catsdogsbabies.com
imagfi.catsdogsbaby.com
imagfi.christianstay.com
imagfi.civilexpo.in
imagfi.codeconcepts.co
imagfi.codeconcepts.in
imagfi.duvalcountyapartment.com
imagfi.eczemapatient.com
imagfi.episcopalianstay.com
imagfi.estimateyourworth.com
imagfi.goodappledigital.com
imagfi.hairlosspatient.com
imagfi.headachepatient.com
imagfi.icesurat.org
imagfi.insomniapatient.com
imagfi.irritablebowelsyndromepatient.com
imagfi.jacksonvillerentalcommunity.com
imagfi.jaxapt.com
imagfi.jesusstay.com
imagfi.jorgetonarely.com
imagfi.latterydaysaintstay.com
imagfi.lutheranstay.com
imagfi.mepex.in
imagfi.methodiststay.com
imagfi.migrainepatient.com
imagfi.mormonstay.com
imagfi.officialrentersinsurance.com
imagfi.pichvaitraditionandbeyond.com
imagfi.shivionexchange.com
nusorti.adderallpatient.com
nusorti.albertmuzaurieta.net
nusorti.allergypatient.net
nusorti.anxietypatient.com
nusorti.bharatbioscience.in
nusorti.buddhiststay.com
nusorti.catholicstay.com
nusorti.catsdogsbabies.com
nusorti.catsdogsbaby.com
nusorti.christianstay.com
nusorti.codeconcepts.co
nusorti.codeconcepts.in
nusorti.divineeyogaa.com
nusorti.headachepatient.com
nusorti.icesurat.org
nusorti.ihavedryskin.com
nusorti.insomniapatient.com
nusorti.irritablebowelsyndromepatient.com
nusorti.jacksonvillerentalcommunity.com
nusorti.jaipurmurtibhandar.in
nusorti.jorgetonarely.com
nusorti.mysouthmiamiapartment.com
nusorti.pichvaitraditionandbeyond.com
nusorti.pichwaitraditionandbeyond.com
nusorti.shivionexchange.com
bubin.albertmuzaurieta.org
bubin.allergypatient.net
bubin.bipolarpatient.com
bubin.heartdiseasepatient.com
bubin.icesurat.org
bubin.ihavebackpain.com
bubin.lupusinfotech.com
bubin.mepex.in
gudint.albertmuzaurieta.org
gudint.dentalhealthpatient.com
gudint.estimateyourworth.com
gudint.heartdiseasepatient.com
gudint.ihavebackpain.com
gudint.jacksonvillerentalcommunity.com
gudint.lupusinfotech.com
gudint.mormonstay.com
gudint.officialrentersinsurance.com
gudint.pichwaitraditionandbeyond.com
gupoty.albertmuzaurieta.org
gupoty.anxietypatient.com
gupoty.bipolarpatient.com
gupoty.codeconcepts.in
gupoty.goodappledigital.com
gupoty.hairlosspatient.com
gupoty.heartdiseasepatient.com
gupoty.ihavebackpain.com
gupoty.jorgetonarely.com
gupoty.lupusinfotech.com
gupoty.officialrentersinsurance.com
gupoty.pichwaitraditionandbeyond.com
imagfi.albertmuzaurieta.org
imagfi.asthmapatient.com
imagfi.bipolarpatient.com
imagfi.breastcancerpatient.net
imagfi.dentalhealthpatient.com
imagfi.diabetespatient.net
imagfi.gerdpatient.com
imagfi.heartdiseasepatient.com
imagfi.jaipurmurtibhandar.in
imagfi.lupusinfotech.com
imagfi.mysouthmiamiapartment.com
imagfi.pichwaitraditionandbeyond.com
imagfi.pranavashram.in
nusorti.acnepatient.com
nusorti.addpatient.com
nusorti.albertmuzaurieta.org
nusorti.baptiststay.com
nusorti.bipolarpatient.com
nusorti.civilexpo.in
nusorti.goodappledigital.com
nusorti.hairlosspatient.com
nusorti.lupusinfotech.com
nusorti.mepex.in
nusorti.officialrentersinsurance.com
nusorti.pranavashram.in
gudint.addpatient.com
gudint.diabetespatient.net
imagfi.9monthstobaby.com
imagfi.bloodpressurepatient.com
nusorti.albertmuzaurieta.com

IPs:
178.170.189.215
212.109.193.142
212.109.199.112

Additional IOC:
Example of the dropping URL:
uftvnahj.theradicalbrandlab.com/edkkbxdchsojr/omzlyzmcnyny/wgyjxyb/kkpej

Staging domains:
topbagswallets.com
periodpetty.com
theradicalbrandlab.org
tampaparentcoordinator.com
radicalbrandlab.com
mprushomes.com
jordanhayles.com
theradicalbrandlab.com
perspectivesbookseries.com
medsupsavings.com
prushomes.com

Malicious subdomains:
bnuaxndr.topbagswallets.com
boabighq.periodpetty.com
djifckxk.theradicalbrandlab.org
dontgpml.periodpetty.com
dvxagyts.tampaparentcoordinator.com
egypoluy.theradicalbrandlab.org
eugfdmkr.periodpetty.com
fanedccy.periodpetty.com
flaicgok.radicalbrandlab.com
hbvkyqsy.mprushomes.com
hjfltjck.jordanhayles.com
hwttfcyq.theradicalbrandlab.org
hzifxytq.theradicalbrandlab.org
ilbosyvt.tampaparentcoordinator.com
ipacabae.theradicalbrandlab.org
jbsyantl.jordanhayles.com
jgdyykgr.theradicalbrandlab.com
jnbdxtgv.theradicalbrandlab.com
jpocstmj.perspectivesbookseries.com
jqguauzb.tampaparentcoordinator.com
jtpbhmho.theradicalbrandlab.com
meozqrgl.periodpetty.com
nmvcusal.theradicalbrandlab.com
ocdsgxku.perspectivesbookseries.com
oqqyvpoo.periodpetty.com
pefbnumv.mprushomes.com
phtegbzr.jordanhayles.com
qydcyyui.theradicalbrandlab.org
rnyeoddw.mprushomes.com
sjzudcjq.tampaparentcoordinator.com
sqpaoilv.theradicalbrandlab.org
tcxxygub.periodpetty.com
tskpnczo.radicalbrandlab.com
ucspziiw.tampaparentcoordinator.com
udkanppc.topbagswallets.com
uftvnahj.theradicalbrandlab.com
ugncnfyx.periodpetty.com
uwwcojjl.medsupsavings.com
uxofhmep.radicalbrandlab.com
vovqtzny.periodpetty.com
vpzrnkoi.periodpetty.com
wqvjwpew.perspectivesbookseries.com
www.jnbdxtgv.theradicalbrandlab.com
www.lhkmnzor.tampaparentcoordinator.com
www.sogasmro.jordanhayles.com
www.theradicalbrandlab.org
www.ucspziiw.tampaparentcoordinator.com
www.yrwscjlh.radicalbrandlab.com
www.zenmqtfj.theradicalbrandlab.org
yetwamkg.radicalbrandlab.com
ylfcolxd.tampaparentcoordinator.com
zbzvvwer.mprushomes.com
zenmqtfj.theradicalbrandlab.org
zsdnzmru.tampaparentcoordinator.com
bkytrozb.theradicalbrandlab.org
bnmehpfv.mprushomes.com
byfvktou.tampaparentcoordinator.com
cbgsehig.topbagswallets.com
dirrxbll.periodpetty.com
eltouwji.mprushomes.com
etolxrot.tampaparentcoordinator.com
exyuabsb.prushomes.com
gdugyows.mprushomes.com
gjsjsrtx.theradicalbrandlab.org
gmnomrti.radicalbrandlab.com
gpodztte.perspectivesbookseries.com
hdsxddbk.prushomes.com
iendtcym.medsupsavings.com
ioelmeom.periodpetty.com
laxqlbgc.topbagswallets.com
luhxpkpy.theradicalbrandlab.org
mbzxzevp.prushomes.com
mnkvwkip.theradicalbrandlab.com
mqkvaecq.mprushomes.com
povaedhy.mprushomes.com
rqvkqpwq.mprushomes.com
scbplfas.theradicalbrandlab.com
sielbbvr.jordanhayles.com
sizrsjkh.jordanhayles.com
sizsnsfi.theradicalbrandlab.org
slheoqor.theradicalbrandlab.com
tckszpdp.tampaparentcoordinator.com
tkaopedc.perspectivesbookseries.com
wcbezrbq.tampaparentcoordinator.com
www.omlmqixw.tampaparentcoordinator.com
yhtxmhpc.perspectivesbookseries.com
yop.tampaparentcoordinator.com
yqwlofav.theradicalbrandlab.org
zdprmqch.radicalbrandlab.com
zjofruzf.radicalbrandlab.com
zzjwobut.theradicalbrandlab.com

IPs:
193.111.155.123