| Name / Title | Added | Expires | Hits | Comments | Syntax | |
|---|---|---|---|---|---|---|
| Hancitor 10/8/2019 | Oct 8th, 2019 | Never | 1,942 | 0 | None | - |
| Hancitor 07/01/2019 | Jul 1st, 2019 | Never | 1,884 | 0 | None | - |
| TrickBot sat10 Template | Jul 6th, 2018 | Never | 2,519 | 0 | None | - |
| Hancitor/Tordal: BUILD=1204b | Apr 12th, 2017 | Never | 1,451 | 0 | None | - |
| vawtrak 305 c2s | Dec 20th, 2016 | Never | 1,031 | 0 | None | - |
| config thing | Aug 26th, 2016 | Never | 625 | 0 | None | - |
| IronSource new domains | Aug 19th, 2016 | Never | 338 | 0 | None | - |
| Retefe Swiss config | Jun 22nd, 2016 | Never | 1,810 | 0 | None | - |
| CryptoWall XYZ links | Mar 2nd, 2016 | Never | 884 | 0 | None | - |
| more locky | Feb 24th, 2016 | Never | 502 | 0 | None | - |
| Nymaim delivery domains | Feb 23rd, 2016 | Never | 360 | 0 | None | - |
| Cryptowall links | Feb 23rd, 2016 | Never | 243 | 0 | None | - |
| _mjllin.dll | Feb 23rd, 2016 | Never | 1,348 | 0 | None | - |
| _rcqwap_box.dll | Feb 23rd, 2016 | Never | 514 | 0 | None | - |
| Brazil banker junk | Feb 23rd, 2016 | Never | 218 | 0 | None | - |
| Locky downloads 2/18 | Feb 18th, 2016 | Never | 462 | 0 | None | - |
| Locky downloads | Feb 17th, 2016 | Never | 459 | 0 | None | - |
| Locky junk | Feb 16th, 2016 | Never | 1,037 | 0 | None | - |
| Teslacrypt links | Feb 9th, 2016 | Never | 422 | 0 | None | - |
| Pony -> Vawtrak links | Dec 23rd, 2015 | Never | 437 | 0 | None | - |
| Turkish TorrentLocker stuff | Aug 28th, 2015 | Never | 493 | 0 | None | - |
| CryptoWall crypt7 | Aug 10th, 2015 | Never | 1,173 | 0 | None | - |
| Cryptowall | Jun 8th, 2015 | Never | 1,261 | 0 | None | - |
| CryptoWall crypt13 | Jun 2nd, 2015 | Never | 1,966 | 0 | None | - |
| Zeus variant | Jun 2nd, 2015 | Never | 1,537 | 0 | None | - |
| Some strings | May 26th, 2015 | Never | 708 | 0 | None | - |
| Cryptowall crypt7 | May 26th, 2015 | Never | 2,198 | 0 | None | - |
| CryptoWall check-ins | May 20th, 2015 | Never | 494 | 0 | None | - |
| Geodo/Emotet config stuff | May 19th, 2015 | Never | 1,619 | 0 | None | - |
| Dridex bot 123 settings | May 12th, 2015 | Never | 801 | 0 | None | - |
| Dridex bot 122 settings | May 12th, 2015 | Never | 501 | 0 | None | - |
| Dridex bot 200 settings | May 11th, 2015 | Never | 1,698 | 0 | None | - |
| Hedsen Get_letter example | May 8th, 2015 | Never | 642 | 0 | None | - |
| Dridex bot 120 settings | May 7th, 2015 | Never | 2,266 | 0 | None | - |
| Some Dyre bit.ly links | May 4th, 2015 | Never | 623 | 0 | None | - |
| Dyre spam containing Rig EK link | May 4th, 2015 | Never | 1,496 | 0 | None | - |
| related domains | Apr 30th, 2015 | Never | 555 | 0 | None | - |
| get_letter example | Apr 30th, 2015 | Never | 1,291 | 0 | None | - |
| Dridex bot 220 settings | Apr 30th, 2015 | Never | 1,043 | 0 | None | - |
| Upatre campaign: TSS12 | Apr 30th, 2015 | Never | 835 | 0 | None | - |
| get_letter | Apr 23rd, 2015 | Never | 964 | 0 | None | - |
| hedsen powered dyre campaign | Apr 22nd, 2015 | Never | 893 | 0 | None | - |
| dyre/dyreza spambot sending out these urls | Apr 21st, 2015 | Never | 892 | 0 | None | - |
| andromeda stuff | Apr 16th, 2015 | Never | 571 | 0 | None | - |
| Hancitor and Dyreza hosting IP addresses | Apr 15th, 2015 | Never | 2,089 | 0 | None | - |
| decoded jjencoded upatre | Apr 10th, 2015 | Never | 565 | 0 | None | - |
| Dridex bot 200 settings | Apr 9th, 2015 | Never | 44,952 | 13 | None | - |
| Macro -> hancitor->Vawtrak dropper-> Vawtrak DLL | Apr 8th, 2015 | Never | 682 | 0 | None | - |
| Snippet of dyre config | Apr 6th, 2015 | Never | 756 | 0 | None | - |
| InstallCore domains for 4/3/2015 | Apr 3rd, 2015 | Never | 617 | 0 | None | - |
| Cryptowall | Apr 3rd, 2015 | Never | 793 | 0 | None | - |
| Dridex 125 ips | Apr 2nd, 2015 | Never | 398 | 0 | None | - |
| Dridex IPs 120 | Apr 2nd, 2015 | Never | 641 | 0 | None | - |
| Dridex bot 120 settings | Apr 2nd, 2015 | Never | 1,140 | 0 | None | - |
| Dridex 3/31/2015 for botnets 120 and 125 | Mar 31st, 2015 | Never | 971 | 0 | None | - |
