BlackTech_IOCs {
  meta:
    creator = "Cpl Iverson"
    date = "2025-01-12"
    description = "Suspicious IPs, Hashes, and Domains"
    apt_group = "BlackTech"
  strings:
    $ip_59_124_71_29 = "59.124.71.29"
    $ip_61_56_11_42 = "61.56.11.42"
    $ip_210_242_211_175 = "210.242.211.175"
    $ip_114_27_132_233 = "114.27.132.233"
    $ip_122_117_107_178 = "122.117.107.178"
    $ip_59_125_132_175 = "59.125.132.175"
    $ip_211_23_191_4 = "211.23.191.4"
    $ip_220_132_50_81 = "220.132.50.81"
    $ip_61_222_32_205 = "61.222.32.205"
    $ip_220_134_98_3 = "220.134.98.3"
    $ip_1_170_118_233 = "1.170.118.233"
    $ip_60_251_199_226 = "60.251.199.226"
    $ip_123_110_131_86 = "123.110.131.86"
    $ip_59_120_169_51 = "59.120.169.51"
    $ip_220_133_73_13 = "220.133.73.13"
    $ip_220_134_10_17 = "220.134.10.17"
    $ip_60_249_208_167 = "60.249.208.167"
    $ip_118_163_168_223 = "118.163.168.223"
    $ip_111_249_102_102 = "111.249.102.102"
    $ip_61_58_90_11 = "61.58.90.11"
    $ip_125_227_225_181 = "125.227.225.181"
    $ip_118_163_14_17 = "118.163.14.17"
    $ip_122_147_248_69 = "122.147.248.69"
    $ip_125_227_241_2 = "125.227.241.2"
    $ip_114_39_59_244 = "114.39.59.244"
    $ip_59_125_7_185 = "59.125.7.185"
    $ip_61_219_96_18 = "61.219.96.18"
    $ip_61_58_90_63 = "61.58.90.63"
    $ip_210_67_101_84 = "210.67.101.84"
    $ip_203_74_123_121 = "203.74.123.121"
    $ip_18_163_14_17 = "18.163.14.17"
    $ip_177_135_177_54 = "177.135.177.54"
    $md5_34a0be585725b0076e017c8fcb0fc180 = "34a0be585725b0076e017c8fcb0fc180"
    $md5_1423e253f7a8954ca3c74432b5e4d038 = "1423e253f7a8954ca3c74432b5e4d038"
    $md5_b7bf246b1481b24ff262cd03c53caf15 = "b7bf246b1481b24ff262cd03c53caf15"
    $md5_fda02aaff2ea8c91283f1041257cf36f = "fda02aaff2ea8c91283f1041257cf36f"
    $md5_3d341703a981388b3fde70173a172f89 = "3d341703a981388b3fde70173a172f89"
    $md5_59e9af5b230f46df15e076cd6dd82d1e = "59e9af5b230f46df15e076cd6dd82d1e"
    $md5_bd917f5ac3dc380a6fc53c60c9223deb = "bd917f5ac3dc380a6fc53c60c9223deb"
    $md5_e5c8b3017d309a7383c9504d7e318596 = "e5c8b3017d309a7383c9504d7e318596"
    $md5_926f008ef342ae1cc138687ff68a424a = "926f008ef342ae1cc138687ff68a424a"
    $md5_1c460850b55125a7d1f554ee0203fa25 = "1c460850b55125a7d1f554ee0203fa25"
    $md5_65f4245e3e7f80c47c7e5b7aa23c5920 = "65f4245e3e7f80c47c7e5b7aa23c5920"
    $md5_2a94c32c20dd4632e0a5084b134e6344 = "2a94c32c20dd4632e0a5084b134e6344"
    $md5_cc18bdaf99fa701796518db86e651702 = "cc18bdaf99fa701796518db86e651702"
    $md5_6a97ff47b8d715be62305ff15fb47332 = "6a97ff47b8d715be62305ff15fb47332"
    $md5_9bb0135b4808331933490d4749d30c11 = "9bb0135b4808331933490d4749d30c11"
    $md5_ab9b323901bcf38b8b990db3cae2b596 = "ab9b323901bcf38b8b990db3cae2b596"
    $md5_87af1c51d21d13899db75f675b1faa87 = "87af1c51d21d13899db75f675b1faa87"
    $md5_dc2b8aefe8bd08f196ea7a6f0caa2764 = "dc2b8aefe8bd08f196ea7a6f0caa2764"
    $md5_cad875330c25231211fc9a416c3846b7 = "cad875330c25231211fc9a416c3846b7"
    $md5_019ef03e6b34991c31518ceafa3c6498 = "019ef03e6b34991c31518ceafa3c6498"
    $md5_0db2c1195c97fc909b6fdb4b09227457 = "0db2c1195c97fc909b6fdb4b09227457"
    $md5_eae2ea929c754a6d65e2b216e5d32e7a = "eae2ea929c754a6d65e2b216e5d32e7a"
    $md5_a11d30dcfb8cedcb56dad172b213f388 = "a11d30dcfb8cedcb56dad172b213f388"
    $md5_5694a226f66e3b07aeb188a54304b371 = "5694a226f66e3b07aeb188a54304b371"
    $md5_b04fab560ac090e0ff3f1c602f3fcfd7 = "b04fab560ac090e0ff3f1c602f3fcfd7"
    $md5_299d0c5f43e59fc9415d70816aee56c6 = "299d0c5f43e59fc9415d70816aee56c6"
    $md5_296dcc2bd1f6359466ff068c8001bbec = "296dcc2bd1f6359466ff068c8001bbec"
    $md5_5a7d8fe286333416796cefc19b0f5cba = "5a7d8fe286333416796cefc19b0f5cba"
    $md5_57c0114780d2860a3adbae095c72a97d = "57c0114780d2860a3adbae095c72a97d"
    $md5_6b18b1e939e5a06303220ee16f045a50 = "6b18b1e939e5a06303220ee16f045a50"
    $md5_062bcc4ed28b41bab70d7efc2e8b1b11 = "062bcc4ed28b41bab70d7efc2e8b1b11"
    $md5_3214cdac71fa4313d195eb81eace4db8 = "3214cdac71fa4313d195eb81eace4db8"
    $md5_1fe7391ac994bf37d7ccb9c7358c4419 = "1fe7391ac994bf37d7ccb9c7358c4419"
    $md5_1134972f093ab1ef08b912cabbc43b39 = "1134972f093ab1ef08b912cabbc43b39"
    $md5_b2559336f0e73830a411ce6032474d6e = "b2559336f0e73830a411ce6032474d6e"
    $md5_f0c1cc799d56d58f528f41039895f8f8 = "f0c1cc799d56d58f528f41039895f8f8"
    $md5_65a4384fcbe3d010a57a8530b27e0a4e = "65a4384fcbe3d010a57a8530b27e0a4e"
    $md5_7a00205cdb74c1d5811cc3c44739a348 = "7a00205cdb74c1d5811cc3c44739a348"
    $md5_6ea02a64df51ab2f12530ffd2e3688de = "6ea02a64df51ab2f12530ffd2e3688de"
    $md5_5699884869d8796ab33416c3af5305a2 = "5699884869d8796ab33416c3af5305a2"
    $md5_4085f90f6934422921bd8602f0a975c0 = "4085f90f6934422921bd8602f0a975c0"
    $md5_fa4bb0c43fcfaaa4d98d6322c376281d = "fa4bb0c43fcfaaa4d98d6322c376281d"
    $md5_18c409071622553a1d66e0a02d261f7f = "18c409071622553a1d66e0a02d261f7f"
    $md5_d39b01a44f1487c4bb3c68a528438144 = "d39b01a44f1487c4bb3c68a528438144"
    $md5_b9b6488f990a96a1c2f5c3e99a43a212 = "b9b6488f990a96a1c2f5c3e99a43a212"
    $md5_737c6923effeee58717f613db304955a = "737c6923effeee58717f613db304955a"
    $md5_662edc1100e2d8863bf713ae47985245 = "662edc1100e2d8863bf713ae47985245"
    $md5_5f06d234fc285ee9f127f95206696796 = "5f06d234fc285ee9f127f95206696796"
    $md5_96be4a1c418f10c50659bab0b25b9115 = "96be4a1c418f10c50659bab0b25b9115"
    $md5_34e38d4b970be9f19b6f29c83023b498 = "34e38d4b970be9f19b6f29c83023b498"
    $md5_73fabddce8887d0253503daa4a50fdf7 = "73fabddce8887d0253503daa4a50fdf7"
    $md5_64ec5419edd9ff050d839845a0a5bea3 = "64ec5419edd9ff050d839845a0a5bea3"
    $md5_5633009e7ce55be0213e76c74fdcf9d6 = "5633009e7ce55be0213e76c74fdcf9d6"
    $md5_cab9d743c0868f7edfe11fa9fb99262b = "cab9d743c0868f7edfe11fa9fb99262b"
    $md5_8a81e6a62d3bdcffe074807d7173840f = "8a81e6a62d3bdcffe074807d7173840f"
    $md5_7a1b0e86d2c7da3f52c74a4ce4b675af = "7a1b0e86d2c7da3f52c74a4ce4b675af"
    $md5_7745f7a89aa20da8d681fee4f25741df = "7745f7a89aa20da8d681fee4f25741df"
    $md5_5fc4a20161b6d95d5bd0c0567472c4b0 = "5fc4a20161b6d95d5bd0c0567472c4b0"
    $md5_9e529a8fbc25cc73bafc1e9d881f320f = "9e529a8fbc25cc73bafc1e9d881f320f"
    $md5_9b6f818f769655c8618ae0420bc994ec = "9b6f818f769655c8618ae0420bc994ec"
    $md5_8edf98a3e38cf8e2a5414f2ff9a1c2a6 = "8edf98a3e38cf8e2a5414f2ff9a1c2a6"
    $md5_ea1a6799ee02bcadf70b34f7801e525f = "ea1a6799ee02bcadf70b34f7801e525f"
    $md5_259ce74e8a6ddc2507efa64371f3d45e = "259ce74e8a6ddc2507efa64371f3d45e"
    $md5_6d355a4339f92d6056f2708194213440 = "6d355a4339f92d6056f2708194213440"
    $md5_76055e90b1e1e9d67139c7645c21092e = "76055e90b1e1e9d67139c7645c21092e"
    $md5_0929230644a301857bac09379257883a = "0929230644a301857bac09379257883a"
    $md5_22ede86834e0060a88d6f45ce3982277 = "22ede86834e0060a88d6f45ce3982277"
    $md5_ec7c6b43beec56df72cb74dd28b5b1d2 = "ec7c6b43beec56df72cb74dd28b5b1d2"
    $md5_76b464c98790d8f01e02d24b53f4486d = "76b464c98790d8f01e02d24b53f4486d"
    $md5_93b68ae2023940bb2e8506d6131d9d27 = "93b68ae2023940bb2e8506d6131d9d27"
    $md5_289286f8289b707d41e74a199a88be64 = "289286f8289b707d41e74a199a88be64"
    $md5_97fdb683e7b56bdf198d2b4c0e9b2715 = "97fdb683e7b56bdf198d2b4c0e9b2715"
    $md5_70b31b12a5ba644de0093970af9866b8 = "70b31b12a5ba644de0093970af9866b8"
    $md5_2267326efac998fa4ddbc7d8e3940c0d = "2267326efac998fa4ddbc7d8e3940c0d"
    $md5_6c145f1ad75de785a75903a4a5d485e8 = "6c145f1ad75de785a75903a4a5d485e8"
    $md5_28da4707d69de5cc3d544d6a90fff8ff = "28da4707d69de5cc3d544d6a90fff8ff"
    $md5_4446ba673bc5c2adf31823301a4fdd3a = "4446ba673bc5c2adf31823301a4fdd3a"
    $md5_37bf2df225650b39c9874ecf392a9a9b = "37bf2df225650b39c9874ecf392a9a9b"
    $md5_976f0e7d1b1d5a4c5dc3f714885134dd = "976f0e7d1b1d5a4c5dc3f714885134dd"
    $md5_468571266346f4b659b948a67e8ab005 = "468571266346f4b659b948a67e8ab005"
    $md5_1d87a00f54a16f9c0ee135731296eb58 = "1d87a00f54a16f9c0ee135731296eb58"
    $md5_8820d713e7052abe411cccb92c365783 = "8820d713e7052abe411cccb92c365783"
    $md5_f77bd5d0d0b85c0fb2f986d952891071 = "f77bd5d0d0b85c0fb2f986d952891071"
    $md5_410ceb4d5008887a66587130d57adeee = "410ceb4d5008887a66587130d57adeee"
    $md5_09d1ebf1a6c10083f8d66003418e6e06 = "09d1ebf1a6c10083f8d66003418e6e06"
    $md5_9d014bc00ecb311db63beeadf0d8bb19 = "9d014bc00ecb311db63beeadf0d8bb19"
    $md5_5b83dcd3f6615e9b18104088523eaaf3 = "5b83dcd3f6615e9b18104088523eaaf3"
    $md5_3d356c2d84c39bab9fcb1fea1a132f6a = "3d356c2d84c39bab9fcb1fea1a132f6a"
    $md5_e448666cf15651eff32e7296f2f57206 = "e448666cf15651eff32e7296f2f57206"
    $md5_b3dfe482568c508bc21f8da8a291f2cd = "b3dfe482568c508bc21f8da8a291f2cd"
    $md5_5e72bcafef281999bafeff7b9085dc7c = "5e72bcafef281999bafeff7b9085dc7c"
    $md5_01a916c6863f98d8126bb75a4f291a5d = "01a916c6863f98d8126bb75a4f291a5d"
    $md5_47a0e644aae76b040aaecf7f7b75404b = "47a0e644aae76b040aaecf7f7b75404b"
    $md5_c56f890e9a3e4d9ffd2aba80d95b2f89 = "c56f890e9a3e4d9ffd2aba80d95b2f89"
    $md5_8d31ebecdf790a80175d358212b3dd19 = "8d31ebecdf790a80175d358212b3dd19"
    $md5_a735b9c81e6cffd576abd914cc635aea = "a735b9c81e6cffd576abd914cc635aea"
    $md5_a2bfef210952aa4177ec03000b231228 = "a2bfef210952aa4177ec03000b231228"
    $md5_791dbd6071c8d5e04fcaad95b9b6a039 = "791dbd6071c8d5e04fcaad95b9b6a039"
    $md5_089d583667b28c2182be1b65b74c2ffb = "089d583667b28c2182be1b65b74c2ffb"
    $md5_b0969efc34fe6d06542942b14295305b = "b0969efc34fe6d06542942b14295305b"
    $md5_601a4718678a290c004b531b498e40fa = "601a4718678a290c004b531b498e40fa"
    $md5_811ad8d894c461c446843de4a9a3fd42 = "811ad8d894c461c446843de4a9a3fd42"
    $md5_dcd88df79393a92bbf29824580649d0c = "dcd88df79393a92bbf29824580649d0c"
    $md5_18ca4159820c1766f358de2ffc92a271 = "18ca4159820c1766f358de2ffc92a271"
    $md5_50ee06096d78ca5eff8d19de8aacf76e = "50ee06096d78ca5eff8d19de8aacf76e"
    $md5_fd016b952c98a8be9c51c44d2a288c71 = "fd016b952c98a8be9c51c44d2a288c71"
    $md5_3470568793761e75d72eb0c99a4bb6ec = "3470568793761e75d72eb0c99a4bb6ec"
    $md5_cb612bd16abae8bdbd551e78278988f4 = "cb612bd16abae8bdbd551e78278988f4"
    $md5_cea5d1fcf92da7212bcdc2989a3518e7 = "cea5d1fcf92da7212bcdc2989a3518e7"
    $md5_7d166e7a86084eeae5f42211ace8622c = "7d166e7a86084eeae5f42211ace8622c"
    $md5_69d83dd95abf0f3e9cccaf30d909d8ab = "69d83dd95abf0f3e9cccaf30d909d8ab"
    $md5_f7675431685701edb506ffebc182f6ef = "f7675431685701edb506ffebc182f6ef"
    $md5_4bcb99623c05fc2abaa1b4090b0bee6c = "4bcb99623c05fc2abaa1b4090b0bee6c"
    $md5_c6e098547bace9c4844dd99230a525b8 = "c6e098547bace9c4844dd99230a525b8"
    $md5_5bb14699b14e48608d43f51c56b88a04 = "5bb14699b14e48608d43f51c56b88a04"
    $md5_1c00baebd1d2979a1009652dbc58c1fd = "1c00baebd1d2979a1009652dbc58c1fd"
    $md5_87375cc6cdf60fc92c973ca984946e7f = "87375cc6cdf60fc92c973ca984946e7f"
    $md5_3406ce96eaafd68fa469af2409ad6ffe = "3406ce96eaafd68fa469af2409ad6ffe"
    $md5_dee1f09ef83a041555ce8b1f3effab01 = "dee1f09ef83a041555ce8b1f3effab01"
    $md5_c40b172d7e99335e1724dc8ba18a42d7 = "c40b172d7e99335e1724dc8ba18a42d7"
    $md5_04a420981c8724b654b30ecb13a1b9a5 = "04a420981c8724b654b30ecb13a1b9a5"
    $md5_402627c57c6127187c7ee1ba9b4e11ad = "402627c57c6127187c7ee1ba9b4e11ad"
    $md5_413a34cb61e954c4e82a63875cce9a67 = "413a34cb61e954c4e82a63875cce9a67"
    $md5_87835a271ff098d7a0a44e45be83a9d8 = "87835a271ff098d7a0a44e45be83a9d8"
    $md5_7f84dea46b4e29911604a2afaf1c57ab = "7f84dea46b4e29911604a2afaf1c57ab"
    $md5_9c863613cc5890067a9733eb15cf749e = "9c863613cc5890067a9733eb15cf749e"
    $md5_61d318aacfd97961a9248f696025177e = "61d318aacfd97961a9248f696025177e"
    $md5_23b1717f7690f2670585ce42abcf07c0 = "23b1717f7690f2670585ce42abcf07c0"
    $md5_e5761a294e7955bf234f7dd38b980633 = "e5761a294e7955bf234f7dd38b980633"
    $md5_7021e319704ba7bddcdc37716a5c879e = "7021e319704ba7bddcdc37716a5c879e"
    $md5_f60de91238d965455629b12694fb9dbc = "f60de91238d965455629b12694fb9dbc"
    $md5_7ca58dd5daa70dd5dc278070512eb394 = "7ca58dd5daa70dd5dc278070512eb394"
    $md5_391974cd1e5338938faf7f9a22ee3bf5 = "391974cd1e5338938faf7f9a22ee3bf5"
    $md5_842e7ed1d9a3148c706e2f5e80e01735 = "842e7ed1d9a3148c706e2f5e80e01735"
    $md5_45ed3086b3d03b253f8746a174a060d1 = "45ed3086b3d03b253f8746a174a060d1"
    $md5_639637d46f64f4e0164e704be98c7c67 = "639637d46f64f4e0164e704be98c7c67"
    $md5_2a233c4f6571a2fc3342d6edf3c1e98d = "2a233c4f6571a2fc3342d6edf3c1e98d"
    $md5_77e8503f721a715a5309f89c88f1da8c = "77e8503f721a715a5309f89c88f1da8c"
    $md5_6b022a8cea1bd0e3b511961c7f12da0e = "6b022a8cea1bd0e3b511961c7f12da0e"
    $md5_5bc08352ad0ca4b3727bd7c509515693 = "5bc08352ad0ca4b3727bd7c509515693"
    $md5_dbeb16d8745a9b9b0daf946d2caecae0 = "dbeb16d8745a9b9b0daf946d2caecae0"
    $md5_3da2ad2d32f02172623cc5dfb342e43c = "3da2ad2d32f02172623cc5dfb342e43c"
    $md5_c288f4729f7cdce991dcf7c2b156e854 = "c288f4729f7cdce991dcf7c2b156e854"
    $md5_acc03ef1eef25c397972ae27087621a6 = "acc03ef1eef25c397972ae27087621a6"
    $md5_63d453db999cb3a9b388180b7364d43c = "63d453db999cb3a9b388180b7364d43c"
    $md5_89eb892d945034e549118cda2120c17d = "89eb892d945034e549118cda2120c17d"
    $md5_d016d961bf0cf4b3aec5619b1b5ebc60 = "d016d961bf0cf4b3aec5619b1b5ebc60"
    $md5_17cece9c7bbe0c2d6c37056742a7a7e9 = "17cece9c7bbe0c2d6c37056742a7a7e9"
    $md5_c6c5b4de5cc10418e2f14305d6541bd4 = "c6c5b4de5cc10418e2f14305d6541bd4"
    $md5_b90b0ff065be669d4d882a2861115ea5 = "b90b0ff065be669d4d882a2861115ea5"
    $md5_5708d6c871e56833020be00fcac9b4fa = "5708d6c871e56833020be00fcac9b4fa"
    $md5_cfc48c66c7630653faa136ba83617cb0 = "cfc48c66c7630653faa136ba83617cb0"
    $md5_8c2e717c09cee5234bec059decc04fbc = "8c2e717c09cee5234bec059decc04fbc"
    $md5_03823081d5de20d03cf85259ae7ee47c = "03823081d5de20d03cf85259ae7ee47c"
    $md5_cf128ba5945102e1b1a089032f2e4bc1 = "cf128ba5945102e1b1a089032f2e4bc1"
    $md5_b14f8f099e4ebbaf4312eb86d739267f = "b14f8f099e4ebbaf4312eb86d739267f"
    $md5_3b30e94191d82f3566de058a60c4ce41 = "3b30e94191d82f3566de058a60c4ce41"
    $md5_f5cce3e8c5d8d24edca83ae34d505d61 = "f5cce3e8c5d8d24edca83ae34d505d61"
    $md5_32549e52c76cacf4a4725340c5eaaabd = "32549e52c76cacf4a4725340c5eaaabd"
    $md5_0fd48bd160854bea6e9df66a9451b9ed = "0fd48bd160854bea6e9df66a9451b9ed"
    $md5_ea475f5a99ae4f81d23be81bdcfbb6ac = "ea475f5a99ae4f81d23be81bdcfbb6ac"
    $md5_123a97612de9089409ad512f3bb2379a = "123a97612de9089409ad512f3bb2379a"
    $md5_808e8a7ff27e284bbd07cee65403b66c = "808e8a7ff27e284bbd07cee65403b66c"
    $md5_73993f9f448449f0c5c6977664cfd8fa = "73993f9f448449f0c5c6977664cfd8fa"
    $md5_58ebad50377af27347a4a216625ec8c7 = "58ebad50377af27347a4a216625ec8c7"
    $md5_bc6b1264f9dfebdde7a4b94ff0f61c83 = "bc6b1264f9dfebdde7a4b94ff0f61c83"
    $md5_593d2f1113836a49cb27cef3ce699933 = "593d2f1113836a49cb27cef3ce699933"
    $md5_463d74f0085a613c44dc9ded28ba903d = "463d74f0085a613c44dc9ded28ba903d"
    $md5_c74a645b0a52812f026f5cfe6d168f40 = "c74a645b0a52812f026f5cfe6d168f40"
    $md5_69b4467e347dcf360ef7d2dd2a869601 = "69b4467e347dcf360ef7d2dd2a869601"
    $md5_7163a7326321ce88f14c2156c29f8386 = "7163a7326321ce88f14c2156c29f8386"
    $md5_73add080471429445ecba08d95f03b01 = "73add080471429445ecba08d95f03b01"
    $md5_4892a108c084f7471b601194957ec431 = "4892a108c084f7471b601194957ec431"
    $md5_0fbf6146e6478d9a6945341a45885400 = "0fbf6146e6478d9a6945341a45885400"
    $md5_6ff0374bf169ddedaf2654c94b985617 = "6ff0374bf169ddedaf2654c94b985617"
    $md5_c64778a2ddcc66db666e63ca6781ef3f = "c64778a2ddcc66db666e63ca6781ef3f"
    $md5_462372c1f7f27ad12cc452dbb3358122 = "462372c1f7f27ad12cc452dbb3358122"
    $md5_a6b48f5675c55b124908dd11635919ac = "a6b48f5675c55b124908dd11635919ac"
    $md5_79f1af23d5ab729a3071d1f4c2a0606f = "79f1af23d5ab729a3071d1f4c2a0606f"
    $domain_ting_qpoe_com = "ting.qpoe.com"
    $domain_moutain_onmypc_org = "moutain.onmypc.org"
    $domain_cust_compradecedines_com_ar = "cust.compradecedines.com.ar"
    $domain_cecs_ben-wan_com = "cecs.ben-wan.com"
    $domain_edit_ctotw_tw = "edit.ctotw.tw"
    $domain_rio_onmypc_org = "rio.onmypc.org"
    $domain_techlawilo_effers_com = "techlawilo.effers.com"
    $domain_moc_mrface_com = "moc.mrface.com"
    $domain_every_b0ne_com = "every.b0ne.com"
    $domain_usamovie_mylftv_com = "usamovie.mylftv.com"
    $domain_applestore_dnset_com = "applestore.dnset.com"
    $domain_fastnews_ezua_com = "fastnews.ezua.com"
    $domain_accounts_fartit_com = "accounts.fartit.com"
    $domain_music_ftp_sh = "music.ftp.sh"
    $domain_ikwb55_ikwb_com = "ikwb55.ikwb.com"
    $domain_pcphoto_servehalflife_com = "pcphoto.servehalflife.com"
    $domain_festival_lflinkup_net = "festival.lflinkup.net"
    $domain_kh7710103_qnoddns_org_cn = "kh7710103.qnoddns.org.cn"
    $domain_soo_dtdns_net = "soo.dtdns.net"
    $domain_sysinfo_itemdb_com = "sysinfo.itemdb.com"
    $domain_injure_ignorelist_com = "injure.ignorelist.com"
    $domain_linenews_mypicure_info = "linenews.mypicure.info"
    $domain_forums_happyforever_com = "forums.happyforever.com"
    $domain_showgirls_mooo_com = "showgirls.mooo.com"
    $domain_dcns_chickenkiller_com = "dcns.chickenkiller.com"
    $domain_xuite_myMom_info = "xuite.myMom.info"
    $domain_kukupy_chatnook_com = "kukupy.chatnook.com"
    $domain_support_bonbonkids_hk = "support.bonbonkids.hk"
    $domain_tabf_garrarufaworld_com = "tabf.garrarufaworld.com"
    $domain_hehagame_Got-Game_org = "hehagame.Got-Game.org"
    $domain_newspaper_otzo_com = "newspaper.otzo.com"
    $domain_greeting_hopewill_com = "greeting.hopewill.com"
    $domain_picture_diohwm_com = "picture.diohwm.com"
    $domain_npa_dynamicdns_org_uk = "npa.dynamicdns.org.uk"
    $domain_formosa_happyforever_com = "formosa.happyforever.com"
    $domain_moea_crabdance_com = "moea.crabdance.com"
    $domain_subnotes_ignorelist_com = "subnotes.ignorelist.com"
    $domain_forums_toythieves_com = "forums.toythieves.com"
    $domain_paperspot_wikaba_com = "paperspot.wikaba.com"
    $domain_firstme_mysecondarydns_com = "firstme.mysecondarydns.com"
    $domain_nspo_itaiwans_com = "nspo.itaiwans.com"
    $domain_asus_strangled_net = "asus.strangled.net"
    $domain_freeonshop_x24hr_com = "freeonshop.x24hr.com"
    $domain_mirdc_happyforever_com = "mirdc.happyforever.com"
    $domain_job_jobical_com = "job.jobical.com"
    $domain_hinet_homenet_org = "hinet.homenet.org"
    $domain_cypd_slyip_com = "cypd.slyip.com"
    $domain_picture_brogrammer_org = "picture.brogrammer.org"
    $domain_17ublig_1dumb_com = "17ublig.1dumb.com"
    $domain_cert_dynet_com = "cert.dynet.com"
    $domain_cwb_soportetechmdp_com_ar = "cwb.soportetechmdp.com.ar"
    $domain_zing_youdontcare_com = "zing.youdontcare.com"
    $domain_mozila_strangled_net = "mozila.strangled.net"
    $domain_tios_nsicscores_com = "tios.nsicscores.com"
    $domain_setting_herbalsolo_com = "setting.herbalsolo.com"
    $domain_pictures_wasson_com = "pictures.wasson.com"
    $domain_jog_punked_us = "jog.punked.us"
    $domain_pictures_happyforever_com = "pictures.happyforever.com"
    $domain_superapple_sendsmtp_com = "superapple.sendsmtp.com"
    $domain_rdec_compress_to = "rdec.compress.to"
    $domain_timehigh_ddns_info = "timehigh.ddns.info"
    $domain_amazon_otzo_com = "amazon.otzo.com"
    $domain_teacher_yahoomit_com = "teacher.yahoomit.com"
    $domain_dream_wikaba_com = "dream.wikaba.com"
    $domain_webmail_24-7_ro = "webmail.24-7.ro"
    $domain_av100_mynetav_net = "av100.mynetav.net"
    $domain_yahoo_zzux_com = "yahoo.zzux.com"
    $domain_zip_zyns_com = "zip.zyns.com"
    $domain_avira_justdied_com = "avira.justdied.com"
    $domain_dwnic_crabdance_com = "dwnic.crabdance.com"
    $domain_africa_themafia_info = "africa.themafia.info"
    $domain_wordhasword_darktech_org = "wordhasword.darktech.org"
    $domain_techlaw_linestw_com = "techlaw.linestw.com"
    $domain_webey_sbfhome_net = "webey.sbfhome.net"
    $domain_twcert_compress_to = "twcert.compress.to"
    $domain_INetGIS_faceboktw_com = "INetGIS.faceboktw.com"
    $domain_idb_jamescyoung_com = "idb.jamescyoung.com"
    $domain_icst_compress_to = "icst.compress.to"
    $domain_needjustword_bbsindex_com = "needjustword.bbsindex.com"
    $domain_blognews_onmypc_org = "blognews.onmypc.org"
    $domain_su27_oCry_com = "su27.oCry.com"
    $domain_dcns_soniceducation_com = "dcns.soniceducation.com"
    $domain_front_fartit_com = "front.fartit.com"
    $domain_sushow_xxuz_com = "sushow.xxuz.com"
    $domain_motc_linestw_com = "motc.linestw.com"
    $domain_facebook_itsaol_com = "facebook.itsaol.com"
    $domain_tw_chatnook_com = "tw.chatnook.com"
    $domain_newpower_jkub_com = "newpower.jkub.com"
    $domain_boe_pixarworks_com = "boe.pixarworks.com"
    $domain_docsedit_cleansite_us = "docsedit.cleansite.us"
    $domain_wendy_uberleet_com = "wendy.uberleet.com"
    $domain_flog_pgp_com_mx = "flog.pgp.com.mx"
    $domain_zany_strangled_net = "zany.strangled.net"
    $domain_microsfot_ikwb_com = "microsfot.ikwb.com"
    $domain_blognews_ezua_com = "blognews.ezua.com"
    $domain_beersale_servebeer_com = "beersale.servebeer.com"
    $domain_ametoy_acmetoy_com = "ametoy.acmetoy.com"
    $domain_effinfo_effers_com = "effinfo.effers.com"
    $domain_movieonline_redirectme_net = "movieonline.redirectme.net"
    $domain_tw_shop_tm = "tw.shop.tm"
    $domain_asus0213_asuscomm_com = "asus0213.asuscomm.com"
    $domain_furniture_home_kg = "furniture.home.kg"
    $domain_dpp_edesizns_com = "dpp.edesizns.com"
  condition:
    any of them
}