Ursnif/Gozi URLs 8/16/19-current

Ursnif/Gozi 8/16/19+

https://twitter.com/SecSome/status/1163848993253707776?s=20
https://twitter.com/killamjr/status/1163830306627043329?s=20

8/20:
http://bh79sbu.com/qtra/ttqr.php?l=csuv[1-16].j12
http://n96p251.com/qtra/ttqr.php?l=csuv[1-16].j12

Other ones seen last week and this week so far:
http://l9oheathj.com/qtra/ttqr.php?l=gwba[1-16].j12
http://p813632eliza.com/qtra/ttqr.php?l=apqo[1-16].j12
http://g15aocbenedict.com/qtra/ttqr.php?l=csuv[1-16].j12
http://qrobertouyy.com/qtra/ttqr.php?l=gwba[1-16].j12
http://rimfaoyahv4115.com/qtra/ttqr.php?l=apqo[1-16].j12
http://zvaleriefs96.com/qtra/ttqr.php?l=qena[1-16].j12

In my experience there is usually nothing of value on these domains so I would just block them all.

Other contributors: @killamjr, @ps66uk, @secsome