| Name / Title | Added | Expires | Hits | Comments | Syntax | |
|---|---|---|---|---|---|---|
| Hancitor 10/8/2019 | Oct 8th, 2019 | Never | 1,907 | 0 | None | - |
| Hancitor 07/01/2019 | Jul 1st, 2019 | Never | 1,854 | 0 | None | - |
| TrickBot sat10 Template | Jul 6th, 2018 | Never | 2,491 | 0 | None | - |
| Hancitor/Tordal: BUILD=1204b | Apr 12th, 2017 | Never | 1,421 | 0 | None | - |
| vawtrak 305 c2s | Dec 20th, 2016 | Never | 1,004 | 0 | None | - |
| config thing | Aug 26th, 2016 | Never | 598 | 0 | None | - |
| IronSource new domains | Aug 19th, 2016 | Never | 310 | 0 | None | - |
| Retefe Swiss config | Jun 22nd, 2016 | Never | 1,777 | 0 | None | - |
| CryptoWall XYZ links | Mar 2nd, 2016 | Never | 852 | 0 | None | - |
| more locky | Feb 24th, 2016 | Never | 476 | 0 | None | - |
| Nymaim delivery domains | Feb 23rd, 2016 | Never | 328 | 0 | None | - |
| Cryptowall links | Feb 23rd, 2016 | Never | 215 | 0 | None | - |
| _mjllin.dll | Feb 23rd, 2016 | Never | 1,322 | 0 | None | - |
| _rcqwap_box.dll | Feb 23rd, 2016 | Never | 490 | 0 | None | - |
| Brazil banker junk | Feb 23rd, 2016 | Never | 195 | 0 | None | - |
| Locky downloads 2/18 | Feb 18th, 2016 | Never | 436 | 0 | None | - |
| Locky downloads | Feb 17th, 2016 | Never | 426 | 0 | None | - |
| Locky junk | Feb 16th, 2016 | Never | 1,005 | 0 | None | - |
| Teslacrypt links | Feb 9th, 2016 | Never | 393 | 0 | None | - |
| Pony -> Vawtrak links | Dec 23rd, 2015 | Never | 410 | 0 | None | - |
| Turkish TorrentLocker stuff | Aug 28th, 2015 | Never | 464 | 0 | None | - |
| CryptoWall crypt7 | Aug 10th, 2015 | Never | 1,139 | 0 | None | - |
| Cryptowall | Jun 8th, 2015 | Never | 1,225 | 0 | None | - |
| CryptoWall crypt13 | Jun 2nd, 2015 | Never | 1,914 | 0 | None | - |
| Zeus variant | Jun 2nd, 2015 | Never | 1,496 | 0 | None | - |
| Some strings | May 26th, 2015 | Never | 676 | 0 | None | - |
| Cryptowall crypt7 | May 26th, 2015 | Never | 2,176 | 0 | None | - |
| CryptoWall check-ins | May 20th, 2015 | Never | 460 | 0 | None | - |
| Geodo/Emotet config stuff | May 19th, 2015 | Never | 1,577 | 0 | None | - |
| Dridex bot 123 settings | May 12th, 2015 | Never | 770 | 0 | None | - |
| Dridex bot 122 settings | May 12th, 2015 | Never | 470 | 0 | None | - |
| Dridex bot 200 settings | May 11th, 2015 | Never | 1,669 | 0 | None | - |
| Hedsen Get_letter example | May 8th, 2015 | Never | 610 | 0 | None | - |
| Dridex bot 120 settings | May 7th, 2015 | Never | 2,236 | 0 | None | - |
| Some Dyre bit.ly links | May 4th, 2015 | Never | 597 | 0 | None | - |
| Dyre spam containing Rig EK link | May 4th, 2015 | Never | 1,467 | 0 | None | - |
| related domains | Apr 30th, 2015 | Never | 518 | 0 | None | - |
| get_letter example | Apr 30th, 2015 | Never | 1,256 | 0 | None | - |
| Dridex bot 220 settings | Apr 30th, 2015 | Never | 1,014 | 0 | None | - |
| Upatre campaign: TSS12 | Apr 30th, 2015 | Never | 808 | 0 | None | - |
| get_letter | Apr 23rd, 2015 | Never | 907 | 0 | None | - |
| hedsen powered dyre campaign | Apr 22nd, 2015 | Never | 862 | 0 | None | - |
| dyre/dyreza spambot sending out these urls | Apr 21st, 2015 | Never | 861 | 0 | None | - |
| andromeda stuff | Apr 16th, 2015 | Never | 540 | 0 | None | - |
| Hancitor and Dyreza hosting IP addresses | Apr 15th, 2015 | Never | 2,050 | 0 | None | - |
| decoded jjencoded upatre | Apr 10th, 2015 | Never | 538 | 0 | None | - |
| Dridex bot 200 settings | Apr 9th, 2015 | Never | 44,346 | 13 | None | - |
| Macro -> hancitor->Vawtrak dropper-> Vawtrak DLL | Apr 8th, 2015 | Never | 661 | 0 | None | - |
| Snippet of dyre config | Apr 6th, 2015 | Never | 720 | 0 | None | - |
| InstallCore domains for 4/3/2015 | Apr 3rd, 2015 | Never | 586 | 0 | None | - |
| Cryptowall | Apr 3rd, 2015 | Never | 762 | 0 | None | - |
| Dridex 125 ips | Apr 2nd, 2015 | Never | 375 | 0 | None | - |
| Dridex IPs 120 | Apr 2nd, 2015 | Never | 610 | 0 | None | - |
| Dridex bot 120 settings | Apr 2nd, 2015 | Never | 1,105 | 0 | None | - |
| Dridex 3/31/2015 for botnets 120 and 125 | Mar 31st, 2015 | Never | 945 | 0 | None | - |
