| Name / Title | Added | Expires | Hits | Comments | Syntax | |
|---|---|---|---|---|---|---|
| Hancitor 10/8/2019 | Oct 8th, 2019 | Never | 1,850 | 0 | None | - |
| Hancitor 07/01/2019 | Jul 1st, 2019 | Never | 1,799 | 0 | None | - |
| TrickBot sat10 Template | Jul 6th, 2018 | Never | 2,432 | 0 | None | - |
| Hancitor/Tordal: BUILD=1204b | Apr 12th, 2017 | Never | 1,371 | 0 | None | - |
| vawtrak 305 c2s | Dec 20th, 2016 | Never | 942 | 0 | None | - |
| config thing | Aug 26th, 2016 | Never | 542 | 0 | None | - |
| IronSource new domains | Aug 19th, 2016 | Never | 255 | 0 | None | - |
| Retefe Swiss config | Jun 22nd, 2016 | Never | 1,369 | 0 | None | - |
| CryptoWall XYZ links | Mar 2nd, 2016 | Never | 801 | 0 | None | - |
| more locky | Feb 24th, 2016 | Never | 408 | 0 | None | - |
| Nymaim delivery domains | Feb 23rd, 2016 | Never | 257 | 0 | None | - |
| Cryptowall links | Feb 23rd, 2016 | Never | 176 | 0 | None | - |
| _mjllin.dll | Feb 23rd, 2016 | Never | 1,260 | 0 | None | - |
| _rcqwap_box.dll | Feb 23rd, 2016 | Never | 423 | 0 | None | - |
| Brazil banker junk | Feb 23rd, 2016 | Never | 145 | 0 | None | - |
| Locky downloads 2/18 | Feb 18th, 2016 | Never | 388 | 0 | None | - |
| Locky downloads | Feb 17th, 2016 | Never | 387 | 0 | None | - |
| Locky junk | Feb 16th, 2016 | Never | 944 | 0 | None | - |
| Teslacrypt links | Feb 9th, 2016 | Never | 342 | 0 | None | - |
| Pony -> Vawtrak links | Dec 23rd, 2015 | Never | 348 | 0 | None | - |
| Turkish TorrentLocker stuff | Aug 28th, 2015 | Never | 417 | 0 | None | - |
| CryptoWall crypt7 | Aug 10th, 2015 | Never | 1,082 | 0 | None | - |
| Cryptowall | Jun 8th, 2015 | Never | 1,157 | 0 | None | - |
| CryptoWall crypt13 | Jun 2nd, 2015 | Never | 1,844 | 0 | None | - |
| Zeus variant | Jun 2nd, 2015 | Never | 1,361 | 0 | None | - |
| Some strings | May 26th, 2015 | Never | 625 | 0 | None | - |
| Cryptowall crypt7 | May 26th, 2015 | Never | 2,124 | 0 | None | - |
| CryptoWall check-ins | May 20th, 2015 | Never | 406 | 0 | None | - |
| Geodo/Emotet config stuff | May 19th, 2015 | Never | 1,520 | 0 | None | - |
| Dridex bot 123 settings | May 12th, 2015 | Never | 599 | 0 | None | - |
| Dridex bot 122 settings | May 12th, 2015 | Never | 411 | 0 | None | - |
| Dridex bot 200 settings | May 11th, 2015 | Never | 1,603 | 0 | None | - |
| Hedsen Get_letter example | May 8th, 2015 | Never | 548 | 0 | None | - |
| Dridex bot 120 settings | May 7th, 2015 | Never | 2,176 | 0 | None | - |
| Some Dyre bit.ly links | May 4th, 2015 | Never | 551 | 0 | None | - |
| Dyre spam containing Rig EK link | May 4th, 2015 | Never | 1,421 | 0 | None | - |
| related domains | Apr 30th, 2015 | Never | 467 | 0 | None | - |
| get_letter example | Apr 30th, 2015 | Never | 1,207 | 0 | None | - |
| Dridex bot 220 settings | Apr 30th, 2015 | Never | 934 | 0 | None | - |
| Upatre campaign: TSS12 | Apr 30th, 2015 | Never | 751 | 0 | None | - |
| get_letter | Apr 23rd, 2015 | Never | 849 | 0 | None | - |
| hedsen powered dyre campaign | Apr 22nd, 2015 | Never | 809 | 0 | None | - |
| dyre/dyreza spambot sending out these urls | Apr 21st, 2015 | Never | 808 | 0 | None | - |
| andromeda stuff | Apr 16th, 2015 | Never | 486 | 0 | None | - |
| Hancitor and Dyreza hosting IP addresses | Apr 15th, 2015 | Never | 1,998 | 0 | None | - |
| decoded jjencoded upatre | Apr 10th, 2015 | Never | 495 | 0 | None | - |
| Dridex bot 200 settings | Apr 9th, 2015 | Never | 37,309 | 0 | None | - |
| Macro -> hancitor->Vawtrak dropper-> Vawtrak DLL | Apr 8th, 2015 | Never | 603 | 0 | None | - |
| Snippet of dyre config | Apr 6th, 2015 | Never | 666 | 0 | None | - |
| InstallCore domains for 4/3/2015 | Apr 3rd, 2015 | Never | 533 | 0 | None | - |
| Cryptowall | Apr 3rd, 2015 | Never | 711 | 0 | None | - |
| Dridex 125 ips | Apr 2nd, 2015 | Never | 329 | 0 | None | - |
| Dridex IPs 120 | Apr 2nd, 2015 | Never | 561 | 0 | None | - |
| Dridex bot 120 settings | Apr 2nd, 2015 | Never | 1,040 | 0 | None | - |
| Dridex 3/31/2015 for botnets 120 and 125 | Mar 31st, 2015 | Never | 899 | 0 | None | - |
