From cf00838b6d21c24ed7b522ba706f8a410640b57a Mon Sep 17 00:00:00 2001 From: sssnake Date: Tue, 31 Mar 2026 03:09:00 -0700 Subject: [PATCH] Initial release: Vigil Anti-Surveillance Shield v0.1.0 KernelSU-Next/Magisk/APatch module providing: - Threat scanner with 11,000+ IOCs (stalkerware, Pegasus, government spyware) - FrostGuard file integrity monitor (pseudo-locked-bootloader) - Encryption key wiper / BFU mode transition - Forensic Shield (anti-Cellebrite with 71 known binary hashes) - Silent SMS detection (Type-0, Class-0, WAP Push) - Network monitor with C2/tracker domain and IP blocking - vigild daemon with periodic scanning and alert management - Full CLI interface --- .gitignore | 7 + README.md | 161 ++ customize.sh | 81 + module.prop | 7 + post-fs-data.sh | 45 + service.sh | 44 + tools/build_ioc_db.py | 555 ++++ uninstall.sh | 21 + vigil/bin/vigil | 302 ++ vigil/bin/vigild | 181 ++ vigil/config/exclusions.conf | 15 + vigil/config/vigil.conf | 63 + vigil/ioc/cellebrite_hashes.txt | 73 + vigil/ioc/certificates.txt | 476 ++++ vigil/ioc/domains.txt | 4668 +++++++++++++++++++++++++++++++ vigil/ioc/hashes.txt | 298 ++ vigil/ioc/hosts.txt | 4494 +++++++++++++++++++++++++++++ vigil/ioc/hosts_block.txt | 2333 +++++++++++++++ vigil/ioc/ips.txt | 141 + vigil/ioc/packages.txt | 1197 ++++++++ vigil/lib/forensic_shield.sh | 236 ++ vigil/lib/integrity.sh | 228 ++ vigil/lib/key_wiper.sh | 192 ++ vigil/lib/network_monitor.sh | 255 ++ vigil/lib/scanner.sh | 362 +++ vigil/lib/sms_shield.sh | 201 ++ vigil/signatures/cellebrite.sig | 136 + 27 files changed, 16772 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100755 customize.sh create mode 100644 module.prop create mode 100755 post-fs-data.sh create mode 100755 service.sh create mode 100644 tools/build_ioc_db.py create mode 100755 uninstall.sh create mode 100755 vigil/bin/vigil create mode 100755 vigil/bin/vigild create mode 100644 vigil/config/exclusions.conf create mode 100644 vigil/config/vigil.conf create mode 100644 vigil/ioc/cellebrite_hashes.txt create mode 100644 vigil/ioc/certificates.txt create mode 100644 vigil/ioc/domains.txt create mode 100644 vigil/ioc/hashes.txt create mode 100644 vigil/ioc/hosts.txt create mode 100644 vigil/ioc/hosts_block.txt create mode 100644 vigil/ioc/ips.txt create mode 100644 vigil/ioc/packages.txt create mode 100755 vigil/lib/forensic_shield.sh create mode 100755 vigil/lib/integrity.sh create mode 100755 vigil/lib/key_wiper.sh create mode 100755 vigil/lib/network_monitor.sh create mode 100755 vigil/lib/scanner.sh create mode 100755 vigil/lib/sms_shield.sh create mode 100644 vigil/signatures/cellebrite.sig diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..02cf73f --- /dev/null +++ b/.gitignore @@ -0,0 +1,7 @@ +*.log +*.pid +*.bak +*.tmp +*.swp +*.zip +build/ diff --git a/README.md b/README.md new file mode 100644 index 0000000..62d6565 --- /dev/null +++ b/README.md @@ -0,0 +1,161 @@ +# Vigil — Anti-Surveillance Shield + +**KernelSU-Next / Magisk / APatch module for journalists, activists, and at-risk users.** + +Vigil detects stalkerware, government spyware (Pegasus, Predator, Hermit), forensic extraction tools (Cellebrite UFED), silent SMS tracking, and IMSI catchers. It provides real-time protection with file integrity monitoring, encryption key eviction, and network-level threat blocking. + +Developed by **Setec Labs**. + +--- + +## Features + +### Threat Scanner +- Scans installed packages, signing certificates, APK hashes, running processes, accessibility services, and device admins against a curated IOC database +- 11,000+ indicators sourced from CitizenLab, MVT, EFF, Meta Threat Research, and stalkerware-indicators +- Detects Pegasus, Predator, Hermit, Chrysaor, commercial stalkerware, and trojans + +### FrostGuard — File Integrity Monitor +- SHA256 baseline of system partitions, boot images, and critical binaries +- Continuous monitoring for unauthorized modifications +- Heuristic detection: SUID anomalies, staging directory implants, SELinux tampering, injection frameworks +- Pseudo-locked-bootloader protection for rooted devices + +### Key Wiper / BFU Mode +- Evicts FBE (File-Based Encryption) credential keys from memory +- Moves the device to a "Before First Unlock" equivalent state +- Runs TRIM to prevent NAND flash recovery of deleted data +- Disables ADB, developer settings, and minimizes system logging +- Effectively defeats AFU-mode forensic extraction + +### Forensic Shield +- Real-time USB monitoring for forensic tool staging +- 71 known Cellebrite UFED binary hashes +- Exploit binary name detection (dirtycow, zergRush, pingroot, etc.) +- Frida injection detection +- Automatic lockdown on forensic tool detection (opt-in) + +### SMS Shield +- Detects Type-0 (silent) and Class-0 (flash) SMS pings used for location tracking +- Monitors RIL/telephony layer via logcat with root access +- WAP Push and binary SMS detection +- Optional delivery receipt suppression + +### Network Monitor +- Hosts-based domain blocking (4,400+ C2 and tracker domains) +- iptables IP blocking (139+ known malicious IPs) +- Live connection monitoring against threat indicators +- DNS resolution watchdog + +--- + +## Installation + +Flash the ZIP via KernelSU-Next, Magisk, or APatch manager. + +Requires: +- Android 9+ (API 28) +- Root access (KernelSU-Next, Magisk, or APatch) + +## Usage + +```sh +# Show protection status +vigil status + +# Run full threat scan +vigil scan + +# Run quick scan (packages + processes only) +vigil scan quick + +# Enter BFU lockdown mode +vigil lockdown + +# Check file integrity +vigil integrity verify + +# Create new integrity baseline +vigil integrity baseline + +# View alerts +vigil alerts + +# Forensic shield scan +vigil forensic scan + +# SMS shield status +vigil sms status + +# Start SMS monitoring +vigil sms monitor + +# Install/update network blocklists +vigil network install + +# Update threat indicators +vigil update-ioc + +# View logs +vigil log +``` + +## Configuration + +Edit `/data/adb/vigil/vigil.conf` on the device. Key settings: + +| Setting | Default | Description | +|---------|---------|-------------| +| `SCANNER_INTERVAL` | 3600 | Seconds between automatic scans | +| `FROSTGUARD_ENABLED` | 1 | File integrity monitoring | +| `FORENSIC_AUTO_LOCKDOWN` | 0 | Auto-lockdown on forensic tool detection | +| `SMS_BLOCK_SILENT` | 1 | Block silent SMS delivery receipts | +| `NETWORK_BLOCK_C2` | 1 | Block known C2 domains | +| `KEYWIPER_TRIM_ON_LOCKDOWN` | 1 | TRIM storage on lockdown | +| `VIGIL_BACKEND_URL` | (empty) | Reporting server URL | + +## Threat Indicator Sources + +- [CitizenLab Malware Indicators](https://github.com/citizenlab/malware-indicators) +- [AssoEchap Stalkerware Indicators](https://github.com/AssoEchap/stalkerware-indicators) +- [MVT — Mobile Verification Toolkit](https://github.com/mvt-project/mvt) +- [Meta Threat Research](https://github.com/facebook/threat-research) +- [EFF Rayhunter](https://github.com/EFForg/rayhunter) +- [Lockup Anti-Forensics](https://github.com/levlesec/lockup) +- [Costin Raiu Mobile Trackers](https://github.com/craiu/mobiletrackers) +- [Palo Alto Unit42](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel) + +## Architecture + +``` +vigil/ +├── module.prop # KernelSU/Magisk module metadata +├── customize.sh # Installation script +├── service.sh # Boot service (starts vigild) +├── post-fs-data.sh # Early boot (integrity check, lockdown enforcement) +├── vigil/ +│ ├── bin/ +│ │ ├── vigil # CLI interface +│ │ └── vigild # Main daemon +│ ├── config/ +│ │ ├── vigil.conf # Default configuration +│ │ └── exclusions.conf # User exclusions +│ ├── ioc/ # Threat indicator database +│ └── lib/ +│ ├── scanner.sh # Threat scanner engine +│ ├── integrity.sh # FrostGuard file integrity +│ ├── key_wiper.sh # BFU mode / key eviction +│ ├── forensic_shield.sh # Anti-Cellebrite +│ ├── sms_shield.sh # Silent SMS detection +│ └── network_monitor.sh # C2/tracker blocking +└── tools/ + └── build_ioc_db.py # IOC database builder +``` + +## License + +Copyright (c) 2025 Setec Labs. All rights reserved. + +## Disclaimer + +This tool is intended for defensive security use by journalists, activists, human rights defenders, and security researchers. It is designed to detect and defend against unauthorized surveillance. Use responsibly and in accordance with applicable laws. diff --git a/customize.sh b/customize.sh new file mode 100755 index 0000000..730e6cd --- /dev/null +++ b/customize.sh @@ -0,0 +1,81 @@ +#!/system/bin/sh +# Vigil — Anti-Surveillance Shield +# KernelSU-Next Module Installation Script +# (c) Setec Labs + +SKIPUNZIP=1 + +ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" +ui_print " Vigil — Anti-Surveillance Shield v0.1.0" +ui_print " by Setec Labs" +ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" +ui_print "" + +# Detect environment +if [ "$KSU" = "true" ]; then + ui_print "[*] KernelSU detected (version: $KSU_VER_CODE)" + MODPATH="/data/adb/modules/vigil" +elif [ "$APATCH" = "true" ]; then + ui_print "[*] APatch detected" + MODPATH="/data/adb/modules/vigil" +else + ui_print "[*] Magisk detected (version: $MAGISK_VER_CODE)" + MODPATH="/data/adb/modules/vigil" +fi + +# Check Android version +API=$(getprop ro.build.version.sdk) +if [ "$API" -lt 28 ]; then + ui_print "[!] Android 9+ (API 28) required. Aborting." + abort +fi +ui_print "[*] Android API: $API" + +# Check architecture +ARCH=$(getprop ro.product.cpu.abi) +ui_print "[*] Architecture: $ARCH" + +# Extract module files +ui_print "[*] Extracting module files..." +mkdir -p "$MODPATH" +unzip -o "$ZIPFILE" -d "$MODPATH" >&2 + +# Set permissions +ui_print "[*] Setting permissions..." +set_perm_recursive "$MODPATH" 0 0 0755 0644 +set_perm_recursive "$MODPATH/vigil/bin" 0 0 0755 0755 +set_perm_recursive "$MODPATH/vigil/lib" 0 0 0755 0755 + +# Create runtime directories +mkdir -p "$MODPATH/vigil/logs" +mkdir -p /data/adb/vigil +mkdir -p /data/adb/vigil/baseline +mkdir -p /data/adb/vigil/alerts +mkdir -p /data/adb/vigil/quarantine + +# Initialize config if first install +if [ ! -f /data/adb/vigil/vigil.conf ]; then + ui_print "[*] First install — initializing configuration..." + cp "$MODPATH/vigil/config/vigil.conf" /data/adb/vigil/vigil.conf + cp "$MODPATH/vigil/config/exclusions.conf" /data/adb/vigil/exclusions.conf +fi + +# Copy IOC database +ui_print "[*] Installing threat indicator database..." +cp -r "$MODPATH/vigil/ioc/"* /data/adb/vigil/ 2>/dev/null + +# Generate initial file integrity baseline +ui_print "[*] Generating file integrity baseline..." +"$MODPATH/vigil/lib/integrity.sh" baseline 2>/dev/null + +ui_print "" +ui_print "[✓] Vigil installed successfully." +ui_print "" +ui_print " Commands:" +ui_print " vigil scan — Run full threat scan" +ui_print " vigil status — Show protection status" +ui_print " vigil lockdown — Enter lockdown / BFU mode" +ui_print " vigil integrity — Check file integrity" +ui_print " vigil update-ioc — Update threat indicators" +ui_print "" +ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" diff --git a/module.prop b/module.prop new file mode 100644 index 0000000..bf34ece --- /dev/null +++ b/module.prop @@ -0,0 +1,7 @@ +id=vigil +name=Vigil — Anti-Surveillance Shield +version=v0.1.0 +versionCode=1 +author=Setec Labs +description=Anti-surveillance, anti-stalkerware, and anti-forensic protection for journalists, activists, and at-risk users. Detects Pegasus, stalkerware, IMSI catchers, silent SMS, forensic extraction tools, and more. +updateJson= diff --git a/post-fs-data.sh b/post-fs-data.sh new file mode 100755 index 0000000..5d4a14a --- /dev/null +++ b/post-fs-data.sh @@ -0,0 +1,45 @@ +#!/system/bin/sh +# Vigil — post-fs-data stage (runs before Zygote/apps) +# This is the earliest stage — used for file integrity checks and forensic shield + +MODDIR="${0%/*}" +VIGIL_DATA="/data/adb/vigil" +VIGIL_LIB="$MODDIR/vigil/lib" +VIGIL_LOG="$VIGIL_DATA/vigil.log" + +log_vigil() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [post-fs] $1" >> "$VIGIL_LOG" +} + +log_vigil "Vigil post-fs-data stage starting" + +# Load config +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +# --- FILE INTEGRITY CHECK (FrostGuard) --- +# Check critical system files before anything else loads +if [ "${FROSTGUARD_ENABLED:-1}" = "1" ]; then + log_vigil "FrostGuard: Running early integrity check" + "$VIGIL_LIB/integrity.sh" verify-critical 2>/dev/null + INTEGRITY_RESULT=$? + if [ $INTEGRITY_RESULT -ne 0 ]; then + log_vigil "FrostGuard: INTEGRITY VIOLATION DETECTED (code: $INTEGRITY_RESULT)" + # Write alert for daemon to pick up + echo "integrity_violation:$(date +%s):post-fs-data" >> "$VIGIL_DATA/alerts/pending" + fi +fi + +# --- FORENSIC SHIELD: Early USB monitoring --- +# Disable ADB if forensic shield is in lockdown mode +if [ -f "$VIGIL_DATA/.lockdown" ]; then + log_vigil "LOCKDOWN MODE: Disabling ADB and USB debugging" + settings put global adb_enabled 0 2>/dev/null + setprop persist.sys.usb.config "charging" 2>/dev/null +fi + +# --- ANTI-FORENSIC: Disable safe boot if configured --- +if [ "${BLOCK_SAFE_MODE:-1}" = "1" ]; then + settings put global safe_boot_disallowed 1 2>/dev/null +fi + +log_vigil "Vigil post-fs-data stage complete" diff --git a/service.sh b/service.sh new file mode 100755 index 0000000..7f7cb67 --- /dev/null +++ b/service.sh @@ -0,0 +1,44 @@ +#!/system/bin/sh +# Vigil — late_start service stage (runs after boot completes) +# Starts the main Vigil daemon + +MODDIR="${0%/*}" +VIGIL_DATA="/data/adb/vigil" +VIGIL_BIN="$MODDIR/vigil/bin" +VIGIL_LOG="$VIGIL_DATA/vigil.log" + +log_vigil() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [service] $1" >> "$VIGIL_LOG" +} + +# Wait for boot to complete +while [ "$(getprop sys.boot_completed)" != "1" ]; do + sleep 1 +done + +# Small delay to let system settle +sleep 5 + +log_vigil "Vigil service stage starting" + +# Symlink CLI to PATH +[ ! -f /data/adb/vigil/bin/vigil ] && { + mkdir -p /data/adb/vigil/bin + ln -sf "$VIGIL_BIN/vigil" /data/adb/vigil/bin/vigil +} +# Make accessible via su +mount --bind "$VIGIL_BIN/vigil" /system/bin/vigil 2>/dev/null || { + # Fallback: create wrapper in a PATH-accessible location + cat > /data/local/tmp/vigil <> "$VIGIL_LOG" 2>&1 & +DAEMON_PID=$! +echo $DAEMON_PID > "$VIGIL_DATA/vigild.pid" +log_vigil "vigild started (PID: $DAEMON_PID)" diff --git a/tools/build_ioc_db.py b/tools/build_ioc_db.py new file mode 100644 index 0000000..a2806e2 --- /dev/null +++ b/tools/build_ioc_db.py @@ -0,0 +1,555 @@ +#!/usr/bin/env python3 +""" +Vigil IOC Database Builder +Extracts Indicators of Compromise from research repositories and writes +unified indicator files for the Vigil anti-surveillance module. +""" + +import csv +import io +import os +import re +import sys +from collections import OrderedDict + +RESEARCH = "/home/snake/research/repos" +OUT_DIR = "/home/snake/vigil/vigil/ioc" + +os.makedirs(OUT_DIR, exist_ok=True) + +# ────────────────────────────────────────────────────────────────────── +# Helpers +# ────────────────────────────────────────────────────────────────────── + +def dedup_sorted(lines): + """Return sorted, deduplicated list (case-sensitive).""" + return sorted(set(l for l in lines if l.strip())) + + +def write_ioc(filename, lines, header=""): + path = os.path.join(OUT_DIR, filename) + lines = dedup_sorted(lines) + with open(path, "w") as f: + if header: + f.write(header + "\n") + for line in lines: + f.write(line + "\n") + return len(lines) + + +def read_file(path): + if not os.path.isfile(path): + return "" + with open(path, "r", errors="replace") as f: + return f.read() + + +# ────────────────────────────────────────────────────────────────────── +# YAML parser (no pyyaml dependency -- simple state-machine parser) +# Parses stalkerware-indicators/ioc.yaml +# ────────────────────────────────────────────────────────────────────── + +def parse_stalkerware_yaml(path): + """ + Parse the stalkerware-indicators ioc.yaml which has a known structure: + - name: ThreatName + type: stalkerware + packages: + - com.example.pkg + certificates: + - DEADBEEF... + websites: + - example.com + distribution: + - dist.example.com + c2: + ips: + - 1.2.3.4 + domains: + - c2.example.com + Returns lists of: packages, certificates, domains (with category), ips + """ + text = read_file(path) + if not text: + return [], [], [], [] + + packages = [] # (pkg, threat_name, type) + certificates = [] # (hash, threat_name) + domains = [] # (domain, threat_name, category) + ips = [] # (ip, threat_name) + + current_name = None + current_type = "stalkerware" + current_section = None # packages, certificates, websites, distribution, c2_ips, c2_domains + in_c2 = False + + for line in text.splitlines(): + stripped = line.rstrip() + if not stripped or stripped.startswith("#"): + continue + + # Top-level entry + m = re.match(r'^- name:\s*(.+)', stripped) + if m: + current_name = m.group(1).strip() + current_section = None + in_c2 = False + continue + + # type field + m = re.match(r'^\s+type:\s*(.+)', stripped) + if m: + current_type = m.group(1).strip() + continue + + # names field (aliases) -- skip + if re.match(r'^\s+names:\s*$', stripped): + current_section = "names" + continue + + # Section headers + if re.match(r'^\s+packages:\s*$', stripped): + current_section = "packages" + in_c2 = False + continue + if re.match(r'^\s+certificates:\s*$', stripped): + current_section = "certificates" + in_c2 = False + continue + if re.match(r'^\s+websites:\s*$', stripped): + current_section = "websites" + in_c2 = False + continue + if re.match(r'^\s+distribution:\s*$', stripped): + current_section = "distribution" + in_c2 = False + continue + if re.match(r'^\s+c2:\s*$', stripped): + in_c2 = True + current_section = None + continue + if in_c2 and re.match(r'^\s+ips:\s*$', stripped): + current_section = "c2_ips" + continue + if in_c2 and re.match(r'^\s+domains:\s*$', stripped): + current_section = "c2_domains" + continue + + # List items + m = re.match(r'^\s+- (.+)', stripped) + if m and current_name: + val = m.group(1).strip() + if current_section == "packages": + packages.append((val, current_name, current_type)) + elif current_section == "certificates": + certificates.append((val, current_name)) + elif current_section == "websites": + domains.append((val, current_name, "tracking")) + elif current_section == "distribution": + domains.append((val, current_name, "distribution")) + elif current_section == "c2_domains": + domains.append((val, current_name, "c2")) + elif current_section == "c2_ips": + ips.append((val, current_name)) + # skip "names" items + + return packages, certificates, domains, ips + + +# ────────────────────────────────────────────────────────────────────── +# 1. PACKAGES +# ────────────────────────────────────────────────────────────────────── + +def build_packages(): + lines = [] + + # Source 1: stalkerware-indicators + pkgs, _, _, _ = parse_stalkerware_yaml( + os.path.join(RESEARCH, "stalkerware-indicators/ioc.yaml")) + for pkg, name, typ in pkgs: + lines.append(f"{pkg}|{name}|{typ}") + + # Source 2: threat-research indicators -- look for android_package_name in CSVs + tr_csv_dir = os.path.join(RESEARCH, "threat-research/indicators/csv") + if os.path.isdir(tr_csv_dir): + for root, dirs, files in os.walk(tr_csv_dir): + for fn in files: + if not fn.endswith(".csv"): + continue + fpath = os.path.join(root, fn) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + itype = (row.get("indicator_type") or row.get("type") or "").strip().lower() + val = (row.get("indicator_value") or row.get("value") or "").strip() + comment = (row.get("comment") or "").strip() + if "android" in itype and "package" in itype and val: + threat = comment if comment else os.path.basename(fn).replace(".csv", "") + lines.append(f"{val}|{threat}|spyware") + except Exception: + pass + + # Source 3: isdi app-flags.csv -- extract appId where flag is spyware + isdi_path = os.path.join(RESEARCH, "isdi/static_data/app-flags.csv") + if os.path.isfile(isdi_path): + content = read_file(isdi_path) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + flag = (row.get("flag") or "").strip().lower() + app_id = (row.get("appId") or "").strip() + if flag == "spyware" and app_id: + title = (row.get("title") or "").strip() + threat = title.split(",")[0].split("|")[0].strip() if title else "Unknown" + lines.append(f"{app_id}|{threat}|stalkerware") + + # Source 4: MVT ROOT_PACKAGES + mvt_utils = os.path.join(RESEARCH, "mvt/src/mvt/android/utils.py") + if os.path.isfile(mvt_utils): + content = read_file(mvt_utils) + # Extract ROOT_PACKAGES list + m = re.search(r'ROOT_PACKAGES.*?\[(.*?)\]', content, re.DOTALL) + if m: + for pkg in re.findall(r'"([^"]+)"', m.group(1)): + lines.append(f"{pkg}|MVT_RootDetection|forensic") + + return write_ioc("packages.txt", lines, + "# Vigil IOC: Malicious/stalkerware Android packages\n" + "# Format: package_name|threat_name|category") + + +# ────────────────────────────────────────────────────────────────────── +# 2. CERTIFICATES +# ────────────────────────────────────────────────────────────────────── + +def build_certificates(): + lines = [] + _, certs, _, _ = parse_stalkerware_yaml( + os.path.join(RESEARCH, "stalkerware-indicators/ioc.yaml")) + for h, name in certs: + # Determine hash type by length + h_clean = h.strip() + if len(h_clean) == 40: + htype = "SHA1" + elif len(h_clean) == 64: + htype = "SHA256" + elif len(h_clean) == 32: + htype = "MD5" + else: + htype = "unknown" + lines.append(f"{h_clean}|{name}|{htype}") + + return write_ioc("certificates.txt", lines, + "# Vigil IOC: Malicious signing certificate hashes\n" + "# Format: hash|threat_name|hash_type") + + +# ────────────────────────────────────────────────────────────────────── +# 3. DOMAINS +# ────────────────────────────────────────────────────────────────────── + +def build_domains(): + lines = [] + + # Source 1: stalkerware-indicators + _, _, doms, _ = parse_stalkerware_yaml( + os.path.join(RESEARCH, "stalkerware-indicators/ioc.yaml")) + for d, name, cat in doms: + lines.append(f"{d}|{name}|{cat}") + + # Source 2: mobiletrackers list.txt + mt_path = os.path.join(RESEARCH, "mobiletrackers/list.txt") + if os.path.isfile(mt_path): + for line in read_file(mt_path).splitlines(): + line = line.strip() + if not line or line.startswith("#"): + continue + # Should be a domain + if re.match(r'^[a-zA-Z0-9][\w.-]+\.[a-zA-Z]{2,}$', line): + lines.append(f"{line}|MobileTracker|tracking") + + # Source 3: malware-indicators CSVs -- domain types + mi_dir = os.path.join(RESEARCH, "malware-indicators") + if os.path.isdir(mi_dir): + for root, dirs, files in os.walk(mi_dir): + # Skip .git + dirs[:] = [d for d in dirs if d != ".git"] + for fn in files: + if not fn.endswith(".csv"): + continue + fpath = os.path.join(root, fn) + # Determine threat from directory name + parent = os.path.basename(os.path.dirname(fpath)) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + itype = (row.get("type") or row.get("indicator_type") or "").strip().lower() + val = (row.get("value") or row.get("indicator_value") or "").strip().strip('"') + if itype == "domain" and val: + lines.append(f"{val}|{parent}|c2") + elif itype == "domain_name" and val: + lines.append(f"{val}|{parent}|c2") + except Exception: + pass + + # Source 4: threat-research CSVs -- domain_name types + tr_csv_dir = os.path.join(RESEARCH, "threat-research/indicators/csv") + if os.path.isdir(tr_csv_dir): + for root, dirs, files in os.walk(tr_csv_dir): + for fn in files: + if not fn.endswith(".csv"): + continue + fpath = os.path.join(root, fn) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + itype = (row.get("indicator_type") or row.get("type") or "").strip().lower() + val = (row.get("indicator_value") or row.get("value") or "").strip().strip('"') + if itype in ("domain_name", "domain") and val: + threat = os.path.basename(fn).replace(".csv", "") + lines.append(f"{val}|{threat}|c2") + except Exception: + pass + + return write_ioc("domains.txt", lines, + "# Vigil IOC: C2 and tracking domains\n" + "# Format: domain|threat_name|category") + + +# ────────────────────────────────────────────────────────────────────── +# 4. IPS +# ────────────────────────────────────────────────────────────────────── + +def build_ips(): + lines = [] + + # Source 1: stalkerware-indicators + _, _, _, ip_list = parse_stalkerware_yaml( + os.path.join(RESEARCH, "stalkerware-indicators/ioc.yaml")) + for ip, name in ip_list: + lines.append(f"{ip}|{name}|c2") + + # Source 2: malware-indicators CSVs -- ip-dst types + mi_dir = os.path.join(RESEARCH, "malware-indicators") + if os.path.isdir(mi_dir): + for root, dirs, files in os.walk(mi_dir): + dirs[:] = [d for d in dirs if d != ".git"] + for fn in files: + if not fn.endswith(".csv"): + continue + fpath = os.path.join(root, fn) + parent = os.path.basename(os.path.dirname(fpath)) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + itype = (row.get("type") or "").strip().lower() + val = (row.get("value") or "").strip().strip('"') + if itype in ("ip-dst", "ip-src") and val: + lines.append(f"{val}|{parent}|c2") + except Exception: + pass + + # Source 3: threat-research CSVs + tr_csv_dir = os.path.join(RESEARCH, "threat-research/indicators/csv") + if os.path.isdir(tr_csv_dir): + for root, dirs, files in os.walk(tr_csv_dir): + for fn in files: + if not fn.endswith(".csv"): + continue + fpath = os.path.join(root, fn) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + itype = (row.get("indicator_type") or row.get("type") or "").strip().lower() + val = (row.get("indicator_value") or row.get("value") or "").strip().strip('"') + if itype in ("ip_address", "ip-dst", "ip-src") and val: + threat = os.path.basename(fn).replace(".csv", "") + lines.append(f"{val}|{threat}|c2") + except Exception: + pass + + return write_ioc("ips.txt", lines, + "# Vigil IOC: Malicious IPs\n" + "# Format: ip|threat_name|category") + + +# ────────────────────────────────────────────────────────────────────── +# 5. HASHES +# ────────────────────────────────────────────────────────────────────── + +def build_hashes(): + lines = [] + + # Source 1: stalkerware-indicators generated -- look for samples/hashes + gen_dir = os.path.join(RESEARCH, "stalkerware-indicators/generated") + if os.path.isdir(gen_dir): + for fn in os.listdir(gen_dir): + if not fn.endswith(".csv"): + continue + fpath = os.path.join(gen_dir, fn) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + # Look for hash-like columns + for key in row: + kl = key.lower() + val = (row[key] or "").strip() + if "sha256" in kl and len(val) == 64 and re.match(r'^[0-9a-fA-F]+$', val): + app = row.get("app", row.get("name", fn)) + lines.append(f"{val}|{app}|SHA256") + elif "sha1" in kl and len(val) == 40 and re.match(r'^[0-9a-fA-F]+$', val): + app = row.get("app", row.get("name", fn)) + lines.append(f"{val}|{app}|SHA1") + elif "md5" in kl and len(val) == 32 and re.match(r'^[0-9a-fA-F]+$', val): + app = row.get("app", row.get("name", fn)) + lines.append(f"{val}|{app}|MD5") + except Exception: + pass + + # Source 2: malware-indicators CSVs -- sha256, md5 types + mi_dir = os.path.join(RESEARCH, "malware-indicators") + if os.path.isdir(mi_dir): + for root, dirs, files in os.walk(mi_dir): + dirs[:] = [d for d in dirs if d != ".git"] + for fn in files: + if not fn.endswith(".csv"): + continue + fpath = os.path.join(root, fn) + parent = os.path.basename(os.path.dirname(fpath)) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + fields = reader.fieldnames or [] + for row in reader: + itype = (row.get("type") or "").strip().lower() + val = (row.get("value") or "").strip().strip('"') + if itype == "sha256" and len(val) == 64: + lines.append(f"{val}|{parent}|SHA256") + elif itype == "md5" and len(val) == 32: + lines.append(f"{val}|{parent}|MD5") + elif itype == "sha1" and len(val) == 40: + lines.append(f"{val}|{parent}|SHA1") + # Also check named columns (like hashes.csv) + if "MD5" in fields: + md5 = (row.get("MD5") or "").strip() + if len(md5) == 32 and re.match(r'^[0-9a-fA-F]+$', md5): + lines.append(f"{md5}|{parent}|MD5") + except Exception: + pass + + # Source 3: threat-research CSVs + tr_csv_dir = os.path.join(RESEARCH, "threat-research/indicators/csv") + if os.path.isdir(tr_csv_dir): + for root, dirs, files in os.walk(tr_csv_dir): + for fn in files: + if not fn.endswith(".csv"): + continue + fpath = os.path.join(root, fn) + try: + content = read_file(fpath) + reader = csv.DictReader(io.StringIO(content)) + for row in reader: + itype = (row.get("indicator_type") or row.get("type") or "").strip().lower() + val = (row.get("indicator_value") or row.get("value") or "").strip().strip('"') + if itype in ("sha256", "hash_sha256") and len(val) == 64: + threat = os.path.basename(fn).replace(".csv", "") + lines.append(f"{val}|{threat}|SHA256") + elif itype in ("md5", "hash_md5") and len(val) == 32: + threat = os.path.basename(fn).replace(".csv", "") + lines.append(f"{val}|{threat}|MD5") + except Exception: + pass + + return write_ioc("hashes.txt", lines, + "# Vigil IOC: Malicious file hashes\n" + "# Format: hash|threat_name|hash_type") + + +# ────────────────────────────────────────────────────────────────────── +# 6. HOSTS (blocklist format) +# ────────────────────────────────────────────────────────────────────── + +def build_hosts(): + """Build hosts file from all domains in domains.txt.""" + domains_path = os.path.join(OUT_DIR, "domains.txt") + lines = [] + if os.path.isfile(domains_path): + for line in open(domains_path): + line = line.strip() + if not line or line.startswith("#"): + continue + parts = line.split("|") + domain = parts[0].strip() + if domain and re.match(r'^[a-zA-Z0-9][\w.-]+\.[a-zA-Z]{2,}$', domain): + lines.append(f"0.0.0.0 {domain}") + + return write_ioc("hosts.txt", lines, + "# Vigil IOC: Hosts blocklist (C2 + tracking domains)\n" + "# Format: 0.0.0.0 domain") + + +# ────────────────────────────────────────────────────────────────────── +# 7. CELLEBRITE HASHES +# ────────────────────────────────────────────────────────────────────── + +def build_cellebrite_hashes(): + lines = [] + + lockup_service = os.path.join( + RESEARCH, "lockup/app/src/main/java/com/lockup/LockUpService.java") + if os.path.isfile(lockup_service): + content = read_file(lockup_service) + + # Extract CB_ELEVATOR_HASHES array + m = re.search(r'CB_ELEVATOR_HASHES\s*=\s*new\s+String\[\]\s*\{(.*?)\}', content, re.DOTALL) + if m: + for h in re.findall(r'"([0-9a-fA-F]{64})"', m.group(1)): + lines.append(f"{h}|Cellebrite_UFED_Elevator|SHA256") + + # Extract bannedKeys array + m = re.search(r'bannedKeys\s*=\s*new\s+String\[\]\s*\{(.*?)\}', content, re.DOTALL) + if m: + for h in re.findall(r'"([0-9a-fA-F]{64})"', m.group(1)): + lines.append(f"{h}|Cellebrite_BannedKey|SHA256") + + return write_ioc("cellebrite_hashes.txt", lines, + "# Vigil IOC: Cellebrite forensic tool hashes\n" + "# Format: hash|threat_name|hash_type") + + +# ────────────────────────────────────────────────────────────────────── +# Main +# ────────────────────────────────────────────────────────────────────── + +def main(): + print("=" * 60) + print("Vigil IOC Database Builder") + print("=" * 60) + + counts = {} + counts["packages.txt"] = build_packages() + counts["certificates.txt"] = build_certificates() + counts["domains.txt"] = build_domains() + counts["ips.txt"] = build_ips() + counts["hashes.txt"] = build_hashes() + counts["hosts.txt"] = build_hosts() + counts["cellebrite_hashes.txt"] = build_cellebrite_hashes() + + print() + total = 0 + for fn, count in counts.items(): + print(f" {fn:30s} {count:>6d} indicators") + total += count + print(f" {'TOTAL':30s} {total:>6d} indicators") + print() + print(f"Output directory: {OUT_DIR}") + print("Done.") + + +if __name__ == "__main__": + main() diff --git a/uninstall.sh b/uninstall.sh new file mode 100755 index 0000000..cbceb42 --- /dev/null +++ b/uninstall.sh @@ -0,0 +1,21 @@ +#!/system/bin/sh +# Vigil — Uninstall cleanup + +VIGIL_DATA="/data/adb/vigil" + +# Stop daemon +if [ -f "$VIGIL_DATA/vigild.pid" ]; then + kill $(cat "$VIGIL_DATA/vigild.pid") 2>/dev/null +fi + +# Remove bind mount +umount /system/bin/vigil 2>/dev/null + +# Remove CLI wrapper +rm -f /data/local/tmp/vigil + +# Ask user about data retention via prop +# If user set vigil.keep_data=1 before uninstall, preserve data +if [ "$(getprop vigil.keep_data)" != "1" ]; then + rm -rf "$VIGIL_DATA" +fi diff --git a/vigil/bin/vigil b/vigil/bin/vigil new file mode 100755 index 0000000..1f83fee --- /dev/null +++ b/vigil/bin/vigil @@ -0,0 +1,302 @@ +#!/system/bin/sh +# vigil — Vigil Anti-Surveillance Shield CLI +# Command-line interface for managing Vigil protection +# (c) Setec Labs + +VERSION="0.1.0" +MODDIR="" +VIGIL_DATA="/data/adb/vigil" + +# Find module directory +for d in /data/adb/modules/vigil /data/adb/modules_update/vigil; do + [ -d "$d/vigil/lib" ] && MODDIR="$d" && break +done + +VIGIL_LIB="${MODDIR:+$MODDIR/vigil/lib}" +VIGIL_LOG="$VIGIL_DATA/vigil.log" + +# Colors (if terminal supports it) +if [ -t 1 ]; then + RED='\033[0;31m' + GREEN='\033[0;32m' + YELLOW='\033[0;33m' + CYAN='\033[0;36m' + BOLD='\033[1m' + NC='\033[0m' +else + RED="" GREEN="" YELLOW="" CYAN="" BOLD="" NC="" +fi + +print_banner() { + echo "${BOLD}" + echo " ╔══════════════════════════════════════╗" + echo " ║ Vigil — Anti-Surveillance Shield ║" + echo " ║ by Setec Labs v${VERSION} ║" + echo " ╚══════════════════════════════════════╝" + echo "${NC}" +} + +check_root() { + if [ "$(id -u)" != "0" ]; then + echo "${RED}Error: Vigil requires root access${NC}" + echo "Run: su -c vigil $*" + exit 1 + fi +} + +check_module() { + if [ -z "$VIGIL_LIB" ] || [ ! -d "$VIGIL_LIB" ]; then + echo "${RED}Error: Vigil module not found${NC}" + echo "Is the KernelSU module installed and enabled?" + exit 1 + fi +} + +daemon_running() { + if [ -f "$VIGIL_DATA/vigild.pid" ]; then + local pid=$(cat "$VIGIL_DATA/vigild.pid") + kill -0 "$pid" 2>/dev/null && return 0 + fi + return 1 +} + +# ── COMMANDS ── + +cmd_status() { + print_banner + echo "${BOLD}Protection Status${NC}" + echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" + + # Daemon + if daemon_running; then + local pid=$(cat "$VIGIL_DATA/vigild.pid") + echo " Daemon: ${GREEN}RUNNING${NC} (PID: $pid)" + else + echo " Daemon: ${RED}STOPPED${NC}" + fi + + # Lockdown + if [ -f "$VIGIL_DATA/.lockdown" ]; then + echo " Mode: ${RED}LOCKDOWN${NC}" + else + echo " Mode: ${GREEN}Normal${NC}" + fi + + # Load config for status display + [ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + + echo "" + echo "${BOLD}Modules${NC}" + echo " Threat Scanner: $([ "${SCANNER_ENABLED:-1}" = "1" ] && echo "${GREEN}ON${NC}" || echo "${RED}OFF${NC}")" + echo " FrostGuard: $([ "${FROSTGUARD_ENABLED:-1}" = "1" ] && echo "${GREEN}ON${NC}" || echo "${RED}OFF${NC}")" + echo " Forensic Shield: $([ "${FORENSIC_SHIELD_ENABLED:-1}" = "1" ] && echo "${GREEN}ON${NC}" || echo "${RED}OFF${NC}")" + echo " SMS Shield: $([ "${SMS_SHIELD_ENABLED:-1}" = "1" ] && echo "${GREEN}ON${NC}" || echo "${RED}OFF${NC}")" + echo " Network Monitor: $([ "${NETWORK_MONITOR_ENABLED:-1}" = "1" ] && echo "${GREEN}ON${NC}" || echo "${RED}OFF${NC}")" + echo " Key Wiper: $([ "${KEYWIPER_ENABLED:-1}" = "1" ] && echo "${GREEN}ON${NC}" || echo "${RED}OFF${NC}")" + + # IOC stats + echo "" + echo "${BOLD}Threat Database${NC}" + for f in packages.txt certificates.txt domains.txt ips.txt hashes.txt cellebrite_hashes.txt; do + if [ -f "$VIGIL_DATA/$f" ]; then + local count=$(wc -l < "$VIGIL_DATA/$f") + local name=$(echo "$f" | sed 's/\.txt//' | sed 's/_/ /g') + printf " %-18s %s indicators\n" "$name:" "$count" + fi + done + + # Recent alerts + echo "" + echo "${BOLD}Recent Alerts${NC}" + if [ -f "$VIGIL_DATA/alerts/history" ]; then + local total=$(wc -l < "$VIGIL_DATA/alerts/history") + echo " Total: $total" + echo "" + tail -5 "$VIGIL_DATA/alerts/history" | while IFS='|' read -r sev ts mod msg; do + local date=$(date -d @"$ts" '+%m/%d %H:%M' 2>/dev/null || echo "$ts") + case "$sev" in + CRITICAL) echo " ${RED}[$sev]${NC} $date $msg" ;; + HIGH) echo " ${YELLOW}[$sev]${NC} $date $msg" ;; + *) echo " [$sev] $date $msg" ;; + esac + done + else + echo " ${GREEN}No alerts${NC}" + fi + echo "" +} + +cmd_scan() { + check_module + local scan_type="${1:-full}" + "$VIGIL_LIB/scanner.sh" "$scan_type" +} + +cmd_integrity() { + check_module + local subcmd="${1:-verify}" + "$VIGIL_LIB/integrity.sh" "$subcmd" +} + +cmd_lockdown() { + check_module + echo "${RED}${BOLD}WARNING: This will enter BFU lockdown mode.${NC}" + echo "Actions: evict encryption keys, disable ADB, TRIM storage, minimize logging" + echo "A reboot is required to restore normal operation." + echo "" + + # In non-interactive mode (e.g., from duress trigger), skip confirmation + if [ "$1" = "--force" ] || [ "$1" = "-f" ]; then + "$VIGIL_LIB/key_wiper.sh" lockdown + return + fi + + echo -n "Proceed? [y/N] " + read -r confirm + if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then + "$VIGIL_LIB/key_wiper.sh" lockdown + else + echo "Aborted" + fi +} + +cmd_unlock() { + check_module + "$VIGIL_LIB/key_wiper.sh" unlock +} + +cmd_alerts() { + if [ -f "$VIGIL_DATA/alerts/history" ]; then + local count="${1:-20}" + echo "${BOLD}Alert History${NC} (last $count)" + echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" + tail -"$count" "$VIGIL_DATA/alerts/history" | while IFS='|' read -r sev ts mod msg; do + local date=$(date -d @"$ts" '+%Y-%m-%d %H:%M:%S' 2>/dev/null || echo "$ts") + case "$sev" in + CRITICAL) echo "${RED}[$sev]${NC} $date [$mod] $msg" ;; + HIGH) echo "${YELLOW}[$sev]${NC} $date [$mod] $msg" ;; + MEDIUM) echo "${CYAN}[$sev]${NC} $date [$mod] $msg" ;; + *) echo "[$sev] $date [$mod] $msg" ;; + esac + done + else + echo "No alerts recorded" + fi +} + +cmd_update_ioc() { + check_module + echo "Updating threat indicators..." + + if [ -n "$VIGIL_BACKEND_URL" ]; then + # Download from backend + for f in packages.txt certificates.txt domains.txt ips.txt hashes.txt hosts.txt cellebrite_hashes.txt; do + echo -n " $f... " + if curl -sf -o "$VIGIL_DATA/$f.new" "$VIGIL_BACKEND_URL/ioc/$f"; then + mv "$VIGIL_DATA/$f.new" "$VIGIL_DATA/$f" + echo "${GREEN}updated${NC}" + else + rm -f "$VIGIL_DATA/$f.new" + echo "${YELLOW}failed (keeping current)${NC}" + fi + done + + # Reinstall hosts blocklist + "$VIGIL_LIB/network_monitor.sh" install + echo "IOC update complete" + else + echo "${YELLOW}No backend URL configured${NC}" + echo "Set VIGIL_BACKEND_URL in /data/adb/vigil/vigil.conf" + echo "Or manually update files in /data/adb/vigil/" + fi +} + +cmd_forensic() { + check_module + local subcmd="${1:-scan}" + "$VIGIL_LIB/forensic_shield.sh" "$subcmd" +} + +cmd_sms() { + check_module + local subcmd="${1:-status}" + "$VIGIL_LIB/sms_shield.sh" "$subcmd" +} + +cmd_network() { + check_module + local subcmd="${1:-status}" + "$VIGIL_LIB/network_monitor.sh" "$subcmd" +} + +cmd_log() { + if [ -f "$VIGIL_LOG" ]; then + local lines="${1:-50}" + tail -"$lines" "$VIGIL_LOG" + else + echo "No log file found" + fi +} + +cmd_wipe_session() { + check_module + "$VIGIL_LIB/key_wiper.sh" wipe-session +} + +cmd_help() { + print_banner + echo "Usage: vigil [options]" + echo "" + echo "${BOLD}Core Commands${NC}" + echo " status Show overall protection status" + echo " scan [full|quick] Run threat scan (default: full)" + echo " alerts [N] Show last N alerts (default: 20)" + echo " log [N] Show last N log lines (default: 50)" + echo "" + echo "${BOLD}Protection${NC}" + echo " lockdown [-f] Enter BFU lockdown mode (evict keys, disable ADB)" + echo " unlock Clear lockdown state (after reboot)" + echo " wipe-session Clear session data (clipboard, caches)" + echo "" + echo "${BOLD}Modules${NC}" + echo " integrity [baseline|verify|heuristic]" + echo " FrostGuard file integrity operations" + echo " forensic [scan|status]" + echo " Forensic Shield (anti-Cellebrite)" + echo " sms [monitor|analyze|status]" + echo " SMS Shield (silent SMS detection)" + echo " network [install|remove|status]" + echo " Network monitor (C2/tracker blocking)" + echo "" + echo "${BOLD}Maintenance${NC}" + echo " update-ioc Update threat indicator database" + echo " version Show version" + echo " help Show this help" + echo "" +} + +# ── DISPATCH ── + +check_root + +case "$1" in + status) cmd_status ;; + scan) shift; cmd_scan "$@" ;; + integrity) shift; cmd_integrity "$@" ;; + lockdown) shift; cmd_lockdown "$@" ;; + unlock) cmd_unlock ;; + wipe-session) cmd_wipe_session ;; + alerts) shift; cmd_alerts "$@" ;; + update-ioc) cmd_update_ioc ;; + forensic) shift; cmd_forensic "$@" ;; + sms) shift; cmd_sms "$@" ;; + network) shift; cmd_network "$@" ;; + log) shift; cmd_log "$@" ;; + version) echo "Vigil v${VERSION}" ;; + help|--help|-h|"") cmd_help ;; + *) + echo "Unknown command: $1" + echo "Run 'vigil help' for usage" + exit 1 + ;; +esac diff --git a/vigil/bin/vigild b/vigil/bin/vigild new file mode 100755 index 0000000..67a7f51 --- /dev/null +++ b/vigil/bin/vigild @@ -0,0 +1,181 @@ +#!/system/bin/sh +# vigild — Vigil Anti-Surveillance Daemon +# Main daemon that orchestrates all protection modules +# (c) Setec Labs + +MODDIR=$(dirname $(dirname $(dirname $(readlink -f "$0")))) +VIGIL_DATA="/data/adb/vigil" +VIGIL_LIB="$MODDIR/vigil/lib" +VIGIL_LOG="$VIGIL_DATA/vigil.log" +VIGIL_PID="$VIGIL_DATA/vigild.pid" + +# Ensure dirs exist +mkdir -p "$VIGIL_DATA/alerts" "$VIGIL_DATA/baseline" + +# Load config +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +log() { + local level="$1" + local msg="$2" + local min_level="${VIGIL_LOG_LEVEL:-2}" + + case "$level" in + ERROR) lvl=1 ;; + WARN) lvl=2 ;; + INFO) lvl=3 ;; + DEBUG) lvl=4 ;; + *) lvl=3 ;; + esac + + [ $lvl -le $min_level ] && \ + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [vigild] [$level] $msg" >> "$VIGIL_LOG" +} + +rotate_log() { + local max_size="${VIGIL_LOG_MAX_SIZE:-1048576}" + if [ -f "$VIGIL_LOG" ]; then + local size=$(stat -c '%s' "$VIGIL_LOG" 2>/dev/null || echo 0) + if [ "$size" -gt "$max_size" ]; then + mv "$VIGIL_LOG" "$VIGIL_LOG.1" + log INFO "Log rotated" + fi + fi +} + +process_alerts() { + local alert_file="$VIGIL_DATA/alerts/pending" + if [ -f "$alert_file" ] && [ -s "$alert_file" ]; then + local count=$(wc -l < "$alert_file") + log WARN "Processing $count pending alerts" + + # Archive alerts + cat "$alert_file" >> "$VIGIL_DATA/alerts/history" + + # If backend configured, report alerts + if [ -n "$VIGIL_BACKEND_URL" ]; then + # POST alerts to backend server + local payload=$(cat "$alert_file" | while IFS='|' read -r sev ts mod msg; do + echo "{\"severity\":\"$sev\",\"timestamp\":$ts,\"module\":\"$mod\",\"message\":\"$msg\"}" + done | paste -sd',' -) + + curl -s -X POST \ + -H "Content-Type: application/json" \ + -H "X-Vigil-Device: ${VIGIL_DEVICE_ID:-unknown}" \ + -d "{\"alerts\":[$payload]}" \ + "$VIGIL_BACKEND_URL/api/alerts" \ + >> "$VIGIL_LOG" 2>&1 & + fi + + # Clear pending + > "$alert_file" + fi +} + +generate_device_id() { + if [ -z "$VIGIL_DEVICE_ID" ] || [ "$VIGIL_DEVICE_ID" = "" ]; then + # Generate a pseudorandom device ID (not fingerprinting — just for backend comms) + VIGIL_DEVICE_ID=$(cat /proc/sys/kernel/random/uuid 2>/dev/null | cut -d'-' -f1-2) + if [ -n "$VIGIL_DEVICE_ID" ]; then + sed -i "s/^VIGIL_DEVICE_ID=.*/VIGIL_DEVICE_ID=\"$VIGIL_DEVICE_ID\"/" "$VIGIL_DATA/vigil.conf" 2>/dev/null + fi + fi +} + +# ── SIGNAL HANDLERS ── +cleanup() { + log INFO "vigild shutting down (PID: $$)" + # Stop background monitors + kill $(jobs -p) 2>/dev/null + rm -f "$VIGIL_PID" + exit 0 +} + +trap cleanup TERM INT QUIT + +# ── MAIN ── +main() { + echo $$ > "$VIGIL_PID" + log INFO "════════════════════════════════════════" + log INFO "vigild starting (PID: $$)" + log INFO "Module: $MODDIR" + log INFO "Data: $VIGIL_DATA" + log INFO "════════════════════════════════════════" + + generate_device_id + + # ── Start background monitors ── + + # 1. Forensic Shield (continuous USB/process monitoring) + if [ "${FORENSIC_SHIELD_ENABLED:-1}" = "1" ]; then + log INFO "Starting Forensic Shield monitor..." + "$VIGIL_LIB/forensic_shield.sh" monitor >> "$VIGIL_LOG" 2>&1 & + log INFO "Forensic Shield PID: $!" + fi + + # 2. SMS Shield (continuous logcat monitoring) + if [ "${SMS_SHIELD_ENABLED:-1}" = "1" ] && [ "${SMS_SILENT_DETECT:-1}" = "1" ]; then + log INFO "Starting SMS Shield monitor..." + "$VIGIL_LIB/sms_shield.sh" monitor >> "$VIGIL_LOG" 2>&1 & + log INFO "SMS Shield PID: $!" + fi + + # 3. Network Monitor (continuous connection watching) + if [ "${NETWORK_MONITOR_ENABLED:-1}" = "1" ] && [ "${NETWORK_LOG_SUSPICIOUS:-1}" = "1" ]; then + log INFO "Starting Network monitor..." + "$VIGIL_LIB/network_monitor.sh" monitor >> "$VIGIL_LOG" 2>&1 & + log INFO "Network Monitor PID: $!" + fi + + # 4. Install network blocklists + if [ "${NETWORK_BLOCK_C2:-1}" = "1" ] || [ "${NETWORK_BLOCK_TRACKERS:-1}" = "1" ]; then + log INFO "Installing network blocklists..." + "$VIGIL_LIB/network_monitor.sh" install >> "$VIGIL_LOG" 2>&1 + fi + + # 5. Run initial scan + log INFO "Running initial quick scan..." + "$VIGIL_LIB/scanner.sh" quick >> "$VIGIL_LOG" 2>&1 + + # ── Main loop ── + local last_scan=$(date +%s) + local last_integrity=$(date +%s) + local scan_interval="${SCANNER_INTERVAL:-3600}" + local integrity_interval="${FROSTGUARD_INTERVAL:-1800}" + + log INFO "Entering main loop (scan: ${scan_interval}s, integrity: ${integrity_interval}s)" + + while true; do + local now=$(date +%s) + + # Periodic threat scan + if [ $((now - last_scan)) -ge "$scan_interval" ]; then + log INFO "Running scheduled threat scan..." + "$VIGIL_LIB/scanner.sh" quick >> "$VIGIL_LOG" 2>&1 + last_scan=$now + fi + + # Periodic integrity check + if [ "${FROSTGUARD_ENABLED:-1}" = "1" ] && [ $((now - last_integrity)) -ge "$integrity_interval" ]; then + log INFO "Running scheduled integrity check..." + "$VIGIL_LIB/integrity.sh" verify >> "$VIGIL_LOG" 2>&1 + last_integrity=$now + fi + + # Process any pending alerts + process_alerts + + # Rotate log if needed + rotate_log + + # Check if we're still supposed to be running + if [ ! -f "$VIGIL_PID" ] || [ "$(cat "$VIGIL_PID" 2>/dev/null)" != "$$" ]; then + log WARN "PID file mismatch — another instance may be running. Exiting." + cleanup + fi + + sleep 60 + done +} + +main diff --git a/vigil/config/exclusions.conf b/vigil/config/exclusions.conf new file mode 100644 index 0000000..4aadaf6 --- /dev/null +++ b/vigil/config/exclusions.conf @@ -0,0 +1,15 @@ +# Vigil — Exclusions Configuration +# Add package names, paths, or domains to exclude from scanning. +# One entry per line. Lines starting with # are comments. + +# ── Package Exclusions (won't trigger stalkerware alerts) ── +# Example: com.my.trusted.app +#packages: + +# ── Domain Exclusions (won't be blocked by network monitor) ── +# Example: trusted.analytics.com +#domains: + +# ── Path Exclusions (won't be checked by FrostGuard) ── +# Example: /system/addon.d +#paths: diff --git a/vigil/config/vigil.conf b/vigil/config/vigil.conf new file mode 100644 index 0000000..b49cee5 --- /dev/null +++ b/vigil/config/vigil.conf @@ -0,0 +1,63 @@ +# Vigil — Anti-Surveillance Shield Configuration +# (c) Setec Labs +# +# This file is sourced by all Vigil components. +# Edit /data/adb/vigil/vigil.conf on your device (not this copy). + +# ── General ────────────────────────────────────────── +VIGIL_ENABLED=1 +VIGIL_LOG_LEVEL=2 # 0=silent 1=error 2=warn 3=info 4=debug +VIGIL_LOG_MAX_SIZE=1048576 # 1MB, rotated automatically +VIGIL_BACKEND_URL="" # Optional: reporting server URL +VIGIL_DEVICE_ID="" # Auto-generated on first run + +# ── Threat Scanner ─────────────────────────────────── +SCANNER_ENABLED=1 +SCANNER_INTERVAL=3600 # Seconds between automatic scans (3600=1hr) +SCANNER_ON_INSTALL=1 # Scan new app installs immediately +SCANNER_CHECK_PACKAGES=1 # Check installed package names against IOC DB +SCANNER_CHECK_CERTS=1 # Check app signing certificates +SCANNER_CHECK_HASHES=1 # Check APK file hashes +SCANNER_CHECK_PROCESSES=1 # Scan running processes +SCANNER_CHECK_ACCESSIBILITY=1 # Check accessibility service abuse +SCANNER_CHECK_DEVICE_ADMIN=1 # Check device admin abuse + +# ── FrostGuard (File Integrity) ───────────────────── +FROSTGUARD_ENABLED=1 +FROSTGUARD_INTERVAL=1800 # Seconds between integrity checks +FROSTGUARD_CRITICAL_PATHS="/system/bin /system/xbin /system/lib64 /system/framework /system/app /system/priv-app /vendor/bin /init" +FROSTGUARD_ALERT_ON_VIOLATION=1 +FROSTGUARD_BLOCK_ON_VIOLATION=0 # Aggressive: prevent boot if violated + +# ── Forensic Shield ───────────────────────────────── +FORENSIC_SHIELD_ENABLED=1 +FORENSIC_USB_MONITOR=1 # Monitor USB for forensic tools +FORENSIC_ADB_GUARD=1 # Restrict ADB when threat detected +FORENSIC_AUTO_LOCKDOWN=0 # Auto-enter lockdown on detection (DANGEROUS) +FORENSIC_WIPE_ON_DETECT=0 # Nuclear option: wipe on forensic tool detect + +# ── Key Wiper / BFU Mode ──────────────────────────── +KEYWIPER_ENABLED=1 +KEYWIPER_TRIM_ON_LOCKDOWN=1 # Run TRIM on lockdown to prevent recovery +KEYWIPER_KILL_LOGD=1 # Stop logging daemon on lockdown +KEYWIPER_DISABLE_ADB=1 # Disable ADB on lockdown +KEYWIPER_CLEAR_CLIPBOARD=1 # Clear clipboard on lockdown + +# ── SMS Shield ─────────────────────────────────────── +SMS_SHIELD_ENABLED=1 +SMS_SILENT_DETECT=1 # Detect silent/stealth SMS (Class-0, Type-0) +SMS_BLOCK_SILENT=1 # Block silent SMS from reaching the device +SMS_FAKE_RESPONSE=0 # Respond with fake data to silent SMS probes +SMS_LOG_ALL=0 # Log all SMS metadata (privacy tradeoff) + +# ── Network Monitor ───────────────────────────────── +NETWORK_MONITOR_ENABLED=1 +NETWORK_BLOCK_C2=1 # Block known C2 domains via hosts file +NETWORK_BLOCK_TRACKERS=1 # Block known tracking domains +NETWORK_LOG_SUSPICIOUS=1 # Log connections to suspicious IPs +NETWORK_IPTABLES_ENABLED=1 # Use iptables for IP-level blocking + +# ── Duress / Panic ────────────────────────────────── +DURESS_ENABLED=0 # DISABLED by default — user must opt in +DURESS_PIN="" # Duress PIN triggers emergency lockdown +DURESS_ACTION="lockdown" # lockdown | wipe | wipe-full diff --git a/vigil/ioc/cellebrite_hashes.txt b/vigil/ioc/cellebrite_hashes.txt new file mode 100644 index 0000000..761f3e9 --- /dev/null +++ b/vigil/ioc/cellebrite_hashes.txt @@ -0,0 +1,73 @@ +# Vigil IOC: Cellebrite forensic tool hashes +# Format: hash|threat_name|hash_type +0519d111df96968e376a0dc1fb4c37eef35829dd0f472953e71e19d05b15eb47|Cellebrite_UFED_Elevator|SHA256 +064af61a468a719291779c2aab1d8fd152e66d422b402ebf112c5d896f268a52|Cellebrite_UFED_Elevator|SHA256 +07e3923c52e1c73e6ba314e230605e2ddbb5033aab75495654c131ff8b1b32a6|Cellebrite_UFED_Elevator|SHA256 +08853c949bbc98b9e334ae52d6d344f219e225914abaf7e813c81307a8e3bcb5|Cellebrite_UFED_Elevator|SHA256 +1226873d2fac892c3187b7a7da3a1c4b2a5c31d7ecdcd0c18f7ecba4197b05f0|Cellebrite_UFED_Elevator|SHA256 +17afd50ea379a6669e59af03fa73af816f3947ab0bc979b41e8828916c63dc49|Cellebrite_UFED_Elevator|SHA256 +23d9ce4a7df20b28d0b5b24ac320a9643c1716987dd5f29110bff71f775dca8d|Cellebrite_UFED_Elevator|SHA256 +2a797d28f44e9865d0dc0a9b7393b62e468fde03a8e1982ddb32142f7570b23b|Cellebrite_UFED_Elevator|SHA256 +2db036febbbad09586eac6279a4de4852c353444c4cacb7f926605d174cc7e6e|Cellebrite_UFED_Elevator|SHA256 +3254e75112c3d219e1af7bbb7be73d2cea76e4786aa9678683bf8d77f1ffbde2|Cellebrite_UFED_Elevator|SHA256 +3541425a729454569dccdf713f84102a8b2efeeb77abd34a6c210dd4b9b61cf4|Cellebrite_UFED_Elevator|SHA256 +37178f4d2711fc132b8ef19499c1517a70f73d29dc204116a85f5e6caa025034|Cellebrite_UFED_Elevator|SHA256 +39560ebb98e6973c88e4a92fb20e5b216616e4c7f607432329f26538aff77694|Cellebrite_UFED_Elevator|SHA256 +3c6dee8fcf4a47c70be5b2b1af6a84c7b54f4941b2a341f23547f1a1db64d034|Cellebrite_UFED_Elevator|SHA256 +460ba81b6dc17efe179cf7d0617ff99dc66be3be4375348f1c97a88dfa4f39ea|Cellebrite_UFED_Elevator|SHA256 +46a202a88af8c7208d552904cd16d28580a24830011a536c431703848c5739fb|Cellebrite_UFED_Elevator|SHA256 +47e7ddbadcb1ec5c228413e93baa029e06f24f44e77a83e817ba48770ffddd10|Cellebrite_UFED_Elevator|SHA256 +49b7368bd28c936ac824bf6040101f57f2c42ce4e9e16877dab2f44922683213|Cellebrite_BannedKey|SHA256 +49b7368bd28c936ac824bf6040101f57f2c42ce4e9e16877dab2f44922683213|Cellebrite_UFED_Elevator|SHA256 +5a14004e4c1a67acfd124ff21703b78ef3710c8e81677013234b4deb6af7da66|Cellebrite_BannedKey|SHA256 +5a14004e4c1a67acfd124ff21703b78ef3710c8e81677013234b4deb6af7da66|Cellebrite_UFED_Elevator|SHA256 +5c3d38ad5f26606ca19d277ee7392b039555449ac66cc96e9ad2c818857a3b31|Cellebrite_UFED_Elevator|SHA256 +5de2e8d08d246a7bb5c8ddd020853dbb5896cec4149527fa9256a786ebf3541d|Cellebrite_UFED_Elevator|SHA256 +5e8dce4e63214099c35f342c6c5a548be30ed6341ec9f4655827f28473333b6b|Cellebrite_UFED_Elevator|SHA256 +6a14b252b01f7ddc21a20a4a9577cb76c82f459652845959040eae677c0df3ce|Cellebrite_BannedKey|SHA256 +6a14b252b01f7ddc21a20a4a9577cb76c82f459652845959040eae677c0df3ce|Cellebrite_UFED_Elevator|SHA256 +6a4e49d86f471cd5be05af0737fcc8a7f58922c591c0d03c446bd0cf3bb0d8cb|Cellebrite_UFED_Elevator|SHA256 +6bea0ed340e33aa457ca91a986ed266906e3639bccf7ee6cdf1597ba683d25cb|Cellebrite_UFED_Elevator|SHA256 +6c66e32cc3c16dca941b9322e21463bb57c99cd7f3909e748fdfa671171cf66d|Cellebrite_UFED_Elevator|SHA256 +6c6909839af1076330fdfd64a82d2209030fcfd3f7819acbfccc7697d7d3b5ae|Cellebrite_UFED_Elevator|SHA256 +7546f3e3e6bfd3cc3b0d91f7883e39a1c9cd39be7a3a2c72cd76d9ca5378c540|Cellebrite_UFED_Elevator|SHA256 +7b6343e560c51c0152af0479a8cd9e7c74b9464f16deaaf07a7263f3b876c6e2|Cellebrite_UFED_Elevator|SHA256 +7e898e7d0f04e798954f285d50feb44f9697b47a443bfac27a7bedee52942bf6|Cellebrite_UFED_Elevator|SHA256 +7efdbc53f31c24bfe0046452e902be8fd7a500aae1a97d0d554ebe2bf8f2f9d8|Cellebrite_UFED_Elevator|SHA256 +829dd6f9fc7b39d16b3f75428b3b8417e3b411a9dbb422030f4a2d0e93dbbe3f|Cellebrite_UFED_Elevator|SHA256 +856ef82bb6f1e7d940be20a049a3566842a0c9b2c8635d646fdd487a00bd051a|Cellebrite_BannedKey|SHA256 +856ef82bb6f1e7d940be20a049a3566842a0c9b2c8635d646fdd487a00bd051a|Cellebrite_UFED_Elevator|SHA256 +859192e3d697a8522a7f9c19088d125b723193ce27df348712701ee78aea286c|Cellebrite_UFED_Elevator|SHA256 +872944fcf79fb92eb5f4134d87b6f6caabc5dec919070a1109ee820442942250|Cellebrite_UFED_Elevator|SHA256 +8e13aff69bc075116194f9d4e2dc7f2ef38ab502903649b4da8b9fc9ce2347e4|Cellebrite_UFED_Elevator|SHA256 +93028ad412cfc3a792614596d5db155470840bb5614eb416d9e3265b959fc95c|Cellebrite_BannedKey|SHA256 +93028ad412cfc3a792614596d5db155470840bb5614eb416d9e3265b959fc95c|Cellebrite_UFED_Elevator|SHA256 +945a19f4a22daab9cdea1686971a0215f777d3b19f5ee45ffcf846b3a0638cd3|Cellebrite_BannedKey|SHA256 +945a19f4a22daab9cdea1686971a0215f777d3b19f5ee45ffcf846b3a0638cd3|Cellebrite_UFED_Elevator|SHA256 +962390deb44b84d5781c5f0868aaea7f55d374b2db161598bebe3dd90abc1564|Cellebrite_BannedKey|SHA256 +962390deb44b84d5781c5f0868aaea7f55d374b2db161598bebe3dd90abc1564|Cellebrite_UFED_Elevator|SHA256 +96ea633fe332a30f65e80e1c48ca9a0158b6e02c33afcb4d05d9d96d62135aab|Cellebrite_UFED_Elevator|SHA256 +97496d8bbfb71bff2ea121ae731da8e474d1cdd6aabdb2bf1d592afe3bd649de|Cellebrite_BannedKey|SHA256 +97496d8bbfb71bff2ea121ae731da8e474d1cdd6aabdb2bf1d592afe3bd649de|Cellebrite_UFED_Elevator|SHA256 +98e2efe999a859531af4940b4fcc63725f9b84f0c14645c32fd7def907e03030|Cellebrite_UFED_Elevator|SHA256 +9da883c6999f2f333ab91631946984893fc51163e0c109e8683131b4775accdb|Cellebrite_UFED_Elevator|SHA256 +a2ea5e0d94abb55ade88a6ffe40a73f49329347c96d334c58426e1bc0c41e72b|Cellebrite_UFED_Elevator|SHA256 +a4ea82cd91d99bf26ca19dfd4b1969c42b5551151f1d3bdb635ebb2567e5a741|Cellebrite_BannedKey|SHA256 +a4ea82cd91d99bf26ca19dfd4b1969c42b5551151f1d3bdb635ebb2567e5a741|Cellebrite_UFED_Elevator|SHA256 +a75788739e8f97fd9901496f2a69d5b6b24892992c106a1e8ee06faa25076c18|Cellebrite_UFED_Elevator|SHA256 +a8212687308d7067af3d25664e84ace7f84fd939914a96a1c47e67c613c7b225|Cellebrite_UFED_Elevator|SHA256 +a944fd9e66d6b56bd031a3236b6ae8daee4b90e4689f167c22f7c0d02eaa3a98|Cellebrite_UFED_Elevator|SHA256 +ab8130caac25334f2ae46781e4ef625020bd95b215a427785798c729d81fc410|Cellebrite_UFED_Elevator|SHA256 +ab9bc4c15b1589e45dcf9c604617eaa67034c388c8b8df3af7c71dc50b29bef5|Cellebrite_UFED_Elevator|SHA256 +b5804223bdf91099de465a9cdc3d6bc8aec01f19a8856f6e9bdaec3a2a941035|Cellebrite_UFED_Elevator|SHA256 +bbe87d1cd44869ee1ba8dbca4a671965765fcd5818f16efa434bbe972961de1c|Cellebrite_UFED_Elevator|SHA256 +c58a06ba1b0be01c564629f76f496fc3b7e2d971c807ab6fe06ade291fafb3cc|Cellebrite_UFED_Elevator|SHA256 +ca52579b3ded35fc8337ff9763634c4bf5407a97c85d0c03fb3de16b22d7638b|Cellebrite_UFED_Elevator|SHA256 +cac5fdb8be75968291b42ab75dd654b3b21cf5dd1a5539490e6e8e015cb2a4ff|Cellebrite_UFED_Elevator|SHA256 +d3aa3c7b75e986d2addf4364f90fb948addee91deade17765a383ec69f582806|Cellebrite_UFED_Elevator|SHA256 +df89c654afaad67ac7e85e5d34072b5463ea0849ef3e8462a13e299baa6aa6dc|Cellebrite_BannedKey|SHA256 +df89c654afaad67ac7e85e5d34072b5463ea0849ef3e8462a13e299baa6aa6dc|Cellebrite_UFED_Elevator|SHA256 +e228cf22fa4934168fbde171e67729c8774df3813c1d31d9e5e206a19097ab87|Cellebrite_UFED_Elevator|SHA256 +f9ca7565b557f315a9a4fc0d77571206ba8471713160784b570bebc541a29fac|Cellebrite_BannedKey|SHA256 +f9ca7565b557f315a9a4fc0d77571206ba8471713160784b570bebc541a29fac|Cellebrite_UFED_Elevator|SHA256 +ffc118fc66a09e5a421f2aa5a036c0b49fb178dc9a18d847592d68ddf21cbd1e|Cellebrite_UFED_Elevator|SHA256 diff --git a/vigil/ioc/certificates.txt b/vigil/ioc/certificates.txt new file mode 100644 index 0000000..19ebf94 --- /dev/null +++ b/vigil/ioc/certificates.txt @@ -0,0 +1,476 @@ +# Vigil IOC: Malicious signing certificate hashes +# Format: hash|threat_name|hash_type +002DD372C94E80600C7C60192CBD701A3C3B87EE|RealtimeSpy|SHA1 +00F618C4C43C28B107DAB8F5641AD00D3A774AFD|Buhsam|SHA1 +018D06B4A5679892572CB9DA44BA1A8C1E3B68A5|MeuSpy|SHA1 +01E49C220A9776D4978C1D28D6C32F86D145B8AE|ShadowSpy|SHA1 +01EFA0C8FAE43215125ACA78308EFB1768FB4049|AndroidPolice|SHA1 +021985CEA754D8E58D538D2FEDFF6B1565A6B45B|mSpy|SHA1 +021A3F097EDA780798DF5ECB16EF338C08236847|MobileTrackerFree|SHA1 +0387135D057AEAA0F8BCFCE2AFA84D9BD1FA6F30|AndroidPolice|SHA1 +0568E0400308CBFC58E11A324EA233F5B2E923BF|MobileTrackerFree|SHA1 +05B23C7E9156A4C55768DA27936FF2D7AF09BB8F|Spymie|SHA1 +06A49FE1347C7D2E596DF2F08B8C235C00975AF8|XDSpy|SHA1 +07525D7D2E83CE865F98E1B9C0F6095B1C29D48A|AppSpy|SHA1 +07906D1FA933730B8EB44F03910C88FDAC2C0135|EasyLogger|SHA1 +08ACB92D02487EBC0CEA42B672A631BA7EA59ADF|TalkLog|SHA1 +09273A6004A46078991F3FBA2A4868DA26DBB508|MobileTrackerFree|SHA1 +09DCBFDB7C7262F143089C5493435AB07564FD67|MobileTrackerFree|SHA1 +0AD33649F0D0532B5EB0A36A81712962AA79BF54|AppSpy|SHA1 +0AF3219D3A9525CB4A618215DB7A29CBFD9FFE78|MeuSpy|SHA1 +0B6C1B010FBEA4316EB01602F71CDD6A8F365023|FlexiSpy|SHA1 +0C01AEB7346C700D02613EBA513BD40E87A182F8|CallSMSTracker|SHA1 +0C422F0025F866C311DF61A7549FCD519683898D|iKeyMonitor|SHA1 +0C5AB4D05A2C804D3A4D0472CEAC50B89833E6E4|AndroidPolice|SHA1 +0D025A887A1546585D9BBA6F023F42B8BE0274E1|AndroidPolice|SHA1 +0DCD7C9CC6A76AD28D7D992C4EF3DF2F768EA473|MonitorUltra|SHA1 +0E0BE37D31CA21F19095FC38F9F1BEF310CE227C|Hoverwatch|SHA1 +0ECD5FD80682776D804715AB5B8504DAF59A4B54|Ahmyth|SHA1 +0F64B6EBB49849AC685FE5DF605908594623368E|AndroidPolice|SHA1 +0FB6108D34289681BA0181ED9A4350514EB07665|MobileTrackerFree|SHA1 +0FB6643902E891C230F6E6662083442EEA1F16CE|OneSpy|SHA1 +1128939E0D8B8BAEAB14C41AEBFAA100C319AD8F|MobileTrackerFree|SHA1 +114C4DC0F254EFD81F0AC7F41DBE882FFDB2E127|MeuSpy|SHA1 +123C09B261DFA0F67D817E9BA079942830C31D54|Spyone|SHA1 +14A071616D4BC37F08BE865D375101F4C963777A|OwnSpy|SHA1 +14EE7779B2E84A0FF1309DEA72881670D78E98AB|AndroidPolice|SHA1 +159B64B29BC8842ACDF8022B70730B13E288044B|BrunoEspiao|SHA1 +16226330EBB138A5D47913151827A86567AD9CD4|AndroidPolice|SHA1 +16254E7CBDFEC82B6CCE599DFCE6A6E84CF25504|MobileTrackerFree|SHA1 +18C94FAB82F77F89546600F84D2D2B48A0C0B927|MeuSpy|SHA1 +18CD402CC43DF0BC03E9951B0F843DC4B1552DC6|CouplerTracker|SHA1 +1988EDEA389D42983CEC8B5F8A9C27AE49F800F9|Snoopza|SHA1 +1A6D10E15280C6A938EED9BEF53A31DA0CEBA45A|AndroidPolice|SHA1 +1BB7F1E962C35F00BE2EF97A64C753CCA0993637|AndroidPolice|SHA1 +1C6E171D3A6E51947DF9E83946BB115ED4A41C6A|AbsoluTrack|SHA1 +1CD94B411B5D4D2F5F525D775876FF0993B4B716|AndroidPolice|SHA1 +1CE722F401C3FA8FE498FF824669C0007A200AA9|MobileTrackerFree|SHA1 +1DB0D66C1D21DD4B185D03B13D6CF620E4FACBAA|TrackingSmartphone|SHA1 +1E15B0D27C0551061885340A3990D52A93F646B8|SMSForward|SHA1 +1EBFFD9FE9463B2ED24582D2846990A5ABEF79B9|HelloSpy|SHA1 +1ECC7F67BBD1BFAB97ADDCB05A496BCA7B6B135F|mSpy|SHA1 +20948233C3EF1662E79850AE0AB959C4760114C2|AndroidPolice|SHA1 +20AB40ACC2822A34EC199622CDCA9D7A63BB302B|Unisafe|SHA1 +20C940625B322C487A89B1FEBF6C090845B040C1|FlexiSpy|SHA1 +20F092BEC76C406223A7943371A1DBBB5BF66C13|pcTattletale|SHA1 +219D2D7FEC2B2DA6E25693A75FC15D2C6F4F6E67|AllTracker|SHA1 +219D542F901D8DB85C729B0F7AE32410096077CB|SpyNote|SHA1 +230E35A26E471352DF5DBDBCF9834E0711500CB0|Reptilicus|SHA1 +240E97A0587BF99441787EA3BCB2B2D8827564FE|Snoopza|SHA1 +2441F6D331D6CFD8624346ED4B1987EAE6534FA3|Spyone|SHA1 +24D3251C7A1184649211B9068820545397B112C9|EasyLogger|SHA1 +26AF8554EE338D6969FAC51BF4DAC3186098056E|SpyPhoneApp|SHA1 +26DDA9B261169FB0A63A6CEA5B682B7A190328B6|AndroidPolice|SHA1 +26FC20C25AF99E4B6C16ABAD8E8D76AFA55973BB|AndroidPolice|SHA1 +271CA9A77AF56B94F942EDA8F517E4B0FD44206C|AndroidPolice|SHA1 +272CD0BC357FA03AF87940644CB8FFDECD2FDDC6|AndroidPolice|SHA1 +28393DBA55F5B08294D1E54962BE1648C1EFB4A2|AbsoluTrack|SHA1 +284E4AF2E92E8E49EDC2C8792D7008759813CB68|FlexiSpy|SHA1 +28AFF3C41C0D42ACBB6B73C6C08868C442088640|Spyone|SHA1 +2919FF38F04D757BA6FE344F1729275739F43E89|AndroidPolice|SHA1 +29FFFE437675D2B55512953759C40776E547592D|MobileTrackerFree|SHA1 +2A1C74FFFE33C7D867C7B284FFDBBA4DDD024450|AndroidPolice|SHA1 +2A84B79A7E17E1F49642E8D5EA9828CFEA763E8C|MobileTrackerFree|SHA1 +2B02F9708FAD9017D9F709AB2C5C8B5BD0D29394|AndroidPolice|SHA1 +2C08279BCC8EB16B2B31ACFBD7E1D4BB28E49A87|Reptilicus|SHA1 +2CF347EA59967F7799AA2C1FDB5D711B2B93D586|AndroidPolice|SHA1 +2E104C33C8DA4DB32E59A45701D8E0C4CAD16BD3|VIPTrack|SHA1 +2F033070A8CD93CEAC60F9E203BA33C9A9A3D226|MobileTrackerFree|SHA1 +2FD8BEF4081F126D4DA655B40E9FC63F116DD857|Reptilicus|SHA1 +317A9577A5B2D0930D06E0D8D7427E2F8FCAD29D|Spyone|SHA1 +31A6ECECD97CF39BC4126B8745CD94A7C30BF81C|TheTruthSpy|SHA1 +32570AD62B2DF951A67251ACB49E39E96B8A43BA|BosSpy|SHA1 +32F6E28DD3E2E61ED94446591E31F89AEE3A9BD2|Spyone|SHA1 +3397C095EAD93B13CC5B9979D1F3B4FAEF1D194C|AndroidPolice|SHA1 +339B5C1746A1CDEA945D51BBE967C1320AE73CC4|AndroidPolice|SHA1 +340E571CB1A64E6EE384D3F8A544681459CF3F5F|LetMeSpy|SHA1 +340FE1F4AA4A401AD8E326907E35FB9E0C2486BD|FlashKeylogger|SHA1 +34B791B5D35A874D189202EEA1FA99188F58A4C1|RealtimeSpy|SHA1 +35B05ACC96D02849E20D9ED3BA9CEA41C2B83FFA|MeuSpy|SHA1 +35CD797D1736484786152A231920575FABC5C12A|MobileTrackerFree|SHA1 +35D1DB3904A84793394FE5DF7B678E263B1B33A0|AndroidPolice|SHA1 +35D7CF057BFA5023CE739A725ADA0DA1FD34D1FF|EasyLogger|SHA1 +35E90A29262F1E6CC25B6E483DEC67161513DE30|AndroidPolice|SHA1 +36E6671BC4397F475A350905D9A649A5ADE97BB2|TheTruthSpy|SHA1 +377223C40330F7925BB238E3A2AC6E1BE1A05749|MobileTrackerFree|SHA1 +37ACE0321E8833F25BDDB363AB395C81354E88A0|TrackMyPhones|SHA1 +38819265668EEAE6AC3C6C80D1A6530EAE99AD0E|SpyApp|SHA1 +3930B621F30D13D24692CBBBBC67C59F92F1C9BD|mSpy|SHA1 +3935E474CD6EDACB19F24192809B337D376656F6|MobileTrackerFree|SHA1 +39DDEFD8261C1946E4F3160F6A9E200F59F06C11|AndroidPolice|SHA1 +3A041A8B1CF12E01AD4AA14779C1FCCA0701FE5C|AndroidPolice|SHA1 +3BA583488F36C708025C078D9EB4BEDC3918B098|AndroidPolice|SHA1 +3D4D65F3584201E74B186A90C3333C468D3C6A09|Observer|SHA1 +3E1A6646C93A7423A25104A88DA5BECE2F35EFF0|mSpy|SHA1 +3E4E5813CA5B9D9BB50B70FAD3C201FAA54B4FD5|AndroidPolice|SHA1 +3E929DB5941C185EA4FAC2B0D7BA7589D40A379E|MeuSpy|SHA1 +3E9B3E5190F64BA9A952B7F57942AA21FFDA50BA|MobileTool|SHA1 +3EA68714AE224B0C0EEED64A14B11D3983C3D6F8|iMonitorSpy|SHA1 +40159690AF08A01670E3FA07A021F7B1C1437042|AbsoluTrack|SHA1 +409B589FDEAE073A94D609E2B41A6C0EA952B35A|Cerberus|SHA1 +4140120093B5655CF559B2A786269CF3F82E3AE9|AndroidPolice|SHA1 +41862C48D4BBC2A83DB3CE6EBA0D0C53E3D882B6|Unisafe|SHA1 +437940A417B58B1C2CDB85EDE4D37C3DE6EFDC95|VIPTrack|SHA1 +43D45CE7BEE36E449434C14973B7D285209414C7|AllTracker|SHA1 +4474D3395029E6C6744A470EE5F2107DBAEF16A0|AndroidPolice|SHA1 +4569A62308FA134A33A5DDCC065D6FDAE5653435|AndroidPolice|SHA1 +4579E9E02465DAC399B7A47682813F5104E5D914|AndroidPolice|SHA1 +457D2470CA3E635178D224C14C0D743B7C7F9F80|MobileTrackerFree|SHA1 +4591BD0E4CBE86FD7510F1427BA6538BB269AE4D|AndroidPolice|SHA1 +45DECBF059864164A4BC644D3EAB8127FC98238A|FlexiSpy|SHA1 +473F919A69BBAD3457AF2F0E3AFC34E513F103F1|bark|SHA1 +483716998F0C092FE82B0B12B1A4BA399D941318|TheTruthSpy|SHA1 +48A2190050B80F31E1E3CCFAF9909FAD238D9849|HighsterMobile|SHA1 +492FF617A79F6C8D80B453815CFE6586E21C5F72|AppSpy|SHA1 +493812991A9A1CC7BEEFD45F2180CD2FC0AF8913|MeuSpy|SHA1 +4A3742E0C96AFB91954D613AAA637076750E5A0B|EasyPhoneTrack|SHA1 +4AF16661FC885F7CC84358CCB8F272308436D5E3|RealtimeSpy|SHA1 +4CACA12EB37B7A7F07AE380C7E1741D2C36531DF|BlurSpy|SHA1 +4DAD108F915E237CA2834FAC70C077AD8105E804|iKeyMonitor|SHA1 +4E6B680EF3B588EF53097BC7CEFB778833B8A475|AndroidPolice|SHA1 +4F6AD2383DADACCF93EA5BE4300571C315DBDF5B|Hoverwatch|SHA1 +4FF0174BEDC1D16BE55AC53B98599398AC461F82|TheTruthSpy|SHA1 +5037E917539B4F31E0B92EBB7A9089C5DC567518|CatWatchful|SHA1 +5051413BB7C4931F5CD25260FFF173739CBE0F3A|AndroidPolice|SHA1 +50CADBA5487E7C00D67C8FF0D3A952D7B62BEE9A|MeuSpy|SHA1 +523C42BF2F6CBAFC78BE41043E8E3E3BB311CBA2|CatWatchful|SHA1 +5284272445CE993DE601BB23CAE6BA9E43E4589C|Hoverwatch|SHA1 +52B12772C6558D6A44A2DAF9E18FFAE48C577CA7|Cerberus|SHA1 +53486B8F8790D1848E0842F37B5C6DFA15CD3EBB|MeuSpy|SHA1 +53FADDAF873B7BD00E5AD9F5F05E7888A398CE70|EasyLogger|SHA1 +5407E1CC26F28D6024E0384693045AEA2B24C5DA|AndroidPolice|SHA1 +54E4D1ACDA9E3071D27AA7B6470E23F75BF1380B|AndroidPolice|SHA1 +554137DEE63BE07CE9687C5886244954277227F5|TrackMyPhones|SHA1 +558765849658A3821FE4054ED2C1FF6E28B4B8A0|AndroidMonitor|SHA1 +56BD8EB8A20904E4766D99F6D38D87466C44B114|RealtimeSpy|SHA1 +56C8FA19250EDBA1A91A37F500DA91FBC0657B1F|SpyMug|SHA1 +56EF5244378FB6B4EF82D2B9E99BF41F7B97D93A|TheTruthSpy|SHA1 +57178BA7BE0677C3143C24362FD35A9CF0E311A8|MobileTrackerFree|SHA1 +575A730BC2411897A318DEB23B3C3CC4F63422F5|MobileTrackerFree|SHA1 +575F8E8A04A5967E78BC5B5A3E31FDACF42F4FB1|uMobix|SHA1 +597C0169D8C27DE7C6B62C2C252F9ECAC0E562C4|SpyHuman|SHA1 +5A73C8FE7CBA5C9E70B0DF69B3A111C42A10B215|VIPTrack|SHA1 +5AD2ACB089F8BE5112FF5125D94036983DE3E8D5|MobiStealth|SHA1 +5C5EF3DFE98B02251A6EC82609F22A092562AFEE|iMonitorSpy|SHA1 +5C77395F77E17F293CC8C4E3E1FDD48296EE4B28|AndroidPolice|SHA1 +5C9031E2340478521630198F3F90E5C8D38D3B64|AndroidPolice|SHA1 +5D655F30DE8B8BDABCCDF660582C6369145E7A5A|AbsoluTrack|SHA1 +5D7B59F3AFB74D86CCD56440F99CA2FC83A23F22|TheTruthSpy|SHA1 +5E16BA998632C1C3E4D4AE707D6EE2454ED2AEB5|Snoopza|SHA1 +5E3C376B52C672C81439358DE6348F25F96EAAA4|TheTruthSpy|SHA1 +5EC970BC602D0EBB2F3C7A5135E24C330B71DE59|PhoneSpy|SHA1 +5EEC898F0DBBD70A9B33DD16EE5FF06B6DE26EA6|mSpy|SHA1 +5EF38D0143F601FD01AA39BFE9079E9927920208|AndroidPolice|SHA1 +5F2DCC133AF3E19D3935A85A3E2871856602A21D|Fenced|SHA1 +5F43A60BFC663FB37F419A40015495431649310B|MobileTrackerFree|SHA1 +5F61BEB9591ADBDF9DA5B141A1EF35CDC0944C8C|SpyphoneMobileTracker|SHA1 +6000C3F6A35C81C0AE6ACA73DBF7B7D19DCDB7BC|MobileTrackerFree|SHA1 +60277E8CE202D8023F2ECC86F1726A50D9990576|AndroidPolice|SHA1 +603881E46350999FF7A5CBD68FE6A5897C50CEDE|TrackingSmartphone|SHA1 +6041F01561EC43309CCC8452719C4F515C32F3C2|BrunoEspiao|SHA1 +60DA6A5B04C0100DFCE1213C850EFBDEB0D1E8D7|EspiaoAndroid|SHA1 +6144ED2E25B6F3A5FAFCF914965CA071A685674B|Hoverwatch|SHA1 +6156DB551938BB4560D4643B54527E4F169ED44F|GPSTrackerLoki|SHA1 +630BB83172B184A6571126229E2B2DCA2EB4123F|SpyLive360|SHA1 +636F6FE622D3059B569C9989F3CD491607F23A5D|FlexiSpy|SHA1 +64403A61F41848F987D6FD0BE00392E9561A0EF7|Hoverwatch|SHA1 +64AC17A447EB4BCAF556B57C5C66F232C489C7A7|Observer|SHA1 +656CD7890ED79CE8570D1B7156C31958D5AC1606|HelloSpy|SHA1 +665D624FD53E4D538DFE9F7A87087C513CB40506|TrackingSmartphone|SHA1 +6696449AA96EBA57CDF4707F0F84274958BE4523|uMobix|SHA1 +683722A1C629AD5734B93E08ADFAA61775AD196F|HighsterMobile|SHA1 +68AC78A7CD660ED204B4BC3C73A3F91DA1AE45FC|TrackMyPhones|SHA1 +68E4A16FD2B8D41E817CC5A06BA95B9CED9BD9F9|CatWatchful|SHA1 +69B327860EDB531DDFFB1B5DBF0C24245A75F3E4|FlexiSpy|SHA1 +69C28343A4D0F2156D7B56AE4616E1386173A047|Cerberus|SHA1 +69EE83CB3E0968B49E33849D40F7D91B0592C7DB|LetMeSpy|SHA1 +6A610D0211E543113EFE1A82CC4D270B6A45C526|AndroidPolice|SHA1 +6B1DC3EAE0E8C59E7769A6E0A1BAA1938620A191|MeuSpy|SHA1 +6B660EAAEBA47793B7A1278D714669A6612BCA5B|HelloSpy|SHA1 +6C0B8CF7F47DB7A82A2C06D410690935FDD912DF|MeuSpy|SHA1 +6C4E74FD002AEC131F8D05852566055C349E0A54|AllTracker|SHA1 +6CA8C06D7DAC5F5685E014AE5C4D2062F77B42D6|AndroidPolice|SHA1 +6CC6FB667F4D178DF4E9111FE96BE9AEAEE485EF|AndroidPolice|SHA1 +6D0FF787BF4534F1077D1E4BF2E18BA381D97061|Reptilicus|SHA1 +6DB1F33668AA745163DFB6C5614C3800BCA8D693|TrackMyPhones|SHA1 +6DFB725019C7784B400D940DAAEDAED18C5B898B|RealtimeSpy|SHA1 +6EB49E72D6138B4210D1CA60247D419E5660315C|HelloSpy|SHA1 +6EF8C27EBCF808FFA377A391DB9892B997AF16C9|AllTracker|SHA1 +6F1CE95315749AC6F377B310C0B831CF05B04C68|MobileTrackerFree|SHA1 +6F1FDA1889463BFA646A950E49E121B7829A884D|AndroidPolice|SHA1 +6F93929AB60AC760000E873CD7C56BA79A9E6CAD|SpyToApp|SHA1 +718F3191938DA39D3A4EAC0EF0F44C70F32B0989|Mrecorder|SHA1 +71AD1F579C3DCF32AA1E00E02245D359F80C260B|AndroidPolice|SHA1 +71BE35691A181E1524DDF83F931FBC62DC4E7EC6|Cocospy|SHA1 +724C6500F11737C12C0B89185A60427989656697|Cerberus|SHA1 +73BF44A503427F7682C7136B109631E3BE4114DE|SpyLive360|SHA1 +757DB1C635344324B665BAF056DC3E4B1D0CC39B|CatWatchful|SHA1 +7688EA09EE353ED077E0A90D401881B63F115A3F|CatWatchful|SHA1 +76A90B5E41FA2AFE14478CDA24A0CA6B4F7FC5F3|AndroidPolice|SHA1 +76F6C302533751BED738D40882AC219BAAD65E7B|SpyHuman|SHA1 +77032E80CC0ECEE49B8F2F58F9999330026E0DB3|CatWatchful|SHA1 +77142DA3A865C256FCDD24E187FDCEBA1B4EC587|Mrecorder|SHA1 +77C411957F307F6B971C7C07825CA5EA06F0E36D|AndroidPolice|SHA1 +77E86A5C583256B5A52A5AEEB70542CD1BE34A99|MeuSpy|SHA1 +783B1880ECDC5E75620A4C484E3BDBE08D6D4397|CatWatchful|SHA1 +786325AB3E614F868CA2A7F2F0E75EC76A047311|iKeyMonitor|SHA1 +789A24C1605F1BF2B6D64580C697BD38D9446A7E|AndroidPolice|SHA1 +795C30FAD432EE48EDF52B0748BA2749F0915CA3|SwiftMobileSpy|SHA1 +79C395148C34F0826E04B37A6632A53A7977A1AA|Spy24|SHA1 +7A22EB86FD8D817ED7BFAA03E7A280A03AF20779|XDSpy|SHA1 +7A55C057800823F710BF32A7D9865B300777E2D5|AndroidPolice|SHA1 +7AFD651F96C7C938351396A53895C3C0704F6B96|HelloSpy|SHA1 +7D0F4308B87223AEEFFA65060F0F752E84D363BE|AndroidPolice|SHA1 +7D9EDDE23B4D3D7AC459B06ECEBE8EA1350D4F8F|AndroidPolice|SHA1 +7DED7756C3DBE351A23BE061E989273888414FE6|AndroidPolice|SHA1 +7F11358AC560C5E90B735A21B907F1C8143353DF|MobileTool|SHA1 +7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09|HelloSpy|SHA1 +7FFE6DA96346FEE822E1F791176CD6970A1DC770|mSpy|SHA1 +813A3AD37D87AA36120DFEC64146C311DB5F4CA9|SpyEra|SHA1 +839FBBE6F3DF8153BB6582247DBBC2A42864A87D|RealtimeSpy|SHA1 +8418703221A74C73405AD273C28CBC12444D7520|Cocospy|SHA1 +842676B67005E6561808B650152F598035D12800|SmartKeylogger|SHA1 +845705FB0FE177970768CE3F5241AEBD99F3BEEE|MobileTrackerFree|SHA1 +849D181E1BEE5084CBE1BACBA8442996A8B1F8C6|TrackMyPhones|SHA1 +8508603AE680C3BCDE91E6F909BF400F6DC878B4|MeuSpy|SHA1 +854F7978408EA58C5B792C1C1EF9733FC2D5E813|Snoopza|SHA1 +85A4C4F357A99888725862C351119FBB12C45695|AndroidPolice|SHA1 +85AF7A95F8A95541F6B6DE88A8EBC24FF1658E98|Observer|SHA1 +85F12B25CEB58B8376F83209D8D128841132DC51|MobileTrackerFree|SHA1 +8698564FBEC700167FCC53D1AED00FFADF6BED6C|EasyLogger|SHA1 +86D94A8CE736F82D834FA588F34106AE7B69D325|TrackingSmartphone|SHA1 +87EF370B8D6E3089E7F8CDDD6E830B5E4C8CF60B|TrackMyPhones|SHA1 +8851279B5177EF52B0B8540EE1FCED4BABDFB318|AbsoluTrack|SHA1 +892C4F172AD3262EC398B40BBF8130C6421040A1|EasyPhoneTrack|SHA1 +8A718113C6EDE9473FE4BF1F29E2E807B7EB7B56|MobileTrackerFree|SHA1 +8A92A4F6F9FC52BC8788F17704944614C744716C|MobileTrackerFree|SHA1 +8AD595A53B76014B7B919ED231DB372096D358E7|SpyMasterPro|SHA1 +8AE2267AEEA0DBFF7D7CC1C82E54343B1B0CFA22|AndroidPolice|SHA1 +8B187B3EBEF7D1BC8E32BEC78D36CBF95505A1C1|AndroidPolice|SHA1 +8B9540311C46184984B48BF9CB51F1742A8AFB42|MobileTrackerFree|SHA1 +8C017FDB2A81807EC879A8E30F4AB05D5CA02034|SpyPhoneApp|SHA1 +8C76B4444DAE08ECF578AF51D295836F0D9BADC6|AndroidPolice|SHA1 +8CD8FB235EA7F9B0FC308C1A59AB561C3869878C|RealtimeSpy|SHA1 +8CED75E875A2F11B3327A73A6DBD0B25E26533F2|MobileTrackerFree|SHA1 +8D7FEC36654F6B35FA89E079685D637CCEE27755|AndroidPolice|SHA1 +8E352F2EE18054DF97C238915C0375AA13305DEC|CatWatchful|SHA1 +8E38D577187544D4E0F747CAEF32B47FD15B07E5|BrunoEspiao|SHA1 +8F0EAD4F1DA5DAAF8C0F7A51096CECEEF81D0C76|LetMeSpy|SHA1 +8F23E1457ADC6189F6ED504A60DF8896FEC6D970|EasyLogger|SHA1 +8F576BEEB71EA74E5F27764917BFF5B508017B68|CallSMSTracker|SHA1 +917BB5B2D40EC40018541784A06285DE0F50F60F|TheTruthSpy|SHA1 +91ED4F75A763A63471E1D1D39BA012DF867550D4|ShadySpy|SHA1 +9225C8FD380154467908AE344FBE75CE7EF996B8|MobileTrackerFree|SHA1 +9256E291823DA741B64CB23F7E371D0940E5272E|Reptilicus|SHA1 +927CA44949D7788AA86F9D7F04D7FDACECD1DFB9|MobileTrackerFree|SHA1 +9284CB43B87E9F9C77DA509F1672E884BD6CA876|iKeyMonitor|SHA1 +92DF71DB15BEEAB77DF36FD879A89E5E0DEF4617|CatWatchful|SHA1 +92EBDB7D7C18A34705A6918B5F327DDB0E8C8452|AndroidMonitor|SHA1 +93135ABA6FF4B6CFE9B06153B9BDF769AEBC1D87|CatWatchful|SHA1 +9329632A70D41158EBAB6EED27B12D8CB0D47579|AndroidPolice|SHA1 +93385A087BB5CAB96EAE83A1AF874E0E39B2990F|FlexiSpy|SHA1 +933C19015525266982AC6D830CB6B3D25079777B|RealtimeSpy|SHA1 +934A3C0DC8912C4F2F8620F666FC7621BD7B97B8|pcTattletale|SHA1 +9427212B33E9D3636970EAB73E2845E0DC59B5AA|AndroidPolice|SHA1 +9442F1D40FBAAD7053D130986C4487D0BA5C079F|MobileTrackerFree|SHA1 +9477420001BC79500623374EC586B054AAC97BF9|SpyPhoneApp|SHA1 +95D589A90971992A2038E5961B39C8B6BC77CF19|AndroidPolice|SHA1 +96A1F635F940D8D154FD42D550B6201B60692744|TrackView|SHA1 +970B463F5103B36326AF8C8349A4106F6932835B|AndroidPolice|SHA1 +98140CAE57F4D4CA53EF81F6521E7A0FD601F6E9|AndroidPolice|SHA1 +984F8786102D9BF26E5244BBC93733D3609948F4|FlexiSpy|SHA1 +986E5892EFB97E807772698BAC701F49CE9CAEA8|AndroidPolice|SHA1 +98E76043B54DD7CB76E0E6E384A83646F1865BAE|AndroidPolice|SHA1 +98ED5841256A44FB1525FE154C0516ACED82FFF3|iKeyMonitor|SHA1 +9B07A93BC509C0AE614AEAFFCD6B56797CD02166|SpyMasterPro|SHA1 +9B48840CBF93379410172B4B85989624D2B33D59|FindMyKids|SHA1 +9B48840CBF93379410172B4B85989624D2B33D59|WiseMo|SHA1 +9BCE25527FF174A4AD6CDE233B17038641A5EEF9|Xnore|SHA1 +9BD494107EFED96F630D29D6E18AE4DCC47149E2|Reptilicus|SHA1 +9DE8D6C6757152EC819C1A09F5665B77F72493A2|TheOneSpy|SHA1 +9E09874197988F20DB51EB6A34BFD908AC42C35B|AppSpy|SHA1 +9ED8DD944D3EB545E1EEEEEC1D8174772CF37C07|NeoSpy|SHA1 +9EECE9B4ECF4DC0C5981FEACFB271E1C0A2967FF|AndroidLost|SHA1 +9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85|RealtimeSpy|SHA1 +9FE876AF76CDCB685102A38528A3A732B0872DC6|CatWatchful|SHA1 +A1AA4CD5B6CDBD906E3B27A7D1FA42EA2416ADC3|BrunoEspiao|SHA1 +A2CD01EE20E3C25575D2D9B9645A52A1FA8C36C6|AndroidPolice|SHA1 +A2CE290D98B66B577880F3D7807DC01EB7FCE01B|AndroidPolice|SHA1 +A2EBDD14E2AE17F52363BCB751CCBE15BE5A2F8D|AndroidPolice|SHA1 +A36C70833A8A796F94CCD56B810D2A123F4F0485|AndroidPolice|SHA1 +A40D8FDC7953AD69D970FF00658EB0F58B3A052A|HelloSpy|SHA1 +A4817668612688754B4905C44AB9F70C58C25CB2|MobileTrackerFree|SHA1 +A4E169AAF0068A1FC5F7900B7F59A438B833364C|NetSpy|SHA1 +A519EF2B8C4E73A097065B322687C9D38DED610C|Unisafe|SHA1 +A759EC34A1144DC3443A9D4C3286F9F3A4F23FB1|Traccar|SHA1 +A75B340A58545B28B7E837582259C1CC2CE21512|MobileTrackerFree|SHA1 +A7E75010B3709D54D52CCE914AF06946744F5F67|MeuSpy|SHA1 +A93266E83B136CBC220062898D308213263E793A|TrackMyPhones|SHA1 +A9A302C9606AF4BE4468A4FC74F7873DDADA2AB0|AndroidPolice|SHA1 +AA0458B6C035E767E61DB7456CBCA89CC4D42090|RealtimeSpy|SHA1 +AA4F85CD7C24116BB51FA733BE59290B7BB8C204|AndroidPolice|SHA1 +AA752803419B66BC6D5CFCD61A7C88935FFE5511|Traccar|SHA1 +ACB2CA50376456FD81B5C6C19CF6D717CFBB888B|iKeyMonitor|SHA1 +AD231A7CD57E2CEF8162F4D341C3573DE2B8F443|ShadowSpy|SHA1 +AD62CBB4BD298CF69CDA40997C3E5D70112D7161|AndroidPolice|SHA1 +ADF393A6628366341BA488B85A5AE738793BFD17|AndroidPolice|SHA1 +AF113D18054A6B8DE74644BCE3F0AE41206B16AC|MeuSpy|SHA1 +AF821DD021558AEDF49730D2892063BD502DEA14|TalkLog|SHA1 +AFC457A96258490FBC284EE889634B5F3E325B8E|Hoverwatch|SHA1 +AwamiSolution|SmartKeylogger|unknown +B0A100360B029E0B2105F60E2C8EEB9053998A7E|MeuSpy|SHA1 +B0B09157DC34E3D20DF6A92EBA0014D36A27C451|MobileTrackerFree|SHA1 +B0F639B67819EDBADC73B9FEFF2582FC58B8F115|TheTruthSpy|SHA1 +B1336A5F3A017394186563E84AE0D2649FC1697D|TheTruthSpy|SHA1 +B14E50E56D5D483031137FD247D4A5466D0E61B4|TrackView|SHA1 +B374A75F87F992A6F57CF99A24197ABCEB17A1E7|SpyAdvice|SHA1 +B4A1513C2C71F08D2EE763CD3FAE585F71F268A9|Cocospy|SHA1 +B4ED5FA9E2A9176DA53324717A9B10F57191859C|Cerberus|SHA1 +B5075AB201EE483C8ECADE1BC4FC711293D6932B|MobiSpy|SHA1 +B57FAAB701E26B4C92972442D3A428881E18441A|AndroidPolice|SHA1 +B5895930053256D408DE74B66BA132B73CB21527|Unisafe|SHA1 +B61326887306E5A65726AE6BFD1D720D2760CEFF|Reptilicus|SHA1 +B6A744B0E8AE049AC0C20402EBC137B1192699A9|AllTracker|SHA1 +B6B58148F1B2198C94BDE546FD2E0734EC7838D6|Hoverwatch|SHA1 +B6D2D36C75931CCA18538B79C5DE3A04EF4AF777|TheOneSpy|SHA1 +B7285348B05EDAEFF7F032384E4F90182E1C1F27|TrackMyPhones|SHA1 +B7322B2126B2C4F4DED940D719FE1E63FD233D35|MobileTrackerFree|SHA1 +B7B561250288C8BB44932B591B5451D852A95109|eagleSPY|SHA1 +B7BB744C68FD6EB4C49298E7506BED53DC4773FF|RealtimeSpy|SHA1 +B8C908630D7D1ED52FA4E5AEC2A2BDA0414F8B3F|AndroidPolice|SHA1 +B8CA103D22C39282D7A1E8028D93333E481CCA83|MeuSpy|SHA1 +B8D8C25B1CFE2829D397C8FB166895A6791A43D5|MobileTrackerFree|SHA1 +B8F5FDFAE5920C4CFB6ACE214D39327F299FA76D|iKeyMonitor|SHA1 +B8FCBCA563B1CD0E79CAC595002422C2E54072B7|RealtimeSpy|SHA1 +B927DACA3BB3876523E2E8B1BDB56CE84B0DFFF7|CatWatchful|SHA1 +B9D5BAEDCF0C711317E8B6E54D60F0A5EDEE9517|AndroidPolice|SHA1 +B9F546776987F0F2FF893325D2CCDF7F62F0D56E|MeuSpy|SHA1 +BB59FC701EAC40C51C9274EA6A8EE623F5002802|AndroidPolice|SHA1 +BB5E2C0E8DFDC54730C1E9B48754977E7DBCCCF9|WtSpy|SHA1 +BC53CC2A9996DE47BF72348F2A592DC0EBDAF06B|CouplerTracker|SHA1 +BC682A41C2AA1EFFFD65CE42BBE3FA967A561EEC|AndroidPolice|SHA1 +BC693B48B7EC988E275CF9E1CDAA1447A31717D9|Cerberus|SHA1 +BCA2BCB87F6E28FB403CED643311B135CA0DC0A2|AiSpyer|SHA1 +BD3986483D9B962B029D65BF34BF4B7C568FF204|AndroidPolice|SHA1 +BEF28CC19ADFBEADC95137A2BD5035B6046666E9|AndroidPolice|SHA1 +BFC4C15E35E3506095B42E2B428E4016B1FFA1AB|iMonitorSpy|SHA1 +BFF94895A64AEB38B5278BC41B1DB242CD82DA62|TheWiSpy|SHA1 +C1D83F5FFE3EC319FF103EC7346CDDF218B5634D|iKeyMonitor|SHA1 +C270531A6D75EB4EA2AA0F4D6DF2980AFB494CB3|SpyHuman|SHA1 +C276C3B087207C9D3CEEDA766C01E0BDEF7EAC71|XNSpy|SHA1 +C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9|Cocospy|SHA1 +C44894EE63F2E861A6960834A21EB27169150722|ShadySpy|SHA1 +C4B56E3768543190FDBE0AA01DD628E579F5514C|Spyone|SHA1 +C51C36FE4F1DFC0C5B8CD55F74773135C1C1E1E5|AppMia|SHA1 +C656605BDB536B842319AC008FBB249D8B0A7422|MobileTrackerFree|SHA1 +C7FBC97C3BD3949A6C19FF332E6CF2F2E5CEE561|AndroidPolice|SHA1 +C863D800B89648724CD483911FBF756F36497CC9|RealtimeSpy|SHA1 +C87A87F7F5EDE2D279DDA0CCDE55E6AB85549D70|Cerberus|SHA1 +C8BAE63357CA1DCD9B084BCC99399C96A5B67D49|SpyMasterPro|SHA1 +C9BE6C42B975258DEA10EB6946A7986E4FE955E2|AbsoluTrack|SHA1 +CA5304E94F4BC97DA9D147E76858DBF70AB8B4E6|OwnSpy|SHA1 +CA6F27DDCBE5D7929C82F42F63FF24703A352756|AndroidPolice|SHA1 +CB28ADFD818FBFFDF5542F2EFC5140D596EE957E|mSpy|SHA1 +CB6E6DEB296275EDF70DC71A62A75AB7B9C8DB89|MobileTrackerFree|SHA1 +CB97E71AFA4665D6D28697B9197046C81E5E5D6C|TrackView|SHA1 +CBDA86758FBE8E5A6AB805F493AA151B1F2B95F4|TheTruthSpy|SHA1 +CC4A78DBE96AC1FA5977E03C97052A9A334113B4|Hoverwatch|SHA1 +CC866E79BDAD431A2B1E07229B92E64808221610|Cocospy|SHA1 +CCCD74B31E53685BFA5A23AD0AE020AF74689085|MySpyApps|SHA1 +CCD5678FF73D6ECF4E74317166422AFE67D77406|PanSpy|SHA1 +CCE55D4C3E844E8A7542036D40BFBB4AA98B89D7|ClevGuard|SHA1 +CD5724426B602C1CD0BF3BD65EF75B9021C0EC3A|MobileTrackerFree|SHA1 +CD8F39DAECC7793F33D8D847A598373B8F25A7B7|HelloSpy|SHA1 +CE3BB9701274C15D26A92C1D7D34110961EB73F1|MobileTrackerFree|SHA1 +CE94B8512390676F62F3EC61BECEDDDE9AB5519F|AntiFurtoDroid|SHA1 +CF627144481D3F1DCFBB6CF12291C540AE325FBE|RealtimeSpy|SHA1 +D09EE9D79FF75E737429DDE34FD13EDFDDA34E78|AndroidPolice|SHA1 +D15A276F181C839E0390672A43065E8D97F140E9|EasyLogger|SHA1 +D1BB66A93F621A66094F28856988C7A2AE9972D0|AbsoluTrack|SHA1 +D244AA1DD3D4296CE875EDA2E1B0332459F7DACE|MobileTrackerFree|SHA1 +D2A84922F8F747FD7582EFEF4189E06897FA8839|Spyone|SHA1 +D3A7E0E542A3E1112741806AC31F341C4200FBA1|Reptilicus|SHA1 +D3E6A092741CBA59BE9308FBA72DF887EAB184FD|RealtimeSpy|SHA1 +D44524FA0D7866F1798C41C28953DA899B46BE65|Observer|SHA1 +D46492F02F25877E9F5D6CFFA4CE99DAC64D981A|TheOneSpy|SHA1 +D667A33203776F2285EBA3E826CD286356EF05D0|TheTruthSpy|SHA1 +D8418B279414687729D37B34E53AB75D502B9F73|RealtimeSpy|SHA1 +D943998AEC15B3D70DA3BF00FF7BF580A41F6E4B|MobileTrackerFree|SHA1 +D98C69B50C1092FE21F7CF748DC8B2F91BE56B64|AppSpy|SHA1 +DAE17DA900E269741688CEA3DAF929A8D896536D|Traccar|SHA1 +DBA6211533A354E4BBF685A2EA458AC372C4ECE4|Trackji|SHA1 +DBC4B607C3B07C48F40F9D184DE443D651436CA5|AndroidPolice|SHA1 +DD34B4E5125F07BA50738192FBE7B745785FC15A|MeuSpy|SHA1 +DDCF7F1032E7D9DA4E3D245A5145363F69F9C393|MobileTrackerFree|SHA1 +DDE822BAF53EF55C49096E866A995464CECB8B1C|AndroidPolice|SHA1 +DE648A3253C16692AF71141C069D15C87C3E5495|TheTruthSpy|SHA1 +E0103BF20E95E826920A3F0F7B3BD03A899127D7|FreeAndroidSpy|SHA1 +E023517B163AAAE209CBD97E312752960F575D38|Snoopza|SHA1 +E0E02AD30F042E096A7A5654217B846EA08C02D1|MeuSpy|SHA1 +E0FCD3E782FB859F7388E4F44A44A5D694114968|AndroidPolice|SHA1 +E169250B134E5C46C3064F166E457CDBFCC16524|SpyHuman|SHA1 +E2AC495C52B9FBD49B83CFAE0C167878A2F796A5|SpyHuman|SHA1 +E3620714FB24A45614A456DF1176D482BCD1B032|SpyApp|SHA1 +E401C172FE10C4893A13B38B1FABAA43473E2900|AndroidPolice|SHA1 +E43B5671CBA3F48619BF00D6E380BBC2F02A5DCA|OneLocator|SHA1 +E458DC7CD8928A41865F502A884F0D51309E0BEF|OneSpy|SHA1 +E48C6714DBFD2AB6E5CF85C87EFD05BD8E11E6FB|ClevGuard|SHA1 +E6502D8A870C3F3910EA34F5B46D20D923047580|TheTruthSpy|SHA1 +E689432F7C2A39379BD64CB0BD2A6028F3A666DD|AndroidPolice|SHA1 +E6F85CAB3903304DC16197B7EDA8F67ED6D65A1A|AndroidPolice|SHA1 +E7D395DF3B8077C733D9BE67D841FDF271F49406|OneSpy|SHA1 +E8395BE2A32B62C1BA21E37663E3BF1583E00FAA|MobileTrackerFree|SHA1 +E871393054ED858ACB5854C0DB9F674C42160344|AndroidPolice|SHA1 +E8FF1077D207E47AB4B53F275C437C0889579658|Hoverwatch|SHA1 +E906D462FA05007DE06423A10539C7E7EAB041CD|Observer|SHA1 +EA35FC50B3B0E0A9E5405BAC2D7E58D7F9559FD0|AndroidPolice|SHA1 +EAD44242A3C0A73DEF7976C56AC10A4530E8F67A|AndroidPolice|SHA1 +EBD3713DFB02D79ADC90C88DE1E0B547882F5A42|TrackMyPhones|SHA1 +ED5BADBC20B1B027F5858D29DAFBF66535C46DB9|AndroidPolice|SHA1 +EE35E2740576480486307C991C762A3FBA8DA46D|RealtimeSpy|SHA1 +EF6BC4C13FE455CD98192E56D96317069BDF7658|LetMeSpy|SHA1 +EF8006163D09D176083936CFB068BB07A8918118|AndroidPolice|SHA1 +F038CD90AFEA9C037A801FFAE67DF55A870879C4|AiSpyer|SHA1 +F18B3369F152EC3C74EC884BE977B3CA0E0C996D|CatWatchful|SHA1 +F1912CEE4B5D6C1EA4070B53B440E2F660FFCBBD|AllTracker|SHA1 +F21ECAFCFF000686E8EC090F1ECDAECE08798BFF|Hoverwatch|SHA1 +F25D72FCCB84BAF7F73467FC9571024B7E274CA3|Cocospy|SHA1 +F2633353631EE72F7B7A7B946FABE1EF0A339041|Cerberus|SHA1 +F28F3A97D25E51AB266E56D3B80F04747D242E50|PhoneSheriff|SHA1 +F3E17DFDB98B1F7774A16967FD1D84D3D9D59389|SpyApp|SHA1 +F4E6DA34F0071AEB70010EBB69875E5212D69140|uMobix|SHA1 +F4F16BDEB31AED018276B47CAD9007063029FD22|Traccar|SHA1 +F575CA9980D3075CF728F2081D9EC5F910CC17E8|AndroidPolice|SHA1 +F57CACB890BE22907709DDE69ED3887F6943734E|RealtimeSpy|SHA1 +F57CBB4CBB9834A14AF675222CECA6A0D26D838E|PhoneSheriff|SHA1 +F5A5336B28456208EF357B4630A93A91206CF21A|TrackMyPhones|SHA1 +F5C25A3B800311E8053295676ADB112753E03F0B|Spy24|SHA1 +F5EAEFDECAD39B93134E859BEDC7D3ED42FBE2B3|AndroidPolice|SHA1 +F6422B9D4DD3C7370E3ED2879EA4DC8F463CD2A2|FlexiSpy|SHA1 +F6914F044B9385D6005DC9C50A9AECDC2349F413|HelloSpy|SHA1 +F747F0BBEF33FFEE6AFC4E7CFA03B28215985F24|iKeyMonitor|SHA1 +F7871F09D6E58B9BEA5913FB2FA879E5427725E3|AllTracker|SHA1 +F8FC21D0709C3C0A3E4FBA81D24AB50979F25C19|WheresMyDroid|SHA1 +F9181C6CF9AACB3AB1092F5338C3198A8D833431|TheTruthSpy|SHA1 +F9265164219A1C5DEE4A76D66BEA0C35A1FD6032|SpyHuman|SHA1 +FB2EEA183C183B486B3001EC5FC4E8C906593356|MobileTrackerFree|SHA1 +FB8F23C57D0AFD255FD255B290B2EF6DBB2EAFD8|AndroidPolice|SHA1 +FB926CF2937331BB8A46E2C5280233C04DA2342E|AppSpy|SHA1 +FBC83FD67E3B534B8B03D3B341249DB3186374E2|PhoneSpy|SHA1 +FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037|EasyPhoneTrack|SHA1 +FC786B8F918655D45245C685A471BD57F02FB366|AndroidPolice|SHA1 +FCB6F780EA8F2FE7249F66C6348572BDBD54F576|Unisafe|SHA1 +FD4C2144DF6E431378A46EAEACC696AF94DE9D56|AndroidPolice|SHA1 +FD5E1BBC94E5609F366DD4816C975C1CF4003F40|AndroidPolice|SHA1 +FD84821C80C1499A2446F6F7E13BF8BDA6A66402|AndroidPolice|SHA1 +FE7626A8D3C38FD78EA2A729B39B943BA814F014|ShadowSpy|SHA1 +FE821A533BDC31822D9EB5F98243EB16917C8EE7|mSpy|SHA1 +FED69D6F09AE8C98DD4053C1934CCAF57D31824D|MobiStealth|SHA1 +FEEF07EA18BA2EF7B75AD311F45A45AB4C1E8F0E|AndroidPolice|SHA1 +FF8CCD9816B0524A58FBDE1809FB227DBCDFD692|TheTruthSpy|SHA1 +H20201128|AndroidPolice|unknown +MobileRecorder|Mrecorder|unknown +Tesline-Service SRL|AndroidPolice|unknown +^Kids\WSafety\W[0-9]{2}-[0-9]{2}-[0-9]{2,4}\W[0-9]{2}:[0-9]{2}:[0-9]{2}$|AndroidPolice|unknown +mobizim|MobiStealth|unknown +mrecorder2|Mrecorder|unknown diff --git a/vigil/ioc/domains.txt b/vigil/ioc/domains.txt new file mode 100644 index 0000000..d24eb73 --- /dev/null +++ b/vigil/ioc/domains.txt @@ -0,0 +1,4668 @@ +# Vigil IOC: C2 and tracking domains +# Format: domain|threat_name|category +11111.pl|Spyone|distribution +12d60.appspot.com|AndroidPolice|c2 +12d60.firebaseio.com|AndroidPolice|c2 +13-5.org|AndroidPolice|c2 +13-5.ru|AndroidPolice|c2 +1688-global.cn-hongkong.log.aliyuncs.com|MobileTracker|tracking +178.63.71.15|HelloSpy|distribution +1ca43.appspot.com|TheTruthSpy|c2 +1drivestorage.com|2022_08_metas_adversarial_threat_report_q2|c2 +1g7kvrv.xyz|MobileTracker|tracking +1st-smtp2go.email|2021_07_taking_action_against_hackers_in_iran|c2 +1topspy.com|HelloSpy|c2 +1topspy.com|HelloSpy|tracking +20minuts.com|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +24.com|201512_PackRAT|c2 +2fapass.club|MobileTracker|tracking +2fnoqifq.com|MobileTracker|tracking +2g8cvdii.com|MobileTracker|tracking +2j1i9uqw.oss-eu-central-1.aliyuncs.com|MobileTracker|tracking +2mata.net|AndroidPolice|tracking +2mblk.com|202006_DarkBasin|c2 +2nd-smtp2go.email|2021_07_taking_action_against_hackers_in_iran|c2 +2oafxcbq.xyz|MobileTracker|tracking +2y4nothing.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +3rd-smtp2go.email|2021_07_taking_action_against_hackers_in_iran|c2 +4-dot-all-tracker.appspot.com|AllTracker|c2 +404mobi.com|MobileTracker|tracking +4jslg.11111.pl|Spyone|distribution +4mblk.com|202006_DarkBasin|c2 +4th-smtp2go.email|2021_07_taking_action_against_hackers_in_iran|c2 +519c195138.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +51ginkgo.com|MobileTracker|tracking +5m5.io|2021_12_taking_action_against_surveillance_for_hire|c2 +5rfvbnji9.com|MobileTracker|tracking +6-dot-all-tracker.appspot.com|AllTracker|c2 +6287970dd9.era3000.com|OwnSpy|distribution +678ikmbtui.com|MobileTracker|tracking +6kvses.com|MobileTool|c2 +7hn706pwsj.execute-api.ap-southeast-1.amazonaws.com|MobileTracker|tracking +7lc6jc.xyz|MobileTracker|tracking +7nvdx0.xyz|MobileTracker|tracking +83dd4.appspot.com|iKeyMonitor|c2 +8916f.appspot.com|BlurSpy|c2 +89685.firebaseio.com|AndroidPolice|c2 +8balwalz1i.execute-api.us-east-2.amazonaws.com|MobileTracker|tracking +8sghnct.xyz|MobileTracker|tracking +97.logger.mobi|EasyLogger|c2 +Market.dedyn.io|2022_04_metas_adversarial_threat_report_q1|c2 +a-qa3.thd.cc|mSpy|c2 +a-spy.com|RealtimeSpy|c2 +a-spy.com|RealtimeSpy|tracking +a-video.vip|MobileTracker|tracking +a.hdmodecam.live|MobileTracker|tracking +a.hw.cab|Hoverwatch|c2 +a.hwa.cab|Hoverwatch|c2 +a.pricetaco.de|MobileTracker|tracking +a.syncvch.com|Hoverwatch|c2 +a.thd.cc|mSpy|c2 +a1.etrality.com|MobileTracker|tracking +a2.etrality.com|MobileTracker|tracking +a342f.appspot.com|Unisafe|c2 +a71f4.firebaseio.com|HighsterMobile|c2 +aalaan.tv|201608_NSO_Group|c2 +aax.me|201605_Stealth_Falcon|c2 +abforbrowser.com|MobileTracker|tracking +ablyazovangels.com|202006_DarkBasin|c2 +ablyazovcog.com|202006_DarkBasin|c2 +ablyazovcrimestory.com|202006_DarkBasin|c2 +ablyazovcrimesyndicate.com|202006_DarkBasin|c2 +ablyazovcriminalgang.com|202006_DarkBasin|c2 +ablyazovcriminals.com|202006_DarkBasin|c2 +ablyazovgang.com|202006_DarkBasin|c2 +ablyazovmafia.com|202006_DarkBasin|c2 +ablyazovorganisedcrime.com|202006_DarkBasin|c2 +absolutesoftsystem.in|AbsoluTrack|c2 +absolutesoftsystem.in|AbsoluTrack|tracking +absolutestoreindia.com|AbsoluTrack|tracking +ac.iprocam.xyz|MobileTracker|tracking +ac480.firebaseio.com|HighsterMobile|c2 +account-google.serveftp.com|201702_NilePhish|c2 +account-gooogle.info|201801_SpyingOnABudget|c2 +account.cellphone-remote-tracker.com|HelloSpy|c2 +account.childsafetytrackerapp.com|EasyLogger|c2 +account.logger.mobi|EasyLogger|c2 +account.mobile-remote-tracker.com|HelloSpy|tracking +account.refog.com|Hoverwatch|c2 +account.spytomobile.com|AndroidPolice|tracking +account.trackerplus.ru|AndroidPolice|c2 +accountgoogle.firewall-gateway.com|201603_Shifting_Tactics|c2 +accounts-email.space|201801_SpyingOnABudget|c2 +accounts-goog-le.com|2021_04_taking_action_against_hackers_in_palestine|c2 +accounts-goog1e.com|201801_SpyingOnABudget|c2 +accounts-goog1e.info|201801_SpyingOnABudget|c2 +accounts-goog1e.in|201801_SpyingOnABudget|c2 +accounts-google.cc|201801_SpyingOnABudget|c2 +accounts-google.co.in|201801_SpyingOnABudget|c2 +accounts-google.firewall-gateway.com|201603_Shifting_Tactics|c2 +accounts-google.gq|201801_SpyingOnABudget|c2 +accounts-google.info|201801_SpyingOnABudget|c2 +accounts-gooog1e.asia|201801_SpyingOnABudget|c2 +accounts-gooog1e.info|201801_SpyingOnABudget|c2 +accounts-gooog1e.online|201801_SpyingOnABudget|c2 +accounts-gooog1e.space|201801_SpyingOnABudget|c2 +accounts-mail.space|201801_SpyingOnABudget|c2 +accounts-mailbox.space|201801_SpyingOnABudget|c2 +accounts.cam|2021_07_taking_action_against_hackers_in_iran|c2 +accounts.gooog1e.com|201801_SpyingOnABudget|c2 +accounts.loginshare.info|MobileTracker|tracking +accounts.mx|201608_NSO_Group|c2 +accounts.pgv4.com|SpyApp|tracking +accounts.spyapp.ro|SpyApp|tracking +accountsgoog1e.info|201801_SpyingOnABudget|c2 +accountsgoogle.firewall-gateway.com|201603_Shifting_Tactics|c2 +accountsgoogles.firewall-gateway.com|201603_Shifting_Tactics|c2 +acd.kcpro.ga|MobileTracker|tracking +activate-google.servehttp.com|201702_NilePhish|c2 +activate-your-account-now.com|MobileTracker|tracking +activation.spytec.com|SpyTec|tracking +activesessions.me|2021_07_taking_action_against_hackers_in_iran|c2 +actv8technologies.com|MobileTracker|tracking +ad.iprocam.xyz|MobileTracker|tracking +ad.mobnv.com|MobileTracker|tracking +adblox.org|MobileTracker|tracking +adbsc.flyermobi.com|MobileTracker|tracking +adbsc.ikmytech.com|MobileTracker|tracking +adbsdk.flyermobi.com|MobileTracker|tracking +addons.news|2021_12_taking_action_against_surveillance_for_hire|c2 +adeco.adecosystems.com|MobileTracker|tracking +adhostingcache.com|201605_Stealth_Falcon|c2 +adhostingcaches.com|201605_Stealth_Falcon|c2 +adibjan.net|2021_12_taking_action_against_surveillance_for_hire|c2 +adjust-local-settings.com|201608_NSO_Group|c2 +admin.dofunapps.com|MobileTracker|tracking +admin.fenced.ai|Fenced|tracking +admin.flexispy.com|FlexiSpy|c2 +admin.nemospy.com|AndroidPolice|tracking +admin.surf-admin.link|MobileTracker|tracking +admin.webdetetive.com.br|OwnSpy|tracking +adobes.software|2021_07_taking_action_against_hackers_in_iran|c2 +ads.dofunapps.com|MobileTracker|tracking +ads.flyermobi.com|MobileTracker|tracking +adserver.hahamobi.com|MobileTracker|tracking +adservices.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +adultpcz.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +advance-chat-app.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +advance-chat-app.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +advanced-files.club|2021_04_taking_action_against_hackers_in_palestine|c2 +advertsservices.com|2021_12_taking_action_against_surveillance_for_hire|c2 +advfb.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +ae.mveditor.xyz|MobileTracker|tracking +aecodero.com|MobileTracker|tracking +af.to.123games.club|MobileTracker|tracking +aff.fortunnecat.com|MobileTracker|tracking +affiliate.spyera.com|SpyEra|tracking +affiliatedomainservice.com|202006_DarkBasin|c2 +affinemainung.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemainung.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemainung.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemainung.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemaiunng.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemaiunng.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemaiunng.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemaiunng.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemaiunng.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemanung.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemanung.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemanung.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affineminung.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affineminung.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affineminung.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemiunng.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemiunng.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemiunng.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affinemiunng.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +affise.app|2021_12_taking_action_against_surveillance_for_hire|c2 +affliatedomainservice.com|202006_DarkBasin|c2 +ai-pilot.cn-shanghai.log.aliyuncs.com|MobileTracker|tracking +ai.parentalsearch.xyz|MobileTracker|tracking +airlineadverts.com|201605_Stealth_Falcon|c2 +aispyer.com|AiSpyer|tracking +aivideoedit.com|AiSpyer|tracking +akhbar-arabia.com|201810_TheKingdomCameToCanada|c2 +aki.kcpro.ga|MobileTracker|tracking +aksoft.gq|PhoneSpy|tracking +alaiblompass.com|MobileTracker|tracking +alawaeltech.com|201608_NSO_Group|c2 +alb.bearclod.com|MobileTracker|tracking +alert.bk128.com|MobileTracker|tracking +alert.bk128.com|XNSpy|c2 +alert.xiz4me.com|MobileTracker|tracking +alert.xiz4me.com|XNSpy|c2 +alharbitelecom.co|2022_04_metas_adversarial_threat_report_q1|c2 +alhds.net|2021_07_taking_action_against_hackers_in_iran|c2 +ali.panspy.com|PanSpy|c2 +alidocs.dingtalk.com|MobileTracker|tracking +alishatnixon.site|2021_04_taking_action_against_hackers_in_palestine|c2 +all-sales.info|201810_TheKingdomCameToCanada|c2 +all-tracker.appspot.com|AllTracker|c2 +all-tracker.firebaseio.com|AllTracker|c2 +allaboutiot.website|202006_DarkBasin|c2 +alldrings.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alldrings.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alldrings.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alldrings.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrigns.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrigns.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrigns.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrigns.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrigns.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrngs.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrngs.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrngs.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alledrngs.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +allelpcoonmber.com|MobileTracker|tracking +allerdigns.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +allerdigns.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +allerdigns.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +allerdigns.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +allerdigns.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +alljazeera.co|201608_NSO_Group|c2 +alltracker.org|AllTracker|c2 +alltracker.org|AllTracker|tracking +almal-news.com|MobileTracker|tracking +almasryelyuom.com|2021_12_taking_action_against_surveillance_for_hire|c2 +alog.umeng.com|Cocospy|c2 +alospy.com|HelloSpy|tracking +alpineai.uk|2021_12_taking_action_against_surveillance_for_hire|c2 +alraeeenews.com|2021_12_taking_action_against_surveillance_for_hire|c2 +alraeesnews.net|2021_12_taking_action_against_surveillance_for_hire|c2 +alter757.info|mSpy|c2 +altsantiri.news|2021_12_taking_action_against_surveillance_for_hire|c2 +alttaeb.info|2021_04_taking_action_against_hackers_in_palestine|c2 +aly.bearclod.com|MobileTracker|tracking +alz.bearclod.com|MobileTracker|tracking +amanda-hart.website|2021_04_taking_action_against_hackers_in_palestine|c2 +amazing.lab|2021_12_taking_action_against_surveillance_for_hire|c2 +amazingvideoeditor.club|MobileTracker|tracking +ami0wned.com|MobileTracker|tracking +amiowned.com|MobileTracker|tracking +amon.android-monitor.ru|AndroidPolice|c2 +amon.android-monitor.ru|AndroidPolice|tracking +amon1.android-monitor.ru|AndroidPolice|c2 +amon1.android-monitor.ru|AndroidPolice|tracking +amyacunningham.us|2021_04_taking_action_against_hackers_in_palestine|c2 +analytics.hahamobi.com|MobileTracker|tracking +analytics.localytics.com|MobileTracker|tracking +analytics.rayjump.com|MobileTracker|tracking +analytics.salmonads.com|MobileTracker|tracking +analytics.trackview.net|TrackView|c2 +analyzeryandex.000webhostapp.com|2022_04_metas_adversarial_threat_report_q1|c2 +anayurt.net|2021_03_taking_action_against_hackers_in_china|c2 +anayurt.net|MobileTracker|tracking +ancienthistory.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +and.info-taxi.info|AndroidPolice|c2 +and.retardrattle.website|MobileTracker|tracking +andmon.name|AndroidPolice|c2 +andmon.name|AndroidPolice|tracking +androappstore.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +android-api.umobix.com|uMobix|c2 +android-apk.android-monitor.ru|AndroidPolice|c2 +android-apk.android-monitor.ru|AndroidPolice|tracking +android-apps.s3.amazonaws.com|OneSpy|distribution +android-apps.tech|2021_12_taking_action_against_surveillance_for_hire|c2 +android-flash.com|201512_PackRAT|c2 +android-monitor.ru|AndroidPolice|c2 +android-monitor.ru|AndroidPolice|tracking +android-monitor1.android-monitor.ru|AndroidPolice|c2 +android-monitor1.android-monitor.ru|AndroidPolice|tracking +android-police.android-monitor.ru|AndroidPolice|c2 +android-police.android-monitor.ru|AndroidPolice|tracking +android-police.ru|AndroidPolice|c2 +android-police.ru|AndroidPolice|tracking +android-quinoa-config-prod.sense360eng.com|MobileTracker|tracking +android.chyldmonitor.com|OneSpy|c2 +android.spy24.app|Spy24|c2 +android.spytoapp.com|SpyToApp|c2 +android.viptrack.ro|VIPTrack|c2 +android007.com|Android007|tracking +androidapk.biz|AndroidPolice|c2 +androidapk.biz|AndroidPolice|tracking +androidlost.appspot.com|AndroidLost|c2 +androidlost.com|AndroidLost|c2 +androidlost.com|AndroidLost|tracking +androidlost.firebaseio.com|AndroidLost|c2 +androidmonitor.com|AndroidMonitor|tracking +androidradio.life|MobileTracker|tracking +androidspy.info|XDSpy|tracking +anguaganslatast.com|MobileTracker|tracking +anitmationworldnews.com|202006_DarkBasin|c2 +anmon.android-monitor.ru|AndroidPolice|c2 +anmon.android-monitor.ru|AndroidPolice|tracking +anmon.name|AndroidPolice|c2 +anmon.name|AndroidPolice|tracking +anmon.ru|AndroidPolice|c2 +anmon.ru|AndroidPolice|tracking +anmon.su|AndroidPolice|c2 +anmon.su|AndroidPolice|tracking +anmon1.android-monitor.ru|AndroidPolice|c2 +anmon1.android-monitor.ru|AndroidPolice|tracking +anna-sanchez.online|2021_04_taking_action_against_hackers_in_palestine|c2 +anonymous.browse.live|MobileTracker|tracking +anothershortnr.com|202006_DarkBasin|c2 +ansa.ltd|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ansonwhitmore.live|2021_04_taking_action_against_hackers_in_palestine|c2 +anti-corona.app|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +antifurtodroid.com|AntiFurtoDroid|tracking +antitheft-88554.firebaseio.com|AbsoluTrack|c2 +antmoving.online|201909_MissingLink|c2 +antranslaro.com|MobileTracker|tracking +aovivo.foxspy.com.br|EspiaoAndroid|c2 +ap.chyldmonitor.com|OneSpy|tracking +ap.iprocam.xyz|MobileTracker|tracking +apd1.thunup.com|MobileTracker|tracking +apd1.warnlog.com|MobileTracker|tracking +api-apple-buy.com|2021_12_taking_action_against_surveillance_for_hire|c2 +api-gateway.creatant.com|MobileTracker|tracking +api-gateway.franceverif.fr|MobileTracker|tracking +api-llm.prd.alva.xyz|MobileTracker|tracking +api-new.gocashback.com|MobileTracker|tracking +api-production-v4.actv8technologies.com|MobileTracker|tracking +api-project-285519687053.firebaseio.com|TrackView|c2 +api-project-999803017449.firebaseio.com|Cerberus|c2 +api-telecommunication.com|2021_12_taking_action_against_surveillance_for_hire|c2 +api.aliprice.com|MobileTracker|tracking +api.allblock.app|MobileTracker|tracking +api.asbipartnerdb.com|MobileTracker|tracking +api.awarenesstechnologies.com|AndroidPolice|c2 +api.bibigpt.co|MobileTracker|tracking +api.branch.io|MobileTracker|tracking +api.bytepioner.com|CouplerTracker|c2 +api.cardlift.co|MobileTracker|tracking +api.childsafetytrackerapp.com|EasyLogger|c2 +api.cleanmasters.store|MobileTracker|tracking +api.clearlyreader.com|MobileTracker|tracking +api.clevguard.com|ClevGuard|c2 +api.corn-cob.com|AiSpyer|c2 +api.cp.onemonitar.com|OneSpy|c2 +api.dev.chat.roimaster.site|MobileTracker|tracking +api.findgravy.com|MobileTracker|tracking +api.findmykids.org|FindMyKids|c2 +api.flexispy.com|FlexiSpy|c2 +api.foozor.com|MobileTracker|tracking +api.free-spy.com|AppSpy|c2 +api.hashdit.io|MobileTracker|tracking +api.huqindustries.co.uk|MobileTracker|tracking +api.joinsmarty.com|MobileTracker|tracking +api.kallo.io|MobileTracker|tracking +api.lifecircle.app|TrackView|c2 +api.lingoway.net|MobileTracker|tracking +api.lingowhale.com|MobileTracker|tracking +api.lunabot.ai|MobileTracker|tracking +api.mainrepo.org|MobileTracker|tracking +api.mamma.com|MobileTracker|tracking +api.mixpanel.com|MobileTracker|tracking +api.mobilebackup.biz|AndroidPolice|c2 +api.mobilespy.at|AndroidPolice|c2 +api.mousegesturesapi.com|MobileTracker|tracking +api.mycellspy.com|AndroidPolice|c2 +api.myendpoint.io|MobileTracker|tracking +api.nextialive.roimaster.site|MobileTracker|tracking +api.odskguo.xyz|MobileTracker|tracking +api.ogymogy.com|TheOneSpy|c2 +api.onmanzbien.com|MobileTracker|tracking +api.origano.xyz|MobileTracker|tracking +api.phia.com|MobileTracker|tracking +api.pnt.is|MobileTracker|tracking +api.pythonexample.com|MobileTracker|tracking +api.relingo.net|MobileTracker|tracking +api.safegraph.com|MobileTracker|tracking +api.salmonads.com|MobileTracker|tracking +api.seniorsafetyapp.com|EasyLogger|c2 +api.simpleallowcopy.com|MobileTracker|tracking +api.simplycodes.com|MobileTracker|tracking +api.slovarek.hrprime.ru|MobileTracker|tracking +api.smartechmetrics.com|MobileTracker|tracking +api.snoopza.com|Snoopza|c2 +api.speedspot.org|MobileTracker|tracking +api.spylix.com|AndroidPolice|c2 +api.thd.cc|mSpy|c2 +api.tllms.com|MobileTracker|tracking +api.trackview.lifecircle.app|TrackView|c2 +api.ttspy.com|RealtimeSpy|c2 +api.ultrablock.org|MobileTracker|tracking +api.witheden.ai|MobileTracker|tracking +api.wzrkt.com|MobileTracker|tracking +api.yapthread.com|MobileTracker|tracking +api.zave.it|MobileTracker|tracking +api007.foxspy.com.br|EspiaoAndroid|c2 +api1.easydoc.info|MobileTrackerFree|c2 +api2.mytranslator.app|MobileTracker|tracking +api3.easydoc.info|MobileTrackerFree|c2 +api4.truecaller.com|MobileTracker|tracking +apidemo.spylix.com|AndroidPolice|c2 +apispyhuman.com|SpyHuman|c2 +apitest.awarenesstechnologies.com|AndroidPolice|c2 +apiv4.alter757.info|mSpy|c2 +apk.mtf.re|MobileTrackerFree|c2 +apk01.spytoapp.com|SpyToApp|c2 +apk02.spytoapp.com|SpyToApp|c2 +apk03.spytoapp.com|SpyToApp|c2 +apk04.spytoapp.com|SpyToApp|c2 +apk7.biz|AndroidPolice|c2 +apkcar.com|MobileTracker|tracking +apkhl.pw|MobileTracker|tracking +apkprue.info|2021_03_taking_action_against_hackers_in_china|c2 +apkprue.info|MobileTracker|tracking +apkpure.bz|MobileTracker|tracking +apkstore.filehubspot.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +apkv2.qwertykeypad.host|MobileTracker|tracking +apkv5.ppadaolnwod.xyz|MobileTracker|tracking +apkv6.endurecif.top|MobileTracker|tracking +aplsrvrer.com|202006_DarkBasin|c2 +apollospy.com|Reptilicus|c2 +apollospy.com|Reptilicus|tracking +app-api.phonedata.me|Cocospy|c2 +app-api.spyzie.com|Cocospy|c2 +app-chat1.atwebpages.com|2021_04_taking_action_against_hackers_in_palestine|c2 +app-market.online|2021_04_taking_action_against_hackers_in_palestine|c2 +app-measurement.com|MobileTracker|tracking +app-showchat.atwebpages.com|2021_04_taking_action_against_hackers_in_palestine|c2 +app-stats.net2share.com|MobileTracker|tracking +app.aflink.com|MobileTracker|tracking +app.antifurtodroid.com|AntiFurtoDroid|c2 +app.api.spyzie.wondershare.cn|Cocospy|c2 +app.appspy.net|AppSpy|c2 +app.appspy.net|AppSpy|tracking +app.appspyfree.com|AppSpy|tracking +app.buenosocial.club|MobileTracker|tracking +app.fonetracker.com|TheTruthSpy|distribution +app.foreverspy.com|Metasploit|c2 +app.freephonespy.net|AppSpy|tracking +app.givefreely.com|MobileTracker|tracking +app.mobilespyfree.net|AppSpy|tracking +app.mobiletracking.app|TheTruthSpy|distribution +app.mobnv.com|MobileTracker|tracking +app.numici.com|MobileTracker|tracking +app.ogymogy.com|TheOneSpy|distribution +app.onemonitar.com|OneSpy|tracking +app.phonespying.com|TheTruthSpy|tracking +app.snoopza.com|Snoopza|c2 +app.xdspy.app|XDSpy|c2 +app.xpspy.com|TheTruthSpy|distribution +app.xyspy.com|TheTruthSpy|c2 +app2.appvlc.com|2022_08_metas_adversarial_threat_report_q2|c2 +app2.snoopza.com|Snoopza|c2 +appbriar.com|2022_08_metas_adversarial_threat_report_q2|c2 +appeur.gnway.cc|201510_NGO_Burma|c2 +appinstall-mail.space|201801_SpyingOnABudget|c2 +appjiagu.com|Cocospy|c2 +applepps.com|2021_12_taking_action_against_surveillance_for_hire|c2 +application.opence.fr|MobileTracker|tracking +applispy.com|SpyApp|tracking +apply-jobs.com|2022_04_metas_adversarial_threat_report_q1|c2 +applytalents.com|2022_04_metas_adversarial_threat_report_q1|c2 +appmia.com.es|AppMia|tracking +appmia.com|AppMia|tracking +appmia.fr|AppMia|tracking +appmia.it|AppMia|tracking +appprotonvpn.com|2022_08_metas_adversarial_threat_report_q2|c2 +apppure.cf|2021_07_taking_action_against_hackers_in_iran|c2 +approve.aegisweb3.com|MobileTracker|tracking +apprtc.appspot.com|AndroidPolice|c2 +apps-download.store|2021_04_taking_action_against_hackers_in_palestine|c2 +apps-ios.net|2021_12_taking_action_against_surveillance_for_hire|c2 +apps-store.online|2021_04_taking_action_against_hackers_in_palestine|c2 +appslocallogin.online|2022_04_metas_adversarial_threat_report_q1|c2 +appspy-net.firebaseio.com|AppSpy|c2 +appspy.com|AppSpy|tracking +appspy.net|AppSpy|c2 +appspy.net|AppSpy|tracking +appspyfree.com|AppSpy|tracking +appsstore.in|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +appsupdate.net|2022_08_metas_adversarial_threat_report_q2|c2 +apptracker.net|AppSpy|tracking +aps12.spyhuman.com|SpyHuman|c2 +aps13.spyhuman.com|SpyHuman|c2 +aps14.spyhuman.com|SpyHuman|c2 +aps15.spyhuman.com|SpyHuman|c2 +aps16.spyhuman.com|SpyHuman|c2 +aps16042016.spyhuman.com|SpyHuman|c2 +aps17.spyhuman.com|SpyHuman|c2 +aps18data.securebackuponline.net|SpyHuman|c2 +aps18file.securebackuponline.net|SpyHuman|c2 +aps2.spyhuman.com|SpyHuman|c2 +aps22.spyhuman.com|SpyHuman|c2 +arabnews365.com|201810_TheKingdomCameToCanada|c2 +arabworld.biz|201810_TheKingdomCameToCanada|c2 +aralaper.com|MobileTracker|tracking +aramex-shipping.servehttp.com|201702_NilePhish|c2 +aramexegypt.com|2021_12_taking_action_against_surveillance_for_hire|c2 +archery.dedyn.io|2022_04_metas_adversarial_threat_report_q1|c2 +archiverst.com|2022_08_metas_adversarial_threat_report_q2|c2 +arcpi.nextialive.roimaster.site|MobileTracker|tracking +arduous.work|MobileTracker|tracking +area.spyapp.ch|SpyApp|tracking +arindocation.com|MobileTracker|tracking +arr.kcpro.tk|MobileTracker|tracking +artateulseonitor.com|MobileTracker|tracking +asambleanacional-gob-ec.cu9.co|201512_PackRAT|c2 +asgard-f8c53.firebaseio.com|GPSTrackerLoki|c2 +asgardtech.ru|GPSTrackerLoki|tracking +asrararabiya.co|201608_NSO_Group|c2 +asrararablya.com|201608_NSO_Group|c2 +asrarrarabiya.com|201608_NSO_Group|c2 +ass.absolutesoftsystem.in|AbsoluTrack|c2 +ass.absolutesoftsystem.in|AbsoluTrack|tracking +assadcrimes.info|201608_Group5|c2 +asset.bk128.com|MobileTracker|tracking +asset.bk128.com|XNSpy|c2 +asset.xiz4me.com|MobileTracker|tracking +assuredreturnplan.com|202006_DarkBasin|c2 +at.gogameportal.club|MobileTracker|tracking +atb.bearclod.com|MobileTracker|tracking +atheere.com|2021_12_taking_action_against_surveillance_for_hire|c2 +ats.flyermobi.com|MobileTracker|tracking +ats.ikmytech.com|MobileTracker|tracking +attorney-client-privileged.com|MobileTracker|tracking +attorney-client.org|MobileTracker|tracking +attorneyclientprivileged.com|MobileTracker|tracking +audit-pvv.com|2021_12_taking_action_against_surveillance_for_hire|c2 +auditionregistrationonline.com|202006_DarkBasin|c2 +auth.forwardtoken.website|MobileTracker|tracking +autlook.live|2021_04_taking_action_against_hackers_in_palestine|c2 +auto-forward.com|HighsterMobile|c2 +auto-forward.com|HighsterMobile|tracking +autocoupon.net|MobileTracker|tracking +autoforward-8433d.firebaseio.com|HighsterMobile|c2 +autoforward.app|HighsterMobile|tracking +autoforward.co|HighsterMobile|tracking +av2wg.rt14v.com|MobileTracker|tracking +avisindependent.eu|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +awamisolution.com|SmartKeylogger|c2 +awamisolution.com|SmartKeylogger|tracking +awarenesstechnologies.com|AndroidPolice|tracking +awsapi.io|iKeyMonitor|c2 +b.appjiagu.com|Cocospy|c2 +b.freespy1.ml|MobileTracker|tracking +b.freespy1.tk|MobileTracker|tracking +b.hdmodecam.live|MobileTracker|tracking +b1.etrality.com|MobileTracker|tracking +b2.etrality.com|MobileTracker|tracking +b3.etrality.com|MobileTracker|tracking +b55y.net|mSpy|c2 +b7.photoeffect.xyz|MobileTracker|tracking +b8c.mveditor.xyz|MobileTracker|tracking +ba.beautycam.xyz|MobileTracker|tracking +ba3.photoeffect.xyz|MobileTracker|tracking +back.brunoespiao.com.br|BrunoEspiao|c2 +backup-a71f4.firebaseio.com|HighsterMobile|c2 +backupsoft.eu|AndroidPolice|tracking +backwaterreservoir.com|202006_DarkBasin|c2 +badr-regex.fastytb.com|MobileTracker|tracking +bagscaner.com|MobileTracker|tracking +bahrainsms.co|201608_NSO_Group|c2 +bahri.site|2021_07_taking_action_against_hackers_in_iran|c2 +bank-alahly.com|2021_12_taking_action_against_surveillance_for_hire|c2 +bark-android-media.s3.amazonaws.com|bark|c2 +bark.us|bark|tracking +basemailservice.com|202006_DarkBasin|c2 +baseserveremailbg.com|202006_DarkBasin|c2 +basichostingrussia.com|202006_DarkBasin|c2 +basichostnetservice.com|202006_DarkBasin|c2 +basicmyoffshore.com|202006_DarkBasin|c2 +basicruoffshore.com|202006_DarkBasin|c2 +basicservicehk.com|202006_DarkBasin|c2 +basicservicelux.com|202006_DarkBasin|c2 +basicservicemy.com|202006_DarkBasin|c2 +basicservicerus.com|202006_DarkBasin|c2 +basicservicesg.com|202006_DarkBasin|c2 +basicsgoffshore.com|202006_DarkBasin|c2 +batterychargingeffect.club|MobileTracker|tracking +batterylivewallpaperhd.club|MobileTracker|tracking +bbc-africa.com|201608_NSO_Group|c2 +bbcnews.email|2021_07_taking_action_against_hackers_in_iran|c2 +bbcsworld.com|2021_12_taking_action_against_surveillance_for_hire|c2 +bbiindia.com|LetMeSpy|tracking +bbrp.co|mSpy|c2 +be.startdownload.mobi|MobileTracker|tracking +beachhackerspace.com|MobileTracker|tracking +beauty-msg.com|2021_04_taking_action_against_hackers_in_palestine|c2 +beemail.online|201909_MissingLink|c2 +belcherjacky.info|2021_04_taking_action_against_hackers_in_palestine|c2 +bellsouthnetwork.com|202006_DarkBasin|c2 +belowmargins.com|202006_DarkBasin|c2 +berf4o.xyz|MobileTracker|tracking +best-mobile-spy.com|Cocospy|tracking +best-spy-apps.com|AndroidPolice|c2 +bestairlinepricetags.com|201605_Stealth_Falcon|c2 +bestcellphonespyapps.com|HighsterMobile|tracking +beststores4u.com|201810_TheKingdomCameToCanada|c2 +beta-api.logger.mobi|EasyLogger|c2 +beta.logger.mobi|EasyLogger|c2 +beta.smstracker.com|CallSMSTracker|c2 +beta.spyapp.ro|SpyApp|tracking +betly.me|MobileTracker|tracking +bf.mk|201909_MissingLink|c2 +bff.ecoindex.fr|MobileTracker|tracking +bi.thd.cc|mSpy|c2 +bi.tly.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +bi.tly.link|2021_12_taking_action_against_surveillance_for_hire|c2 +bigdata800.com|MobileTracker|tracking +bild.asia|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bild.eu.com|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bild.expert|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bild.llc|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bild.pics|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bild.vip|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bild.work|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bild.ws|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +bill-msp.app|mSpy|tracking +billing.chyldmonitor.com|OneSpy|tracking +bin5y4muil.execute-api.us-east-1.amazonaws.com|MobileTracker|tracking +bincdi.6kvses.com|MobileTool|c2 +bincdi.birxpk.com|MobileTool|c2 +birxpk.com|MobileTool|c2 +bit-li.com|2021_12_taking_action_against_surveillance_for_hire|c2 +bit-li.ws|2021_12_taking_action_against_surveillance_for_hire|c2 +bit-ly.link|2021_12_taking_action_against_surveillance_for_hire|c2 +bit-ly.org|2021_12_taking_action_against_surveillance_for_hire|c2 +bitlinkin.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +bitlly.live|2021_12_taking_action_against_surveillance_for_hire|c2 +bitly.cam|2021_07_taking_action_against_hackers_in_iran|c2 +bitlyrs.com|2021_12_taking_action_against_surveillance_for_hire|c2 +bitserverhk.com|202006_DarkBasin|c2 +bitserverlux.com|202006_DarkBasin|c2 +bitt.fi|2021_12_taking_action_against_surveillance_for_hire|c2 +biturl.cx|2021_07_taking_action_against_hackers_in_iran|c2 +bity.ws|2021_12_taking_action_against_surveillance_for_hire|c2 +bityl.me|2021_12_taking_action_against_surveillance_for_hire|c2 +bivitis.bearclod.com|MobileTracker|tracking +bk128.com|MobileTracker|tracking +bk128.com|XNSpy|c2 +bl.publicapi.semrush.com|MobileTracker|tracking +blackboxmusic.co|201512_PackRAT|c2 +blackdragon.oss-ap-southeast-5.aliyuncs.com|MobileTracker|tracking +blackdragon03.oss-ap-southeast-5.aliyuncs.com|MobileTracker|tracking +blacktrail.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +blfnf9y.com|MobileTracker|tracking +blog.flexispy.com|FlexiSpy|tracking +blogforpranks.com|202006_DarkBasin|c2 +blogserverlx.com|202006_DarkBasin|c2 +blompascator.com|MobileTracker|tracking +blurspy.com|BlurSpy|c2 +blurspy.com|BlurSpy|tracking +bmw.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +bnc.lt|MobileTracker|tracking +bnt2.live|2022_04_metas_adversarial_threat_report_q1|c2 +bombinate.winload.info|201803_BadTraffic|c2 +bookjob.club|2021_12_taking_action_against_surveillance_for_hire|c2 +boostvocab.com|MobileTracker|tracking +bosspy.com|BosSpy|tracking +botfortickets.site|MobileTracker|tracking +bourneliam.info|2021_04_taking_action_against_hackers_in_palestine|c2 +bowenpres.com|201707_InsiderInfo|c2 +bowenpress.net|201707_InsiderInfo|c2 +bowenpress.org|201707_InsiderInfo|c2 +bowenpross.com|201707_InsiderInfo|c2 +br.loverman.net|MobileTrackerFree|tracking +br.mobile-tracker-free.com|MobileTrackerFree|tracking +br.pgv4.com|SpyApp|tracking +br.refog.com|Hoverwatch|tracking +brdcst.email|2021_07_taking_action_against_hackers_in_iran|c2 +briarapppro.org|2022_08_metas_adversarial_threat_report_q2|c2 +brilliant-flame-585.appspot.com|MobileTracker|tracking +brilliant-flame-585.firebaseio.com|MobileTracker|tracking +brilliant-flame-585.firebaseio.com|XNSpy|c2 +brlyp4pg.com|MobileTracker|tracking +browsercheck.services|2021_12_taking_action_against_surveillance_for_hire|c2 +browserdirectservice.com|202006_DarkBasin|c2 +browserextensions.info|202006_DarkBasin|c2 +browserredirect.com|202006_DarkBasin|c2 +brt.bearclod.com|MobileTracker|tracking +brul.bearclod.com|MobileTracker|tracking +brunoespiao.com.br|BrunoEspiao|c2 +brunoespiao.com.br|BrunoEspiao|tracking +brunoespiao.com|BrunoEspiao|c2 +brunoespiao2.s3.amazonaws.com|BrunoEspiao|c2 +bsrvrer.com|202006_DarkBasin|c2 +budgtoffmy.com|202006_DarkBasin|c2 +budgtoffru.com|202006_DarkBasin|c2 +bulbazaur.com|201608_NSO_Group|c2 +bulk.fun|MobileTracker|tracking +bumabara.bid|2021_12_taking_action_against_surveillance_for_hire|c2 +burgerprince.us|2021_12_taking_action_against_surveillance_for_hire|c2 +burivingsim.com|MobileTracker|tracking +bus-metrolis.com|MobileTracker|tracking +businesnews.net|2021_12_taking_action_against_surveillance_for_hire|c2 +buyeasyspy.com|HighsterMobile|tracking +buzzoffbul.com|202006_DarkBasin|c2 +buzzoffhk.com|202006_DarkBasin|c2 +buzzoffmy.com|202006_DarkBasin|c2 +buzzoffru.com|202006_DarkBasin|c2 +buzzoffsg.com|202006_DarkBasin|c2 +c-phone.ru|AndroidPolice|c2 +c-phone.ru|AndroidPolice|tracking +c.appjiagu.com|Cocospy|c2 +c.betly.me|MobileTracker|tracking +c.freespy1.ml|MobileTracker|tracking +c.freespy1.tk|MobileTracker|tracking +c.webengage.com|MobileTracker|tracking +c1.etrality.com|MobileTracker|tracking +c1.panspy.com|PanSpy|c2 +c2.etrality.com|MobileTracker|tracking +c3.etrality.com|MobileTracker|tracking +c4.etrality.com|MobileTracker|tracking +c9db9bbc8d.era3000.com|OwnSpy|distribution +cabinet.ecohouse-eg.com|Reptilicus|c2 +cabinet.gps-monitor.uz|Reptilicus|c2 +cabinet.kfnm.ru|Reptilicus|c2 +cabinet.thecybernanny.com|Reptilicus|c2 +cabinet.vegosm.ru|Reptilicus|c2 +cabinet.vkur.se|Reptilicus|c2 +cabinet.vkur1.se|Reptilicus|c2 +cailrecorder.com|MobileTracker|tracking +calculator-1e016.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +calculator-1e016.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +callerids.club|MobileTracker|tracking +callrecordpro.club|MobileTracker|tracking +callsmstracker.com|CallSMSTracker|tracking +callwhozdine.com|MobileTracker|tracking +camera.dvrcam.info|2021_04_taking_action_against_hackers_in_palestine|c2 +camerdentifier.com|MobileTracker|tracking +campaignmanager.fun.moobig.com|MobileTracker|tracking +canary.wakweli.com|MobileTracker|tracking +canopoument.com|MobileTracker|tracking +canyouc.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +capitalinvestmentsllp.com|202006_DarkBasin|c2 +careeronestop.site|2021_07_taking_action_against_hackers_in_iran|c2 +careers-finder.com|2022_04_metas_adversarial_threat_report_q1|c2 +carmesin.me|MobileTracker|tracking +carracer.club|MobileTracker|tracking +carrefourmisr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +cart.mspy.com|mSpy|tracking +cart.spynger.net|Spynger|tracking +cathostingservice.com|202006_DarkBasin|c2 +cathy-seliver.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +catwatchful-e03b8-2.firebaseio.com|CatWatchful|c2 +catwatchful-e03b8.appspot.com|CatWatchful|tracking +catwatchful-e03b8.firebaseio.com|CatWatchful|c2 +catwatchful.com|CatWatchful|c2 +catwatchful.com|CatWatchful|tracking +catwatchful.online|CatWatchful|tracking +catwatchful.pink|CatWatchful|tracking +cb.wzrkt.com|MobileTracker|tracking +cbapi.rewardsbunny.com|MobileTracker|tracking +cbbc01.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +cbphe.com|MobileTracker|tracking +cbpheback.com|MobileTracker|tracking +cc-mail-secret.com|201801_SpyingOnABudget|c2 +cc-security-inc.email|2021_07_taking_action_against_hackers_in_iran|c2 +ccallerx.com|MobileTracker|tracking +ccsecurity-mail-inc.email|2021_07_taking_action_against_hackers_in_iran|c2 +ccsecurity-mail-inc.services|2021_07_taking_action_against_hackers_in_iran|c2 +cdn-upd-ms6.com|201803_BadTraffic|c2 +cdn.branch.io|MobileTracker|tracking +cdn.optimizely.com|MobileTracker|tracking +cdn.owebanalytics.com|MobileTracker|tracking +cef.kcpro.tk|MobileTracker|tracking +celebrnewz.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +cell-phones-tracker.net|EasyPhoneTrack|c2 +cell-tracker-green.firebaseio.com|TrackMyPhones|c2 +cell-tracker-updated.firebaseio.com|TrackMyPhones|c2 +cellconn.net|2021_12_taking_action_against_surveillance_for_hire|c2 +cellmonitoring.co|PhoneSheriff|c2 +cellphone-remote-tracker.com|HelloSpy|c2 +cellphoneservices.info|HighsterMobile|c2 +cellphoneservices.info|HighsterMobile|tracking +cellphonespyappon.com|AppSpy|tracking +cellphonetrackers.org|Cerberus|tracking +celltracker.io|MobileTrackerFree|tracking +celltracker.mobi|EasyPhoneTrack|c2 +celltrackernew.firebaseio.com|MobileTrackerFree|c2 +celular007.s3.amazonaws.com|EspiaoAndroid|c2 +cerberusapp.com|Cerberus|c2 +cerberusapp.com|Cerberus|tracking +cerberusbrasil.com|Cerberus|tracking +cezz.me|AndroidPolice|tracking +cfg.inappertising.org|MobileTracker|tracking +cfs.kcpro.ga|MobileTracker|tracking +chad-jessie.info|2021_04_taking_action_against_hackers_in_palestine|c2 +charles.huqindustries.co.uk|MobileTracker|tracking +charmainellauzier.host|2021_04_taking_action_against_hackers_in_palestine|c2 +charmander.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +chat-14bb1.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +chat-14bb1.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +chat-support.support|MobileTracker|tracking +chat-transa.com|MobileTracker|tracking +chat-update.live|2021_04_taking_action_against_hackers_in_palestine|c2 +chatluongvacuocsong.vn|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +chatsafe.tecnova.com.br|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +chatserverrussia.com|202006_DarkBasin|c2 +chatwithme.store|2021_12_taking_action_against_surveillance_for_hire|c2 +chaty-98547.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +chaty-98547.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +chavistas24.com|201512_PackRAT|c2 +cheapapartmentsaroundme.com|201810_TheKingdomCameToCanada|c2 +checkheart.club|MobileTracker|tracking +checkinonlinehere.com|201608_NSO_Group|c2 +checkmailserverhk.com|202006_DarkBasin|c2 +childmonitoringsystem.com|TheWiSpy|tracking +childsafetytrackerapp.com|EasyLogger|tracking +chipp.pw|MobileTracker|tracking +chome.zstone.co|TrackView|tracking +chromehistory.herokuapp.com|MobileTracker|tracking +chromeperfection.com|202006_DarkBasin|c2 +chulahfi.xyz|MobileTracker|tracking +chyldmonitor.com|OneSpy|tracking +ciaolvc.com|MobileTracker|tracking +cibeg.online|MobileTracker|tracking +citroen.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +citymyworkday.com|2021_07_taking_action_against_hackers_in_iran|c2 +cityofberkeley.support|2021_07_taking_action_against_hackers_in_iran|c2 +ck-running-apps-700f1.firebaseio.com|MobileTracker|tracking +ckforward.one|2021_12_taking_action_against_surveillance_for_hire|c2 +claptfindzmphone.com|MobileTracker|tracking +claytoniosep.live|2021_04_taking_action_against_hackers_in_palestine|c2 +clevguard.com|ClevGuard|tracking +clevguard.net|ClevGuard|c2 +clevguard.net|ClevGuard|tracking +clickstatistic.com|201605_Stealth_Falcon|c2 +client.mobilefonex.com|FlexiSpy|c2 +client.spyhide.com|HelloSpy|c2 +client.spyhide.ir|HelloSpy|c2 +clienti.securspy.com|SpyApp|tracking +clientreport.info|NeoSpy|c2 +clipbuddy.club|MobileTracker|tracking +clockupdate.com|2021_12_taking_action_against_surveillance_for_hire|c2 +cloud.nathompsstra.com|MobileTracker|tracking +cloud.onemonitar.com|OneSpy|tracking +cloud.ttspy.com|RealtimeSpy|c2 +cloudgoogle.co|2022_04_metas_adversarial_threat_report_q1|c2 +cloudstatistics.net|2021_12_taking_action_against_surveillance_for_hire|c2 +cloudtimesync.com|2021_12_taking_action_against_surveillance_for_hire|c2 +cloudwatchtower.com|MobileTracker|tracking +clues.link|AndroidPolice|c2 +clues4.com|AndroidPolice|c2 +clues4.com|AndroidPolice|tracking +cluestr.com|AndroidPolice|c2 +cluestr.com|AndroidPolice|tracking +cmvkvncsse.xyz|MobileTracker|tracking +cnapi.trackview.net|TrackView|c2 +cnbcnews.email|2021_07_taking_action_against_hackers_in_iran|c2 +cnn-africa.co|201608_NSO_Group|c2 +cnn.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +cnnnews.global|2021_07_taking_action_against_hackers_in_iran|c2 +co.akisinn.info|MobileTracker|tracking +co.dewrain.life|MobileTracker|tracking +co.vaicore.site|MobileTracker|tracking +co.vaicore.xyz|MobileTracker|tracking +cocachar.com|MobileTracker|tracking +cockpit.chyldmonitor.com|OneSpy|tracking +cocospy.com|Cocospy|tracking +cocospy.net|Cocospy|tracking +codejquery-ui.com|2021_07_taking_action_against_hackers_in_iran|c2 +coinsearch.cash|MobileTracker|tracking +color.joarteauxelb.com|MobileTracker|tracking +colorizerset.club|MobileTracker|tracking +com-account-challenge.email|2021_07_taking_action_against_hackers_in_iran|c2 +com-ar-en-us.com|202006_DarkBasin|c2 +com-authmail.com|202006_DarkBasin|c2 +com-biz.website|202006_DarkBasin|c2 +com-com-us.com|202006_DarkBasin|c2 +com-com.website|202006_DarkBasin|c2 +com-en-us.co.uk|202006_DarkBasin|c2 +com-er-en-us.com|202006_DarkBasin|c2 +com-hl-en-us.com|202006_DarkBasin|c2 +com-io-en-us.com|202006_DarkBasin|c2 +com-mail-us.com|202006_DarkBasin|c2 +com-mail.net|202006_DarkBasin|c2 +com-nh-en-us.com|202006_DarkBasin|c2 +com-oa-en-us.com|202006_DarkBasin|c2 +com-securitysettingpage.tk|201705_TaintedLeaks|c2 +com-signin-v2.email|2021_07_taking_action_against_hackers_in_iran|c2 +com-us-en-us.com|202006_DarkBasin|c2 +com-website33.biz|202006_DarkBasin|c2 +com-website33.com|202006_DarkBasin|c2 +com-website33.info|202006_DarkBasin|c2 +com-website33.net|202006_DarkBasin|c2 +com-website33.org|202006_DarkBasin|c2 +comclap.club|MobileTracker|tracking +comemail.email|201808_FamiliarFeeling|c2 +comemails.email|201808_FamiliarFeeling|c2 +comlogin.online|2021_07_taking_action_against_hackers_in_iran|c2 +comlogin.services|2021_07_taking_action_against_hackers_in_iran|c2 +commail.co|201808_FamiliarFeeling|c2 +community.flexispy.com|FlexiSpy|tracking +community.sidenoteapp.com|MobileTracker|tracking +comphotolab.club|MobileTracker|tracking +compte.applispy.com|SpyApp|tracking +computer.security-centers.com|201604_UP007_SLServer|c2 +computing.downloaders.today|201803_BadTraffic|c2 +comqubla.club|MobileTracker|tracking +comservicelogin.com|202006_DarkBasin|c2 +config.unityads.unity3d.com|MobileTracker|tracking +config.unityads.unitychina.cn|MobileTracker|tracking +conhost.servehttp.com|201512_PackRAT|c2 +connectivitycheck.live|2021_12_taking_action_against_surveillance_for_hire|c2 +connectivitycheck.online|2021_12_taking_action_against_surveillance_for_hire|c2 +connectivitychecker.com|2021_12_taking_action_against_surveillance_for_hire|c2 +consilio.lawyer|MobileTracker|tracking +consiliolaw.com|MobileTracker|tracking +console.presto.oystr.com.br|MobileTracker|tracking +continue-to-get-content-now.com|MobileTracker|tracking +control-phone-a05a3.firebaseio.com|AndroidPolice|c2 +control.teragence.net|MobileTracker|tracking +controlcenterios.club|MobileTracker|tracking +controllo.spystoreitalia.com|SpyApp|tracking +converse-app.org|2022_08_metas_adversarial_threat_report_q2|c2 +cophico.pw|MobileTracker|tracking +copy9.com|TheTruthSpy|c2 +copy9.com|TheTruthSpy|tracking +copy9db.com|HelloSpy|c2 +copyleft.today|2021_07_taking_action_against_hackers_in_iran|c2 +core.knowee.ai|MobileTracker|tracking +corn-cob.com|AiSpyer|c2 +corn-en-gb.com|202006_DarkBasin|c2 +corn-en-us.com|202006_DarkBasin|c2 +corn-fr-fr.com|202006_DarkBasin|c2 +corn-lang-eng.com|202006_DarkBasin|c2 +corn-loginservicesverified.com|202006_DarkBasin|c2 +corn-msrvrgr.com|202006_DarkBasin|c2 +corn-servicelogin.com|202006_DarkBasin|c2 +corn-ukr.com|202006_DarkBasin|c2 +cortanaservice.com|2022_04_metas_adversarial_threat_report_q1|c2 +cortanaupdate.co|2022_04_metas_adversarial_threat_report_q1|c2 +coupletracker.com|CouplerTracker|tracking +coupongiftsnstashop.com|MobileTracker|tracking +coupons.comagno.com|MobileTracker|tracking +covid19-ca.link|MobileTracker|tracking +covid19masks.shop|2021_12_taking_action_against_surveillance_for_hire|c2 +cp.appmia.com|AppMia|tracking +cp.mspyonline.com|mSpy|c2 +cp.onemonitar.com|OneSpy|tracking +cp.thewispy.com|TheWiSpy|c2 +cp.xnspy.com|XNSpy|tracking +cpcalendars.spymasterpro.com|SpyMasterPro|c2 +cpcontacts.spymasterpro.com|SpyMasterPro|c2 +crashonline.site|2021_12_taking_action_against_surveillance_for_hire|c2 +crisiswatchsupport.shop|2021_07_taking_action_against_hackers_in_iran|c2 +csa.naaronegya.com|MobileTracker|tracking +csrvrer.com|202006_DarkBasin|c2 +ctrl-msp.app|mSpy|tracking +cu9.co|201512_PackRAT|c2 +cut.red|2021_12_taking_action_against_surveillance_for_hire|c2 +cutcutpro.club|MobileTracker|tracking +cvectorart.club|MobileTracker|tracking +cwkjravqsj.xyz|MobileTracker|tracking +cyber.country|2021_12_taking_action_against_surveillance_for_hire|c2 +cyberanalyticals.com|202006_DarkBasin|c2 +cyberserverusa.com|202006_DarkBasin|c2 +cynthiaecook.club|2021_04_taking_action_against_hackers_in_palestine|c2 +d-app-apk.com|MobileTrackerFree|c2 +d.appjiagu.com|Cocospy|c2 +d.corn-cob.com|AiSpyer|c2 +d.d-app-apk.com|MobileTrackerFree|c2 +d.freespy1.ml|MobileTracker|tracking +d.freespy1.tk|MobileTracker|tracking +d.tispy.net|AndroidPolice|c2 +d1.panspy.com|PanSpy|c2 +d1gslyvqtipqvi.cloudfront.net|Mrecorder|c2 +d24lo6rmha82nf.cloudfront.net|Mrecorder|c2 +d2nipadu1fr4ne.cloudfront.net|AndroidPolice|c2 +d3.mveditor.xyz|MobileTracker|tracking +d3cameraplan.com|MobileTracker|tracking +d3clybje3sun07.cloudfront.net|MobileTracker|tracking +d3ftgl1xpkr9bu.cloudfront.net|MobileTracker|tracking +d3g4zswpacwtfb.cloudfront.net|Mrecorder|c2 +daily-sport.news|201810_TheKingdomCameToCanada|c2 +dailymail.cam|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dailymail.cfd|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dailymail.top|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dalailama.space|201801_SpyingOnABudget|c2 +dalbam.vip|MobileTracker|tracking +damanhealth.online|201608_NSO_Group|c2 +danas.bid|2021_12_taking_action_against_surveillance_for_hire|c2 +darknetinfo.com|MobileTracker|tracking +darrell-ferris.site|2021_04_taking_action_against_hackers_in_palestine|c2 +dash-chat-c02b3.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +dash-chat-c02b3.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +dash-chat.site|2021_04_taking_action_against_hackers_in_palestine|c2 +dashboard.linkpublishers.com|MobileTracker|tracking +dassprachrohr.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprachrohr.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprachrohr.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprachrohr.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprahcrohr.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprahcrohr.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprahcrohr.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprahcrohr.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprhcorhr.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprhcorhr.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassprhcorhr.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassrpahcorhr.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassrpahcorhr.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassrpahcorhr.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dassrpahcorhr.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dasvidaniya.ddns.net|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +dat.funheroic.com|MobileTracker|tracking +data-api.phonedata.me|Cocospy|c2 +data-api.similarsites.com|MobileTracker|tracking +data-api.spyzie.com|Cocospy|c2 +data-webwatcherdata-alb-1451089636.us-west-2.elb.amazonaws.com|AndroidPolice|c2 +data.api.spyzie.wondershare.cn|Cocospy|c2 +data.mistat.india.xiaomi.com|MobileTracker|tracking +data.mistat.intl.xiaomi.com|MobileTracker|tracking +data.mistat.rus.xiaomi.com|MobileTracker|tracking +data.popup-blocker.org|MobileTracker|tracking +data.qa.webwatcherdata.com|AndroidPolice|c2 +data.reptilicus.net|Reptilicus|c2 +data.webwatcherdata.com|AndroidPolice|c2 +data.youtube-adblock.pro|MobileTracker|tracking +data240.mrec24.com|Mrecorder|c2 +data241.mrec24.com|Mrecorder|c2 +datacatch.xyz|2021_07_taking_action_against_hackers_in_iran|c2 +dataillusionist.com|MobileTracker|tracking +datalink.one|201707_InsiderInfo|c2 +datingappswmt.com|MobileTracker|tracking +day-on.site|2021_04_taking_action_against_hackers_in_palestine|c2 +daynew.today|201808_FamiliarFeeling|c2 +daynews.sytes.net|201512_PackRAT|c2 +daynews.today|201808_FamiliarFeeling|c2 +dayzim.org|2021_07_taking_action_against_hackers_in_iran|c2 +dc-407883c18502.mspyitaly.com|AndroidPolice|tracking +dcylog.com|MobileTracker|tracking +dd.adecosystems.com|MobileTracker|tracking +ddiutilities.com|HighsterMobile|c2 +ddiutilities.com|HighsterMobile|tracking +de.mobilespy.at|AndroidPolice|tracking +de.refog.com|Hoverwatch|tracking +decide.mixpanel.com|MobileTracker|tracking +defenderupdate.ddns.net|2022_04_metas_adversarial_threat_report_q1|c2 +deferrer.website|202006_DarkBasin|c2 +dehcoveanager.com|MobileTracker|tracking +deknuzesrtnach.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknuzesrtnach.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknuzesrtnach.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknuzesrtnach.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknuzesrtnach.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknuzesrtnach.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzuersntch.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzuerstnch.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzuerstnch.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzuerstnch.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzuerstnch.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzursntch.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzursntch.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzursntch.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzursntch.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzursntch.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzursntch.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzusrtnach.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzusrtnach.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzusrtnach.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzusrtnach.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzusrtnach.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +deknzusrtnach.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +delfi.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +delfi.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +delfi.top|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +demo.fenced.ai|Fenced|tracking +demo.snoopza.com|Snoopza|tracking +demo.traccar.org|Traccar|tracking +demo.ultimatephonespy.com|AndroidMonitor|tracking +demoprojectsuk.com|202006_DarkBasin|c2 +denkuzesrtnch.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkuzesrtnch.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkuzesrtnch.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkuzesrtnch.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkuzesrtnch.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkzusrntch.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkzusrntch.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkzusrntch.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkzusrntch.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +denkzusrntch.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +detail43.myfirewall.org|201603_Shifting_Tactics|c2 +dev.chat.roimaster.site|MobileTracker|tracking +dev.hoverwatch.com|Hoverwatch|c2 +dev.nodle.io|MobileTracker|tracking +dev.safeguarde.com|HighsterMobile|tracking +dev.snoopza.com|Snoopza|c2 +dev2.refog.com|Hoverwatch|c2 +devassist-api.onrender.com|MobileTracker|tracking +device-ac480.appspot.com|HighsterMobile|c2 +device-ac480.firebaseio.com|HighsterMobile|c2 +device-activation.servehttp.com|201702_NilePhish|c2 +devices.starbolt.io|MobileTracker|tracking +deyrep.com|201512_PackRAT|c2 +deyrep24.ddns.net|201512_PackRAT|c2 +dgmxn.c8xwor.com|MobileTracker|tracking +dh135.world|2021_07_taking_action_against_hackers_in_iran|c2 +dhfvbsihjf.com|MobileTracker|tracking +digital-apps.store|2021_04_taking_action_against_hackers_in_palestine|c2 +digitalsecurityworld.com|HighsterMobile|tracking +dinneraroundyou.com|201810_TheKingdomCameToCanada|c2 +diretube.co.uk|201712_Cyberbit|c2 +discover-api.flashintel.ai|MobileTracker|tracking +disp2.mrec24.com|Mrecorder|c2 +dispatcher.mrecorder.com|Mrecorder|c2 +distedc.com|2021_12_taking_action_against_surveillance_for_hire|c2 +djp.bz|FlexiSpy|c2 +dknuzersntch.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzersntch.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzersntch.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzersntch.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzrstnach.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzrstnach.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzrstnach.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzrstnach.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzrstnach.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzsrntch.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzsrntch.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzsrntch.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzsrntch.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzsrntch.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknuzsrntch.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknzursntach.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknzursntach.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknzursntach.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknzursntach.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dknzursntach.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dllhost.servehttp.com|201512_PackRAT|c2 +dmp.starbolt.io|MobileTracker|tracking +dmw.bz|FlexiSpy|c2 +dmw.cc|FlexiSpy|c2 +dnkzuesrtnach.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dnkzuesrtnach.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +dns.bowenpress.org|201707_InsiderInfo|c2 +dns1.sdkbalance.com|MobileTracker|tracking +dns2.sdkbalance.com|MobileTracker|tracking +dns3.sdkbalance.com|MobileTracker|tracking +dnsserverprv.com|202006_DarkBasin|c2 +docs-mail-google.us|201801_SpyingOnABudget|c2 +docs-mail.space|201801_SpyingOnABudget|c2 +docs-mails.servehttp.com|201702_NilePhish|c2 +document.downloadingsystem.com|201803_BadTraffic|c2 +dollrealdoll.com|2021_07_taking_action_against_hackers_in_iran|c2 +dollrealdoll.online|2021_07_taking_action_against_hackers_in_iran|c2 +domainblacklistcheck.com|202006_DarkBasin|c2 +domainemailhostings.com|202006_DarkBasin|c2 +domainexpertswebuk.com|202006_DarkBasin|c2 +domainforhostuk.com|202006_DarkBasin|c2 +domainformailinguk.com|202006_DarkBasin|c2 +domainhostnetworkuk.com|202006_DarkBasin|c2 +domainhostnetworkusa.com|202006_DarkBasin|c2 +domainhostworkeu.com|202006_DarkBasin|c2 +domainlocalhostingeu.com|202006_DarkBasin|c2 +domainlocalhostinghk.com|202006_DarkBasin|c2 +domainlocalhostinguk.com|202006_DarkBasin|c2 +domainmanager33.com|202006_DarkBasin|c2 +domainmanager33.site|202006_DarkBasin|c2 +domainmanager33.website|202006_DarkBasin|c2 +domainserver322.com|202006_DarkBasin|c2 +domainserver399.com|202006_DarkBasin|c2 +domainserveractive.com|202006_DarkBasin|c2 +domainsforfreehosting.com|202006_DarkBasin|c2 +domainsforsupport.com|202006_DarkBasin|c2 +domainsfortechhelp.com|202006_DarkBasin|c2 +domainsserver4f.com|202006_DarkBasin|c2 +donnamfelton.club|2021_04_taking_action_against_hackers_in_palestine|c2 +dotnerserversg.com|202006_DarkBasin|c2 +dotnetserverhk.com|202006_DarkBasin|c2 +down.tracksz.co|MobileTracker|tracking +downapk.spytoapp.com|SpyToApp|c2 +downdating.club|MobileTracker|tracking +download-file.top|MobileTracker|tracking +download-revo.vercel.app|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +download-telegram.vercel.app|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +download.downloadering.co|201803_BadTraffic|c2 +download.downloading.shop|201803_BadTraffic|c2 +download.freespyphone.net|SpyAdvice|distribution +download.mobile-tracker-free.me|MobileTrackerFree|distribution +download.syriantelecommunications.co|201803_BadTraffic|c2 +download.webwatcherdata.com|AndroidPolice|c2 +download4you.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +downloading.internetdownloading.co|201803_BadTraffic|c2 +downloading.syriantelecom.co|201803_BadTraffic|c2 +downloads.refog.com|Hoverwatch|c2 +downloads.shadow-spy.com|ShadowSpy|distribution +dragonair.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +drive-accounts-goog1e.cf|201801_SpyingOnABudget|c2 +drive-accounts-google.com|201801_SpyingOnABudget|c2 +drive-accounts-google.ga|201801_SpyingOnABudget|c2 +drive-accounts-google.ml|201801_SpyingOnABudget|c2 +drive-accounts-gooogle.com|201801_SpyingOnABudget|c2 +drive-goo.space|201801_SpyingOnABudget|c2 +drive-goog1e.com|201801_SpyingOnABudget|c2 +drive-google.cf|201801_SpyingOnABudget|c2 +drive-google.gq|201801_SpyingOnABudget|c2 +drive-google.me|201801_SpyingOnABudget|c2 +drive-google.ml|201801_SpyingOnABudget|c2 +drive-google.space|201801_SpyingOnABudget|c2 +drive-gooog1e.space|201801_SpyingOnABudget|c2 +drive-mail-google.cf|201801_SpyingOnABudget|c2 +drive-mail-google.com|201801_SpyingOnABudget|c2 +drive-mail.info|201801_SpyingOnABudget|c2 +drive-mail.online|201801_SpyingOnABudget|c2 +drive-mail.us|201801_SpyingOnABudget|c2 +drive.accounts-gooog1e.online|201801_SpyingOnABudget|c2 +drive.gooog1e.com|201801_SpyingOnABudget|c2 +drive.mail-status.com|201801_SpyingOnABudget|c2 +drive.myaccount-mail.com|201801_SpyingOnABudget|c2 +drive.postmailsecret.com|201801_SpyingOnABudget|c2 +drivegoogle.biz|201801_SpyingOnABudget|c2 +driveriders.club|MobileTracker|tracking +drivesuplouders.000webhostapp.com|2021_04_taking_action_against_hackers_in_palestine|c2 +drivgoogle.firewall-gateway.com|201603_Shifting_Tactics|c2 +drivingexpiriencesimulator.club|MobileTracker|tracking +drlve-gooog1e.com|201801_SpyingOnABudget|c2 +droimon20.ru|AndroidPolice|c2 +droimon20.ru|AndroidPolice|tracking +dropbox-service.serveftp.com|201702_NilePhish|c2 +dropbox-sign.servehttp.com|201702_NilePhish|c2 +dropbox-verfy.servehttp.com|201702_NilePhish|c2 +dropboxnotification.servehttp.com|201702_NilePhish|c2 +dropboxsupport.servehttp.com|201702_NilePhish|c2 +druze.life|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +dsfhskln.com|MobileTracker|tracking +dsrvrer.com|202006_DarkBasin|c2 +dto.kcpro.ga|MobileTracker|tracking +dwn.vys.me|MobiStealth|c2 +dz7.wethnc067.xyz|MobileTool|c2 +e-spy.app|AndroidPolice|c2 +e-spy.org|AndroidPolice|c2 +e-spy.org|AndroidPolice|distribution +e-spy.org|AndroidPolice|tracking +e.appjiagu.com|Cocospy|c2 +e.crashlytics.com|MobileTracker|tracking +e.freespy1.ml|MobileTracker|tracking +e2c64.firebaseio.com|Reptilicus|c2 +eagerfox.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +eaglespy.com.br|eagleSPY|c2 +eaglespy.com.br|eagleSPY|tracking +easemon.com|iKeyMonitor|tracking +eastafro.net|201712_Cyberbit|c2 +easybassbooster.club|MobileTracker|tracking +easycalea.com|MobileTracker|tracking +easydoc.info|MobileTrackerFree|c2 +easyloggerbeta.azurewebsites.net|EasyLogger|c2 +easyphonetrack.com|EasyPhoneTrack|c2 +easyphonetrack.com|EasyPhoneTrack|tracking +easyvshow.com|MobileTracker|tracking +ebill.cosmote.center|2021_12_taking_action_against_surveillance_for_hire|c2 +ec.cu9.co|201512_PackRAT|c2 +ecom-servicelogin.com|202006_DarkBasin|c2 +ecom.flexispy.com|FlexiSpy|c2 +economyfeeds.com|202006_DarkBasin|c2 +economyservicesil.com|202006_DarkBasin|c2 +ecoserveraus.com|202006_DarkBasin|c2 +ecuadorenvivo.com|201512_PackRAT|c2 +ecuadorenvivo.co|201512_PackRAT|c2 +edge-cloudservices.com|2022_04_metas_adversarial_threat_report_q1|c2 +edgecacheimagehosting.com|201605_Stealth_Falcon|c2 +edit-ymail.space|201801_SpyingOnABudget|c2 +editsbackground.club|MobileTracker|tracking +edlnc255s2q.s3.amazonaws.com # edlnc255s2q.s3.amazonaws.com/databackup.apk|AndroidPolice|c2 +efsyn.online|2021_12_taking_action_against_surveillance_for_hire|c2 +egyqaz.com|2021_12_taking_action_against_surveillance_for_hire|c2 +einformatiks.com|MobiStealth|c2 +ejn.kcpro.ga|MobileTracker|tracking +eksndtpf.org|MobileTracker|tracking +elcore-api.azurewebsites.net|EasyLogger|c2 +elecresearch.org|2022_04_metas_adversarial_threat_report_q1|c2 +em.awsapi.io|iKeyMonitor|c2 +email-163.space|201801_SpyingOnABudget|c2 +email-netvigator.info|201801_SpyingOnABudget|c2 +email23.secuerserver.com|201707_InsiderInfo|c2 +emailauthservice.com|202006_DarkBasin|c2 +emailbaseserverhl.com|202006_DarkBasin|c2 +emaildeliverysuccess.com|202006_DarkBasin|c2 +emailhostholland.com|202006_DarkBasin|c2 +emailhostsecurehk.com|202006_DarkBasin|c2 +emailmappingservice.com|202006_DarkBasin|c2 +emailsecurenode.com|202006_DarkBasin|c2 +emailserver399.com|202006_DarkBasin|c2 +emailserver4859.com|202006_DarkBasin|c2 +emailserver499.com|202006_DarkBasin|c2 +emailserverhk48.com|202006_DarkBasin|c2 +emailserverholland.com|202006_DarkBasin|c2 +emailservername299.com|202006_DarkBasin|c2 +emailseverrus23.com|202006_DarkBasin|c2 +emailvalidateservice.com|202006_DarkBasin|c2 +emcpanel.com|iKeyMonitor|c2 +emiratesfoundation.net|201608_NSO_Group|c2 +emmashop.app|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +emraiyz.xyz|MobileTracker|tracking +en.ownspy.com|OwnSpy|tracking +enerflex.ddns.net|2022_04_metas_adversarial_threat_report_q1|c2 +enerflex.org|2022_04_metas_adversarial_threat_report_q1|c2 +energy-mail.org|201909_MissingLink|c2 +engine.ninja|2021_12_taking_action_against_surveillance_for_hire|c2 +enigmase.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +enikos.news|2021_12_taking_action_against_surveillance_for_hire|c2 +enough-hamas.000webhostapp.com|2021_04_taking_action_against_hackers_in_palestine|c2 +enterprise.cerberusapp.com|Cerberus|tracking +enti5abat.pw|2021_04_taking_action_against_hackers_in_palestine|c2 +entrust.work|2021_07_taking_action_against_hackers_in_iran|c2 +eok8wd5v.net|MobileTracker|tracking +epiphany.download-document.world|201803_BadTraffic|c2 +epoch.englishdownloaders.today|201803_BadTraffic|c2 +epoch.uploaders.online|201803_BadTraffic|c2 +epoch.wind-files.today|201803_BadTraffic|c2 +epochatimes.com|201707_InsiderInfo|c2 +epochtimes.space|201801_SpyingOnABudget|c2 +era3000.com|OwnSpy|tracking +erbfzk.com|MobileTracker|tracking +ereportaz.news|2021_12_taking_action_against_surveillance_for_hire|c2 +erictrumpfundation.com|2021_07_taking_action_against_hackers_in_iran|c2 +ern.kcpro.ga|MobileTracker|tracking +ersokbkj.com|MobileTracker|tracking +es-last-telegram.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +es-last-telegram.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +es.mobilespy.at|AndroidPolice|tracking +es.mobiplus.me|MobileTracker|tracking +es.refog.com|Hoverwatch|tracking +espiao.meuspy.com|MeuSpy|tracking +espiaodecelulargratis.com.br|MeuSpy|tracking +espressonews.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +esrvrer.com|202006_DarkBasin|c2 +etcotater.com|MobileTracker|tracking +etisalategypt.tech|2021_12_taking_action_against_surveillance_for_hire|c2 +etisalatgreen.com|2021_12_taking_action_against_surveillance_for_hire|c2 +etisalatonline.com|2022_04_metas_adversarial_threat_report_q1|c2 +etpweb.answerai.pro|MobileTracker|tracking +eu1-spiky.wzrkt.com|MobileTracker|tracking +eu1.alb.wzrkt.com|MobileTracker|tracking +eu1.wzrkt.com|MobileTracker|tracking +euanticorruption.com|202006_DarkBasin|c2 +evaspy.com|EvaSpy|tracking +evt17.com|HighsterMobile|c2 +evt17.com|HighsterMobile|tracking +ewish.cards|2021_12_taking_action_against_surveillance_for_hire|c2 +exactspy.com|TheTruthSpy|tracking +exchangeserver2345.com|202006_DarkBasin|c2 +exchangeserverformailing.com|202006_DarkBasin|c2 +explorer.sikayetvar.com|MobileTracker|tracking +expresscreditcash.com|MobileTracker|tracking +exprogroup.org|2022_04_metas_adversarial_threat_report_q1|c2 +extapp.globalsou.com|MobileTracker|tracking +extension.1dasou.com|MobileTracker|tracking +extension.ground.news|MobileTracker|tracking +extranetserviceonline.com|202006_DarkBasin|c2 +extremeexploits.com|MobileTracker|tracking +extremeexploits.org|MobileTracker|tracking +eyezyapp.thd.cc|mSpy|c2 +f-b.today|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +f.appjiagu.com|Cocospy|c2 +f.freespy1.ml|MobileTracker|tracking +f.freespy1.tk|MobileTracker|tracking +f0.photoeffect.xyz|MobileTracker|tracking +f6.beautycam.xyz|MobileTracker|tracking +f8a.beautycam.xyz|MobileTracker|tracking +fa.gifcam.xyz|MobileTracker|tracking +faccebookaccunt.blogspot.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +face-book.xyz|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +facebook-helps-center.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +facebookdeck.com|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +facebooks.ddns.me|2021_04_taking_action_against_hackers_in_palestine|c2 +facebookservices.gq|2021_07_taking_action_against_hackers_in_iran|c2 +facenalyer.com|MobileTracker|tracking +fariepoziitn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fariepoziitn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fariepoziitn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fariepoziitn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +faripoziiton.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +faripoziiton.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +faripoziiton.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +faripoziiton.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fasbcaok.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebaak.com|2021_04_taking_action_against_hackers_in_palestine|c2 +faseback.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebaok.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebaok.co|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebaook.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebcak.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebcak.co|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebcck.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fasebcoki.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fasibauik.co|2021_04_taking_action_against_hackers_in_palestine|c2 +fasitoak.com|2021_04_taking_action_against_hackers_in_palestine|c2 +faspulhearratmoni.com|MobileTracker|tracking +fast-download.pro|2021_04_taking_action_against_hackers_in_palestine|c2 +fastdownload.me|2021_12_taking_action_against_surveillance_for_hire|c2 +fastserverasia.com|202006_DarkBasin|c2 +fastservereurope.com|202006_DarkBasin|c2 +fastserveruk.com|202006_DarkBasin|c2 +fastserverusa.com|202006_DarkBasin|c2 +fasttravelclearance.com|201605_Stealth_Falcon|c2 +fastuploads.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +faz.agency|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +faz.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +faz.ltd|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fb-accounts.com|201608_NSO_Group|c2 +fb-accounts.com|201706_RecklessExploit|c2 +fb.gifcam.xyz|MobileTracker|tracking +fbc8213450838f7ae251d4|2021_12_taking_action_against_surveillance_for_hire|c2 +fblogin.me|2021_07_taking_action_against_hackers_in_iran|c2 +fcaibaak.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fdfjhks.com|MobileTracker|tracking +feartranslator.com|MobileTracker|tracking +fecolooklegon.000webhostapp.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fedex-mail.servehttp.com|201702_NilePhish|c2 +fedex-notification.servehttp.com|201702_NilePhish|c2 +fedex-s.servehttp.com|201702_NilePhish|c2 +fedex-shipping.servehttp.com|201702_NilePhish|c2 +fedex-sign.servehttp.com|201702_NilePhish|c2 +fenced.ai|Fenced|tracking +ferehtdwrhl.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferehtdwrhl.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferehtdwrhl.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferehtdwrhl.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferehtdwrhl.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferhedtewrahl.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferhedtewrahl.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferhedtewrahl.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +feriehtdewrahl.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +feriehtdewrahl.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +feriehtdewrahl.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +feriehtdewrahl.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferihetderwahl.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferihetderwahl.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ferrari.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +fetch.mangoerp.com|MobileTracker|tracking +ffitnesstrainer.club|MobileTracker|tracking +ffnbafc.xyz|MobileTracker|tracking +ffoxnewz.com|2021_12_taking_action_against_surveillance_for_hire|c2 +fgcxweasqw.oss-eu-central-1.aliyuncs.com|MobileTracker|tracking +fiddaz.club|MobileTracker|tracking +fif0.top|MobileTracker|tracking +fileblade.ga|2021_07_taking_action_against_hackers_in_iran|c2 +filegoogle.firewall-gateway.com|201603_Shifting_Tactics|c2 +files-gooog1e.space|201801_SpyingOnABudget|c2 +files-mail-google.ml|201801_SpyingOnABudget|c2 +files-mail-qq.online|201801_SpyingOnABudget|c2 +files-mail.space|201801_SpyingOnABudget|c2 +files-store.host|2021_04_taking_action_against_hackers_in_palestine|c2 +filestudios.net|2022_08_metas_adversarial_threat_report_q2|c2 +filtersapp-715ee.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +filtersapp-715ee.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +fimes.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +fincconttact.com|MobileTracker|tracking +find-my-phone-prod.herokuapp.com|AndroidPolice|c2 +find-myphone.com|AndroidPolice|tracking +findcareersatusbofa.com|2021_07_taking_action_against_hackers_in_iran|c2 +findmykids.org|FindMyKids|tracking +findmyphone.mangobird.com|AndroidPolice|c2 +findmyplants.com|201810_TheKingdomCameToCanada|c2 +fingdefend.com|MobileTracker|tracking +fingerprihanger.com|MobileTracker|tracking +fire-upload.host|2021_04_taking_action_against_hackers_in_palestine|c2 +firebase-settings.crashlytics.com|MobileTracker|tracking +fireup.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +firewallupdate.firewall-gateway.com|201603_Shifting_Tactics|c2 +firewallupdate.firewall-gateway.net|201603_Shifting_Tactics|c2 +fiservcareers.com|2021_07_taking_action_against_hackers_in_iran|c2 +fisherman.engine.ninja|2021_12_taking_action_against_surveillance_for_hire|c2 +fitnessdias.club|MobileTracker|tracking +fitnessgymup.club|MobileTracker|tracking +fitnesspoint.club|MobileTracker|tracking +fitnessstrategy.xyz|MobileTracker|tracking +fl.gifcam.xyz|MobileTracker|tracking +flashkeylogger.com|FlashKeylogger|tracking +flexipagez.com|2021_12_taking_action_against_surveillance_for_hire|c2 +flexispy.com|FlexiSpy|tracking +flexispy.mobileapps.com.my|FlexiSpy|tracking +flickry.xyz|MobileTracker|tracking +flower.snoopza.com|Snoopza|c2 +fluency.ryboucoathom.com|MobileTracker|tracking +flushdata.1topspy.com|HelloSpy|c2 +flushdata.copy9db.com|HelloSpy|c2 +flushdata.hellospy.com|HelloSpy|c2 +flushdata2.hellospy.com|HelloSpy|c2 +flushdata3.hellospy.com|HelloSpy|c2 +flushdata4.hellospy.com|HelloSpy|c2 +flushdata5.hellospy.com|HelloSpy|c2 +flushdbd.maxxspy.com|HelloSpy|c2 +flyermobi.com|MobileTracker|tracking +fmk.god-xc.com|FindMyKids|distribution +fnbdeiegpslocoiatntcrkaer.com|MobileTracker|tracking +focusecuador.net|201512_PackRAT|c2 +focusecuador.tk|201512_PackRAT|c2 +fonemonitor.co|Cocospy|tracking +fonemonitor.vip|Cocospy|c2 +fonetracker.com|TheTruthSpy|tracking +foodin.site|MobileTracker|tracking +foreverspy.com|Metasploit|c2 +foreverspy.com|Metasploit|tracking +formmail.com|201512_PackRAT|c2 +forum.spytomobile.com|AndroidPolice|tracking +forumtechtopic.com|202006_DarkBasin|c2 +forwardeshoptt.com|2021_12_taking_action_against_surveillance_for_hire|c2 +forzahmobile.com|MobileTracker|tracking +foxspy.com.br|EspiaoAndroid|tracking +fr.chillaxgames.mobi|MobileTracker|tracking +fr.mobilespy.at|AndroidPolice|tracking +fr.refog.com|Hoverwatch|tracking +fraiepozition.live|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fraiepozition.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fraiepozition.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fraiepozition.store|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fraiesvolk.com|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fraiopziiton.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fraiopziiton.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +fraudpreventionsys.com|MobileTracker|tracking +frecalwolwid.com|MobileTracker|tracking +free-spy.com|AppSpy|tracking +free.apptracker.net|AppSpy|tracking +free.spycell.net|TheTruthSpy|tracking +freeandroidspy.com|FreeAndroidSpy|tracking +freechess.live|2022_04_metas_adversarial_threat_report_q1|c2 +freecoupon21.com|MobileTracker|tracking +freefonespy.com|mSpy|tracking +freemobilespy.net|AppSpy|c2 +freemobilespy.net|AppSpy|tracking +freephonespy.net|AppSpy|tracking +freespy.cf|MobileTracker|tracking +freespyapp.com|AndroidPolice|c2 +freespyapp.com|AndroidPolice|tracking +freespyphone.net|SpyAdvice|tracking +frowtisice.club|2021_04_taking_action_against_hackers_in_palestine|c2 +frwrdrurl.com|202006_DarkBasin|c2 +frwrdrwr.com|202006_DarkBasin|c2 +ftp.ftpserver.com|201512_PackRAT|c2 +ftp.info-taxi.info|AndroidPolice|c2 +ftp.server.com|201512_PackRAT|c2 +ftphotom.com|MobileTracker|tracking +full.naturalpercent.life|MobileTracker|tracking +funnychess.online|2022_04_metas_adversarial_threat_report_q1|c2 +fxkwboard.com|MobileTracker|tracking +g.appjiagu.com|Cocospy|c2 +g.freespy1.ml|MobileTracker|tracking +g.freespy1.tk|MobileTracker|tracking +g1790.rt14v.com|MobileTracker|tracking +gallant-william.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +gallery.play-protect.com|2022_08_metas_adversarial_threat_report_q2|c2 +gateway.unityads.unity3d.com|MobileTracker|tracking +gbcf.odskguo.xyz|MobileTracker|tracking +gd-1301476296.cos.na-toronto.myqcloud.com|MobileTracker|tracking +gemtool.sytes.net|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +geniesoftsystem.com|AbsoluTrack|tracking +geo2ipapi.org|2021_03_taking_action_against_hackers_in_china|c2 +geo2ipapi.org|MobileTracker|tracking +get-your-access-now.com|MobileTracker|tracking +get.adobe.com.bowenpress.org|201707_InsiderInfo|c2 +get.snoopza.com|Snoopza|c2 +get.snoopza.com|Snoopza|tracking +getadobe.ddns.net|2022_04_metas_adversarial_threat_report_q1|c2 +getadobe.net|2022_04_metas_adversarial_threat_report_q1|c2 +getadobeplayer.com|201712_Cyberbit|c2 +getelements.xyz|MobileTracker|tracking +getemailopens.com|202006_DarkBasin|c2 +getmspy.net|mSpy|c2 +getmspy.net|mSpy|distribution +getreadytorunhalfmarathon.com|202006_DarkBasin|c2 +getsetgoforhealth.com|202006_DarkBasin|c2 +getsignalapps.com|2021_12_taking_action_against_surveillance_for_hire|c2 +getsignalapps.live|2021_12_taking_action_against_surveillance_for_hire|c2 +getspyapps.com|HelloSpy|tracking +getspylix.io|AndroidPolice|c2 +getupdatesnow.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +giftmio.com|MobileTracker|tracking +gifts-store.net|2021_04_taking_action_against_hackers_in_palestine|c2 +gleancorp.com|MobileTracker|tracking +globaltalent.in|2022_04_metas_adversarial_threat_report_q1|c2 +gmail-profile.com|201801_SpyingOnABudget|c2 +gmail-relation.tk|201801_SpyingOnABudget|c2 +gmail-retry.tk|201801_SpyingOnABudget|c2 +gmail-safety.pw|201801_SpyingOnABudget|c2 +gmail-secure.tk|201801_SpyingOnABudget|c2 +gmail-ssl.tk|201801_SpyingOnABudget|c2 +gmail.com.msg07.xyz|201512_PackRAT|c2 +gmailapp.me|201909_MissingLink|c2 +go.creativemobilemarketing.com|MobileTracker|tracking +go.fastfinderworld.com|MobileTracker|tracking +go.grandprizewinners.com|MobileTracker|tracking +go.interlinkinternet.com|MobileTracker|tracking +go.protectyoursearch.com|MobileTracker|tracking +go.trackitalltheway.com|MobileTracker|tracking +go.trackiteazy.com|MobileTracker|tracking +go.watchwiser.com|MobileTracker|tracking +go.whatabookmark.com|MobileTracker|tracking +goerge-amper.website|2021_04_taking_action_against_hackers_in_palestine|c2 +goldenscent.net|2021_12_taking_action_against_surveillance_for_hire|c2 +goldenscint.com|2021_12_taking_action_against_surveillance_for_hire|c2 +goldescent.com|2021_12_taking_action_against_surveillance_for_hire|c2 +goo-ply-download.com|2021_04_taking_action_against_hackers_in_palestine|c2 +goodreads.rest|2021_07_taking_action_against_hackers_in_iran|c2 +goodwork-25869.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +goodwork-25869.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +goog1e.space|201801_SpyingOnABudget|c2 +googl.club|2021_07_taking_action_against_hackers_in_iran|c2 +google-authorize.gq|201801_SpyingOnABudget|c2 +google-drive.gq|201801_SpyingOnABudget|c2 +google-issue.tk|201801_SpyingOnABudget|c2 +google-maps.servehttp.com|201702_NilePhish|c2 +google-post.com|201801_SpyingOnABudget|c2 +google-protected.gq|201801_SpyingOnABudget|c2 +google-secret.com|201801_SpyingOnABudget|c2 +google-secure.gq|201801_SpyingOnABudget|c2 +google-settings.ml|201801_SpyingOnABudget|c2 +google-sign.tk|201801_SpyingOnABudget|c2 +google.comemail.email|201808_FamiliarFeeling|c2 +google.comemails.email|201808_FamiliarFeeling|c2 +google.commail.co|201808_FamiliarFeeling|c2 +google.commail.email|201808_FamiliarFeeling|c2 +google.loginto.me|2021_04_taking_action_against_hackers_in_palestine|c2 +googledrive-sign.servehttp.com|201702_NilePhish|c2 +googledriver-sign.ddns.net|201702_NilePhish|c2 +googlefile.firewall-gateway.net|201603_Shifting_Tactics|c2 +googlemaps.servehttp.com|201702_NilePhish|c2 +googleplay-store.com|201608_NSO_Group|c2 +googlesecure-serv.servehttp.com|201702_NilePhish|c2 +googleservices.co|2022_04_metas_adversarial_threat_report_q1|c2 +googlesignin.servehttp.com|201702_NilePhish|c2 +googleupdate.co|2022_04_metas_adversarial_threat_report_q1|c2 +googleverify-signin.servehttp.com|201702_NilePhish|c2 +goomail.ml|202006_DarkBasin|c2 +gooog1e.com|201801_SpyingOnABudget|c2 +gosignal.org|2022_08_metas_adversarial_threat_report_q2|c2 +gosokm.com|2021_12_taking_action_against_surveillance_for_hire|c2 +gotossl.ml|2021_03_taking_action_against_hackers_in_china|c2 +gotossl.ml|MobileTracker|tracking +gp-market.com|2021_04_taking_action_against_hackers_in_palestine|c2 +gpsphonuetrackerfamilylocator.com|MobileTracker|tracking +gravyanalytics.com|MobileTracker|tracking +grd77.cn|MobileTracker|tracking +greenwich-for-chrome.replit.app|MobileTracker|tracking +groovefitness.xyz|MobileTracker|tracking +gropinggo.com|2021_07_taking_action_against_hackers_in_iran|c2 +guardian-tt.me|2021_12_taking_action_against_surveillance_for_hire|c2 +guardnews.live|2021_12_taking_action_against_surveillance_for_hire|c2 +guestspy.com|TheTruthSpy|c2 +guestspy.com|TheTruthSpy|tracking +gurley.s3.ap-southeast-1.wasabisys.com|PhoneMonitor|distribution +h.appjiagu.com|Cocospy|c2 +h.freespy1.ml|MobileTracker|tracking +h.freespy1.tk|MobileTracker|tracking +hadfnews.000webhostapp.com|2021_04_taking_action_against_hackers_in_palestine|c2 +hail-reporting.tutelatechnologies.com|MobileTracker|tracking +hamas31.000webhostapp.com|2021_04_taking_action_against_hackers_in_palestine|c2 +hannah-parsons.info|2021_04_taking_action_against_hackers_in_palestine|c2 +hanstrackr.com|MobileTracker|tracking +hardcoretechnologiesllp.com|202006_DarkBasin|c2 +hathwaynetwork.com|202006_DarkBasin|c2 +hatvax.com|2022_08_metas_adversarial_threat_report_q2|c2 +hawkeye-us.us-west-1.log.aliyuncs.com|MobileTracker|tracking +hbh-europe-ripoff-report.com|202006_DarkBasin|c2 +heartrateandmealtracker.com|MobileTracker|tracking +heartrateproxhealthmonitor.com|MobileTracker|tracking +heartratteandpulsetracker.com|MobileTracker|tracking +heartrhythm.club|MobileTracker|tracking +heaven.army|2021_12_taking_action_against_surveillance_for_hire|c2 +heidi-minaya.host|2021_04_taking_action_against_hackers_in_palestine|c2 +heiiasjournai.com|2021_12_taking_action_against_surveillance_for_hire|c2 +hellasjournal.company|2021_12_taking_action_against_surveillance_for_hire|c2 +hellasjournal.website|2021_12_taking_action_against_surveillance_for_hire|c2 +hellospy.com|HelloSpy|c2 +hellospy.com|HelloSpy|tracking +hellottec.art|2021_12_taking_action_against_surveillance_for_hire|c2 +helloworld.bounceme.net|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +help.domainoutlet.site|MobileTracker|tracking +helpdesk-product.com|2022_04_metas_adversarial_threat_report_q1|c2 +hempower.shop|2021_12_taking_action_against_surveillance_for_hire|c2 +herman-poore.info|2021_04_taking_action_against_hackers_in_palestine|c2 +hespyapp.com|TheTruthSpy|tracking +hex6mak5z98nubb9vpd6t36cydkncfci9im872qx6hjci2egx8irq3qyt9pj.online|2021_07_taking_action_against_hackers_in_iran|c2 +hfstat.bearclod.com|MobileTracker|tracking +hidden-chat-e58d7.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +hidden-chat-e58d7.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +hidden-chat.online|2021_04_taking_action_against_hackers_in_palestine|c2 +hiddensmstracker.com|CallSMSTracker|tracking +hiddensystemhealth.com|CallSMSTracker|tracking +highstermobi.com|Hoverwatch|tracking +highstermobile.com|HighsterMobile|tracking +highstermobile.co|HighsterMobile|tracking +hike.in|AndroidPolice|tracking +hike.studio|2021_07_taking_action_against_hackers_in_iran|c2 +hiremilitaryheroes.com|2021_07_taking_action_against_hackers_in_iran|c2 +hiretechservicehg.com|202006_DarkBasin|c2 +histre.com|MobileTracker|tracking +hk.secuerserver.com|201707_InsiderInfo|c2 +hkdrillonline.com|202006_DarkBasin|c2 +hkemail.f3322.org|201604_UP007_SLServer|c2 +hklinbas.com|202006_DarkBasin|c2 +hkn01.bearclod.com|MobileTracker|tracking +hn.algolia.com|MobileTracker|tracking +hollandtourandtravel.com|202006_DarkBasin|c2 +home.everaccountable.com|MobileTracker|tracking +homeforallorphans.com|202006_DarkBasin|c2 +homeremedytipntricks.com|202006_DarkBasin|c2 +homeserver87.com|202006_DarkBasin|c2 +hongkongshippingcompany.com|202006_DarkBasin|c2 +hookupdating.club|2021_04_taking_action_against_hackers_in_palestine|c2 +hookupmsg.club|2021_04_taking_action_against_hackers_in_palestine|c2 +hoolives.com|MobileTracker|tracking +hopnope.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +horan-free.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +horoscopefortune.club|MobileTracker|tracking +hostbasichk.com|202006_DarkBasin|c2 +hostbasicholl.com|202006_DarkBasin|c2 +hostbasicmy.com|202006_DarkBasin|c2 +hostbasicru.com|202006_DarkBasin|c2 +hostbasicsg.com|202006_DarkBasin|c2 +hosted-microsoft.com|2021_07_taking_action_against_hackers_in_iran|c2 +hostemailsecureserver.com|202006_DarkBasin|c2 +hostemailserver.com|202006_DarkBasin|c2 +hostfeasta.com|202006_DarkBasin|c2 +hostingserviceclean.com|202006_DarkBasin|c2 +hostingserviceforall.com|202006_DarkBasin|c2 +hostingservicesloyal.com|202006_DarkBasin|c2 +hostingservicesukit.com|202006_DarkBasin|c2 +hostmailsecure.com|202006_DarkBasin|c2 +hostmailsecureserver.com|202006_DarkBasin|c2 +hostsecuremail.com|202006_DarkBasin|c2 +hostsecuremail544.com|202006_DarkBasin|c2 +hostserverrus.com|202006_DarkBasin|c2 +hostusewithtech.com|202006_DarkBasin|c2 +hotchat-f0c0e.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +hotmail-sign.com|201801_SpyingOnABudget|c2 +hotnewchat.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +hotofecro.com|MobileTracker|tracking +housesfurniture.com|201810_TheKingdomCameToCanada|c2 +hover.watch|Hoverwatch|c2 +hover.watch|Hoverwatch|tracking +hoverwatch.com|Hoverwatch|c2 +hoverwatch.com|Hoverwatch|tracking +hrvxkxq.xyz|MobileTracker|tracking +htapi.getapiv8.com|MobileTracker|tracking +https-drive-accounts-goog1e.cf|201801_SpyingOnABudget|c2 +https-drive-google.cf|201801_SpyingOnABudget|c2 +https-drive-google.com|201801_SpyingOnABudget|c2 +https-drive-google.gq|201801_SpyingOnABudget|c2 +https-drive-google.ml|201801_SpyingOnABudget|c2 +https-google-drive.ml|201801_SpyingOnABudget|c2 +https-mail-google.gq|201801_SpyingOnABudget|c2 +https-mail-google.ml|201801_SpyingOnABudget|c2 +https-my-accounts-google.gq|201801_SpyingOnABudget|c2 +https-myaccounts-google.space|201801_SpyingOnABudget|c2 +https.drive-google.gq|201801_SpyingOnABudget|c2 +https://github.com/earthshakira/android_hack|Buhsam|distribution +https://github.com/karma9874/AndroRAT|AndroRat|distribution +httpsaccount-google.gq|201801_SpyingOnABudget|c2 +httpsaccounts-drive-google.gq|201801_SpyingOnABudget|c2 +httpsaccounts-google.cf|201801_SpyingOnABudget|c2 +httpsaccounts-google.com|201801_SpyingOnABudget|c2 +httpsaccounts-google.ga|201801_SpyingOnABudget|c2 +httpsaccounts-google.info|201801_SpyingOnABudget|c2 +httpsaccounts-google.pw|201801_SpyingOnABudget|c2 +httpsaccounts-google.site|201801_SpyingOnABudget|c2 +httpsdocs-google.info|201801_SpyingOnABudget|c2 +httpsdrive-accounts-google.site|201801_SpyingOnABudget|c2 +httpsdrive-google.gq|201801_SpyingOnABudget|c2 +httpsdrive-google.net|201801_SpyingOnABudget|c2 +httpsdrive-google.pw|201801_SpyingOnABudget|c2 +httpsdrive-google.site|201801_SpyingOnABudget|c2 +httpsdrive-google.space|201801_SpyingOnABudget|c2 +httpsdrive-mail-google.gq|201801_SpyingOnABudget|c2 +httpsdrive-myaccounts-google.cf|201801_SpyingOnABudget|c2 +httpsgoogle-drive.gq|201801_SpyingOnABudget|c2 +httpsmail-google.cf|201801_SpyingOnABudget|c2 +httpsmail-google.ml|201801_SpyingOnABudget|c2 +httpsmyaccount-google.info|201801_SpyingOnABudget|c2 +httpsmyaccounts-google.space|201801_SpyingOnABudget|c2 +httpsmydrive-accounts-goog1e.gq|201801_SpyingOnABudget|c2 +hu.refog.com|Hoverwatch|tracking +humanrights-1398b.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +humanrights-1398b.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +huntcontactz.com|MobileTracker|tracking +hw.cab|Hoverwatch|c2 +hwa.cab|Hoverwatch|c2 +hwm.cab|Hoverwatch|c2 +hws.icu|Hoverwatch|c2 +hws.icu|Hoverwatch|tracking +hww.cab|Hoverwatch|c2 +hxg.kcpro.ga|MobileTracker|tracking +hydro-ca.link|MobileTracker|tracking +hz-service.thd.cc|mSpy|c2 +hz7.thd.cc|mSpy|c2 +hzdy.birxpk.com|MobileTool|c2 +i.cocospy.com|Cocospy|c2 +i.fonemonitor.co|Cocospy|c2 +i.freespy1.ml|MobileTracker|tracking +i.freespy1.tk|MobileTracker|tracking +i.hoverwatch.com|Hoverwatch|c2 +i.minspy.com|Cocospy|c2 +i.neatspy.com|Cocospy|c2 +i.safespy.com|Cocospy|c2 +i.spyic.com|Cocospy|c2 +i.spyier.com|Spyier|c2 +i.spyine.com|Cocospy|c2 +i.spyzie.io|Cocospy|c2 +i.teensafe.net|Cocospy|c2 +i1.hoverwatch.com|Hoverwatch|c2 +i10.clientreport.info|NeoSpy|c2 +i11.clientreport.info|NeoSpy|c2 +i12.clientreport.info|NeoSpy|c2 +i13.clientreport.info|NeoSpy|c2 +i151125.infourl.net|MobileTracker|tracking +i6.clientreport.info|NeoSpy|c2 +i7.clientreport.info|NeoSpy|c2 +i8.clientreport.info|NeoSpy|c2 +i9.clientreport.info|NeoSpy|c2 +iblompass.com|MobileTracker|tracking +icloudappe.com|TheTruthSpy|c2 +icloudcacher.com|201608_NSO_Group|c2 +icloudeu.com|2021_12_taking_action_against_surveillance_for_hire|c2 +icloudflair.com|2021_12_taking_action_against_surveillance_for_hire|c2 +iconylc.com|MobileTracker|tracking +icoonectedtrack.com|MobileTracker|tracking +icptime.com|2021_03_taking_action_against_hackers_in_china|c2 +icptime.com|MobileTracker|tracking +icrcworld.com|201608_NSO_Group|c2 +id4242.ga|201705_TaintedLeaks|c2 +id833.ga|201705_TaintedLeaks|c2 +id834.ga|201705_TaintedLeaks|c2 +id9954.gq|201705_TaintedLeaks|c2 +ideas-telcel.com.mx|201608_NSO_Group|c2 +ideas-telcel.com.mx|201706_RecklessExploit|c2 +idevs.co|mSpy|c2 +idme.org|MobileTracker|tracking +iemail.today|2021_07_taking_action_against_hackers_in_iran|c2 +iibt.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +ikea-egypt.net|2021_12_taking_action_against_surveillance_for_hire|c2 +ikeymonitor.com|iKeyMonitor|c2 +ikeymonitor.fr|iKeyMonitor|c2 +iklood.co|2021_04_taking_action_against_hackers_in_palestine|c2 +ikm.awsapi.io|iKeyMonitor|c2 +ikoad.co|2021_04_taking_action_against_hackers_in_palestine|c2 +il0baz.com|MobileTracker|tracking +ilfmobileapps.com|HighsterMobile|tracking +ilnk.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +im.brunoespiao.com.br|BrunoEspiao|c2 +im.theonespy.com|TheOneSpy|c2 +image.loadingmessage.info|MobileTracker|tracking +imageview.xyz|MobileTracker|tracking +imapserverholland.com|202006_DarkBasin|c2 +img01.findgravy.com|MobileTracker|tracking +img02.findgravy.com|MobileTracker|tracking +img03.findgravy.com|MobileTracker|tracking +img04.findgravy.com|MobileTracker|tracking +imgsrvrer.com|202006_DarkBasin|c2 +imobispy.com|SpyMasterPro|c2 +imonitor-da8b2.firebaseio.com|iMonitorSpy|c2 +imonitorke.com|iMonitorSpy|c2 +imonitorsoft.cn|iMonitorSpy|c2 +imonitorsoft.cn|iMonitorSpy|tracking +imonitorsoft.com|iMonitorSpy|c2 +in-politics.com|2021_12_taking_action_against_surveillance_for_hire|c2 +in.cb.wzrkt.com|MobileTracker|tracking +in.cuebiq.com|MobileTracker|tracking +in.wzrkt.com|MobileTracker|tracking +in1-spiky.wzrkt.com|MobileTracker|tracking +in1.alb.wzrkt.com|MobileTracker|tracking +in1.wzrkt.com|MobileTracker|tracking +inapturst.top|MobileTracker|tracking +incapsulawebcache.com|201605_Stealth_Falcon|c2 +incognito.today|2021_07_taking_action_against_hackers_in_iran|c2 +indelibleblue.net|MobileTracker|tracking +indelibleblueinc.net|MobileTracker|tracking +info-taxi.info|AndroidPolice|c2 +infoga.cam|2021_07_taking_action_against_hackers_in_iran|c2 +informnapalm.net|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +infosms-a.site|2021_12_taking_action_against_surveillance_for_hire|c2 +ingestion-api.kiwi.sand.cuebiq.ai|MobileTracker|tracking +init.supersonicads.com|MobileTracker|tracking +innoaspy.com|TheTruthSpy|tracking +innovaspy.com|HelloSpy|tracking +inospy.com|TheTruthSpy|tracking +inrsrvrer.com|202006_DarkBasin|c2 +inservices.digital|2021_12_taking_action_against_surveillance_for_hire|c2 +insider.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +insights.getblockify.com|MobileTracker|tracking +instagam.click|2021_12_taking_action_against_surveillance_for_hire|c2 +instagam.in|2021_12_taking_action_against_surveillance_for_hire|c2 +instagam.photos|2021_12_taking_action_against_surveillance_for_hire|c2 +installam.com|AndroidMonitor|distribution +instantspeechtranslation.club|MobileTracker|tracking +instegram.co|2021_12_taking_action_against_surveillance_for_hire|c2 +int.akisinn.info|MobileTracker|tracking +int.akisinn.me|MobileTracker|tracking +int.akisinn.site|MobileTracker|tracking +int.dewrain.life|MobileTracker|tracking +int.dewrain.site|MobileTracker|tracking +int.dewrain.world|MobileTracker|tracking +int.vaicore.site|MobileTracker|tracking +int.vaicore.store|MobileTracker|tracking +int.vaicore.xyz|MobileTracker|tracking +int.vlancaa.fun|MobileTracker|tracking +int.vlancaa.site|MobileTracker|tracking +intelgenttran.com|MobileTracker|tracking +intellens-api.aigos.io|MobileTracker|tracking +interguardsoftware.com|AndroidPolice|tracking +internet.document-management.today|201803_BadTraffic|c2 +internet.downloadingdocuments.com|201803_BadTraffic|c2 +internetcartography.com|MobileTracker|tracking +internetcartography.net|MobileTracker|tracking +internetcartography.org|MobileTracker|tracking +internetmarketingservicehg.com|202006_DarkBasin|c2 +interserver439.com|202006_DarkBasin|c2 +intrsrvrer.com|202006_DarkBasin|c2 +inv.logger.mobi|EasyLogger|c2 +inv.logger.mobi|EasyLogger|distribution +invoker.icu|2021_12_taking_action_against_surveillance_for_hire|c2 +ioi.life|AiSpyer|c2 +ios-apps.store|2021_12_taking_action_against_surveillance_for_hire|c2 +ios-gw.spynger.net|Spynger|c2 +iosmnbg.com|2021_12_taking_action_against_surveillance_for_hire|c2 +iqtel.org|2021_07_taking_action_against_hackers_in_iran|c2 +ircleocatinder.com|MobileTracker|tracking +irenewansley.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +irtreporter.com|2021_07_taking_action_against_hackers_in_iran|c2 +isaac-rowland.space|2021_04_taking_action_against_hackers_in_palestine|c2 +islam-360-plus.com|2022_08_metas_adversarial_threat_report_q2|c2 +islsrickers.com|MobileTracker|tracking +ispyoo.com|TheTruthSpy|tracking +ispytic.com|HelloSpy|tracking +isrvrer.com|202006_DarkBasin|c2 +istiqlaihaber.com|2021_03_taking_action_against_hackers_in_china|c2 +istiqlaihaber.com|MobileTracker|tracking +it.mobilespy.at|AndroidPolice|tracking +it.refog.com|Hoverwatch|tracking +itcgr.live|2021_12_taking_action_against_surveillance_for_hire|c2 +itiee.life|2021_07_taking_action_against_hackers_in_iran|c2 +itieee.life|2021_07_taking_action_against_hackers_in_iran|c2 +itly.link|2021_12_taking_action_against_surveillance_for_hire|c2 +itranstxtvoicepht.com|MobileTracker|tracking +itter.me|2021_12_taking_action_against_surveillance_for_hire|c2 +iusacell-movil.com.mx|201608_NSO_Group|c2 +iusacell-movil.com.mx|201706_RecklessExploit|c2 +iveilembercker.com|MobileTracker|tracking +ivlewepapallrbkragonucd.com|MobileTracker|tracking +ixhtb.s9gxw8.com|MobileTool|c2 +iyouthen.com|201510_NGO_Burma|c2 +izapk.xyz|AndroidPolice|c2 +izelense.com|201909_MissingLink|c2 +izkid.com|AndroidPolice|tracking +izspy-1313.firebaseio.com|AndroidPolice|c2 +j.freespy1.ml|MobileTracker|tracking +j.freespy1.tk|MobileTracker|tracking +jailbreak-gateway.thd.cc|mSpy|c2 +jamila-c8420.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +jamila-c8420.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +jamilabouhaird-c0935.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +jamilabouhaird-c0935.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +javaservermy.com|202006_DarkBasin|c2 +jayboyadams.club|2021_04_taking_action_against_hackers_in_palestine|c2 +jduzuyd.com|MobileTracker|tracking +jennifer-marler.pw|2021_04_taking_action_against_hackers_in_palestine|c2 +jeremy-tanner.live|2021_04_taking_action_against_hackers_in_palestine|c2 +jessicamcgill.life|2021_07_taking_action_against_hackers_in_iran|c2 +jjspy.com|RealtimeSpy|c2 +jjspy.ml|RealtimeSpy|c2 +jk8681oy.oss-eu-central-1.aliyuncs.com|MobileTracker|tracking +jobs.illaewinstralinc.com|MobileTracker|tracking +jodiecarey.live|2021_04_taking_action_against_hackers_in_palestine|c2 +joe-rumley.pw|2021_04_taking_action_against_hackers_in_palestine|c2 +join.crazymob.co|MobileTracker|tracking +join.officeframe.work|MobileTracker|tracking +joincharitytree.com|MobileTracker|tracking +jquery-updater.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +jqueryui-code.com|2021_07_taking_action_against_hackers_in_iran|c2 +js.intercomcdn.com|MobileTracker|tracking +jsdfbhsa.com|MobileTracker|tracking +judystevenson.info|2021_04_taking_action_against_hackers_in_palestine|c2 +juju.co.ke|AndroidPolice|tracking +julie-parker.top|2021_04_taking_action_against_hackers_in_palestine|c2 +jumhuria.com|2021_07_taking_action_against_hackers_in_iran|c2 +justicia-desvinculados.com|201512_PackRAT|c2 +justseries.net|AppSpy|tracking +jydfoafcaf.xyz|MobileTracker|tracking +k.freespy1.ml|MobileTracker|tracking +k.freespy1.tk|MobileTracker|tracking +kartick.net|2021_07_taking_action_against_hackers_in_iran|c2 +kaspersky.team|2021_07_taking_action_against_hackers_in_iran|c2 +katesalinas.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +kathimerini.news|2021_12_taking_action_against_surveillance_for_hire|c2 +kavkazru.press|2022_04_metas_adversarial_threat_report_q1|c2 +kennediewahrheit.live|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +kentporter.site|2021_04_taking_action_against_hackers_in_palestine|c2 +kenyasms.org|201608_NSO_Group|c2 +kevin-good.top|2021_04_taking_action_against_hackers_in_palestine|c2 +key-logger-90fff.firebaseio.com|TrackMyPhones|c2 +keyboardthemes.club|MobileTracker|tracking +kfcwsa.com|MobileTracker|tracking +kgr0aixa.xyz|MobileTracker|tracking +khaleejtimes.co|2022_04_metas_adversarial_threat_report_q1|c2 +kidlogger.net|AndroidPolice|tracking +kidsecured.com|mSpy|tracking +kidsguard-6c6a9.firebaseio.com|ClevGuard|c2 +kidsshield.net|AndroidPolice|c2 +kidsshield.net|AndroidPolice|distribution +kidsshield.net|AndroidPolice|tracking +kimberlycamp.club|2021_04_taking_action_against_hackers_in_palestine|c2 +kinder.engine.ninja|2021_12_taking_action_against_surveillance_for_hire|c2 +kinesis.ap-southeast-1.amazonaws.com|MobileTracker|tracking +kingdom-deals.com|201810_TheKingdomCameToCanada|c2 +kingdom-news.com|201810_TheKingdomCameToCanada|c2 +klg.a-spy.com|RealtimeSpy|c2 +knowledgebaseonlineuk.com|202006_DarkBasin|c2 +koenigseggg.com|2021_12_taking_action_against_surveillance_for_hire|c2 +kohaicorp.com|2021_12_taking_action_against_surveillance_for_hire|c2 +kokum.ru|AndroidPolice|c2 +koora-egypt.com|2021_12_taking_action_against_surveillance_for_hire|c2 +koreavopi.kro.kr|MobileTracker|tracking +kormoran.bid|2021_12_taking_action_against_surveillance_for_hire|c2 +kpsbproxy.kiddoware.com|MobileTracker|tracking +kranos.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +krasil-anthony.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +krkmyvlmdg.xyz|MobileTracker|tracking +kuuvv.com|Cocospy|c2 +kvprojectop.com|MobileTracker|tracking +kvshdi.birxpk.com|MobileTool|c2 +kypler.com|mSpy|c2 +l.freespy1.ml|MobileTracker|tracking +l.freespy1.tk|MobileTracker|tracking +l.hdmodecam.live|MobileTracker|tracking +l.servidor.in|MeuSpy|c2 +laalaslirayeblection.com|MobileTracker|tracking +labrador.ua|Reptilicus|c2 +laced-brass-honeysuckle.glitch.me|MobileTracker|tracking +ladysizi.top|MobileTracker|tracking +lamat-horan.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +lamborghini-s.shop|2021_12_taking_action_against_surveillance_for_hire|c2 +landingpg.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +landingpge.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +laodaoo.oss-ap-southeast-5.aliyuncs.com|MobileTracker|tracking +lasouncherio.com|MobileTracker|tracking +latinoamericareporta.com|2022_04_metas_adversarial_threat_report_q1|c2 +laucass.forumactif.org|Spyone|c2 +lavozamericana.info|201512_PackRAT|c2 +lavozmericana.info|201512_PackRAT|c2 +lb.theonespy.com|TheOneSpy|c2 +lbjg7.com|MobileTracker|tracking +leanwithme.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +lending-online.club|MobileTracker|tracking +lenreuzdeknen.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenreuzdeknen.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenreuzdeknen.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenreuzdeknen.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenruzdeknn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenruzdeknn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenruzdeknn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenruzdeknn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenrzuednken.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenrzuednken.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenrzuednken.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lenrzuednken.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lepamcker.com|MobileTracker|tracking +lernezudeknen.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernezudeknen.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernezudeknen.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernezudeknen.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernezuednkn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernezuednkn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernezuednkn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernezuednkn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernuzdenken.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lernuzdenken.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +leticialittle.pro|2021_04_taking_action_against_hackers_in_palestine|c2 +letmespy.com|LetMeSpy|c2 +letmespy.com|LetMeSpy|tracking +lets-msger.fun|2021_04_taking_action_against_hackers_in_palestine|c2 +leunoon.com|MobileTracker|tracking +lexpress.me|2021_12_taking_action_against_surveillance_for_hire|c2 +lg.luckyforworlds.com|MobileTracker|tracking +lg.requestads.com|MobileTracker|tracking +lg.smardroid.com|MobileTracker|tracking +lgdzbch.com|MobileTracker|tracking +liahkhe.xyz|MobileTracker|tracking +librarycollection.org|2022_04_metas_adversarial_threat_report_q1|c2 +lif0.top|MobileTracker|tracking +lifecircle-223805.firebaseio.com|TrackView|c2 +lifecircle.app|TrackView|tracking +lifeel-scan.com|MobileTracker|tracking +lifestyleshops.net|2021_12_taking_action_against_surveillance_for_hire|c2 +limk.one|2021_12_taking_action_against_surveillance_for_hire|c2 +linda-callaghan.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +link-m.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +link-protection.com|2021_12_taking_action_against_surveillance_for_hire|c2 +linkedinz.me|2022_04_metas_adversarial_threat_report_q1|c2 +linkfollowservice.com|202006_DarkBasin|c2 +linkforwrder.com|202006_DarkBasin|c2 +linkgen.me|2021_07_taking_action_against_hackers_in_iran|c2 +linkit.digital|2021_12_taking_action_against_surveillance_for_hire|c2 +linksbit.com|2021_07_taking_action_against_hackers_in_iran|c2 +linkshortnr.com|202006_DarkBasin|c2 +linkshrtnr22.com|202006_DarkBasin|c2 +linksrtnr.com|202006_DarkBasin|c2 +linktothisa.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +linphone-app.com|2022_08_metas_adversarial_threat_report_q2|c2 +linq.ink|2021_07_taking_action_against_hackers_in_iran|c2 +linuxbasichk.com|202006_DarkBasin|c2 +linuxbasichk1.com|202006_DarkBasin|c2 +linuxbasicmy.com|202006_DarkBasin|c2 +linuxbasicru.com|202006_DarkBasin|c2 +linuxbasicru1.com|202006_DarkBasin|c2 +linuxbasicru3.com|202006_DarkBasin|c2 +linuxbasicsg.com|202006_DarkBasin|c2 +linuxbasicsg1.com|202006_DarkBasin|c2 +linuxhostingplatformuk.com|202006_DarkBasin|c2 +linuxserverfast.com|202006_DarkBasin|c2 +lion20810397.ddns.net|2021_04_taking_action_against_hackers_in_palestine|c2 +lionflix.club|MobileTracker|tracking +liponals.store|2021_12_taking_action_against_surveillance_for_hire|c2 +lippi-doc-portal-frontend.cn-hangzhou.log.aliyuncs.com|MobileTracker|tracking +lisslpagestat.panel.kantartns.lt|MobileTracker|tracking +listen-books.com|2022_04_metas_adversarial_threat_report_q1|c2 +littoralventures.com|MobileTracker|tracking +live-live.vip|MobileTracker|tracking +liveleak.cam|2021_07_taking_action_against_hackers_in_iran|c2 +livetalk.top|MobileTracker|tracking +livetalk.vip|MobileTracker|tracking +liveuamap.live|2021_07_taking_action_against_hackers_in_iran|c2 +livingwithbadkidny.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +llinkedin.net|2021_12_taking_action_against_surveillance_for_hire|c2 +lljmbbk.com|MobileTracker|tracking +lmbbnrhiuj.xyz|MobileTracker|tracking +lnkedin.org|2021_12_taking_action_against_surveillance_for_hire|c2 +lnkshrtnr.com|202006_DarkBasin|c2 +lnruzdeknn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lnruzdeknn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lnruzdeknn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lnruzdeknn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +localadmin.online|2022_04_metas_adversarial_threat_report_q1|c2 +localadmin.ru|2022_04_metas_adversarial_threat_report_q1|c2 +localegem.net|2021_12_taking_action_against_surveillance_for_hire|c2 +localhostinguk.com|202006_DarkBasin|c2 +localserversa.com|202006_DarkBasin|c2 +locatinfind.com|MobileTracker|tracking +locatorprivacy.com|OneLocator|c2 +locatorprivacy.com|OneLocator|tracking +locatorqiafindlocation.com|MobileTracker|tracking +locatorshar.com|MobileTracker|tracking +lockaaocker.com|MobileTracker|tracking +lockheedmartinjobs.us|2021_07_taking_action_against_hackers_in_iran|c2 +lockul.com|MobileTracker|tracking +locxfindxlocx.com|MobileTracker|tracking +log-yoahao.co|2021_04_taking_action_against_hackers_in_palestine|c2 +log-yoheo.info|2021_04_taking_action_against_hackers_in_palestine|c2 +log.adywind.com|MobileTracker|tracking +log.felo.ai|MobileTracker|tracking +log.mobpowertech.com|MobileTracker|tracking +logger.mobi|EasyLogger|tracking +login-live.space|201801_SpyingOnABudget|c2 +login-live.us|201801_SpyingOnABudget|c2 +login-office365.com|201512_PackRAT|c2 +login.evaspy.com|EvaSpy|tracking +login.quanly24h.net|AndroidPolice|c2 +login.spylogs.com|SpyEra|tracking +login.webwatcher.com|AndroidPolice|c2 +loginaccount.email|2021_07_taking_action_against_hackers_in_iran|c2 +loginauths-service.com|202006_DarkBasin|c2 +logincontrolserver.com|202006_DarkBasin|c2 +loginservercheck.com|202006_DarkBasin|c2 +loginservicebasic.com|202006_DarkBasin|c2 +loginservicehelp.com|202006_DarkBasin|c2 +loginservicesmailsonlinesaccounts.com|202006_DarkBasin|c2 +loginserviceunified.com|202006_DarkBasin|c2 +logln-yahoo.com|201801_SpyingOnABudget|c2 +logonexchangeonline.com|2021_07_taking_action_against_hackers_in_iran|c2 +logonmicrosoftonline.com|2021_07_taking_action_against_hackers_in_iran|c2 +logs.supersonic.com|MobileTracker|tracking +logserver39.com|202006_DarkBasin|c2 +logx.optimizely.com|MobileTracker|tracking +lolinha.no-ip.org|201512_PackRAT|c2 +lonakodas.club|2021_04_taking_action_against_hackers_in_palestine|c2 +look-com.org|202006_DarkBasin|c2 +lordblackwood.club|2021_04_taking_action_against_hackers_in_palestine|c2 +lorketstonker.store|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +loverman.net|MobileTrackerFree|c2 +loverman.net|MobileTrackerFree|tracking +loversfinder.xyz|MobileTracker|tracking +lowlight.xyz|MobileTracker|tracking +loyronald.site|2021_04_taking_action_against_hackers_in_palestine|c2 +lp.shoopadoo.com|MobileTracker|tracking +lrneuzdenken.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lrneuzdenken.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lrneuzdenken.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lrneuzdenken.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lrneuzednken.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lrneuzednken.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lrneuzednken.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lrneuzednken.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +lsepeanitor.com|MobileTracker|tracking +lskjirn.life|2021_07_taking_action_against_hackers_in_iran|c2 +ludamec.com|MobileTracker|tracking +ludospeakeasy.club|MobileTracker|tracking +ludospeakv2.club|MobileTracker|tracking +lukoil.in|2022_04_metas_adversarial_threat_report_q1|c2 +luxlinbas.com|202006_DarkBasin|c2 +luxoreditor.club|MobileTracker|tracking +lwvurdsjk.org|MobileTracker|tracking +lxghjoxzns.com|MobileTracker|tracking +lylink.online|2021_12_taking_action_against_surveillance_for_hire|c2 +m-media.thd.cc|mSpy|c2 +m-services.app|mSpy|tracking +m.a-spy.com|RealtimeSpy|c2 +m.asgardtech.ru|GPSTrackerLoki|c2 +m.freespy1.ml|MobileTracker|tracking +m.freespy1.tk|MobileTracker|tracking +m.lifecircle.app|TrackView|c2 +m.pgv4.com|SpyApp|distribution +m.surepointspy.com|HighsterMobile|tracking +m11.slimedit.live|MobileTracker|tracking +m12.slimedit.live|MobileTracker|tracking +m13.slimedit.live|MobileTracker|tracking +magic-smile.co|2021_04_taking_action_against_hackers_in_palestine|c2 +magic-smile.fun|2021_04_taking_action_against_hackers_in_palestine|c2 +magic-store.online|2021_04_taking_action_against_hackers_in_palestine|c2 +magic4smile.com|2021_04_taking_action_against_hackers_in_palestine|c2 +magicchat-1f275.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +magicsmile.fun|2021_04_taking_action_against_hackers_in_palestine|c2 +maglook.eu|MagMonitor|c2 +maglook.eu|MagMonitor|tracking +mail-163.tk|201801_SpyingOnABudget|c2 +mail-account-update.com|201512_PackRAT|c2 +mail-accounts-google.online|201801_SpyingOnABudget|c2 +mail-aol.space|201801_SpyingOnABudget|c2 +mail-attachment-usercontent.space|201801_SpyingOnABudget|c2 +mail-com.org|202006_DarkBasin|c2 +mail-continue.space|201801_SpyingOnABudget|c2 +mail-defend.space|201801_SpyingOnABudget|c2 +mail-defense.space|201801_SpyingOnABudget|c2 +mail-defense.tk|201801_SpyingOnABudget|c2 +mail-doubt.com|201801_SpyingOnABudget|c2 +mail-dsi-go.space|201801_SpyingOnABudget|c2 +mail-epochtimes.space|201801_SpyingOnABudget|c2 +mail-extend.space|201801_SpyingOnABudget|c2 +mail-google-com.gq|201801_SpyingOnABudget|c2 +mail-google-login.blogspot.com|201705_TaintedLeaks|c2 +mail-gooog1e.info|201801_SpyingOnABudget|c2 +mail-guazi.com|201801_SpyingOnABudget|c2 +mail-guazi.space|201801_SpyingOnABudget|c2 +mail-info.space|201801_SpyingOnABudget|c2 +mail-logger.com|202006_DarkBasin|c2 +mail-mg16-yahoo.cf|201801_SpyingOnABudget|c2 +mail-modular.space|201801_SpyingOnABudget|c2 +mail-msrgr.info|202006_DarkBasin|c2 +mail-package.space|201801_SpyingOnABudget|c2 +mail-platform.space|201801_SpyingOnABudget|c2 +mail-protect.space|201801_SpyingOnABudget|c2 +mail-qq.online|201801_SpyingOnABudget|c2 +mail-secret.com|201801_SpyingOnABudget|c2 +mail-secret.info|201801_SpyingOnABudget|c2 +mail-secret.online|201801_SpyingOnABudget|c2 +mail-sina.space|201801_SpyingOnABudget|c2 +mail-status.com|201801_SpyingOnABudget|c2 +mail-youxinpai.com|201801_SpyingOnABudget|c2 +mail.asambleanacional.gob.ec|201512_PackRAT|c2 +mail.google.commail.co|201808_FamiliarFeeling|c2 +mail1.nsogroup.com|201608_NSO_Group|c2 +mail2go.live|2021_07_taking_action_against_hackers_in_iran|c2 +mail2go.online|2021_07_taking_action_against_hackers_in_iran|c2 +mail2u.live|2021_07_taking_action_against_hackers_in_iran|c2 +mailaccountlive.email|2021_07_taking_action_against_hackers_in_iran|c2 +mailaccountlive.support|2021_07_taking_action_against_hackers_in_iran|c2 +mailanalysis.services|201909_MissingLink|c2 +mailannounceservice.com|202006_DarkBasin|c2 +mailapiservice.com|202006_DarkBasin|c2 +mailauthenticatorservice.com|202006_DarkBasin|c2 +mailauthorizationservice.com|202006_DarkBasin|c2 +mailauthservice.com|202006_DarkBasin|c2 +mailauthservice399.com|202006_DarkBasin|c2 +mailchimpservice.com|202006_DarkBasin|c2 +mailcollectorservice.com|202006_DarkBasin|c2 +mailcommunicationservice.com|202006_DarkBasin|c2 +mailcommute.com|202006_DarkBasin|c2 +mailcontactanalysis.online|201909_MissingLink|c2 +maildeliveryagent.com|202006_DarkBasin|c2 +mailer-domain.com|202006_DarkBasin|c2 +mailerdomain56.com|202006_DarkBasin|c2 +mailgatorservice.com|202006_DarkBasin|c2 +mailgooglesign.servehttp.com|201702_NilePhish|c2 +mailhostingsecurenet.com|202006_DarkBasin|c2 +mailingserver938.com|202006_DarkBasin|c2 +maillinkservice.com|202006_DarkBasin|c2 +mailmarknotes.com|202006_DarkBasin|c2 +mailmarkservice.com|202006_DarkBasin|c2 +mailnotes.online|201909_MissingLink|c2 +mailpostsecure.com|202006_DarkBasin|c2 +mailpostsecureservice.com|202006_DarkBasin|c2 +mailpublisher.live|2021_07_taking_action_against_hackers_in_iran|c2 +mailrockservice.com|202006_DarkBasin|c2 +mails.center|2021_07_taking_action_against_hackers_in_iran|c2 +mailsecurehost.com|202006_DarkBasin|c2 +mailsecureservers.com|202006_DarkBasin|c2 +mailserver39.com|202006_DarkBasin|c2 +mailserver89.com|202006_DarkBasin|c2 +mailserver89.net|202006_DarkBasin|c2 +mailserver89.org|202006_DarkBasin|c2 +mailserverdirect3994.com|202006_DarkBasin|c2 +mailserverenterprise.com|202006_DarkBasin|c2 +mailservereurope.com|202006_DarkBasin|c2 +mailserveroutlook.com|202006_DarkBasin|c2 +mailserverru2099.com|202006_DarkBasin|c2 +mailservershare.com|202006_DarkBasin|c2 +mailserveruk.com|202006_DarkBasin|c2 +mailserveruk89.com|202006_DarkBasin|c2 +mailserveruk89.net|202006_DarkBasin|c2 +mailserveruk89.org|202006_DarkBasin|c2 +mailserviceloginonline.com|202006_DarkBasin|c2 +mailtickr.com|202006_DarkBasin|c2 +mailtransferserver.com|202006_DarkBasin|c2 +main.protico.io|MobileTracker|tracking +makeitshort.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +mangasiso.top|MobileTracker|tracking +manoraonline.net|201608_NSO_Group|c2 +margarita-smith.host|2021_04_taking_action_against_hackers_in_palestine|c2 +market.vinam.me|2022_04_metas_adversarial_threat_report_q1|c2 +marketinfo.tips|MobileTracker|tracking +marketing.tllms.com|MobileTracker|tracking +martpolocator.com|MobileTracker|tracking +marty-colvard.top|2021_04_taking_action_against_hackers_in_palestine|c2 +marwapetersson.info|2021_04_taking_action_against_hackers_in_palestine|c2 +mastergatevpn.com|2022_04_metas_adversarial_threat_report_q1|c2 +matchos.price.com|MobileTracker|tracking +maxlaboratories.com|202006_DarkBasin|c2 +maxxspy.com|HelloSpy|c2 +maxxspy.com|HelloSpy|tracking +mbill.app|mSpy|tracking +mblk1.com|202006_DarkBasin|c2 +mcloud-api.thd.cc|mSpy|c2 +mcontrolapp.com|mSpy|tracking +md-news-direct.com|2021_12_taking_action_against_surveillance_for_hire|c2 +mda.kcpro.ga|MobileTracker|tracking +measurelib.com|MobileTracker|tracking +measurementsys.com|MobileTracker|tracking +media-sync-a.copy9.com|TheTruthSpy|c2 +media-sync-a.exactspy.com|TheTruthSpy|c2 +media-sync-a.fonetracker.com|TheTruthSpy|c2 +media-sync-a.ispyoo.com|TheTruthSpy|c2 +media-sync-a.thetruthspy.com|TheTruthSpy|c2 +media-sync-a100.fonetracker.com|TheTruthSpy|c2 +media-sync-a100.thetruthspy.com|TheTruthSpy|c2 +media-sync-a600.fonetracker.com|TheTruthSpy|c2 +media-sync-a621.fonetracker.com|TheTruthSpy|c2 +media-sync-a696.fonetracker.com|TheTruthSpy|c2 +media-sync-a710.fonetracker.com|TheTruthSpy|c2 +media-sync-a740.thetruthspy.com|TheTruthSpy|c2 +media-sync-a743.thetruthspy.com|TheTruthSpy|c2 +media-sync-a746.thetruthspy.com|TheTruthSpy|c2 +media-sync-a747.thetruthspy.com|TheTruthSpy|c2 +media-sync-a748.thetruthspy.com|TheTruthSpy|c2 +media-sync-a749.thetruthspy.com|TheTruthSpy|c2 +media-sync-a780.fonetracker.com|TheTruthSpy|c2 +media-sync-a785.fonetracker.com|TheTruthSpy|c2 +media-sync-a7xx.thetruthspy.com|TheTruthSpy|c2 +media-sync-a810.thetruthspy.com|TheTruthSpy|c2 +media-sync-a820.thetruthspy.com|TheTruthSpy|c2 +media-sync-a825.thetruthspy.com|TheTruthSpy|c2 +media-sync-a830.thetruthspy.com|TheTruthSpy|c2 +media-sync-a835.thetruthspy.com|TheTruthSpy|c2 +media-sync-a895.thetruthspy.com|TheTruthSpy|c2 +media-sync-a8xx.thetruthspy.com|TheTruthSpy|c2 +media-sync-a910.thetruthspy.com|TheTruthSpy|c2 +media-sync-a915.thetruthspy.com|TheTruthSpy|c2 +media-sync-a920.thetruthspy.com|TheTruthSpy|c2 +media-sync-a925.thetruthspy.com|TheTruthSpy|c2 +media-sync-a930.thetruthspy.com|TheTruthSpy|c2 +media-sync-a935.thetruthspy.com|TheTruthSpy|c2 +media-sync-a940.thetruthspy.com|TheTruthSpy|c2 +media-sync-a941.thetruthspy.com|TheTruthSpy|c2 +media-sync-a942.thetruthspy.com|TheTruthSpy|c2 +media-sync-a943.thetruthspy.com|TheTruthSpy|c2 +media-sync-a944.thetruthspy.com|TheTruthSpy|c2 +media-sync-a945.thetruthspy.com|TheTruthSpy|c2 +media-sync-a946.thetruthspy.com|TheTruthSpy|c2 +media-sync-a947.thetruthspy.com|TheTruthSpy|c2 +media-sync.systemserviceprovider.com|TheTruthSpy|c2 +media.thetruthspy.com|TheTruthSpy|c2 +medizz.co|2022_08_metas_adversarial_threat_report_q2|c2 +meetingonlinechat.club|MobileTracker|tracking +melissa-garcia.site|2021_04_taking_action_against_hackers_in_palestine|c2 +melissa-gonzalez.com|2021_04_taking_action_against_hackers_in_palestine|c2 +meskereme.net|201712_Cyberbit|c2 +mespiao.com.br|SpyApp|tracking +message-tracker-98822.firebaseio.com|TrackMyPhones|c2 +messages01.smstracker.com|CallSMSTracker|c2 +messages02.smstracker.com|CallSMSTracker|c2 +messengers.video|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +mesvr.com|201512_PackRAT|c2 +metacafe.live|2021_07_taking_action_against_hackers_in_iran|c2 +meuspy.com|MeuSpy|tracking +mflx.biz|FlexiSpy|c2 +mg-mail-yahoo.us|201801_SpyingOnABudget|c2 +mg-spyzie.oss-us-west-1.aliyuncs.com|Cocospy|c2 +mg.sdkbalance.com|MobileTracker|tracking +mgo.kcpro.ga|MobileTracker|tracking +mgoogle.us|201512_PackRAT|c2 +mgrsr.com|202006_DarkBasin|c2 +mi.thd.cc|mSpy|c2 +micorsoftonilne.com|2021_07_taking_action_against_hackers_in_iran|c2 +micorsoftonline.website|2021_07_taking_action_against_hackers_in_iran|c2 +micorsoftonline.xyz|2021_07_taking_action_against_hackers_in_iran|c2 +microsoft-inc.us|201801_SpyingOnABudget|c2 +microsoftcdn.co|2022_04_metas_adversarial_threat_report_q1|c2 +microsoftdefender.info|2022_04_metas_adversarial_threat_report_q1|c2 +microsoftedgesh.info|2022_04_metas_adversarial_threat_report_q1|c2 +microsoftoffice.systems|2021_07_taking_action_against_hackers_in_iran|c2 +microsoftonilne.cloud|2021_07_taking_action_against_hackers_in_iran|c2 +microtracker-1ca43.firebaseio.com|TheTruthSpy|c2 +mideast-today.com|201810_TheKingdomCameToCanada|c2 +mideasthiring.com|2022_04_metas_adversarial_threat_report_q1|c2 +mifcbook.link|2021_12_taking_action_against_surveillance_for_hire|c2 +mikkelbourke.pro|2021_04_taking_action_against_hackers_in_palestine|c2 +mimestyle.xyz|MobileTracker|tracking +mimeversion.top|MobileTracker|tracking +mimi18s.top|MobileTracker|tracking +mimibox.top|MobileTracker|tracking +mimicwt.net|MobileTracker|tracking +mimimsg.net|MobileTracker|tracking +miniiosapps.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +ministrynewschannel.com|201605_Stealth_Falcon|c2 +ministrynewsinfo.com|201605_Stealth_Falcon|c2 +minrsrvr.com|202006_DarkBasin|c2 +minspy.com|Cocospy|tracking +mintrack.vip|Cocospy|c2 +mirrorscreencasttvv.com|MobileTracker|tracking +mispace.cam|2021_07_taking_action_against_hackers_in_iran|c2 +misran.org|2021_03_taking_action_against_hackers_in_china|c2 +misran.org|MobileTracker|tracking +mitube1.link|2021_12_taking_action_against_surveillance_for_hire|c2 +mix-store.online|2021_04_taking_action_against_hackers_in_palestine|c2 +mkid.app|mSpy|tracking +mkidctrl.app|mSpy|tracking +mkidsecure.com|mSpy|tracking +mlinks.ws|2021_12_taking_action_against_surveillance_for_hire|c2 +mlite-app.livekit.cloud|mSpy|c2 +mlite-app.thd.cc|mSpy|c2 +mlite-socket.thd.cc|mSpy|c2 +mliteapp.alter757.info|mSpy|c2 +mliteapp.com|mSpy|tracking +mmbox.top|MobileTracker|tracking +mnesytrlatr.com|MobileTracker|tracking +mnfbodivbv.com|MobileTracker|tracking +mnrsrvrer.com|202006_DarkBasin|c2 +mob.eurotrans.kz|Reptilicus|c2 +mobeespy.com|HelloSpy|tracking +mobellspy.com|HelloSpy|tracking +mobi22.com|Mrecorder|c2 +mobidad.app|TheTruthSpy|tracking +mobiispy.com|HelloSpy|c2 +mobiispy.com|HelloSpy|tracking +mobil-kem.com|EasyPhoneTrack|tracking +mobil-kem.com|SpyPhoneApp|c2 +mobile-collector.newrelic.com|MobileTracker|tracking +mobile-crash.newrelic.com|MobileTracker|tracking +mobile-gw.thd.cc|mSpy|c2 +mobile-remote-tracker.com|HelloSpy|tracking +mobile-sdk-api.intercom.io|MobileTracker|tracking +mobile-spy.co.za|Intertel|tracking +mobile-tracker-data.com|MobileTrackerFree|c2 +mobile-tracker-family.com|MobileTrackerFree|tracking +mobile-tracker-free.be|MobileTrackerFree|tracking +mobile-tracker-free.biz|MobileTrackerFree|tracking +mobile-tracker-free.com|MobileTrackerFree|c2 +mobile-tracker-free.com|MobileTrackerFree|tracking +mobile-tracker-free.co|MobileTrackerFree|tracking +mobile-tracker-free.de|MobileTrackerFree|tracking +mobile-tracker-free.es|MobileTrackerFree|tracking +mobile-tracker-free.eu|MobileTrackerFree|tracking +mobile-tracker-free.fr|MobileTrackerFree|tracking +mobile-tracker-free.info|MobileTrackerFree|tracking +mobile-tracker-free.ir|MobileTrackerFree|tracking +mobile-tracker-free.it|MobileTrackerFree|tracking +mobile-tracker-free.me|MobileTrackerFree|tracking +mobile-tracker-free.mobi|MobileTrackerFree|tracking +mobile-tracker-free.name|MobileTrackerFree|tracking +mobile-tracker-free.net|MobileTrackerFree|tracking +mobile-tracker-free.org|MobileTrackerFree|tracking +mobile-tracker.mobi|MobileTrackerFree|tracking +mobile.ams2.measurelib.com|MobileTracker|tracking +mobile.fra2.measurelib.com|MobileTracker|tracking +mobile.measurelib.com|MobileTracker|tracking +mobileapps.com.my|FlexiSpy|tracking +mobilebackup.biz|AndroidPolice|tracking +mobilefonex.com|FlexiSpy|tracking +mobileinnova.net|OwnSpy|tracking +mobilenannylogs.com|PhoneSheriff|c2 +mobilerecorder-1277.firebaseio.com|Mrecorder|c2 +mobilerecorder24.com|Mrecorder|tracking +mobilespy.at|AndroidPolice|tracking +mobilespy.io|Fenced|tracking +mobilespyblog.com|HelloSpy|tracking +mobilespyfree.net|AppSpy|tracking +mobilespyonline.com|TheTruthSpy|tracking +mobiletool.ru|MobileTool|c2 +mobiletool.ru|MobileTool|tracking +mobispy.net|MobiSpy|tracking +mobistealth.com|MobiStealth|tracking +mobitrackapps.com|MobileTrackerFree|tracking +mobleingsder.com|MobileTracker|tracking +mobnetlink1.com|2021_12_taking_action_against_surveillance_for_hire|c2 +mobnetlink2.com|2021_12_taking_action_against_surveillance_for_hire|c2 +mobnetlink3.com|2021_12_taking_action_against_surveillance_for_hire|c2 +mocospy.com|MocoSpy|tracking +moggfelicio.info|2021_04_taking_action_against_hackers_in_palestine|c2 +moi-gov.serveftp.com|201702_NilePhish|c2 +moi-pna.pw|2021_04_taking_action_against_hackers_in_palestine|c2 +momomsg.top|MobileTracker|tracking +monitor-android.android-monitor.ru|AndroidPolice|c2 +monitor-android.android-monitor.ru|AndroidPolice|tracking +monitor-ua.com|2022_04_metas_adversarial_threat_report_q1|c2 +monitor-ultra.com|MonitorUltra|c2 +monitorecell.com.br|MeuSpy|tracking +monitorminor.com.tr|AndroidPolice|tracking +moone-b9497.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +moone-b9497.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +movimientoanticorreista.com|201512_PackRAT|c2 +mozillaupdate.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +mpotect.app|mSpy|tracking +mrec24.com|Mrecorder|c2 +mrecorder.com|Mrecorder|tracking +mrgrhr.com|202006_DarkBasin|c2 +mrswd.wo87sf.com|MobileTool|c2 +ms-cdn-88.com|201803_BadTraffic|c2 +msafe.xyz|AndroidPolice|c2 +msafety.app|mSpy|tracking +msap.services|201909_MissingLink|c2 +msas.ws|2021_12_taking_action_against_surveillance_for_hire|c2 +msecureapp.com|mSpy|tracking +msgrdrg.com|202006_DarkBasin|c2 +msol.live|2021_07_taking_action_against_hackers_in_iran|c2 +msonline.live|2021_07_taking_action_against_hackers_in_iran|c2 +msp-control.app|mSpy|tracking +mspkid.app|mSpy|tracking +mspy.alter757.info|mSpy|c2 +mspy.co.il|mSpy|tracking +mspy.co.uk|mSpy|tracking +mspy.com.ar|mSpy|tracking +mspy.com.br|mSpy|tracking +mspy.com.cn|mSpy|tracking +mspy.com.es|mSpy|tracking +mspy.com|mSpy|tracking +mspy.fr|mSpy|tracking +mspy.in|mSpy|tracking +mspy.it|mSpy|tracking +mspy.jp|mSpy|tracking +mspy.net|mSpy|tracking +mspy.nl|mSpy|tracking +mspy.support|mSpy|tracking +mspyitaly.com|AndroidPolice|tracking +mspylite.com|mSpy|tracking +mspymax.com|HelloSpy|tracking +mspyonline.com|mSpy|c2 +mspyonline.com|mSpy|tracking +mspyplus.com|mSpy|tracking +mspytrackercom.alter757.info|mSpy|c2 +msrdr.com|202006_DarkBasin|c2 +msrfrgr.com|202006_DarkBasin|c2 +msrvrgeh.com|202006_DarkBasin|c2 +msrvrgh.com|202006_DarkBasin|c2 +msrwr.com|202006_DarkBasin|c2 +mssecurityaccount.online|2021_07_taking_action_against_hackers_in_iran|c2 +mt2-sdp4.mt-2.co|MobileTracker|tracking +mt5vsuf1.net|MobileTracker|tracking +mtechn.zendesk.com|mSpy|c2 +mtf.re|MobileTrackerFree|c2 +mtm1nwmx-api.findgravy.com|MobileTracker|tracking +mtoolapp.biz|MobileTool|c2 +mtoolapp.biz|MobileTool|tracking +mtoolapp.net|MobileTool|c2 +mtoolapp.net|MobileTool|tracking +mtracker.fortess.net|WiseMo|c2 +multilingualbackend.azurewebsites.net|MobileTracker|tracking +muslim-world.info|201810_TheKingdomCameToCanada|c2 +muslimasauda.com|MobileTracker|tracking +mvrsrvrer.com|202006_DarkBasin|c2 +mxout.net|MobileTracker|tracking +mxspy.com|TheTruthSpy|c2 +mxspy.com|TheTruthSpy|tracking +my-office.cf|201801_SpyingOnABudget|c2 +my-player.vip|MobileTracker|tracking +my-spy-a9c92.firebaseio.com|MySpyApps|c2 +my.a-spy.com|RealtimeSpy|c2 +my.aispyer.com|AiSpyer|c2 +my.androidmonitor.com|AndroidMonitor|tracking +my.copy9.com|TheTruthSpy|c2 +my.hws.icu|Hoverwatch|tracking +my.ispyoo.com|TheTruthSpy|c2 +my.jjspy.com|RealtimeSpy|c2 +my.kidsecured.com|mSpy|c2 +my.mobiletool.ru|MobileTool|c2 +my.mobispy.net|MobiSpy|c2 +my.mrec24.com|Mrecorder|c2 +my.mspyonline.com|mSpy|c2 +my.mtoolapp.net|MobileTool|c2 +my.nexspy.com|AndroidPolice|c2 +my.phonsee.com|mSpy|c2 +my.securechildren.online|mSpy|c2 +my.snoopza.com|Snoopza|c2 +my.spylix.com|AndroidPolice|c2 +my.spynger.net|Spynger|c2 +my.spyzie.com|Cocospy|c2 +my.thespyapp.com|TheTruthSpy|c2 +my.thetruthspy.com|TheTruthSpy|c2 +my2.snoopza.com|Snoopza|c2 +myaccount-mail.com|201801_SpyingOnABudget|c2 +myaccount.servehttp.com|201702_NilePhish|c2 +myaccounts-google.info|201801_SpyingOnABudget|c2 +myaccounts-google.online|201801_SpyingOnABudget|c2 +myaccounts-google.space|201801_SpyingOnABudget|c2 +myaccounts-google.tk|201801_SpyingOnABudget|c2 +myaccounts-gooog1e.com|201801_SpyingOnABudget|c2 +myaccounts-gooog1e.space|201801_SpyingOnABudget|c2 +myaccounts-mail.com|201801_SpyingOnABudget|c2 +myaccountsgoogle.info|201801_SpyingOnABudget|c2 +myaddress.today|MobileTracker|tracking +myapp-gooog1e.com|201801_SpyingOnABudget|c2 +myappmobile-537f7.firebaseio.com|MobileTrackerFree|c2 +mycellspy.com|AndroidPolice|tracking +mychattranslator.club|MobileTracker|tracking +mycloud.wisemo.com|WiseMo|c2 +mycloud1.wisemo.com|WiseMo|c2 +mycoffeeshop.shop|2021_12_taking_action_against_surveillance_for_hire|c2 +mydomainxyz.xyz|2021_07_taking_action_against_hackers_in_iran|c2 +mydrive-accounts-google.ml|201801_SpyingOnABudget|c2 +mydrive-google.asia|201801_SpyingOnABudget|c2 +mydrive-google.com|201801_SpyingOnABudget|c2 +mydrive-google.online|201801_SpyingOnABudget|c2 +mydrive-google.space|201801_SpyingOnABudget|c2 +mydrive-mail.asia|201801_SpyingOnABudget|c2 +mydwnd.com|MobileTracker|tracking +mydwnd.com|XNSpy|c2 +myfacetik.cf|202006_DarkBasin|c2 +myfcbk.net|2021_12_taking_action_against_surveillance_for_hire|c2 +myfonemate.com|mSpy|tracking +mylinbas.com|202006_DarkBasin|c2 +mylocatorplus.club|MobileTracker|tracking +mymensaje-sms.com|201706_RecklessExploit|c2 +myspyapps.com|MySpyApps|tracking +mytrips.quest|2021_12_taking_action_against_surveillance_for_hire|c2 +myutbe.net|2021_12_taking_action_against_surveillance_for_hire|c2 +mywebredirect.info|202006_DarkBasin|c2 +mywebsitevpstest.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +mz-vodacom.info|201608_NSO_Group|c2 +mzanzispy.co.za|MzanziSpy|tracking +mzpgfh.uhabq9.com|MobileTool|c2 +n.appspool.net|MobileTracker|tracking +n.freespy1.ml|MobileTracker|tracking +n.freespy1.tk|MobileTracker|tracking +n.servidor.in|MeuSpy|c2 +n.systemlog.me|MobileTracker|tracking +n.umobix.com|uMobix|tracking +n1.flyermobi.com|MobileTracker|tracking +n1.lavozamericana.info|201512_PackRAT|c2 +n1.login-office365.com|201512_PackRAT|c2 +n1.support-java.com|201512_PackRAT|c2 +n1.update-outlook.info|201512_PackRAT|c2 +n2.login-office365.com|201512_PackRAT|c2 +n3.pancaliente.info|201512_PackRAT|c2 +n4.pancaliente.info|201512_PackRAT|c2 +n47n.oss-ap-southeast-5.aliyuncs.com|MobileTracker|tracking +n6sm2m.celltracker.io|MobileTrackerFree|c2 +nabd.site|2021_12_taking_action_against_surveillance_for_hire|c2 +nabde.app|2021_12_taking_action_against_surveillance_for_hire|c2 +nachat-152615.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +nachat-152615.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +nameserver3476.com|202006_DarkBasin|c2 +nameserverredirect.com|202006_DarkBasin|c2 +nassosblog.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +nation-news.com|201608_NSO_Group|c2 +nav.telematicsdirect.com|MobileTracker|tracking +nd-aktuell.co|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +nd-aktuell.net|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +nd-aktuell.pro|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ndagri.com|MobileTracker|tracking +neatspy.com|Cocospy|tracking +neatspy.vip|Cocospy|c2 +nemaeovies.com|MobileTracker|tracking +nemospy.com|AndroidPolice|c2 +nemospy.com|AndroidPolice|tracking +nemshi-news.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +nemshi.net|2021_12_taking_action_against_surveillance_for_hire|c2 +neospy.net|NeoSpy|tracking +neospy.pro|NeoSpy|tracking +neospy.tech|NeoSpy|tracking +net.cleverjp.com|MobileTracker|tracking +net.etrality.com|MobileTracker|tracking +net.hahamobi.com|MobileTracker|tracking +net.salmonads.com|MobileTracker|tracking +netcomserviceonline.com|202006_DarkBasin|c2 +netgeoserversg.com|202006_DarkBasin|c2 +netmapservice.com|202006_DarkBasin|c2 +netsecureemailservice.com|202006_DarkBasin|c2 +netsecurehostingmy.com|202006_DarkBasin|c2 +netsecuremailhosting.com|202006_DarkBasin|c2 +netsecureserver399.com|202006_DarkBasin|c2 +netserviceru.com|202006_DarkBasin|c2 +netspy-7b8ec.firebaseio.com|NetSpy|c2 +netspy.net|NetSpy|tracking +network190.com|201706_RecklessExploit|c2 +networkcartography.com|MobileTracker|tracking +networkcartography.net|MobileTracker|tracking +networkcartography.org|MobileTracker|tracking +networkenterprise.net|2021_12_taking_action_against_surveillance_for_hire|c2 +networkmiddleast.net|2021_04_taking_action_against_hackers_in_palestine|c2 +networkshareserver.com|202006_DarkBasin|c2 +neuigkeitenfursie.tech|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +new.androidlost.com|AndroidLost|c2 +newdemo.snoopza.com|Snoopza|tracking +newdulcina.com|MobileTracker|tracking +news-fbcb4.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +news-fbcb4.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +news-gazette.info|201810_TheKingdomCameToCanada|c2 +news-smtp2go.email|2021_07_taking_action_against_hackers_in_iran|c2 +news.firewall-gateway.com|201603_Shifting_Tactics|c2 +newsbeast.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +newserver39.com|202006_DarkBasin|c2 +newsl.ink|2021_07_taking_action_against_hackers_in_iran|c2 +newslive2.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +newtarrifs.net|201608_NSO_Group|c2 +newyorkingsite.com|2021_03_taking_action_against_hackers_in_china|c2 +newyorkingsite.com|MobileTracker|tracking +newzeto.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +newzgroup.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +nexspy.com|AndroidPolice|tracking +nextialive.roimaster.site|MobileTracker|tracking +nfrmg1y.xyz|MobileTracker|tracking +ngc77.com|HighsterMobile|c2 +nhansudaihoi13.org|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +niceonase.com|2021_12_taking_action_against_surveillance_for_hire|c2 +niceonesa.net|2021_12_taking_action_against_surveillance_for_hire|c2 +nicoledotson.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +nigeriaoilleaks.com|202006_DarkBasin|c2 +nikjol.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +nimbus.bitdefender.net|MobileTracker|tracking +nineth03.oss-ap-southeast-5.aliyuncs.com|MobileTracker|tracking +nissan.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +nl.refog.com|Hoverwatch|tracking +no.response.delivery.es|201512_PackRAT|c2 +node-api.theonespy.com|TheOneSpy|c2 +node1.theonespy.com|TheOneSpy|c2 +node2.theonespy.com|TheOneSpy|c2 +node3.theonespy.com|TheOneSpy|c2 +node4.theonespy.com|TheOneSpy|c2 +node5.theonespy.com|TheOneSpy|c2 +nodejs.spyhuman.com|SpyHuman|c2 +nodeserver50.com|202006_DarkBasin|c2 +norayowell.info|2021_04_taking_action_against_hackers_in_palestine|c2 +noreplay.email|2021_07_taking_action_against_hackers_in_iran|c2 +notification-team.servehttp.com|201702_NilePhish|c2 +notifications-sec.com|MobileTracker|tracking +notifications.wa-info.com|MobileTracker|tracking +noujx.s9gxw8.com|MobileTool|c2 +nouvelles247.com|201810_TheKingdomCameToCanada|c2 +novafile.tk|2021_07_taking_action_against_hackers_in_iran|c2 +novasdk.oss-cn-beijing.aliyuncs.com|MobileTracker|tracking +novosti.bid|2021_12_taking_action_against_surveillance_for_hire|c2 +nrgrsrvrer.com|202006_DarkBasin|c2 +ns.update-outlook.info|201512_PackRAT|c2 +ns1.deyrep.com|201512_PackRAT|c2 +ns1.hostinger.ru|201512_PackRAT|c2 +ns1.ukraine.com.ua|201512_PackRAT|c2 +ns2.deyrep.com|201512_PackRAT|c2 +nsoqa.com|201608_NSO_Group|c2 +nwluoodzct.xyz|MobileTracker|tracking +nwzhmwux-api.findgravy.com|MobileTracker|tracking +o.freespy1.ml|MobileTracker|tracking +o.freespy1.tk|MobileTracker|tracking +observer.back4app.io|Observer|c2 +ocheyhv.xyz|MobileTracker|tracking +offebnarugn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offebnarugn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offebnarugn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offebnarugn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offebnurgn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offebnurgn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offebnurgn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offebnurgn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbarugn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbarugn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbarugn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbarugn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbaurgn.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbaurgn.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbaurgn.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offenbaurgn.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +office-shop.me|2022_04_metas_adversarial_threat_report_q1|c2 +office.hw.cab|Hoverwatch|c2 +offinemaining.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaining.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaining.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaining.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaining.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemainung.info|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemainung.live|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaiunng.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaiunng.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaiunng.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemanung.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemanung.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemanung.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemaunng.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offineminung.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offineminung.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offineminung.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offineminung.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offineminung.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemiunng.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemiunng.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemizung.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemizung.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemnung.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemnung.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemunng.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offinemunng.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +offroaderssurvive.club|MobileTracker|tracking +offshorecompanyllp.com|202006_DarkBasin|c2 +offshoretoursntravels.com|202006_DarkBasin|c2 +ogymoggy.firebaseio.com|TheOneSpy|c2 +ogymogy.com|TheOneSpy|tracking +oilgy.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +okjojihgv.com|MobileTracker|tracking +olexegy.com|2021_12_taking_action_against_surveillance_for_hire|c2 +olimob.net|MobileTracker|tracking +olurdaolurdediler.shop|MobileTrackerFree|c2 +olxeg.com|2021_12_taking_action_against_surveillance_for_hire|c2 +omanreal.net|2021_12_taking_action_against_surveillance_for_hire|c2 +omeega.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +onarchbylap.com|MobileTracker|tracking +oncamera.top|MobileTracker|tracking +oncamera.vip|MobileTracker|tracking +oncast.top|MobileTracker|tracking +ondemand.pushthisurl.com|202006_DarkBasin|c2 +onedrivelive.me|2022_04_metas_adversarial_threat_report_q1|c2 +onedriveupdate.net|2022_04_metas_adversarial_threat_report_q1|c2 +onelink.me|MobileTracker|tracking +onelnk.com|MobileTracker|tracking +onelocator.com|OneLocator|tracking +onemonitar.com|OneSpy|tracking +onespy-in-196211.firebaseio.com|OneSpy|c2 +onespy-in-d.s3.eu-central-1.amazonaws.com|OneSpy|distribution +onespy.com|OneSpy|tracking +onetouchsecurities.com|AbsoluTrack|tracking +online-audible.com|2022_04_metas_adversarial_threat_report_q1|c2 +online-chess.live|2022_04_metas_adversarial_threat_report_q1|c2 +onlinecontrol.app|mSpy|tracking +onlinefundb.com|TrackingSmartphone|c2 +onlinefundb.com|TrackingSmartphone|tracking +onlineloginportal.com|202006_DarkBasin|c2 +onlineloginportalhk.com|202006_DarkBasin|c2 +onlineloginportalmy.com|202006_DarkBasin|c2 +onlineloginportalsg.com|202006_DarkBasin|c2 +onlineloginserviceeu.com|202006_DarkBasin|c2 +onlineloginserviceuk.com|202006_DarkBasin|c2 +onlineloginserviceusa.com|202006_DarkBasin|c2 +onlinemusicstoreuk.com|202006_DarkBasin|c2 +onlinenetworkinghelp.com|202006_DarkBasin|c2 +onlinesecure.app|mSpy|tracking +onlineservices.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +onpointcorp.co|2021_07_taking_action_against_hackers_in_iran|c2 +ooredoodeals.com|201608_NSO_Group|c2 +openserverholland.com|202006_DarkBasin|c2 +opensourcecontext.com|MobileTracker|tracking +opispy.net|HelloSpy|tracking +oppleman.org|MobileTracker|tracking +optimizedimghosting.com|201605_Stealth_Falcon|c2 +optionalblogging.com|202006_DarkBasin|c2 +optionalblogginges.com|202006_DarkBasin|c2 +optionalbloggingeu.com|202006_DarkBasin|c2 +optionalblogginguk.com|202006_DarkBasin|c2 +optionaldesigners.com|202006_DarkBasin|c2 +optionsothego.com|202006_DarkBasin|c2 +orangegypt.co|2021_12_taking_action_against_surveillance_for_hire|c2 +orchomenos.news|2021_12_taking_action_against_surveillance_for_hire|c2 +order.80876dd5.shop|MobileTracker|tracking +oroscopemestry.com|MobileTracker|tracking +ortn13der.xyz|MobileTracker|tracking +oscontext.com|MobileTracker|tracking +oso.kcpro.ga|MobileTracker|tracking +ospocatracker.com|MobileTracker|tracking +otaupdatesios.com|2021_12_taking_action_against_surveillance_for_hire|c2 +outcome-ssp.supersonicads.com|MobileTracker|tracking +outline.abunddhighett.com|MobileTracker|tracking +outline.truecaller.com|MobileTracker|tracking +outlook-login.com|201801_SpyingOnABudget|c2 +outlook-services.com|2021_07_taking_action_against_hackers_in_iran|c2 +outlookde.live|2022_04_metas_adversarial_threat_report_q1|c2 +outlookdelivery.com|2022_04_metas_adversarial_threat_report_q1|c2 +outlookservices.live|2021_07_taking_action_against_hackers_in_iran|c2 +outlookservices.me|2021_07_taking_action_against_hackers_in_iran|c2 +outube.live|2021_07_taking_action_against_hackers_in_iran|c2 +overingtonray.info|2021_04_taking_action_against_hackers_in_palestine|c2 +ownspy.com|OwnSpy|tracking +ownspy.es|OwnSpy|tracking +oxy.nexspy.com|AndroidPolice|tracking +p.baoyueai.com|MobileTracker|tracking +p.freespy1.ml|MobileTracker|tracking +p.freespy1.tk|MobileTracker|tracking +p.webengage.com|MobileTracker|tracking +package.mrec24.com|Mrecorder|c2 +package2.mrec24.com|Mrecorder|c2 +pageredirectservice.com|202006_DarkBasin|c2 +pageserver299.com|202006_DarkBasin|c2 +pageserver77.com|202006_DarkBasin|c2 +pageserverru.com|202006_DarkBasin|c2 +palpolice.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +pancaliente.info|201512_PackRAT|c2 +panel.clevguard.com|ClevGuard|tracking +panel.spy24.net|Spy24|c2 +panel.webdetetive.com.br|OwnSpy|tracking +panel24.org|Spy24|c2 +panspy-1.oss-us-west-1.aliyuncs.com|PanSpy|c2 +panspy.com|PanSpy|c2 +panspy.com|PanSpy|tracking +panspy.me|PanSpy|c2 +panspy.me|PanSpy|distribution +paok-24.com|2021_12_taking_action_against_surveillance_for_hire|c2 +parent-msp.app|mSpy|tracking +parser.cufinder.io|MobileTracker|tracking +partner.securspy.com|SpyApp|tracking +pastepast.net|2021_12_taking_action_against_surveillance_for_hire|c2 +pathanalyzer.com|MobileTracker|tracking +pathanalyzerpro.com|MobileTracker|tracking +paulycongalton.pro|2021_04_taking_action_against_hackers_in_palestine|c2 +pc.backupsoft.eu|AndroidPolice|c2 +pc.brunoespiao.com.br|BrunoEspiao|c2 +pc.foxspy.com.br|EspiaoAndroid|c2 +pc.freespyapp.com|AndroidPolice|c2 +pc.freespyapp.com|AndroidPolice|tracking +pc.myswiftmobilespy.co.za|SwiftMobileSpy|tracking +pc.selfspy.com|AndroidPolice|c2 +pc.selfspy.com|AndroidPolice|tracking +pc.spykontrol.com|AndroidPolice|c2 +pc.spyone.pl|Spyone|c2 +pc.viptelefonprogrami.com|AndroidPolice|c2 +pc1.brunoespiao.com.br|BrunoEspiao|c2 +pctattletale.com|pcTattletale|c2 +pctattletalev2.s3.amazonaws.com|pcTattletale|c2 +pdfviewer.app|2021_12_taking_action_against_surveillance_for_hire|c2 +pemuti.com|MobileTracker|tracking +perargero.com|MobileTracker|tracking +personaldoaminru.com|202006_DarkBasin|c2 +personaldoaminsg.com|202006_DarkBasin|c2 +pflix.camdvr.org|2022_08_metas_adversarial_threat_report_q2|c2 +pfsense02-01.is-61194.teragence.net|MobileTracker|tracking +pgv4.com|SpyApp|c2 +pgv4.com|SpyApp|tracking +pharaohsadventure.club|MobileTracker|tracking +phone-backup-service.firebaseio.com|RealtimeSpy|c2 +phone-spy.com|PhoneSpy|tracking +phoneboster.com|MobileTracker|tracking +phonecallerscreen.com|MobileTracker|tracking +phonecontrolapp-e2c64.firebaseio.com|Reptilicus|c2 +phonecontrolblockspamcalls.com|MobileTracker|tracking +phonedata.me|Cocospy|c2 +phonemonitor.com|PhoneMonitor|tracking +phoneparental.com|TheTruthSpy|tracking +phonesheriff.com|PhoneSheriff|c2 +phonesheriff.com|PhoneSheriff|tracking +phonespector-b2f13.firebaseio.com|HighsterMobile|c2 +phonespector.com|HighsterMobile|c2 +phonespector.com|HighsterMobile|tracking +phonespying.com|TheTruthSpy|c2 +phonespying.com|TheTruthSpy|tracking +phonetrack.com|EasyPhoneTrack|c2 +phonetracker.com|SpyphoneMobileTracker|c2 +phonetracker.com|SpyphoneMobileTracker|tracking +phonetracker95gpsonly.firebaseio.com|SpyphoneMobileTracker|c2 +phonetracking-dd226.firebaseio.com|SpyAdvice|c2 +phonetracking.net|TheTruthSpy|c2 +phonetracking.net|TheTruthSpy|tracking +phonfinbyclap.com|MobileTracker|tracking +phonsee.com|mSpy|tracking +photoeditorbest.club|MobileTracker|tracking +phpinfo.pw|201801_SpyingOnABudget|c2 +phpwebserver34.best|202006_DarkBasin|c2 +phpwebserver34.site|202006_DarkBasin|c2 +phpwebserver34.tech|202006_DarkBasin|c2 +phpwebserver34.xyz|202006_DarkBasin|c2 +pi.info-taxi.info|AndroidPolice|c2 +pic-shareonline.com|2021_07_taking_action_against_hackers_in_iran|c2 +pickuchu.com|201608_NSO_Group|c2 +piction.club|MobileTracker|tracking +pie.wirelessregistry.com|MobileTracker|tracking +pikchoeditor.com|MobileTracker|tracking +pin.pgv4.com|SpyApp|tracking +pin.spyapp.ro|SpyApp|tracking +pipe.thd.cc|mSpy|c2 +pixelprose.fr|MobileTracker|tracking +pixlr.live|2021_07_taking_action_against_hackers_in_iran|c2 +pixlr.myftp.org|2021_07_taking_action_against_hackers_in_iran|c2 +planyourexoticvacation.com|202006_DarkBasin|c2 +play-protect.com|2022_08_metas_adversarial_threat_report_q2|c2 +play-store-3bb64.firebaseio.com|MeuSpy|c2 +play-store-51182.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +play-store-51182.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +play.google.com.whatsapp.playapps.ga|2022_08_metas_adversarial_threat_report_q2|c2 +playestore.net|2021_12_taking_action_against_surveillance_for_hire|c2 +playgoog1e.com|2021_03_taking_action_against_hackers_in_china|c2 +playgoog1e.com|MobileTracker|tracking +plug2025.bm-com.com|MobileTracker|tracking +pluginapi.chajianapi.com|MobileTracker|tracking +ply.bearclod.com|MobileTracker|tracking +pma-234fsfsddfsdfds09.onemonitar.com|OneSpy|tracking +pn8sm7rjuc.execute-api.us-east-1.amazonaws.com|MobileTracker|tracking +pocopoc.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +poiuwhejgr.com|MobileTracker|tracking +polarismail.services|201909_MissingLink|c2 +policy.getdownloadtime.com|MobileTracker|tracking +politica.in.ua|2022_04_metas_adversarial_threat_report_q1|c2 +politika.bid|2021_12_taking_action_against_surveillance_for_hire|c2 +politique-koaci.info|2021_12_taking_action_against_surveillance_for_hire|c2 +ponyvideochat.com|MobileTracker|tracking +pop.secuerserver.com|201707_InsiderInfo|c2 +portal.android007.com|Android007|tracking +portal.flexispy.com|FlexiSpy|c2 +portal.mobilebackup.biz|AndroidPolice|tracking +portal.spytek.co.za|SpyTek|tracking +portal.topzaloha.cz|AndroidPolice|tracking +portal.unipass.top|MobileTracker|tracking +portfoliofasinating.com|202006_DarkBasin|c2 +positivefitness.club|MobileTracker|tracking +post-jquery.com|2021_07_taking_action_against_hackers_in_iran|c2 +post-manager.com|202006_DarkBasin|c2 +postmailsecret.com|201801_SpyingOnABudget|c2 +postmarkapiservice.com|202006_DarkBasin|c2 +postserverem.com|202006_DarkBasin|c2 +postserviceemaildomain.com|202006_DarkBasin|c2 +power-messenger.com|2021_04_taking_action_against_hackers_in_palestine|c2 +ppleid.org|202006_DarkBasin|c2 +pql.kcpro.ga|MobileTracker|tracking +precise.fit|MobileTracker|tracking +prefiles.ml|2021_07_taking_action_against_hackers_in_iran|c2 +preservtyg.com|2021_03_taking_action_against_hackers_in_china|c2 +preservtyg.com|MobileTracker|tracking +pricetiger.org|MobileTracker|tracking +prmopromo.com|2021_12_taking_action_against_surveillance_for_hire|c2 +pro.logger.mobi|EasyLogger|c2 +pro.logger.mobi|EasyLogger|distribution +productdemoservice.com|202006_DarkBasin|c2 +production.getpriceapp.com|MobileTracker|tracking +products-office.online|2021_04_taking_action_against_hackers_in_palestine|c2 +profile.localytics.com|MobileTracker|tracking +profotoeditor.com|HelloSpy|distribution +prog-money.android-monitor.ru|AndroidPolice|c2 +prog-money.android-monitor.ru|AndroidPolice|tracking +prog-money.com|AndroidPolice|c2 +prog-money.com|AndroidPolice|tracking +project-323448153542050953.firebaseio.com|mSpy|c2 +project-7991479181228723357.firebaseio.com|Mrecorder|c2 +projectormp.com|MobileTracker|tracking +promosdereve.com|201810_TheKingdomCameToCanada|c2 +promotespritialbelief.com|202006_DarkBasin|c2 +pronews.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +prontodigital.com.br|eagleSPY|tracking +proocallerr.com|MobileTracker|tracking +prospybubble.com|Hoverwatch|tracking +protocol-a.copy9.com|TheTruthSpy|c2 +protocol-a.exactspy.com|TheTruthSpy|c2 +protocol-a.fonetracker.com|TheTruthSpy|c2 +protocol-a.guestspy.com|TheTruthSpy|c2 +protocol-a.ispyoo.com|TheTruthSpy|c2 +protocol-a.mxspy.com|TheTruthSpy|c2 +protocol-a.thetruthspy.com|TheTruthSpy|c2 +protocol-a100.fonetracker.com|TheTruthSpy|c2 +protocol-a100.phoneparental.com|TheTruthSpy|c2 +protocol-a100.thetruthspy.com|TheTruthSpy|c2 +protocol-a5.guestspy.com|TheTruthSpy|c2 +protocol-a58.guestspy.com|TheTruthSpy|c2 +protocol-a59.guestspy.com|TheTruthSpy|c2 +protocol-a6.thetruthspy.com|TheTruthSpy|c2 +protocol-a60.guestspy.com|TheTruthSpy|c2 +protocol-a600.fonetracker.com|TheTruthSpy|c2 +protocol-a610.copy9.com|TheTruthSpy|c2 +protocol-a610.thetruthspy.com|TheTruthSpy|c2 +protocol-a611.copy9.com|TheTruthSpy|c2 +protocol-a611.thetruthspy.com|TheTruthSpy|c2 +protocol-a612.copy9.com|TheTruthSpy|c2 +protocol-a614.copy9.com|TheTruthSpy|c2 +protocol-a615.copy9.com|TheTruthSpy|c2 +protocol-a616.copy9.com|TheTruthSpy|c2 +protocol-a617.copy9.com|TheTruthSpy|c2 +protocol-a618.copy9.com|TheTruthSpy|c2 +protocol-a620.copy9.com|TheTruthSpy|c2 +protocol-a621.copy9.com|TheTruthSpy|c2 +protocol-a65.guestspy.com|TheTruthSpy|c2 +protocol-a69.copy9.com|TheTruthSpy|c2 +protocol-a696.copy9.com|TheTruthSpy|c2 +protocol-a70.guestspy.com|TheTruthSpy|c2 +protocol-a710.copy9.com|TheTruthSpy|c2 +protocol-a712.fonetracker.com|TheTruthSpy|c2 +protocol-a72.thetruthspy.com|TheTruthSpy|c2 +protocol-a720.thetruthspy.com|TheTruthSpy|c2 +protocol-a721.thetruthspy.com|TheTruthSpy|c2 +protocol-a722.thetruthspy.com|TheTruthSpy|c2 +protocol-a723.thetruthspy.com|TheTruthSpy|c2 +protocol-a724.thetruthspy.com|TheTruthSpy|c2 +protocol-a725.thetruthspy.com|TheTruthSpy|c2 +protocol-a726.thetruthspy.com|TheTruthSpy|c2 +protocol-a727.thetruthspy.com|TheTruthSpy|c2 +protocol-a728.thetruthspy.com|TheTruthSpy|c2 +protocol-a729.thetruthspy.com|TheTruthSpy|c2 +protocol-a730.thetruthspy.com|TheTruthSpy|c2 +protocol-a731.thetruthspy.com|TheTruthSpy|c2 +protocol-a732.thetruthspy.com|TheTruthSpy|c2 +protocol-a733.thetruthspy.com|TheTruthSpy|c2 +protocol-a734.thetruthspy.com|TheTruthSpy|c2 +protocol-a735.thetruthspy.com|TheTruthSpy|c2 +protocol-a736.thetruthspy.com|TheTruthSpy|c2 +protocol-a737.thetruthspy.com|TheTruthSpy|c2 +protocol-a738.thetruthspy.com|TheTruthSpy|c2 +protocol-a739.thetruthspy.com|TheTruthSpy|c2 +protocol-a740.thetruthspy.com|TheTruthSpy|c2 +protocol-a741.thetruthspy.com|TheTruthSpy|c2 +protocol-a742.thetruthspy.com|TheTruthSpy|c2 +protocol-a743.thetruthspy.com|TheTruthSpy|c2 +protocol-a744.thetruthspy.com|TheTruthSpy|c2 +protocol-a745.mxspy.com|TheTruthSpy|c2 +protocol-a745.thetruthspy.com|TheTruthSpy|c2 +protocol-a746.thetruthspy.com|TheTruthSpy|c2 +protocol-a747.thetruthspy.com|TheTruthSpy|c2 +protocol-a748.thetruthspy.com|TheTruthSpy|c2 +protocol-a749.thetruthspy.com|TheTruthSpy|c2 +protocol-a780.copy9.com|TheTruthSpy|c2 +protocol-a780.fonetracker.com|TheTruthSpy|c2 +protocol-a780.ispyoo.com|TheTruthSpy|c2 +protocol-a780.mxspy.com|TheTruthSpy|c2 +protocol-a785.copy9.com|TheTruthSpy|c2 +protocol-a785.fonetracker.com|TheTruthSpy|c2 +protocol-a810.ispyoo.com|TheTruthSpy|c2 +protocol-a810.mxspy.com|TheTruthSpy|c2 +protocol-a810.thetruthspy.com|TheTruthSpy|c2 +protocol-a811.ispyoo.com|TheTruthSpy|c2 +protocol-a811.mxspy.com|TheTruthSpy|c2 +protocol-a880.ispyoo.com|TheTruthSpy|c2 +protocol-a89.ispyoo.com|TheTruthSpy|c2 +protocol-a89.mxspy.com|TheTruthSpy|c2 +protocol-a910.thetruthspy.com|TheTruthSpy|c2 +protocol-a915.thetruthspy.com|TheTruthSpy|c2 +protocol-a920.thetruthspy.com|TheTruthSpy|c2 +protocol-a925.thetruthspy.com|TheTruthSpy|c2 +protocol-a930.thetruthspy.com|TheTruthSpy|c2 +protocol-a935.thetruthspy.com|TheTruthSpy|c2 +protocol-a940.thetruthspy.com|TheTruthSpy|c2 +protocol-a941.thetruthspy.com|TheTruthSpy|c2 +protocol-a942.thetruthspy.com|TheTruthSpy|c2 +protocol-a943.thetruthspy.com|TheTruthSpy|c2 +protocol-a944.thetruthspy.com|TheTruthSpy|c2 +protocol-a945.thetruthspy.com|TheTruthSpy|c2 +protocol-a946.thetruthspy.com|TheTruthSpy|c2 +protocol-a947.thetruthspy.com|TheTruthSpy|c2 +protocol-monitor.thetruthspy.com|TheTruthSpy|c2 +protocol-viewer-a.copy9.com|TheTruthSpy|c2 +protocol.copy9.com|TheTruthSpy|c2 +protocol.guestspy.com|TheTruthSpy|c2 +protocol.inospy.com|TheTruthSpy|c2 +protocol.ispyoo.com|TheTruthSpy|c2 +protocol.mxspy.com|TheTruthSpy|c2 +protocol.systemserviceprovider.com|TheTruthSpy|c2 +protocol.thetruthspy.com|TheTruthSpy|c2 +protothema.live|2021_12_taking_action_against_surveillance_for_hire|c2 +proupload.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +proxy.reptilicus.net|Reptilicus|c2 +proxy48.oss-eu-central-1.aliyuncs.com|MobileTracker|tracking +prwebsiteuk.com|202006_DarkBasin|c2 +ps1link.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +ps2link.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +ps97mailer.logger.mobi|EasyLogger|c2 +pssts1.nozonenet.com|201712_Cyberbit|c2 +pt.mobilespy.at|AndroidPolice|tracking +publicsgroupe.net|2021_07_taking_action_against_hackers_in_iran|c2 +pulsesolutions-net-easy-logger.firebaseio.com|EasyLogger|c2 +pupki.co|201712_Cyberbit|c2 +pure-talk.site|2021_04_taking_action_against_hackers_in_palestine|c2 +push.mobilefonex.com|FlexiSpy|c2 +pushapi.localytics.com|MobileTracker|tracking +putanything.com|2021_04_taking_action_against_hackers_in_palestine|c2 +pwhois.net|MobileTracker|tracking +pwhois.org|MobileTracker|tracking +pwtgnp.pw|MobileTracker|tracking +pwutc.live|2021_07_taking_action_against_hackers_in_iran|c2 +q12z.net|mSpy|c2 +q12z.net|mSpy|distribution +q95294fs.beget.tech|AndroidPolice|c2 +qaintqa.com|201608_NSO_Group|c2 +qh2020.org|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +qibdirctiowa.com|MobileTracker|tracking +qiberiblaon.com|MobileTracker|tracking +qibla-quran.com|MobileTracker|tracking +qibla-ultima.com|MobileTracker|tracking +qiblassirection.com|MobileTracker|tracking +qrcodesscan.com|MobileTracker|tracking +qrreaderpro.com|MobileTracker|tracking +qtwjhuj.com|MobileTracker|tracking +quanly24h.net|AndroidPolice|c2 +quickupdates.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +quietquell.com|MobileTracker|tracking +quinoa-personal-identify-prod.sense360eng.com|MobileTracker|tracking +quota-notification.servehttp.com|201702_NilePhish|c2 +qwert.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +qwxzyl.com|2021_12_taking_action_against_surveillance_for_hire|c2 +r.findmykids.org|FindMyKids|c2 +racerscardriver.club|MobileTracker|tracking +racksackserveruk.com|202006_DarkBasin|c2 +rackserver39.com|202006_DarkBasin|c2 +rali.live|2021_07_taking_action_against_hackers_in_iran|c2 +randy-severs.info|2021_04_taking_action_against_hackers_in_palestine|c2 +rank.trellian.com|MobileTracker|tracking +rastreadordenamorado.com.br|RastreadorDeNamorado|tracking +ratapi11223344786.azurewebsites.net|2022_08_metas_adversarial_threat_report_q2|c2 +rbk.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +rc-api.lifecircle.app|TrackView|c2 +rcomlogin.com|AndroidPolice|c2 +rctphvxwnjhx.pw|MobileTracker|tracking +rdeskapi719543132892786.azurewebsites.net|2022_08_metas_adversarial_threat_report_q2|c2 +readmytipsntricks.com|202006_DarkBasin|c2 +realtime-spy-mobile.com|RealtimeSpy|c2 +realtime-spy-mobile.com|RealtimeSpy|tracking +rec.hw.cab|Hoverwatch|c2 +recomspy.com|RecomSpy|tracking +recruitme.international|2021_07_taking_action_against_hackers_in_iran|c2 +redcrossworld.com|201608_NSO_Group|c2 +redeitt.com|2021_12_taking_action_against_surveillance_for_hire|c2 +redirection.bid|201803_BadTraffic|c2 +redirectonline.xyz|202006_DarkBasin|c2 +redirectserviceonline.com|202006_DarkBasin|c2 +redvios.com|MobileTracker|tracking +refinery.shopsavvy.com|MobileTracker|tracking +refog.com|Hoverwatch|tracking +refog.de|Hoverwatch|tracking +refog.net|Hoverwatch|tracking +refog.org|Hoverwatch|tracking +registrationonlineeurope.com|202006_DarkBasin|c2 +registrations.smstracker.com|CallSMSTracker|tracking +relay1.trackview.net|TrackView|c2 +remgrogroup.com|2022_04_metas_adversarial_threat_report_q1|c2 +remotecommands.com|LetMeSpy|c2 +remotecommands.com|LetMeSpy|tracking +remotesecurity-629f2.firebaseio.com|AbsoluTrack|c2 +remotesecurityots.firebaseio.com|AbsoluTrack|c2 +remoto.foxspy.com.br|EspiaoAndroid|c2 +repo.mspyonline.com|mSpy|c2 +report.huqindustries.co.uk|MobileTracker|tracking +reporting-util.tutelatechnologies.com|MobileTracker|tracking +reporting.tutelatechnologies.com|MobileTracker|tracking +reports.crashlytics.com|MobileTracker|tracking +reptilicus.net|Reptilicus|c2 +reptilicus.net|Reptilicus|tracking +repubblica.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +restricted-videos.servehttp.com|201702_NilePhish|c2 +retinax.com|PhoneSheriff|tracking +revistadcr.com|2022_04_metas_adversarial_threat_report_q1|c2 +rf.mk|201909_MissingLink|c2 +rfjdhxbz.com|MobileTracker|tracking +richardbeman.info|2021_04_taking_action_against_hackers_in_palestine|c2 +rinimae.oss-ap-southeast-5.aliyuncs.com|MobileTracker|tracking +riospy.net|RioSPY|tracking +rkarsin453287786.azurewebsites.net|2022_08_metas_adversarial_threat_report_q2|c2 +ro.mobilespy.at|AndroidPolice|tracking +ro.pgv4.com|SpyApp|tracking +ro.refog.com|Hoverwatch|tracking +roaccount.pgv4.com|SpyApp|tracking +robert-conley.space|2021_04_taking_action_against_hackers_in_palestine|c2 +robertking.site|2021_04_taking_action_against_hackers_in_palestine|c2 +robotics.land|2021_07_taking_action_against_hackers_in_iran|c2 +rockalab.com|mSpy|c2 +rockerhostings.com|202006_DarkBasin|c2 +rooitor.com|MobileTracker|tracking +rp.apollospy.com|Reptilicus|c2 +rp.dedrone.com.ua|Reptilicus|c2 +rp.labrador.ua|Reptilicus|c2 +rp.liquidblue.com.ua|Reptilicus|c2 +rportranslator.com|MobileTracker|tracking +rrn.world|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +rrspy.com|RealtimeSpy|c2 +rtc.ttspy.com|RealtimeSpy|c2 +ru.neospy.net|NeoSpy|tracking +ruba-bakkour-facebook.blogspot.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +rulapptoplan.com|MobileTracker|tracking +ruley.no-ip.org|201512_PackRAT|c2 +rulinuxbasic.com|202006_DarkBasin|c2 +runaki-support.appspot.com|ShadowSpy|c2 +ruslinbas.com|202006_DarkBasin|c2 +russialinuxbasic.com|202006_DarkBasin|c2 +rythemsjoy.club|MobileTracker|tracking +rythergannon.info|2021_04_taking_action_against_hackers_in_palestine|c2 +rzhpe6vyf9.execute-api.eu-west-2.amazonaws.com|MobileTracker|tracking +s.appjiagu.com|Cocospy|c2 +s.net2share.com|MobileTracker|tracking +s.servidor.in|MeuSpy|c2 +s1.mgoogle.us|201512_PackRAT|c2 +s1.panspy.com|PanSpy|c2 +s1.spylive360.com|SpyLive360|c2 +s1.support|201512_PackRAT|c2 +s2.mgoogle.us|201512_PackRAT|c2 +s2.spylive360.com|SpyLive360|c2 +s3.spylive360.com|SpyLive360|c2 +s3.thd.cc|mSpy|c2 +s9gxw8.com|MobileTool|c2 +sa.api.india.miui.com|MobileTracker|tracking +sa.api.intl.miui.com|MobileTracker|tracking +sa.api.rus.miui.com|MobileTracker|tracking +saahas.servecounterstrike.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +sabafon.info|201608_NSO_Group|c2 +sabic.work|2021_07_taking_action_against_hackers_in_iran|c2 +safe-link.mobi|MobileTracker|tracking +safe-root.com|mSpy|tracking +safe.videoadblockerplus.com|MobileTracker|tracking +safeguarde.com|HighsterMobile|tracking +safelock.club|MobileTracker|tracking +safelyredirecting.com|2021_12_taking_action_against_surveillance_for_hire|c2 +safelyredirecting.digital|2021_12_taking_action_against_surveillance_for_hire|c2 +saferedirect.pw|202006_DarkBasin|c2 +saferspy.com|OwnSpy|tracking +safespy.com|Cocospy|tracking +safespy.vip|Cocospy|c2 +safetyssl.security-centers.com|201604_UP007_SLServer|c2 +safeyourdata.xyz|MobileTracker|tracking +sahar.oss-us-east-1.aliyuncs.com|MobileTracker|tracking +saipem.org|2022_04_metas_adversarial_threat_report_q1|c2 +samehnew-10a7c.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +samehnew-10a7c.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +sandbox97.childsafetytrackerapp.com|EasyLogger|c2 +sandbox97.logger.mobi|EasyLogger|c2 +sandbox97.seniorsafetyapp.com|EasyLogger|c2 +sandra-franklin.fun|2021_04_taking_action_against_hackers_in_palestine|c2 +sandsngo.com|2021_07_taking_action_against_hackers_in_iran|c2 +sanely.cc|MobileTracker|tracking +santanaservice.com|202006_DarkBasin|c2 +sap4mobile-89685.firebaseio.com|AndroidPolice|c2 +sap4mobile.com|AndroidPolice|c2 +sapient-flight-837.firebaseio.com|MobileTrackerFree|c2 +sapserver39j.com|202006_DarkBasin|c2 +sapserverhg.com|202006_DarkBasin|c2 +sapserverhike.com|202006_DarkBasin|c2 +sapserverhipe.com|202006_DarkBasin|c2 +sauditourismguide.com|2022_04_metas_adversarial_threat_report_q1|c2 +saudivisions2030.org|2021_07_taking_action_against_hackers_in_iran|c2 +savemoneytrick.com|2022_04_metas_adversarial_threat_report_q1|c2 +sbt.tv|BrunoEspiao|distribution +scandocnotes.com|MobileTracker|tracking +scar.unityads.unity3d.com|MobileTracker|tracking +scfstats.alixblog.com|MobileTracker|tracking +schlauespiel.de|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +scorerabbate.site|2021_04_taking_action_against_hackers_in_palestine|c2 +screentimelabs.appspot.com|AndroidPolice|c2 +screentimelabs.com|AndroidPolice|tracking +sdk-as.complementics.com|MobileTracker|tracking +sdk.dofunapps.com|MobileTracker|tracking +sdk.predic.io|MobileTracker|tracking +sdk.sdkbalance.com|MobileTracker|tracking +sdk.starbolt.io|MobileTracker|tracking +seahome.top|MobileTracker|tracking +search.matchy.ru|MobileTracker|tracking +searchsimple.info|202006_DarkBasin|c2 +searchsimple.net|202006_DarkBasin|c2 +sec-flare.com|MobileTracker|tracking +secondclone-2d312.firebaseio.com|TheTruthSpy|c2 +secondclone.com|TheTruthSpy|tracking +secontranslatpr.com|MobileTracker|tracking +secuerserver.com|201707_InsiderInfo|c2 +secure-access10.mx|201706_RecklessExploit|c2 +secure-alert.servehttp.com|201702_NilePhish|c2 +secure-msp.app|mSpy|tracking +secure-team.servehttp.com|201702_NilePhish|c2 +secureapplication.azurewebsites.net|2022_08_metas_adversarial_threat_report_q2|c2 +securebackuponline.net|SpyHuman|c2 +securechat.azurewebsites.net|2022_08_metas_adversarial_threat_report_q2|c2 +securechildren.online|mSpy|tracking +secureemailserver65.com|202006_DarkBasin|c2 +securemailhost46.com|202006_DarkBasin|c2 +secureserver9898.com|202006_DarkBasin|c2 +secureserverasia.com|202006_DarkBasin|c2 +secureservereurope.com|202006_DarkBasin|c2 +security-myaccount.servehttp.com|201702_NilePhish|c2 +security.laikalabs.ai|MobileTracker|tracking +securityaccountreply.com|2021_07_taking_action_against_hackers_in_iran|c2 +securityteam-notify.servehttp.com|201702_NilePhish|c2 +securspy.com|SpyApp|tracking +seery.online|2021_07_taking_action_against_hackers_in_iran|c2 +selectedmaxstores.com|202006_DarkBasin|c2 +selectedservicemy.com|202006_DarkBasin|c2 +selectedserviceru.com|202006_DarkBasin|c2 +selectedservicesg.com|202006_DarkBasin|c2 +selectiveservicemax.com|202006_DarkBasin|c2 +selectyourgroom.com|202006_DarkBasin|c2 +selfspy.com|AndroidPolice|tracking +send.onemonitar.com|OneSpy|tracking +send.onespy.com|OneSpy|tracking +sendblaster.org|2021_07_taking_action_against_hackers_in_iran|c2 +sender.gb.net|2021_07_taking_action_against_hackers_in_iran|c2 +senior-safety-189010.firebaseio.com|EasyLogger|c2 +seniorsafetyapp.com|EasyLogger|tracking +senseye.spymasterpro.com|SpyMasterPro|c2 +sentry-01.thd.cc|mSpy|c2 +sentry-02.thd.cc|mSpy|c2 +sentry-03.thd.cc|mSpy|c2 +sentry-04.thd.cc|mSpy|c2 +sentry-05.thd.cc|mSpy|c2 +sentry-06.thd.cc|mSpy|c2 +sentry-07.thd.cc|mSpy|c2 +sentry-product-new.bbrp.co|mSpy|c2 +sentrypc.com|SentryPC|tracking +sentrypc.net|SentryPC|c2 +sepenet.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +sephoragroup.com|2021_12_taking_action_against_surveillance_for_hire|c2 +ser-chat.com|MobileTracker|tracking +server.androidmonitor.com|AndroidMonitor|c2 +server.freeandroidspy.com|FreeAndroidSpy|c2 +server.pgv4.com|SpyApp|tracking +serverasiasap.com|202006_DarkBasin|c2 +serverdemoservice.com|202006_DarkBasin|c2 +serverforhelphk.com|202006_DarkBasin|c2 +serverforhelplux.com|202006_DarkBasin|c2 +serverforhelpmy.com|202006_DarkBasin|c2 +serverforhelpru.com|202006_DarkBasin|c2 +serverforhelpsg.com|202006_DarkBasin|c2 +serverforhiretech.com|202006_DarkBasin|c2 +serverforhome.com|202006_DarkBasin|c2 +serverformailings.com|202006_DarkBasin|c2 +serverfornetworks.com|202006_DarkBasin|c2 +serverforshort.com|202006_DarkBasin|c2 +serverfortechhelp.com|202006_DarkBasin|c2 +serverfortechies.com|202006_DarkBasin|c2 +serverforzapper.com|202006_DarkBasin|c2 +servergateway33.com|202006_DarkBasin|c2 +servergateway56.com|202006_DarkBasin|c2 +serverhello54.com|202006_DarkBasin|c2 +serverloadbalance.com|202006_DarkBasin|c2 +servermailing34.com|202006_DarkBasin|c2 +servermain43.com|202006_DarkBasin|c2 +servermappingserviceonline.com|202006_DarkBasin|c2 +servers-mobile.info|2021_12_taking_action_against_surveillance_for_hire|c2 +serversap54.com|202006_DarkBasin|c2 +service.n.weiguanai.cn|RealtimeSpy|c2 +service.weiguanai.cn|RealtimeSpy|c2 +serviceasneed.com|202006_DarkBasin|c2 +serviceforneworder.com|202006_DarkBasin|c2 +servicegoingfar.com|202006_DarkBasin|c2 +services.spyhuman.com|SpyHuman|tracking +services.spytoapp.com|SpyToApp|c2 +servicesloggermobi.azurewebsites.net|EasyLogger|c2 +serviceupdaterequest.com|2021_12_taking_action_against_surveillance_for_hire|c2 +servidor.in|MeuSpy|c2 +servidor.in|MeuSpy|distribution +setting.rayjump.com|MobileTracker|tracking +settings.crashlytics.com|MobileTracker|tracking +setup.nemospy.com|AndroidPolice|c2 +setupmail-a.icloudappe.com|TheTruthSpy|c2 +setupmail-a720.icloudappe.com|TheTruthSpy|c2 +setupmail-a722.icloudappe.com|TheTruthSpy|c2 +setupmail-a724.icloudappe.com|TheTruthSpy|c2 +setupmail-a725.icloudappe.com|TheTruthSpy|c2 +setupmail-a726.icloudappe.com|TheTruthSpy|c2 +setupmail-a727.icloudappe.com|TheTruthSpy|c2 +setupmail-a729.icloudappe.com|TheTruthSpy|c2 +setupmail-a732.icloudappe.com|TheTruthSpy|c2 +setupmail-a733.icloudappe.com|TheTruthSpy|c2 +setupmail-a734.icloudappe.com|TheTruthSpy|c2 +setupmail-a735.icloudappe.com|TheTruthSpy|c2 +setupmail-a737.icloudappe.com|TheTruthSpy|c2 +setupmail-a738.icloudappe.com|TheTruthSpy|c2 +setupmail-a740.icloudappe.com|TheTruthSpy|c2 +setupmail-a741.icloudappe.com|TheTruthSpy|c2 +setupmail-a742.icloudappe.com|TheTruthSpy|c2 +setupmail-a743.icloudappe.com|TheTruthSpy|c2 +setupmail-a744.icloudappe.com|TheTruthSpy|c2 +setupmail-a745.icloudappe.com|TheTruthSpy|c2 +setupmail-a746.icloudappe.com|TheTruthSpy|c2 +setupmail-a747.icloudappe.com|TheTruthSpy|c2 +setupmail-a748.icloudappe.com|TheTruthSpy|c2 +setupmail-a910.icloudappe.com|TheTruthSpy|c2 +setupmail-a915.icloudappe.com|TheTruthSpy|c2 +setupmail-a920.icloudappe.com|TheTruthSpy|c2 +setupmail.icloudappe.com|TheTruthSpy|c2 +sextape225.me|2021_12_taking_action_against_surveillance_for_hire|c2 +sg1-spiky.wzrkt.com|MobileTracker|tracking +sg1.cb.wzrkt.com|MobileTracker|tracking +sg1.wzrkt.com|MobileTracker|tracking +sglinbas.com|202006_DarkBasin|c2 +sha-talk.co|2021_04_taking_action_against_hackers_in_palestine|c2 +shadow-logs.com|ShadowSpy|c2 +shadow-logs.com|ShadowSpy|tracking +shadow-spy.com|ShadowSpy|c2 +shadow-spy.com|ShadowSpy|tracking +shadowappbundle-default-rtdb.firebaseio.com|ShadowSpy|c2 +shadowlogspanel.firebaseio.com|ShadowSpy|c2 +shadymario.com|202006_DarkBasin|c2 +shadyspy.com|ShadySpy|distribution +shadyspy.com|ShadySpy|tracking +shareae.cf|2021_07_taking_action_against_hackers_in_iran|c2 +shareflx.com|2022_08_metas_adversarial_threat_report_q2|c2 +shareflx.createasocialcard.top|2022_08_metas_adversarial_threat_report_q2|c2 +shareflx.social-card-share.top|2022_08_metas_adversarial_threat_report_q2|c2 +shareflx.socialpreviews.top|2022_08_metas_adversarial_threat_report_q2|c2 +sharepointnotify.com|2022_04_metas_adversarial_threat_report_q1|c2 +shipnyatchholland.com|202006_DarkBasin|c2 +shlink.run|2021_07_taking_action_against_hackers_in_iran|c2 +shlnk.run|2021_07_taking_action_against_hackers_in_iran|c2 +shoponlinefreesg.com|202006_DarkBasin|c2 +shoponlinefreeuk.com|202006_DarkBasin|c2 +short-l.link|2021_07_taking_action_against_hackers_in_iran|c2 +short-ner.com|202006_DarkBasin|c2 +shorten.fi|2021_12_taking_action_against_surveillance_for_hire|c2 +shortenup.com|202006_DarkBasin|c2 +shortenurls.me|2021_12_taking_action_against_surveillance_for_hire|c2 +shortenurlservices.com|202006_DarkBasin|c2 +shortesly.website|2021_04_taking_action_against_hackers_in_palestine|c2 +shortformurl.com|202006_DarkBasin|c2 +shortformurl.xyz|202006_DarkBasin|c2 +shortli.live|2021_07_taking_action_against_hackers_in_iran|c2 +shortlinkcut.com|202006_DarkBasin|c2 +shortmee.one|2021_12_taking_action_against_surveillance_for_hire|c2 +shortnerserviceonline.com|202006_DarkBasin|c2 +shortserver1.com|202006_DarkBasin|c2 +shorturlservice.com|202006_DarkBasin|c2 +shortwidgets.com|2021_12_taking_action_against_surveillance_for_hire|c2 +shortxyz.com|2021_12_taking_action_against_surveillance_for_hire|c2 +showra-22501.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +showra-22501.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +showra-chat.atwebpages.com|2021_04_taking_action_against_hackers_in_palestine|c2 +shrinkandshareurl.com|202006_DarkBasin|c2 +shrinkthisurl.com|202006_DarkBasin|c2 +shrt.rip|2021_07_taking_action_against_hackers_in_iran|c2 +shrtnerlnk.com|202006_DarkBasin|c2 +shuch6ba0w.spyrixweb.com|EvaSpy|distribution +shur.live|2021_07_taking_action_against_hackers_in_iran|c2 +shurl.site|2021_07_taking_action_against_hackers_in_iran|c2 +side-talk.com|2021_04_taking_action_against_hackers_in_palestine|c2 +signal-live.vip|MobileTracker|tracking +signal-premium-app.org|2022_08_metas_adversarial_threat_report_q2|c2 +signal-premium.org|2022_08_metas_adversarial_threat_report_q2|c2 +signalpremium.com|2022_08_metas_adversarial_threat_report_q2|c2 +signalpro.org|2022_08_metas_adversarial_threat_report_q2|c2 +signaltalk.top|MobileTracker|tracking +signin.dedyn.io|2022_04_metas_adversarial_threat_report_q1|c2 +sikhsiyasatapp.net|2022_08_metas_adversarial_threat_report_q2|c2 +simetricode.uk|2021_12_taking_action_against_surveillance_for_hire|c2 +simpleadbanners.com|201605_Stealth_Falcon|c2 +sinai-new.com|2021_12_taking_action_against_surveillance_for_hire|c2 +site1.life|2021_07_taking_action_against_hackers_in_iran|c2 +siteadmineurope.com|202006_DarkBasin|c2 +siteadminhk.com|202006_DarkBasin|c2 +sitebloginfo.com|202006_DarkBasin|c2 +sitepref.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +sjkfsdkg.com|MobileTracker|tracking +sk1-spiky.wzrkt.com|MobileTracker|tracking +sk1-staging-1.wzrkt.com|MobileTracker|tracking +sk1-staging-10.wzrkt.com|MobileTracker|tracking +sk1-staging-2.wzrkt.com|MobileTracker|tracking +sk1-staging-3.wzrkt.com|MobileTracker|tracking +sk1-staging-4.wzrkt.com|MobileTracker|tracking +sk1-staging-5.wzrkt.com|MobileTracker|tracking +sk1-staging-6.wzrkt.com|MobileTracker|tracking +sk1-staging-7.wzrkt.com|MobileTracker|tracking +sk1-staging-8.wzrkt.com|MobileTracker|tracking +sk1-staging-9.wzrkt.com|MobileTracker|tracking +sk1.wzrkt.com|MobileTracker|tracking +skelly-chester.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +skycoachgg.club|MobileTracker|tracking +sl360-7ba65.firebaseio.com|SpyLive360|c2 +slimesimulator.club|MobileTracker|tracking +smalllcalllrecorder.com|MobileTracker|tracking +smart-messenger.online|2021_04_taking_action_against_hackers_in_palestine|c2 +smart.link|MobileTracker|tracking +smartadblocker.com|MobileTracker|tracking +smartback-12d60.appspot.com|AndroidPolice|c2 +smartback-12d60.firebaseio.com|AndroidPolice|c2 +smartguardapp.com|AbsoluTrack|tracking +sms.webadv.co|201608_NSO_Group|c2 +smsandcalltracker.firebaseio.com|TrackMyPhones|c2 +smscentro.com|201706_RecklessExploit|c2 +smser.net|201608_NSO_Group|c2 +smsmensaje.mx|201706_RecklessExploit|c2 +smsmensaje.mx|201706_RecklessRedux|c2 +smstracker.com|CallSMSTracker|tracking +smstrackerweb.com|CallSMSTracker|tracking +smsuns.com|2021_12_taking_action_against_surveillance_for_hire|c2 +smtp-2go.com|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.best|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.club|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.email|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.fun|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.icu|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.live|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.me|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.pw|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.site|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.space|2021_07_taking_action_against_hackers_in_iran|c2 +smtp2go.website|2021_07_taking_action_against_hackers_in_iran|c2 +smtper.center|2021_07_taking_action_against_hackers_in_iran|c2 +smtpout.secuerserver.com|201707_InsiderInfo|c2 +smtpserver389.com|202006_DarkBasin|c2 +smtpserver466.com|202006_DarkBasin|c2 +smtptogo.pw|2021_07_taking_action_against_hackers_in_iran|c2 +snapfire.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +snaphosterservice.com|202006_DarkBasin|c2 +snaplens-pt.com|MobileTracker|tracking +sniper.pet|2021_12_taking_action_against_surveillance_for_hire|c2 +snoopza.com|Snoopza|c2 +snoopza.com|Snoopza|tracking +snoopza.zendesk.com|Snoopza|tracking +soc-usa.email|2021_07_taking_action_against_hackers_in_iran|c2 +social-life.info|201810_TheKingdomCameToCanada|c2 +social-store.online|2021_04_taking_action_against_hackers_in_palestine|c2 +sock.godforgiveuss.live|MobileTracker|tracking +sock.hhhhrkanandda.xyz|MobileTracker|tracking +sock.nmnmnmfsamsfan.xyz|MobileTracker|tracking +socktest.ankatras.xyz|MobileTracker|tracking +softnetworksolutions.com|202006_DarkBasin|c2 +softredirect.info|202006_DarkBasin|c2 +solargoup.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +solargroup.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +solitude.file-download.today|201803_BadTraffic|c2 +solitude.filedownloads.online|201803_BadTraffic|c2 +solvely.ai|MobileTracker|tracking +sonar.actv8technologies.com|MobileTracker|tracking +soporte-login-account-gmail.tk|201512_PackRAT|c2 +soporte-login-account-yahoo.tk|201512_PackRAT|c2 +soulscanneryh.com|MobileTracker|tracking +soundcloud.fun|2021_07_taking_action_against_hackers_in_iran|c2 +soundcloud.live|2021_07_taking_action_against_hackers_in_iran|c2 +sp.kuuvv.com|Cocospy|c2 +sp18022019.firebaseio.com|SpyHuman|c2 +spappmonitoring.com|EasyPhoneTrack|tracking +sparrowsgroup.org|2022_04_metas_adversarial_threat_report_q1|c2 +spartacuscrixus.club|2021_04_taking_action_against_hackers_in_palestine|c2 +spc-runtimes.s3.amazonaws.com|SentryPC|c2 +spectronet.pw|MobileTracker|tracking +speedspot.speedspot.netdna-cdn.com|MobileTracker|tracking +speedy.sbs|2021_12_taking_action_against_surveillance_for_hire|c2 +speedygonzales.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +speedymax.shop|2021_12_taking_action_against_surveillance_for_hire|c2 +spiegel.agency|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.cab|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.ink|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.ltd|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.pro|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.quest|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegel.work|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegeli.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegeli.live|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegeli.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegelr.live|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +spiegelr.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +sport4ever.club|MobileTracker|tracking +sports-mdg.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +sportsnewz.site|2021_12_taking_action_against_surveillance_for_hire|c2 +spreadme.international|2021_07_taking_action_against_hackers_in_iran|c2 +sputniknews.news|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +spy-datacenter.com|EasyPhoneTrack|c2 +spy-phone-app.com|SpyphoneMobileTracker|tracking +spy24.app|Spy24|tracking +spy24.net|Spy24|c2 +spy24.net|Spy24|tracking +spy2mobile-bb441.firebaseio.com|AndroidPolice|c2 +spy2mobile.com|AndroidPolice|c2 +spy2mobile.com|AndroidPolice|tracking +spyacellphone.com|HelloSpy|tracking +spyadvice.com|SpyAdvice|c2 +spyadvice.com|SpyAdvice|tracking +spyapp-8916f.firebaseio.com|BlurSpy|c2 +spyapp.at|SpyApp|tracking +spyapp.ch|SpyApp|tracking +spyapp.es|SpyApp|tracking +spyapp.fr|SpyApp|tracking +spyapp.ro|SpyApp|tracking +spyapp.top|Xnore|c2 +spyapp.uk|SpyApp|tracking +spyapps.net|TheTruthSpy|tracking +spyaudiorecorder.firebaseio.com|TrackMyPhones|c2 +spybrother.com|SpyApp|tracking +spybunker.com|Android007|tracking +spycell.net|TheTruthSpy|tracking +spyera.com|SpyEra|tracking +spyera.postaffiliatepro.com|SpyEra|c2 +spyfer.info|uMobix|tracking +spyfly.co.za|SpyFly|tracking +spyfone.com|SpyphoneMobileTracker|tracking +spyhide.com|HelloSpy|c2 +spyhide.com|HelloSpy|tracking +spyhide.ir|HelloSpy|c2 +spyhide.ir|HelloSpy|tracking +spyhuman-97943.firebaseio.com|SpyHuman|c2 +spyhuman.com|SpyHuman|c2 +spyhuman.com|SpyHuman|tracking +spyic.biz|Cocospy|tracking +spyic.com|Cocospy|tracking +spyier.biz|Cocospy|tracking +spyier.com|Spyier|tracking +spyine.biz|Cocospy|tracking +spyine.com|Cocospy|tracking +spyios8x.com|HelloSpy|tracking +spykontrol.com|AndroidPolice|tracking +spylive360.com|SpyLive360|c2 +spylive360.com|SpyLive360|tracking +spylix.com|AndroidPolice|tracking +spylogs.com|SpyEra|c2 +spymaster-e535b.firebaseio.com|SpyMasterPro|c2 +spymasterpro.com|SpyMasterPro|tracking +spynger.net|Spynger|tracking +spynote.us|SpyNote|c2 +spynote.us|SpyNote|tracking +spyone.pl|Spyone|tracking +spyphone.com|SpyphoneMobileTracker|tracking +spyphonereview.com|FlexiSpy|tracking +spyren.com|AppSpy|tracking +spyrix-sfk.com|EvaSpy|distribution +spyrix.com|EvaSpy|tracking +spysetup.com|FreeAndroidSpy|c2 +spyt.co|AndroidPolice|c2 +spyt.co|AndroidPolice|distribution +spytec.com|SpyTec|tracking +spytecgl300.com|SpyTec|tracking +spytecgps.io|SpyTec|tracking +spytech-web.com|RealtimeSpy|tracking +spytek.co.za|SpyTek|tracking +spytekonline.co.za|SpyTek|tracking +spytoapp.com|SpyToApp|tracking +spytomobile.com|AndroidPolice|c2 +spytomobile.com|AndroidPolice|tracking +spytrac-app1.s3.amazonaws.com|AndroidPolice|c2 +spytrac.com|AndroidPolice|tracking +spyzee.com|TheTruthSpy|c2 +spyzie-a.firebaseio.com|Cocospy|c2 +spyzie.com|Cocospy|c2 +spyzie.com|Cocospy|tracking +spyzie.io|Cocospy|tracking +spyzie.online|Cocospy|tracking +squishyp.com|MobileTracker|tracking +src-ymlang.link|2021_07_taking_action_against_hackers_in_iran|c2 +srtnr.com|202006_DarkBasin|c2 +srtnr.co|202006_DarkBasin|c2 +srvrgruk.com|202006_DarkBasin|c2 +sse.chyldmonitor.com|OneSpy|c2 +sslasmr.com|MobileTracker|tracking +sslportservices.com|2021_03_taking_action_against_hackers_in_china|c2 +sslportservices.com|MobileTracker|tracking +stable.icecyber.org|MobileTracker|tracking +stacks-zadar.website|2021_04_taking_action_against_hackers_in_palestine|c2 +staging-all-tracker.appspot.com|AllTracker|c2 +staging.smstracker.com|CallSMSTracker|c2 +stand-by-97c5c.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +stand-by-97c5c.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +stand-by.site|2021_04_taking_action_against_hackers_in_palestine|c2 +standardofficeholland.com|202006_DarkBasin|c2 +standardofficeil.com|202006_DarkBasin|c2 +standardofficeuk.com|202006_DarkBasin|c2 +static-graph.com|2021_12_taking_action_against_surveillance_for_hire|c2 +static.complementics.com|MobileTracker|tracking +static.privacytrck.com|MobileTracker|tracking +static.trckingbyte.com|MobileTracker|tracking +static.trckpath.com|MobileTracker|tracking +stats.buildwithkt.dev|MobileTracker|tracking +stats.essayget.com|MobileTracker|tracking +stats.inappertising.org|MobileTracker|tracking +stevenfloyd.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +stevensmalley.pro|2021_04_taking_action_against_hackers_in_palestine|c2 +stikerscloud.com|2021_04_taking_action_against_hackers_in_palestine|c2 +stonisi.news|2021_12_taking_action_against_surveillance_for_hire|c2 +storage.computingdownloads.life|201803_BadTraffic|c2 +store.dianmpsoathom.com|MobileTracker|tracking +store.mycustomdevice.com|FlexiSpy|distribution +storeupdates.net|2022_08_metas_adversarial_threat_report_q2|c2 +stream.meetextension.com|MobileTracker|tracking +stream.redcoolmedia.net|MobileTracker|tracking +streetprocarsracingss.com|MobileTracker|tracking +streetracingg.club|MobileTracker|tracking +strngbltru.com|202006_DarkBasin|c2 +strongbolthostinghk.com|202006_DarkBasin|c2 +strongwingtechnologies.com|202006_DarkBasin|c2 +strunhvgpk.com|2021_03_taking_action_against_hackers_in_china|c2 +strunhvgpk.com|MobileTracker|tracking +strurl.click|202006_DarkBasin|c2 +studio11-7e288.firebaseio.com|EasyPhoneTrack|c2 +su.onemonitar.com|OneSpy|tracking +sueddeutsche.cc|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +sueddeutsche.co|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +sueddeutsche.me|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +sueddeutsche.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +sunday-deals.com|201810_TheKingdomCameToCanada|c2 +super-voice.vip|MobileTracker|tracking +supersonicads.com|MobileTracker|tracking +superuser.onemonitar.com|OneSpy|tracking +support-java.com|201512_PackRAT|c2 +support-login-validate-outlook.tk|201512_PackRAT|c2 +support-securitymail.email|2021_07_taking_action_against_hackers_in_iran|c2 +support-whatsapp.com|201512_PackRAT|c2 +support-ymail-team.online|2021_07_taking_action_against_hackers_in_iran|c2 +support.flexispy.com|FlexiSpy|tracking +support.loverman.net|MobileTrackerFree|tracking +support.mobile-tracker-free.com|MobileTrackerFree|tracking +support.mtoolapp.biz|MobileTool|c2 +support.phoneparental.com|TheTruthSpy|c2 +support.spyera.com|SpyEra|tracking +supportgmai1.com|201512_PackRAT|c2 +supportserviceeu.com|202006_DarkBasin|c2 +supportset.net|2021_12_taking_action_against_surveillance_for_hire|c2 +supportskype.com|2022_04_metas_adversarial_threat_report_q1|c2 +surepointspy.com|HighsterMobile|tracking +surl.ist|2021_07_taking_action_against_hackers_in_iran|c2 +surl.live|2021_07_taking_action_against_hackers_in_iran|c2 +surveillance-enfants.com|uMobix|tracking +surveilstar.com|PanSpy|tracking +survey-notify-event.sense360eng.com|MobileTracker|tracking +suwayda-24.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +suzuki.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +svetovid.bid|2021_12_taking_action_against_surveillance_for_hire|c2 +svlogin.asia|FlexiSpy|tracking +swiftmobilespy.co.za|SwiftMobileSpy|tracking +sxde-download.spyrix-sfk.com|EvaSpy|distribution +sxk8xrjtaikv3dxl7hgghw3vptvxpzzxeynrcltu4k3yeecjq3.online|2021_07_taking_action_against_hackers_in_iran|c2 +symoty.com|2021_12_taking_action_against_surveillance_for_hire|c2 +sync-a.copy9.com|TheTruthSpy|c2 +sync-a.exactspy.com|TheTruthSpy|c2 +sync-a.fonetracker.com|TheTruthSpy|c2 +sync-a.ispyoo.com|TheTruthSpy|c2 +sync-a.mxspy.com|TheTruthSpy|c2 +sync-a.thetruthspy.com|TheTruthSpy|c2 +sync-a100.fonetracker.com|TheTruthSpy|c2 +sync-a600.fonetracker.com|TheTruthSpy|c2 +sync-a712.fonetracker.com|TheTruthSpy|c2 +sync-a780.mxspy.com|TheTruthSpy|c2 +sync-a7xx.thetruthspy.com|TheTruthSpy|c2 +sync-a8xx.thetruthspy.com|TheTruthSpy|c2 +sync-a925.thetruthspy.com|TheTruthSpy|c2 +sync-a930.thetruthspy.com|TheTruthSpy|c2 +sync-a935.thetruthspy.com|TheTruthSpy|c2 +sync-a940.thetruthspy.com|TheTruthSpy|c2 +sync-a941.thetruthspy.com|TheTruthSpy|c2 +sync-a942.thetruthspy.com|TheTruthSpy|c2 +sync.bk128.com|MobileTracker|tracking +sync.bk128.com|XNSpy|c2 +sync.xiz4me.com|MobileTracker|tracking +sync.xiz4me.com|XNSpy|c2 +syncservices.one|2021_12_taking_action_against_surveillance_for_hire|c2 +synctimestamp.com|2021_12_taking_action_against_surveillance_for_hire|c2 +syncupdate.site|2021_12_taking_action_against_surveillance_for_hire|c2 +sys.firewall-gateway.net|201603_Shifting_Tactics|c2 +sys.spyapp.ch|SpyApp|tracking +system.documentations.live|201803_BadTraffic|c2 +system.filedownloaders.com|201803_BadTraffic|c2 +systembackend.site|2021_07_taking_action_against_hackers_in_iran|c2 +t-bit.me|MobileTracker|tracking +t-me.link|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +t-online.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +t-onlinl.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +t-onlinl.live|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +t-onlinl.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +t-onlinr.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +t-onlinr.live|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +t-onlinr.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +t.appsflyer.com|MobileTracker|tracking +t.pie.org|MobileTracker|tracking +t1.mailsecurityservice.com|201510_NGO_Burma|c2 +t1.twmills.xyz|MobileTracker|tracking +t1bet.net|201801_SpyingOnABudget|c2 +t1k22.c8xwor.com|MobileTracker|tracking +t2.mailsecurityservice.com|201510_NGO_Burma|c2 +t2.twmills.xyz|MobileTracker|tracking +t3.twmills.xyz|MobileTracker|tracking +tagdps.ru|AndroidPolice|c2 +tagesspiegel.co|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +tagesspiegel.ltd|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +tags.illaryboucnc.com|MobileTracker|tracking +talent-recruitment.org|2022_04_metas_adversarial_threat_report_q1|c2 +talklog.tools|TalkLog|c2 +talklog.tools|TalkLog|tracking +talktalky.azurewebsites.net|2022_04_metas_adversarial_threat_report_q1|c2 +taskmgr.redirectme.com|201512_PackRAT|c2 +taskmgr.redirectme.net|201512_PackRAT|c2 +taskmgr.serveftp.com|201512_PackRAT|c2 +taskmgr.servehttp.com|201512_PackRAT|c2 +tchsrvce.com|TalkLog|c2 +techinnovative.net|AndroidPolice|tracking +techmahindra.support|2021_07_taking_action_against_hackers_in_iran|c2 +teensafe.net|Cocospy|tracking +teensafe.vip|Cocospy|distribution +teensoftware.com|Cocospy|tracking +tel.forensis-lab.com|SpyApp|tracking +tele-gram.vip|MobileTracker|tracking +telecomegy-ads.com|2021_12_taking_action_against_surveillance_for_hire|c2 +telegram-app.tech|2022_08_metas_adversarial_threat_report_q2|c2 +telegram-pro.org|2022_08_metas_adversarial_threat_report_q2|c2 +telegramapppro.org|2022_08_metas_adversarial_threat_report_q2|c2 +telegrom.org|2021_04_taking_action_against_hackers_in_palestine|c2 +telenorconn.com|2021_12_taking_action_against_surveillance_for_hire|c2 +teleszpieg.pl|LetMeSpy|tracking +teleweb.world|2021_07_taking_action_against_hackers_in_iran|c2 +tenday.mysecondarydns.com|201604_UP007_SLServer|c2 +tesla-s.shop|2021_12_taking_action_against_surveillance_for_hire|c2 +teslal.shop|2021_12_taking_action_against_surveillance_for_hire|c2 +teslal.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +teslali.com|2021_12_taking_action_against_surveillance_for_hire|c2 +test-client.mobilefonex.com|FlexiSpy|c2 +test.androidlost.com|AndroidLost|c2 +test.onetouchsecurities.com|AbsoluTrack|c2 +test.refog.com|Hoverwatch|c2 +test.send.onemonitar.com|OneSpy|tracking +test.udadblocker.com|MobileTracker|tracking +testandroidopen.azurewebsites.net|2022_08_metas_adversarial_threat_report_q2|c2 +testapi.foozor.com|MobileTracker|tracking +tetra.email|2021_07_taking_action_against_hackers_in_iran|c2 +tfk7r22klf8vtd8g90jq8qno1tpqhmpe.apps.googleusercontent.com|AndroidPolice|c2 +tgrthgsrgwrthwrtgwr.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +tgscontakcs.com|MobileTracker|tracking +thainews.asia|201608_NSO_Group|c2 +thd.cc|mSpy|c2 +theambix.org|2022_08_metas_adversarial_threat_report_q2|c2 +thecybernanny.com|Reptilicus|tracking +thefreemovies.net|2022_04_metas_adversarial_threat_report_q1|c2 +thegardian.ml|2021_07_taking_action_against_hackers_in_iran|c2 +thegaurdian.live|2021_07_taking_action_against_hackers_in_iran|c2 +theguardian.co.com|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +theispyoo.com|mSpy|tracking +theodoi24h.com|AndroidPolice|c2 +theonespy.com|TheOneSpy|tracking +thepopulator.tutelatechnologies.com|MobileTracker|tracking +thepowerlinegroup.com|HighsterMobile|tracking +thepromise.standsapp.org|MobileTracker|tracking +thespyapp.com|TheTruthSpy|tracking +thetruth-db94a.firebaseio.com|TheTruthSpy|c2 +thetruthspy.com|TheTruthSpy|tracking +thetruthspys.com|TheTruthSpy|tracking +thevendry.com|MobileTracker|tracking +thiefguardbd.com|AbsoluTrack|c2 +thiefguardbd.com|AbsoluTrack|tracking +thomsonsreuters.email|2021_07_taking_action_against_hackers_in_iran|c2 +thomsonsreuters.eu|2021_07_taking_action_against_hackers_in_iran|c2 +thomsonsreuters.link|2021_07_taking_action_against_hackers_in_iran|c2 +thomsonsreuters.net|2021_07_taking_action_against_hackers_in_iran|c2 +thundernews.org|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +ti.domainforlite.com|MobileTracker|tracking +tibet-office.net|201801_SpyingOnABudget|c2 +tibetfrum.info|201808_FamiliarFeeling|c2 +tibethouse.info|201808_FamiliarFeeling|c2 +tibetnews.info|201808_FamiliarFeeling|c2 +tibetnews.today|201808_FamiliarFeeling|c2 +tibetvoices.com|201611_KeyBoy|c2 +tickeakhatsp.com|MobileTracker|tracking +tifamily.net|AndroidPolice|tracking +tim-jordan.info|2021_04_taking_action_against_hackers_in_palestine|c2 +time-local.com|201712_Cyberbit|c2 +time-local.net|201712_Cyberbit|c2 +timestampsync.com|2021_12_taking_action_against_surveillance_for_hire|c2 +timeupdate.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +timeupdateservice.com|2021_12_taking_action_against_surveillance_for_hire|c2 +tineeurl.com|202006_DarkBasin|c2 +tinil.ink|2021_07_taking_action_against_hackers_in_iran|c2 +tinly.me|2021_07_taking_action_against_hackers_in_iran|c2 +tinmoivietnam.com|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +tiny.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +tinylink.pro|2021_07_taking_action_against_hackers_in_iran|c2 +tinylinks.live|2021_12_taking_action_against_surveillance_for_hire|c2 +tinyulrs.com|2021_12_taking_action_against_surveillance_for_hire|c2 +tinyurl.cloud|2021_12_taking_action_against_surveillance_for_hire|c2 +tinyurl.gold|2021_07_taking_action_against_hackers_in_iran|c2 +tinyurlshortner.com|202006_DarkBasin|c2 +tiol.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +tips.ghetaldhighe.com|MobileTracker|tracking +tispy.net|AndroidPolice|c2 +tispy.net|AndroidPolice|tracking +tiwpan.xyz|2021_07_taking_action_against_hackers_in_iran|c2 +tly.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +tly.link|2021_12_taking_action_against_surveillance_for_hire|c2 +tnyurlservice.com|202006_DarkBasin|c2 +tocaoonline.com|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +tocaoonline.org|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|c2 +tocast.vip|MobileTracker|tracking +tok.vaicore.xyz|MobileTracker|tracking +tommy-swope.site|2021_04_taking_action_against_hackers_in_palestine|c2 +tonline.cfd|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +tonline.life|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +tonline.today|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +top-best.com|MobileTracker|tracking +topcontactco.com|201608_NSO_Group|c2 +topzaloha.cz|AndroidPolice|c2 +tos-assigned-build.sfo2.digitaloceanspaces.com|TheOneSpy|distribution +touch.ps|2021_04_taking_action_against_hackers_in_palestine|c2 +tovima.live|2021_12_taking_action_against_surveillance_for_hire|c2 +tox.cheap|2021_07_taking_action_against_hackers_in_iran|c2 +tphmr.com|PhoneMonitor|distribution +tqiblacompas.com|MobileTracker|tracking +tr.appmia.com|AppMia|c2 +traccar-client-app.firebaseio.com|Traccar|c2 +traccar.org|Traccar|c2 +traccar.org|Traccar|tracking +tracerspy.net|AndroidPolice|tracking +track-your-fedex-package.org|201608_NSO_Group|c2 +track.odskguo.xyz|MobileTracker|tracking +trackerfree.net|AppSpy|tracking +trackerplus.ru|AndroidPolice|tracking +trackier.vip|Cocospy|c2 +trackine.vip|Cocospy|c2 +tracking-smartphone.firebaseio.com|TrackingSmartphone|c2 +tracking.hexilo.com|MobileTracker|tracking +tracking.india.miui.com|MobileTracker|tracking +tracking.intl.miui.com|MobileTracker|tracking +tracking.mliteapp.com|mSpy|c2 +tracking.mspyonline.com|mSpy|c2 +tracking.rus.miui.com|MobileTracker|tracking +trackingsmartphone.com|TrackingSmartphone|c2 +trackingsmartphone.com|TrackingSmartphone|tracking +trackji.com|Trackji|c2 +trackji.com|Trackji|tracking +trackmy.mobi|EasyPhoneTrack|c2 +trackmyphones-pro.firebaseio.com|TrackMyPhones|c2 +trackmyphones.com|TrackMyPhones|c2 +trackmyphones.com|TrackMyPhones|tracking +trackpro.vip|Cocospy|c2 +trackserviceonline.xyz|202006_DarkBasin|c2 +tracksp-7743c.firebaseio.com|AiSpyer|c2 +tracksp.in|AiSpyer|c2 +trackview.net|TrackView|c2 +trackview.net|TrackView|tracking +trackview.recurly.com|TrackView|tracking +transatitonneap.com|MobileTracker|tracking +transferdomainhk.com|202006_DarkBasin|c2 +transferdomainlu.com|202006_DarkBasin|c2 +transferdomainmy.com|202006_DarkBasin|c2 +transferserver33.com|202006_DarkBasin|c2 +translations.matetranslate.com|MobileTracker|tracking +trcalluecodr.com|MobileTracker|tracking +treasury.email|2021_07_taking_action_against_hackers_in_iran|c2 +trecv.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +trecvf.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +treporter.com|2021_07_taking_action_against_hackers_in_iran|c2 +trfvbnji7.com|MobileTracker|tracking +tricktravelbooking.com|202006_DarkBasin|c2 +trkc.online|2021_12_taking_action_against_surveillance_for_hire|c2 +trkps.com|FlexiSpy|c2 +truck-rouddrive.com|MobileTracker|tracking +true-truck-86810.appspot.com|MobileTracker|tracking +true-truck-86810.firebaseio.com|MobileTracker|tracking +true-truck-86810.firebaseio.com|XNSpy|c2 +truewebmedia.com|pcTattletale|c2 +trumphotel.net|2021_07_taking_action_against_hackers_in_iran|c2 +trumpnationallosangeles.email|2021_07_taking_action_against_hackers_in_iran|c2 +trumporganization.world|2021_07_taking_action_against_hackers_in_iran|c2 +trumporganizations.com|2021_07_taking_action_against_hackers_in_iran|c2 +trustcor.co|MobileTracker|tracking +trustedserviceonline.com|202006_DarkBasin|c2 +trusteventservices.com|202006_DarkBasin|c2 +tsrt.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +tt.umobix.com|uMobix|tracking +ttjj.ga|RealtimeSpy|c2 +ttjj.ml|RealtimeSpy|c2 +ttjj.tk|RealtimeSpy|c2 +ttspy.com|RealtimeSpy|c2 +ttspy.net|RealtimeSpy|c2 +ttspy.top|RealtimeSpy|c2 +turbophonepsy.com|HighsterMobile|tracking +turkeynewsupdates.com|201608_NSO_Group|c2 +turkishairines.info|201608_NSO_Group|c2 +tv-youtube.com|2021_07_taking_action_against_hackers_in_iran|c2 +tw.itter.me|2021_12_taking_action_against_surveillance_for_hire|c2 +twi-tter.vip|MobileTracker|tracking +twiitter.com.mx|201706_RecklessExploit|c2 +twtter.net|2021_12_taking_action_against_surveillance_for_hire|c2 +u1.panspy.com|PanSpy|c2 +ua.brunoespiao.com.br|BrunoEspiao|c2 +ua.evaspy.com|EvaSpy|c2 +ua.tispy.me|AndroidPolice|tracking +ua.tispy.net|AndroidPolice|c2 +ua.tispy.net|AndroidPolice|tracking +uaenews.online|201608_NSO_Group|c2 +uataz.quickolabs.com|MobileTracker|tracking +ub.evaspy.com|EvaSpy|c2 +ubanks.icu|2021_04_taking_action_against_hackers_in_palestine|c2 +ube.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +uberegypt.cn.com|2021_12_taking_action_against_surveillance_for_hire|c2 +ublocker-chrome.com|MobileTracker|tracking +uc.evaspy.com|EvaSpy|c2 +ud.evaspy.com|EvaSpy|c2 +udata.elephantdata.net|MobileTracker|tracking +ue.brunoespiao.com.br|BrunoEspiao|c2 +ue.evaspy.com|EvaSpy|c2 +ue.maglook.eu|MagMonitor|c2 +uf.brunoespiao.com.br|BrunoEspiao|c2 +uf.evaspy.com|EvaSpy|c2 +uf.maglook.eu|MagMonitor|c2 +uf1.brunoespiao.com.br|BrunoEspiao|c2 +ufz.doesxyz.com|MobileTracker|tracking +ug.evaspy.com|EvaSpy|c2 +ug1c5v.birxpk.com|MobileTool|c2 +uh.evaspy.com|EvaSpy|c2 +uhtpuerdfbnm.com|2021_03_taking_action_against_hackers_in_china|c2 +uhtpuerdfbnm.com|MobileTracker|tracking +ui.evaspy.com|EvaSpy|c2 +uj.evaspy.com|EvaSpy|c2 +uk.evaspy.com|EvaSpy|c2 +ukraine2day.com|2022_04_metas_adversarial_threat_report_q1|c2 +ul.evaspy.com|EvaSpy|c2 +ultimatephonespy.com|AndroidMonitor|tracking +ultimateresponseservice.com|202006_DarkBasin|c2 +ultronnetworksolution.com|202006_DarkBasin|c2 +um.evaspy.com|EvaSpy|c2 +umobix.com|uMobix|tracking +un-told.net|202006_DarkBasin|c2 +un.evaspy.com|EvaSpy|c2 +uncherdroid.com|MobileTracker|tracking +unisafe-a342f.firebaseio.com|Unisafe|c2 +unisafe.su|Unisafe|tracking +unisafe.techmas.ru|Unisafe|tracking +unityads.unity3d.com|MobileTracker|tracking +univision.click|201608_NSO_Group|c2 +unonoticias.net|201608_NSO_Group|c2 +unonoticias.net|201706_RecklessExploit|c2 +uo.evaspy.com|EvaSpy|c2 +up.evaspy.com|EvaSpy|c2 +upd-ms3-app-state.com|201803_BadTraffic|c2 +update-outlook.info|201512_PackRAT|c2 +update-service-7e59f.firebaseio.com|mSpy|c2 +update.crashlytics.com|MobileTracker|tracking +updateddns.ddns.net|2022_04_metas_adversarial_threat_report_q1|c2 +updatedefender.net|2022_04_metas_adversarial_threat_report_q1|c2 +updatedns.ddns.net|2022_04_metas_adversarial_threat_report_q1|c2 +updatenameserver45.com|202006_DarkBasin|c2 +updates4you.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +updateservice.center|2021_12_taking_action_against_surveillance_for_hire|c2 +updateservices.co|2022_04_metas_adversarial_threat_report_q1|c2 +updatetime.zone|2021_12_taking_action_against_surveillance_for_hire|c2 +updatingnews.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +updete.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +updserv-east-cdn3.com|201803_BadTraffic|c2 +upgradetravelservice.com|202006_DarkBasin|c2 +upload-tutelawest.s3-accelerate.amazonaws.com|MobileTracker|tracking +upload.weiguanai.cn|RealtimeSpy|c2 +uploaderfile.cf|2021_07_taking_action_against_hackers_in_iran|c2 +uq.evaspy.com|EvaSpy|c2 +ur.brunoespiao.com.br|BrunoEspiao|c2 +ur.evaspy.com|EvaSpy|c2 +ur.spyone.pl|Spyone|c2 +uri-ready.website|2021_04_taking_action_against_hackers_in_palestine|c2 +urirank.com|MobileTracker|tracking +url-promo.club|2021_12_taking_action_against_surveillance_for_hire|c2 +url-redirect.website|2021_04_taking_action_against_hackers_in_palestine|c2 +url-tiny.app|2021_12_taking_action_against_surveillance_for_hire|c2 +urtyhfds.com|MobileTracker|tracking +us-central1-api-project-285519687053.cloudfunctions.net|TrackView|c2 +us-central1-catwatchful-e03b8.cloudfunctions.net|CatWatchful|c2 +us-central1-production-242307.cloudfunctions.net|MobileTracker|tracking +us.umobix.com|uMobix|c2 +us.xnspy.pro|TheTruthSpy|tracking +us01.salmonads.com|MobileTracker|tracking +us1-spiky.wzrkt.com|MobileTracker|tracking +us1.cb.wzrkt.com|MobileTracker|tracking +us1.wzrkt.com|MobileTracker|tracking +usacia.websecexp.com|201510_NGO_Burma|c2 +usafbi.websecexp.com|201510_NGO_Burma|c2 +usafe-ca594.firebaseio.com|Unisafe|c2 +usafe.ru|Unisafe|c2 +usafe.ru|Unisafe|tracking +usdailypost.com|2021_07_taking_action_against_hackers_in_iran|c2 +usdailypost.net|2021_07_taking_action_against_hackers_in_iran|c2 +usdp.news|2021_07_taking_action_against_hackers_in_iran|c2 +user.mycellspy.com|AndroidPolice|tracking +user.ownspy.es|OwnSpy|c2 +user.trackview.net|TrackView|c2 +user2.trackview.net|TrackView|c2 +userauthen.pw|MobileTracker|tracking +users.awosoft.com|iKeyMonitor|c2 +users.easemon.com|iKeyMonitor|c2 +users.thephonem.com|PhoneMonitor|c2 +users.thephonem.com|PhoneMonitor|tracking +uservicescheck.com|2021_12_taking_action_against_surveillance_for_hire|c2 +uservicesforyou.com|2021_12_taking_action_against_surveillance_for_hire|c2 +usewithcareathome.com|202006_DarkBasin|c2 +utube.digital|2021_12_taking_action_against_surveillance_for_hire|c2 +uu.domainforlite.com|MobileTracker|tracking +uyghur-news.com|2021_03_taking_action_against_hackers_in_china|c2 +uyghur-news.com|MobileTracker|tracking +uyghur-soft-market.com|2021_03_taking_action_against_hackers_in_china|c2 +uyghur-soft-market.com|MobileTracker|tracking +uyghurhaber.com|2021_03_taking_action_against_hackers_in_china|c2 +uyghurhaber.com|MobileTracker|tracking +v-talk.top|MobileTracker|tracking +v-talk.vip|MobileTracker|tracking +v.mobzones.com|MobileTracker|tracking +v4vw4ytvo4.execute-api.us-east-2.amazonaws.com|Spyier|c2 +v9czaci.xyz|MobileTracker|tracking +vaccine-appointment.link|MobileTracker|tracking +vaicore.xyz|MobileTracker|tracking +vbchs.com|MobileTracker|tracking +vbchs.org|MobileTracker|tracking +vbhacker.space|MobileTracker|tracking +vbhackerspace.com|MobileTracker|tracking +vbhackerspace.org|MobileTracker|tracking +vd.toobox.online|MobileTracker|tracking +ve.toobox.online|MobileTracker|tracking +vedioplayers2020.000webhostapp.com|2021_04_taking_action_against_hackers_in_palestine|c2 +venezuela365.com|201512_PackRAT|c2 +verification-acc.servehttp.com|201702_NilePhish|c2 +verification-team.servehttp.com|201702_NilePhish|c2 +verify-gmail-support-secure.tk|201512_PackRAT|c2 +verifyurl.me|MobileTracker|tracking +vickeryduncan.site|2021_04_taking_action_against_hackers_in_palestine|c2 +video-recorder-c0419.firebaseio.com|TrackMyPhones|c2 +video-url.tutelatechnologies.com|MobileTracker|tracking +videos.ultrawidevideo.com|MobileTracker|tracking +videosound.vip|MobileTracker|tracking +viewer.snoopza.com|Snoopza|c2 +viptelefonprogrami.com|AndroidPolice|c2 +viptelefonprogrami.com|AndroidPolice|tracking +viptrack.pro|Cocospy|c2 +viptrack.ro|VIPTrack|tracking +vipyoga.today|MobileTracker|tracking +virsis.net|HelloSpy|c2 +vista-chat.com|2021_04_taking_action_against_hackers_in_palestine|c2 +viva.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +vkur.se|Reptilicus|c2 +vkur1.se|Reptilicus|c2 +vl.denrok.space|MobileTracker|tracking +vodafoneegypt.tech|2021_12_taking_action_against_surveillance_for_hire|c2 +vodafonegypt.com|2021_12_taking_action_against_surveillance_for_hire|c2 +voicecontrol.top|MobileTracker|tracking +voicesupport.vip|MobileTracker|tracking +vortnomade.net|MobileTracker|tracking +vostrom.ventures|MobileTracker|tracking +vote2021.w3spaces.com|2022_04_metas_adversarial_threat_report_q1|c2 +vpnzfep.com|MobileTracker|tracking +vps.limited|2021_07_taking_action_against_hackers_in_iran|c2 +vt.toobox.online|MobileTracker|tracking +vtalk.vip|MobileTracker|tracking +vys.me|MobiStealth|c2 +w-video.vip|MobileTracker|tracking +w9x7itu.xyz|MobileTracker|tracking +wa-info.com|MobileTracker|tracking +wa.zcnewy.com|MobileTracker|tracking +wab-wahtsapp.com|2021_04_taking_action_against_hackers_in_palestine|c2 +wahrheitindenaugen.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +walkingnote.online|201909_MissingLink|c2 +wallvoluminousfourk.club|MobileTracker|tracking +wannameet.co|2021_04_taking_action_against_hackers_in_palestine|c2 +wap.trend-tech.net|MobileTracker|tracking +warhehit.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhehit.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhehit.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhehit.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhehit.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhehit.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheiiptdaunegn.link|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheiiptdaunegn.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheintbaunegn.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheintdaunegn.link|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheintdaunegn.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheit.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheit.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheit.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheit.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +warhheit.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +watch-youtube.com|2021_07_taking_action_against_hackers_in_iran|c2 +watchmanservice.com|202006_DarkBasin|c2 +watchyoutube.servehttp.com|201702_NilePhish|c2 +wavekli.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +waws-prod-blu-247-e7b3.eastus.cloudapp.azure.com|EasyLogger|c2 +waws-prod-blu-247.sip.azurewebsites.windows.net|EasyLogger|c2 +wcf.seven1029.com|MobileTracker|tracking +we-site.net|2021_12_taking_action_against_surveillance_for_hire|c2 +weathear.live|2021_12_taking_action_against_surveillance_for_hire|c2 +weather.play-protect.com|2022_08_metas_adversarial_threat_report_q2|c2 +weatherclub.club|MobileTracker|tracking +weathernewz.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +weathersite.online|2021_12_taking_action_against_surveillance_for_hire|c2 +web.ab-salute.com|MobileTracker|tracking +web.chyldmonitor.com|OneSpy|c2 +web.fenced.ai|Fenced|tracking +web.mobilespy.io|Fenced|tracking +web.whatssapp.co|MobileTracker|tracking +webadv.co|201608_NSO_Group|c2 +webaffise.com|2021_12_taking_action_against_surveillance_for_hire|c2 +webdetetive.com.br|OwnSpy|tracking +webdetetive.era3000.com|OwnSpy|tracking +webdomainexperts.com|202006_DarkBasin|c2 +webhostwebcare.com|202006_DarkBasin|c2 +webhttps.websecexp.com|201510_NGO_Burma|c2 +webmail-dalailama.com|201801_SpyingOnABudget|c2 +webmail-dalailama.space|201801_SpyingOnABudget|c2 +webmail-mpt.space|201801_SpyingOnABudget|c2 +webmail.dalailama.space|201801_SpyingOnABudget|c2 +webmail.postmailsecret.com|201801_SpyingOnABudget|c2 +webmailmanageruk.com|202006_DarkBasin|c2 +webmasterserver39.com|202006_DarkBasin|c2 +webnetonlineservice.com|202006_DarkBasin|c2 +webredirect.click|202006_DarkBasin|c2 +webredirect39.com|202006_DarkBasin|c2 +webrtc.thd.cc|mSpy|c2 +webscan.cyber-risk.upguard.com|MobileTracker|tracking +websecurehostings.com|202006_DarkBasin|c2 +webserver39.com|202006_DarkBasin|c2 +webserver39490.com|202006_DarkBasin|c2 +webserver91.website|202006_DarkBasin|c2 +webserverdomaineu.com|202006_DarkBasin|c2 +webserverdomainhk.com|202006_DarkBasin|c2 +webserverdomainuk.com|202006_DarkBasin|c2 +webserverdomainusa.com|202006_DarkBasin|c2 +webserverhollandservice.com|202006_DarkBasin|c2 +webserveroginusa.com|202006_DarkBasin|c2 +webserveronline9.com|202006_DarkBasin|c2 +webserverredirect99.com|202006_DarkBasin|c2 +webservicesdb.mobiispy.com|HelloSpy|c2 +websiteadminuk.com|202006_DarkBasin|c2 +websitemanagerusa.com|202006_DarkBasin|c2 +websociofiles.com|202006_DarkBasin|c2 +webviewbridge.unityads.unity3d.com|MobileTracker|tracking +webwatcher-child-app.firebaseio.com|AndroidPolice|c2 +webwatcher.com|AndroidPolice|tracking +webwatcherdata.com|AndroidPolice|c2 +webwatchernow.com|AndroidPolice|c2 +welt.ltd|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +welt.media|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +welt.tours|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +welt.ws|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +wendy-johnston.pw|2021_04_taking_action_against_hackers_in_palestine|c2 +wengiguowengui.space|201801_SpyingOnABudget|c2 +werdunstorker.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +werdunstorker.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +werdunstorker.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +wethnc067.xyz|MobileTool|c2 +weysys.com|TheTruthSpy|tracking +wfupppx.com|MobileTracker|tracking +wha.tsapp.me|2021_12_taking_action_against_surveillance_for_hire|c2 +what-sapp.site|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +whatsapp-app.com|201608_NSO_Group|c2 +whatsapp-sy.com|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +whatsmesticker.club|MobileTracker|tracking +whatspp.wa-info.com|MobileTracker|tracking +whatssapp.co|MobileTracker|tracking +where-is-my-children.firebase.io|FindMyKids|c2 +wheresmydroid.com|WheresMyDroid|tracking +whispers-talk.site|2021_04_taking_action_against_hackers_in_palestine|c2 +whoisanalyzer.com|MobileTracker|tracking +whoisanalyzerpro.com|MobileTracker|tracking +whrheit.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +whrheit.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +whrheit.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +whrheit.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +whrheit.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +whrheit.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +whynotworkonit.top|MobileTracker|tracking +wikileaks.email|2021_07_taking_action_against_hackers_in_iran|c2 +williedvazquez.club|2021_04_taking_action_against_hackers_in_palestine|c2 +win.spynger.net|Spynger|distribution +window.processingdownloads.today|201803_BadTraffic|c2 +wine-talk.online|2021_04_taking_action_against_hackers_in_palestine|c2 +winetalk-9ff2d.appspot.com|2021_04_taking_action_against_hackers_in_palestine|c2 +winetalk-9ff2d.firebaseio.com|2021_04_taking_action_against_hackers_in_palestine|c2 +winupdate.space|201801_SpyingOnABudget|c2 +wisemo.com|WiseMo|tracking +wjwj.no-ip.org|201512_PackRAT|c2 +wjwjwj.no-ip.org|201512_PackRAT|c2 +wjwjwjwj.no-ip.org|201512_PackRAT|c2 +wmdcommander.appspot.com|WheresMyDroid|c2 +wmdcommander.appspot.com|WheresMyDroid|tracking +wonderfulinsights.com|201810_TheKingdomCameToCanada|c2 +workshopplatform.network|2021_07_taking_action_against_hackers_in_iran|c2 +worldnws.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +wpc.A3CD.edgecastcdn.net|MobileTracker|tracking +wppspy.tech|XNSpy|c2 +wrhheit.fun|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +wrhheit.online|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +wrhheit.pw|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +wrhheit.site|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +wrhheit.space|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +wrhheit.website|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +ws.findgravy.com|MobileTracker|tracking +ws.nextialive.roimaster.site|MobileTracker|tracking +ws.ttspy.com|RealtimeSpy|c2 +wss.findmykids.org|FindMyKids|c2 +wt-spy.com|WtSpy|tracking +wtc1111.com|2021_12_taking_action_against_surveillance_for_hire|c2 +wtc2222.com|2021_12_taking_action_against_surveillance_for_hire|c2 +wtc3333.com|2021_12_taking_action_against_surveillance_for_hire|c2 +wts-app.info|MobileTracker|tracking +wvv.kcpro.ga|MobileTracker|tracking +www.11111.pl|Spyone|distribution +www.a-spy.com|RealtimeSpy|tracking +www.about.jkub.com|201611_KeyBoy|c2 +www.aispyer.com|AiSpyer|tracking +www.alinbox.co|MobileTracker|tracking +www.android-monitor.ru|AndroidPolice|c2 +www.android-monitor.ru|AndroidPolice|tracking +www.android007.com|Android007|tracking +www.androidlost.com|AndroidLost|c2 +www.androidlost.com|AndroidLost|tracking +www.androidmonitor.com|AndroidMonitor|tracking +www.apk7.biz|AndroidPolice|c2 +www.apkcar.com|MobileTracker|tracking +www.apkhl.pw|2021_03_taking_action_against_hackers_in_china|c2 +www.apkhl.pw|MobileTracker|tracking +www.apkpure.bz|2021_03_taking_action_against_hackers_in_china|c2 +www.apkpure.bz|MobileTracker|tracking +www.app-spy.com|SpyPhoneApp|c2 +www.apphububstore.in|2021_11_action_against_hackers_in_pakistan_and_syria|c2 +www.appmarket.co|MobileTracker|tracking +www.appspy.com|AppSpy|tracking +www.appspy.net|AppSpy|tracking +www.apptracker.net|AppSpy|tracking +www.backus.myftp.name|201611_KeyBoy|c2 +www.bark.us|bark|c2 +www.bark.us|bark|tracking +www.bbiindia.com|LetMeSpy|tracking +www.blackboxmusic.co|201512_PackRAT|c2 +www.blexb.com|MobileTracker|tracking +www.blurspy.com|BlurSpy|tracking +www.bowenpress.org|201707_InsiderInfo|c2 +www.brunoespiao.com.br|BrunoEspiao|c2 +www.cangquyun.com|MobileTracker|tracking +www.cellmonitoring.co|PhoneSheriff|c2 +www.cellphonespyappon.com|AppSpy|tracking +www.cerberusapp.com|Cerberus|c2 +www.cerberusapp.com|Cerberus|tracking +www.cerberusbrasil.com|Cerberus|tracking +www.childsafetytrackerapp.com|EasyLogger|tracking +www.clevguard.com|ClevGuard|tracking +www.comemail.email|201808_FamiliarFeeling|c2 +www.drive-mail.info|201801_SpyingOnABudget|c2 +www.drive-mail.online|201801_SpyingOnABudget|c2 +www.drive-mail.us|201801_SpyingOnABudget|c2 +www.drlve-gooog1e.com|201801_SpyingOnABudget|c2 +www.e-spy.org|AndroidPolice|c2 +www.e-spy.org|AndroidPolice|tracking +www.einformatiks.com|MobiStealth|c2 +www.eleven.mypop3.org|201611_KeyBoy|c2 +www.emobilespy.com|PhoneSheriff|tracking +www.energy-mail.org|201909_MissingLink|c2 +www.enhancedimageviewer.com|MobileTracker|tracking +www.espiaodecelulargratis.com.br|MeuSpy|tracking +www.everestnote.com|MobileTracker|tracking +www.eyezy.com|mSpy|tracking +www.flexispy.com|FlexiSpy|tracking +www.flyermobi.com|MobileTracker|tracking +www.fonemonitor.co|Cocospy|tracking +www.freemobilespy.net|AppSpy|tracking +www.freephonespy.net|AppSpy|tracking +www.gmail-profile.com|201801_SpyingOnABudget|c2 +www.google-sign.tk|201801_SpyingOnABudget|c2 +www.google.comemails.email|201808_FamiliarFeeling|c2 +www.hiddensmstracker.com|CallSMSTracker|tracking +www.hiddensystemhealth.com|CallSMSTracker|tracking +www.hoverwatch.com|Hoverwatch|tracking +www.imonitorsoft.cn|iMonitorSpy|c2 +www.imonitorsoft.cn|iMonitorSpy|tracking +www.imonitorsoft.com|iMonitorSpy|c2 +www.imonitorsoft.com|iMonitorSpy|tracking +www.ioi.life|AiSpyer|c2 +www.izkid.com|AndroidPolice|tracking +www.jjspy.com|RealtimeSpy|tracking +www.jueoxdr.com|MobileTracker|tracking +www.juju.co.ke|AndroidPolice|tracking +www.kidlogger.net|AndroidPolice|tracking +www.letmespy.com|LetMeSpy|tracking +www.liveupdate.cc|MobileTracker|tracking +www.login-live.us|201801_SpyingOnABudget|c2 +www.maglook.eu|MagMonitor|c2 +www.mail-attachment-usercontent.space|201801_SpyingOnABudget|c2 +www.mail-protect.space|201801_SpyingOnABudget|c2 +www.mail.secuerserver.com|201707_InsiderInfo|c2 +www.minspy.com|Cocospy|tracking +www.mnfbodivbv.com|MobileTracker|tracking +www.mobile-spy.com|PhoneSheriff|tracking +www.mobilespy.at|AndroidPolice|tracking +www.mobilespyfree.net|AppSpy|tracking +www.mobilestealthreview.com|MobiStealth|tracking +www.mobiletool.ru|MobileTool|tracking +www.mobistealth.com|MobiStealth|tracking +www.movimientoanticorreista.com|201512_PackRAT|c2 +www.msafe.xyz|AndroidPolice|c2 +www.msap.services|201909_MissingLink|c2 +www.mspy.com|mSpy|c2 +www.mspy.com|mSpy|tracking +www.mspyitaly.com|AndroidPolice|tracking +www.mspyonline.com|mSpy|c2 +www.mspyonline.com|mSpy|tracking +www.mtoolapp.net|MobileTool|c2 +www.mtoolapp.net|MobileTool|tracking +www.mxspy.com|TheTruthSpy|tracking +www.myandroid.org|MobileTracker|tracking +www.mydwnd.com|XNSpy|c2 +www.mzeibiyr.com|MobileTracker|tracking +www.netspy.net|NetSpy|tracking +www.observer.pw|Observer|tracking +www.offerslove.com|MobileTracker|tracking +www.okjojihgv.com|MobileTracker|tracking +www.olinaodi.com|201604_UP007_SLServer|c2 +www.onworks.net|MobileTracker|tracking +www.pctattletale.com|pcTattletale|tracking +www.pgv4.com|SpyApp|c2 +www.phone-spy.com|PhoneSpy|tracking +www.phonesheriff.com|PhoneSheriff|tracking +www.phonespying.com|TheTruthSpy|tracking +www.phonetracker.com|SpyphoneMobileTracker|tracking +www.platstack.com|MobileTracker|tracking +www.questionai.com|MobileTracker|tracking +www.realtime-spy-mobile.com|RealtimeSpy|tracking +www.recentnews.cc|MobileTracker|tracking +www.refog.com|Hoverwatch|tracking +www.reptilicus.net|Reptilicus|c2 +www.retinax.com|PhoneSheriff|tracking +www.riospy.net|RioSPY|tracking +www.runapps.org|MobileTracker|tracking +www.secuerserver.com|201707_InsiderInfo|c2 +www.selfspy.com|AndroidPolice|tracking +www.seniorsafetyapp.com|EasyLogger|tracking +www.sentrypc.com|SentryPC|tracking +www.sentrypc.download|SentryPC|c2 +www.sentrypc.net|SentryPC|c2 +www.sentrypconline.com|SentryPC|c2 +www.shadow-logs.com|ShadowSpy|c2 +www.shadow-logs.com|ShadowSpy|tracking +www.shadow-spy.com|ShadowSpy|tracking +www.shadyspy.com|ShadySpy|c2 +www.shadyspy.com|ShadySpy|tracking +www.shopper.com|MobileTracker|tracking +www.sikhsiyasatapp.net|2022_08_metas_adversarial_threat_report_q2|c2 +www.smartguardapp.com|AbsoluTrack|tracking +www.smstrackerweb.com|CallSMSTracker|tracking +www.spappmonitoring.com|EasyPhoneTrack|tracking +www.spappmonitoring.com|SpyPhoneApp|c2 +www.spclogs.com|SentryPC|c2 +www.speedcheck.org|MobileTracker|tracking +www.speedspot1.com|MobileTracker|tracking +www.speedspot2.com|MobileTracker|tracking +www.speedspot3.com|MobileTracker|tracking +www.speedspot4.com|MobileTracker|tracking +www.speedspot5.com|MobileTracker|tracking +www.speedspot6.com|MobileTracker|tracking +www.speedspot7.com|MobileTracker|tracking +www.spy-datacenter.com|EasyPhoneTrack|c2 +www.spy-phone-app.com|SpyPhoneApp|c2 +www.spy2mobile.com|AndroidPolice|tracking +www.spyapp.ch|SpyApp|tracking +www.spyapp.ro|SpyApp|tracking +www.spybunker.com|Android007|tracking +www.spyequipmentuk.co.uk|MonitorUltra|tracking +www.spyhide.com|HelloSpy|c2 +www.spyhide.com|HelloSpy|tracking +www.spyhide.ir|HelloSpy|c2 +www.spyhide.ir|HelloSpy|tracking +www.spyic.com|Cocospy|tracking +www.spykontrol.com|AndroidPolice|tracking +www.spylive360.com|SpyLive360|tracking +www.spylix.com|AndroidPolice|tracking +www.spymasterpro.com|SpyMasterPro|tracking +www.spynote.us|SpyNote|tracking +www.spyphone.com|SpyphoneMobileTracker|tracking +www.spyphonereview.com|FlexiSpy|tracking +www.spyren.com|AppSpy|tracking +www.spyrix.com|EvaSpy|tracking +www.spytec.com|SpyTec|tracking +www.spytech-web.com|RealtimeSpy|tracking +www.spytomobile.com|AndroidPolice|tracking +www.spyzie.com|Cocospy|c2 +www.spyzie.com|Cocospy|tracking +www.studentenkorting.nl|MobileTracker|tracking +www.suppro.co|MobileTracker|tracking +www.surepointspy.com|HighsterMobile|tracking +www.teensafe.net|Cocospy|tracking +www.teensoftware.com|Cocospy|tracking +www.teleszpieg.pl|LetMeSpy|tracking +www.theonespy.com|TheOneSpy|tracking +www.thewispy.com|TheWiSpy|tracking +www.timpromos.com.br|MobileTracker|tracking +www.traccar.org|Traccar|tracking +www.trackerfree.net|AppSpy|tracking +www.trackingsmartphone.com|TrackingSmartphone|tracking +www.trackmyphones.com|TrackMyPhones|c2 +www.trackmyphones.com|TrackMyPhones|tracking +www.truckrental.cc|MobileTracker|tracking +www.ttjj.tk|RealtimeSpy|c2 +www.ttspy.com|RealtimeSpy|tracking +www.uptoplay.net|MobileTracker|tracking +www.vnews.hk|201707_InsiderInfo|c2 +www.vys.me|MobiStealth|c2 +www.webwatcher.com|AndroidPolice|tracking +www.webwatchernow.com|AndroidPolice|c2 +www.wheresmydroid.com|WheresMyDroid|tracking +www.wisemo.com|WiseMo|tracking +www.xvids.us|AppSpy|tracking +www.yahoo-verification.us|201801_SpyingOnABudget|c2 +www.ywupscsff.com|MobileTracker|tracking +wwwhisp.com|MobileTracker|tracking +wx.weiguanai.cn|RealtimeSpy|c2 +wzrkt.com|MobileTracker|tracking +x.pgv4.com|SpyApp|c2 +x.securspy.com|SpyApp|tracking +x.spyapp.ro|SpyApp|tracking +x1panel.com|MonitorUltra|c2 +xapi.shastic.com|MobileTracker|tracking +xdspy.app|XDSpy|tracking +xf.actor|2021_12_taking_action_against_surveillance_for_hire|c2 +xiaoyuner.com|MobileTracker|tracking +xin-corp.space|201801_SpyingOnABudget|c2 +xiz4me.com|MobileTracker|tracking +xmyevq.birxpk.com|MobileTool|c2 +xn--rumphotels-vcc.com|2021_07_taking_action_against_hackers_in_iran|c2 +xn--twitte-u9a.com|2021_07_taking_action_against_hackers_in_iran|c2 +xnore.com|Xnore|c2 +xnore.com|Xnore|tracking +xnspy.com|XNSpy|c2 +xnspy.com|XNSpy|tracking +xnspy.pro|TheTruthSpy|tracking +xnxx-hub.com|2021_12_taking_action_against_surveillance_for_hire|c2 +xoxospy.com|BlurSpy|tracking +xpcpanel.com|MonitorUltra|c2 +xpertdomain.com|202006_DarkBasin|c2 +xpertmaildomain.com|202006_DarkBasin|c2 +xploitwizer.com|XploitSPY|tracking +xpspy.com|TheTruthSpy|tracking +xvids.us|AppSpy|tracking +xyvok.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +xyzsitexyz.xyz|2021_07_taking_action_against_hackers_in_iran|c2 +y0utube.com.mx|201608_NSO_Group|c2 +y0vvbm.xyz|MobileTracker|tracking +yahoo-device.tk|201801_SpyingOnABudget|c2 +yahoo-edit.us|201801_SpyingOnABudget|c2 +yahoo-images.com|201801_SpyingOnABudget|c2 +yahoo-noreply.tk|201801_SpyingOnABudget|c2 +yahoo-protect.com|201801_SpyingOnABudget|c2 +yahoo-safety.com|201801_SpyingOnABudget|c2 +yahoo-secure.tk|201801_SpyingOnABudget|c2 +yahoo-verification.us|201801_SpyingOnABudget|c2 +yahoomaintain.com|201801_SpyingOnABudget|c2 +yallakora-egy.com|2021_12_taking_action_against_surveillance_for_hire|c2 +ycxrl.com|MobileTracker|tracking +ydc.kcpro.ga|MobileTracker|tracking +ymail-account.support|2021_07_taking_action_against_hackers_in_iran|c2 +ymail-security-support.email|2021_07_taking_action_against_hackers_in_iran|c2 +ymail-security.support|2021_07_taking_action_against_hackers_in_iran|c2 +ymail-settings.space|201801_SpyingOnABudget|c2 +ymailaccounts.us|2021_07_taking_action_against_hackers_in_iran|c2 +ymailsupport.info|2021_07_taking_action_against_hackers_in_iran|c2 +ymex.apkcar.com|MobileTracker|tracking +ymlog.apkcar.com|MobileTracker|tracking +ymsdk.apkcar.com|MobileTracker|tracking +yo.utube.digital|2021_12_taking_action_against_surveillance_for_hire|c2 +yo.utube.to|2021_12_taking_action_against_surveillance_for_hire|c2 +yoga4u.xyz|MobileTracker|tracking +youarefired.xyz|2021_12_taking_action_against_surveillance_for_hire|c2 +your-access-here.com|MobileTracker|tracking +youranotherserver.com|202006_DarkBasin|c2 +yoursdrive.com|2022_08_metas_adversarial_threat_report_q2|c2 +yout.ube.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +youtu-be.net|2021_12_taking_action_against_surveillance_for_hire|c2 +youtub.app|2021_12_taking_action_against_surveillance_for_hire|c2 +youtube.gr.live|2021_12_taking_action_against_surveillance_for_hire|c2 +youtube.voto|2021_12_taking_action_against_surveillance_for_hire|c2 +youtubepremiumapp.com|2022_08_metas_adversarial_threat_report_q2|c2 +youtubesyncapi.com|2021_12_taking_action_against_surveillance_for_hire|c2 +youtubewatch.co|2021_12_taking_action_against_surveillance_for_hire|c2 +yq0z3d.xyz|MobileTracker|tracking +yqchpwxvbg.execute-api.us-east-1.amazonaws.com|MobileTracker|tracking +yuom7.net|2021_12_taking_action_against_surveillance_for_hire|c2 +z2a.digital|2021_12_taking_action_against_surveillance_for_hire|c2 +z2adigital.cloud|2021_12_taking_action_against_surveillance_for_hire|c2 +z2digital.cloud|2021_12_taking_action_against_surveillance_for_hire|c2 +za.startdownload.mobi|MobileTracker|tracking +zain.network|2021_07_taking_action_against_hackers_in_iran|c2 +zdalnakontrola.pl|LetMeSpy|c2 +zerobt.net|MobileTracker|tracking +zerobyte.top|MobileTracker|tracking +zestiftung.com|2022_09_removing_coordinated_inauthentic_behavior_from_china_and_russia|c2 +zeusalmighty.club|MobileTracker|tracking +zmq5ytc1-api.findgravy.com|MobileTracker|tracking +zodiachand.club|MobileTracker|tracking +zoo.bearclod.com|MobileTracker|tracking +zoofanimalm.com|MobileTracker|tracking +zougla.gr.com|2021_12_taking_action_against_surveillance_for_hire|c2 +zougla.news|2021_12_taking_action_against_surveillance_for_hire|c2 +zqn.kcpro.ga|MobileTracker|tracking +zsrvrer.com|202006_DarkBasin|c2 +zsx.kcpro.ga|MobileTracker|tracking +zumba.tampotrust.agency|MobileTracker|tracking diff --git a/vigil/ioc/hashes.txt b/vigil/ioc/hashes.txt new file mode 100644 index 0000000..99d0b64 --- /dev/null +++ b/vigil/ioc/hashes.txt @@ -0,0 +1,298 @@ +# Vigil IOC: Malicious file hashes +# Format: hash|threat_name|hash_type +001316808aa7108b467e8ecc06139c2e|201803_BadTraffic|MD5 +01dec1b1d0760d5a1a562edcfeb478d1|201512_PackRAT|MD5 +01fe88068e43c2276f7d8bbf54824f0f|2021_03_taking_action_against_hackers_in_china|MD5 +029ba5f0f6997bc36a094e86848a5b82|201707_InsiderInfo|MD5 +03de278ec4c4855b885520a377f8b1df462a1d8a4b57b492b3b052aafe509793|2021_04_taking_action_against_hackers_in_palestine|SHA256 +05320c7348c156f0a98907d2b1527ff080eae36437d58735f2822d9f42f5d273|2021_04_taking_action_against_hackers_in_palestine|SHA256 +0540051935145fb1e3f9361ec55b62a759ce6796c1f355249805d186046328dc|2021_04_taking_action_against_hackers_in_palestine|SHA256 +054bad7ec0e19cec931078d45382fee6|201808_FamiliarFeeling|MD5 +058a5d47f8834fccfff8971f0544e387|201808_FamiliarFeeling|MD5 +07532dea34c87ea2c91d2e035ed5dc87|2022_08_metas_adversarial_threat_report_q2|MD5 +07d495245814c5c4996422b4b2f52473|201905_EndlessMayfly|MD5 +087bffa8a570079948310dc9731c5709|201611_KeyBoy|MD5 +08a3bb5b220eb1e0dc2ecccbbc6859f5|201512_PackRAT|MD5 +08b8b4787f3ce90c6c1483cc127b1cdc|201803_BadTraffic|MD5 +08d971f5f4707ae6ea56ed2f243c38b7|201803_BadTraffic|MD5 +09ddd70517cb48a46d9f93644b29c72f|201604_UP007_SLServer|MD5 +0ae0038ffe8cf5c3170734a71ff2213d|201512_PackRAT|MD5 +0c7e55509e0b6d4277b3facf864af018|201611_KeyBoy|MD5 +0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa|201909_MissingLink|SHA256 +0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560|201909_MissingLink|SHA256 +10748ca7648d26316b4857b6139ca93d|2021_03_taking_action_against_hackers_in_china|MD5 +10c1f38305792a0f925e8a2cf9482ce3|2021_03_taking_action_against_hackers_in_china|MD5 +11e0f3e1c7d8855ed7f1dcfce4b7702a|201808_FamiliarFeeling|MD5 +11f47a0f3f1b7e08886a4b6719668ad68405ef0c58fc793efacc778304716cc5|2023_05_malware_iocs|SHA256 +124c475d67aa8391f5220efcc64ca5b3|201808_FamiliarFeeling|MD5 +13b148aead5e844f7262da768873cec0|201707_InsiderInfo|MD5 +13d939b2412c6adbab3cc1b539166671|201512_PackRAT|MD5 +1507f7ecc5fe8ef4c90c853d64e1a9f9|2021_04_taking_action_against_hackers_in_palestine|MD5 +154cb010e8ac4c50a47f4b218c133b5c7d059f5aff4c2820486e0ae511966e89|2021_04_taking_action_against_hackers_in_palestine|SHA256 +15ebe16cd9500de534d5bfd5eeceaf73|201512_PackRAT|MD5 +17fe7554e6ca20fde635a7ae1e265f4a23ece32baa7cc8f573e11dce95bd5ed9|2023_05_malware_iocs|SHA256 +185062606b168f04b8b583045d300be5|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +19c5f8829444956ba30e023aaaec6408|201707_InsiderInfo|MD5 +1b2ada321e2a88d32386efb175787b07dd2098076859a35f715ab1452ada8046|2023_05_malware_iocs|SHA256 +1bf438b5744db73eea58379a3b9f30e5|201603_Shifting_Tactics|MD5 +1c16ee8b2f0dff7280e1d97522ee7e3f|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +1c3757006f972ca957d925accf8bbb3023550d1b|201605_Stealth_Falcon|SHA1 +1e4265a0c37773c2372b97bb6630ae57|201512_PackRAT|MD5 +1e6d0b59d4fb7650453c207688385f3a|201512_PackRAT|MD5 +205a5502ff0da4a471c4dad0e06c6c57|201803_BadTraffic|MD5 +20755b98d7c094747b75b157413e3422|201803_BadTraffic|MD5 +2332aa40d15399179c068ab205a5303d|201707_InsiderInfo|MD5 +23d284245e53ae4fe05c517d807ffccf|201611_KeyBoy|MD5 +250da45d3c509420836958547c8496ab|2021_04_taking_action_against_hackers_in_palestine|MD5 +2580f7afb4746b223b14aceab76bd8bc2e4366bfa55ebf203de2715176032525|2021_04_taking_action_against_hackers_in_palestine|SHA256 +2827450763b55c5e71fda3caaf8e75f9|201512_PackRAT|MD5 +2FC276E1C06C3C78C6D7B66A141213BE|201608_Group5|MD5 +2d722592a4e3c8030410dccccb221ce4|201512_PackRAT|MD5 +2de51e74fd571319bbf763ec62781096|201512_PackRAT|MD5 +2fc276e1c06c3c78c6d7b66a141213be|201608_Group5|MD5 +2fcdcc996ef9cbec970dbd2f63edd9fe6bbfd1270e430917f97bec8a0049a800|2023_05_malware_iocs|SHA256 +3080cf68721343564e903ca40bf86494cfe8d609d626e7f68ea5feb9b0af947a|2023_05_malware_iocs|SHA256 +30BB678DB3AD0140FC33ACD9803385C3|201608_Group5|MD5 +30bb678db3ad0140fc33acd9803385c3|201608_Group5|MD5 +32bc51088953377d601c6b27ca7484a9|201803_BadTraffic|MD5 +33042636a2f9e7e9cecf3ac2f4b6674f9b80338359196a1066a717407887434f|2023_05_malware_iocs|SHA256 +35cd9b4f01e643bf367523572fed2e134d69891e4ce4ea1134156bd23e11afd3|2023_05_malware_iocs|SHA256 +3632fb080545d3518d57320466f96cb3|201803_BadTraffic|MD5 +366908F6C5C4F4329478D60586ECA5BC|201608_Group5|MD5 +366908f6c5c4f4329478d60586eca5bc|201608_Group5|MD5 +371bc132499f455f06fa80696db0df27|201611_KeyBoy|MD5 +3729531c71163cddcded7e70c02a3004|201803_BadTraffic|MD5 +397021af7c0284c28db65297a6711235|201604_UP007_SLServer|MD5 +3a61d64986ee6529cee271ab6754faa5|201512_PackRAT|MD5 +3b869c8e23d66ad0527882fc79ff7237|201603_Shifting_Tactics|MD5 +3c0a20f0726032ad816e670971509b2d|2021_03_taking_action_against_hackers_in_china|MD5 +3c21c0f64ef7b606abb73b9574d0d66895e180e6d1cf2ad21addd5ade79b69fb|2021_04_taking_action_against_hackers_in_palestine|SHA256 +3fda7b2bc654c71f123d6856c7c303a44ecc344ec894bf8d910d67d276be6239|2023_05_malware_iocs|SHA256 +40383bee9846ecbd78581402e3379051|201803_BadTraffic|MD5 +4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be|201605_Stealth_Falcon|SHA256 +43535540e94b39279af925e9548dce7f|2022_04_metas_adversarial_threat_report_q1|MD5 +43b39fd4ddc386092372da19f6278c25|201803_BadTraffic|MD5 +4461c1d286d4237d61b7a66b228d3983c26f6810e66304f068fada5761d5bc1f|2023_05_malware_iocs|SHA256 +449ba12127133ecd0440a558b083468c|201803_BadTraffic|MD5 +44ccafb69e61139d9107a87f58133c43b8586931faf620c38c1824057d66d614|2021_04_taking_action_against_hackers_in_palestine|SHA256 +461446151be0033a668782c2d7ba58cb|201803_BadTraffic|MD5 +494BAB7FD0B42B0B14051ED9ABBD651F|201608_Group5|MD5 +494bab7fd0b42b0b14051ed9abbd651f|201608_Group5|MD5 +495adb1b9777002ecfe22aaf52fcee93|201611_KeyBoy|MD5 +49ceba3347d39870f15f2ab0391af234|201510_NGO_Burma|MD5 +4a23a1d6779d199aaa582cf0a5868ad1|201512_PackRAT|MD5 +4a3ba18ecc4b74d4321912882e175976|2021_04_taking_action_against_hackers_in_palestine|MD5 +4b740be3b607687b0db472504dd734a87ed7be63b26211454cd58cf67b0874fb|2023_05_malware_iocs|SHA256 +4ce92da8928a8d1d72289d126a9fe2f4|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +4d85904b15c0adc8664f71bc2c5496bf|201808_FamiliarFeeling|MD5 +4ddf012d8a42ad2666e06ad2f0a8410e|201707_InsiderInfo|MD5 +4fe4094302c26e7ea2c58f5ca9f7f993|201803_BadTraffic|MD5 +53ab0aecf4f91a7ce0c391cc6507f79f669bac033c7b3be2517406426f7f37f0|2023_05_malware_iocs|SHA256 +53f81415ccedf453d6e3ebcdc142b966|201510_NGO_Burma|MD5 +542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf|201611_KeyBoy|SHA256 +56bc314bc0d4a0a230a4de2bf978b5ae|201803_BadTraffic|MD5 +56f0e67d981024ddcc215543698f44fb|201510_NGO_Burma|MD5 +5710d567d98a8f4a6682859ce3a35336|201510_NGO_Burma|MD5 +5739ece4966904d0c683ed00ac14681075d0e2e35dfc4ceb870d3839ff4b3c62|2023_05_malware_iocs|SHA256 +57ffde3504934e25904bcc57d27f9217|201808_FamiliarFeeling|MD5 +58239ea5747d3375278ce7c04db22c1b|201803_BadTraffic|MD5 +58333095cd9c36b7388901ce997baa0c|2021_04_taking_action_against_hackers_in_palestine|MD5 +5C4EC3D93A664E4BFA1CE6286CCF0249|201608_Group5|MD5 +5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f|201605_Stealth_Falcon|SHA256 +5a8975873f52436377d8fb0b5ab0d87a|201512_PackRAT|MD5 +5b920c6cd1d8de54463f07965b8c43f3|201905_EndlessMayfly|MD5 +5c030802ad411fea059cc9cc4c118125|201603_Shifting_Tactics|MD5 +5c053d98c4281cbf6910029ccb4b02e30dad20c9ddbd72cb6c7c6caf6e609330|2023_05_malware_iocs|SHA256 +5c3f0dcf4aaa699b50154aa245923c86|201803_BadTraffic|MD5 +5c917492368a341811e4c559fc5e5e742620b98a42960a5f74ecf8fa1d85dba5|2023_05_malware_iocs|SHA256 +5d885fd9b896c8d59dbdc6b3ae4068662544f401d98a7eba757b329714d87c45|2022_08_metas_adversarial_threat_report_q2|SHA256 +5d9027c76306efd5fb57f42dbbaa26f976657a523c32d8fd3fa628ee1417d0aa|2022_08_metas_adversarial_threat_report_q2|SHA256 +5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88|201611_KeyBoy|SHA256 +5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49|201611_KeyBoy|SHA256 +60e0279b7cff89ec8bc1c892244989d73f45c6fcc3e432eaca5ae113f71f38c5|2023_05_malware_iocs|SHA256 +6161083021B695814434450C1882F9F3|201608_Group5|MD5 +6161083021b695814434450c1882f9f3|201608_Group5|MD5 +6356d55c79a82829c949a46c762f9bb4ca53da01a304b13b362a8a9cab20d4d2|2021_04_taking_action_against_hackers_in_palestine|SHA256 +639c7239f40d95f677a99abb059e8338|201604_UP007_SLServer|MD5 +64034ca28c0844690f0a195534fff168|2021_04_taking_action_against_hackers_in_palestine|MD5 +6491df10c766be9c487fb9495d04df6e|201803_BadTraffic|MD5 +6701662097e274f3cd089ceec35471d2|201510_NGO_Burma|MD5 +670a389a93b82ccf198dd7789a865096|2021_03_taking_action_against_hackers_in_china|MD5 +67e866c461c285853b225d2b2c850c4f|201808_FamiliarFeeling|MD5 +67e8f9312c8db3b958b189417be4301dcdbaef70b5b102c23bf5ea909b1e44b7|2023_05_malware_iocs|SHA256 +695db7dd3b1daf89f2c56d59faecc088|201512_PackRAT|MD5 +69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|SHA256 +6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7|201909_MissingLink|SHA256 +699b3d90b050cae37f65c855ec7f616a|201510_NGO_Burma|MD5 +6a442a610c047a7a306a12f423978bfb|201803_BadTraffic|MD5 +6a541de84074a2c4ff99eb43252d9030|201604_UP007_SLServer|MD5 +6b2970664cac51054906983f97bd5419|2021_04_taking_action_against_hackers_in_palestine|MD5 +6c34d4296126679d9c6a0bc2660dc453|201512_PackRAT|MD5 +6ce947913231bd968c86a2737bae7bba|201803_BadTraffic|MD5 +6e0ec6bd0bef489c83c2dce4876de5c8|2022_04_metas_adversarial_threat_report_q1|MD5 +6e7b5c71f7ea462c47dc992090cd4d58|2021_04_taking_action_against_hackers_in_palestine|MD5 +70875705e8bc3887cec4ef1873cdb152|2022_04_metas_adversarial_threat_report_q1|MD5 +718f26ac95a9605f3b25ffbd3ab152f7438e0f3fca1c07a2e211471c14d31d2f|2023_05_malware_iocs|SHA256 +72b3fa74db4a1dd7cbf86a82f2ac6a657724f503e12675721be12e0c6c0de55b|2023_05_malware_iocs|SHA256 +72c88c4a9d2316b266a6702374411a99|201808_FamiliarFeeling|MD5 +74613eae84347183b4ca61b912a4573f|201512_PackRAT|MD5 +75b86a01196854919626e87d5bd45a38|201808_FamiliarFeeling|MD5 +762acdd53eb35cd48686b72811ba9f3c|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb|2020_12_taking_action_against_hackers_in_bangladesh_and_vietnam|SHA256 +76F8142B4E52C671871B3DF87F10C30C|201608_Group5|MD5 +76f8142b4e52c671871b3df87f10c30c|201608_Group5|MD5 +7735e571d0450e2a31e97e4f8e0f66fa|201603_Shifting_Tactics|MD5 +779a79c11f581b84e7c81f321fd8d743|201512_PackRAT|MD5 +7804aa608d73e7a9447ae177c31856fe|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +7833c0f413c1611f7281ac303bcef4b3|2021_04_taking_action_against_hackers_in_palestine|MD5 +7999f5af42e6a825db56aa800a6b957c19d609225cc339f12cf85dde06af3b74|2022_08_metas_adversarial_threat_report_q2|SHA256 +7D898530D2E77F15F5BADCE8D7DF215E|201608_Group5|MD5 +7ad8ad340c084f8185e2bb18cbfde891|201803_BadTraffic|MD5 +7b2cb5249d704cb1df8d4210e7c3d553|201512_PackRAT|MD5 +7bef7a2a6ba1b2aceb84ff3adb5db8b3|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +7d898530d2e77f15f5badce8d7df215e|201608_Group5|MD5 +7e0081fba718fcd71753d3199a290f03|201510_NGO_Burma|MD5 +7e9e8c5dd9cb02a35a0e7004e7952b52e4a1029e71ce4fdc3bd4af18cd0905dd|2023_05_malware_iocs|SHA256 +7ea20c7c999bbd59e9b90309c0afa972|2021_04_taking_action_against_hackers_in_palestine|MD5 +7fd98d6bb1e9d6bcf2e1984e812c1e46|201803_BadTraffic|MD5 +80e8ef78b9e28015cde4205aaa65da97|201605_Stealth_Falcon|MD5 +82254d20e63491be3dfcdc0ad9a9dc6b|2021_04_taking_action_against_hackers_in_palestine|MD5 +84d8671e8dc8a12fd1d4ef376cba900b0d5fd785a942ce8d4bc43cb0325c814a|2023_05_malware_iocs|SHA256 +8522c77e48c846c2c026b6e16501a3b2|201905_EndlessMayfly|MD5 +87e1df6f36b96b56186444e37e2a1ef5|201605_Stealth_Falcon|MD5 +884d46c01c762ad6ddd2759fd921bf71|201510_NGO_Burma|MD5 +88e027b1ef7b2da1766e6b6819bba0f0|201707_InsiderInfo|MD5 +88e85fb6074ae50a3ccc9b410805ffe5|201808_FamiliarFeeling|MD5 +88f43fe753e64d9c536fca16979984ef|201707_InsiderInfo|MD5 +89180820b47bb11ccf0c8505371e98d1|201803_BadTraffic|MD5 +8EBEB3F91CDA8E985A9C61BEB8CDDE9D|201608_Group5|MD5 +8b074a0c693d287fca74231d2d6d3a99|2021_04_taking_action_against_hackers_in_palestine|MD5 +8b48cec7cb30ff0f02b06c51aa15f24f|2021_04_taking_action_against_hackers_in_palestine|MD5 +8b83fc5d3a6a80281269f9e337fe3fff|201603_Shifting_Tactics|MD5 +8bb2ba6f1cfa3bd99146688cd1e76bb0|201803_BadTraffic|MD5 +8c8eb5cfc5642a773c5f2b5f59148aa3|201803_BadTraffic|MD5 +8e0f021dcbbfa586a1c6780e77ac0fb6|201512_PackRAT|MD5 +8ebeb3f91cda8e985a9c61beb8cdde9d|201608_Group5|MD5 +8fb96dfab7e4c0acb1eb9f4e950ba4b9|201512_PackRAT|MD5 +8fea3de31a58415c3fec2e6dd4095575|201803_BadTraffic|MD5 +90373539c60529153d0d6b0cc857e845|201803_BadTraffic|MD5 +91e976f76cc027931fed4cf70702efff|201808_FamiliarFeeling|MD5 +93b630891db21a4a2350280a360c713d|201512_PackRAT|MD5 +945de4d3a046a698aec222fc90a148ba|201707_InsiderInfo|MD5 +947e28ba5ddcce733fa1749c7dc50d12942531ce39c4c89a1981c5a935714f84|2023_05_malware_iocs|SHA256 +95efa51b52f121cec239980127b7f96b|201707_InsiderInfo|MD5 +969fe5597a44bf4eb66ebdc7b09ef2c8|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +979db48c0c797db1feb7914447646667248b6083a807d04e2c8bcdfd4c52725b|2023_05_malware_iocs|SHA256 +98977426d544bd145979f65f0322ae30|201611_KeyBoy|MD5 +9a53506c429fa4ff9113b2cbd37d96c708b4ebb8f3424c1b7f6b05ef678f2230|2021_04_taking_action_against_hackers_in_palestine|SHA256 +9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04|201611_KeyBoy|SHA256 +9b0de56f7f862db73e223f41099fc74c|201803_BadTraffic|MD5 +9b91427d195b8b7e75fbbc29a798bede|2022_04_metas_adversarial_threat_report_q1|MD5 +9bc5fec740bdb4d93f2da9b2db75dc3f|2021_03_taking_action_against_hackers_in_china|MD5 +9fd4b37cbaf0d44795319977118d439d|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +A4F1F4921BB11FF9D22FAD89B19B155D|201608_Group5|MD5 +B4121C3A1892332402000EF0D587C0EE|201608_Group5|MD5 +DD5BEDD915967C5EFE00733CF7478CB4|201608_Group5|MD5 +F1F84EA3229DCA0CCACB7381A2F49F99|201608_Group5|MD5 +a070fd2cce434a6f0b0d0fa6d3278d22|201803_BadTraffic|MD5 +a09f100ddc7cf29f8a93a3d7a79c58b9|201512_PackRAT|MD5 +a3d18021cd444e8fe23fffc1a6140071|2022_08_metas_adversarial_threat_report_q2|MD5 +a4f104e2058261c7dbfc1c69e1de8bce|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +a4f1f4921bb11ff9d22fad89b19b155d|201608_Group5|MD5 +a5199e6f1904f5a532a562fbb9d5abc6|2021_03_taking_action_against_hackers_in_china|MD5 +a53c74fa923edce0fa5919d11f945bcc|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +a5ae6e0d74052d4f889f2538fdd7cb9b|201803_BadTraffic|MD5 +a73351623577f44a2b578fed1e78e37e|201512_PackRAT|MD5 +a74ef893b1bf21c9df6d8e31285db981|201512_PackRAT|MD5 +a7a07b5c9d606fbc5480ebd5acd2cf1d|2021_04_taking_action_against_hackers_in_palestine|MD5 +a80a1b022fdcaa171e454086711dcf35|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +a913d9d9dfc7670df5f3a235b1398be8|2021_04_taking_action_against_hackers_in_palestine|MD5 +a988235ad7d47acbeca5ccb4ea5a1ed5|201512_PackRAT|MD5 +aa7330d2d360cac61394843d8af730bb|2022_04_metas_adversarial_threat_report_q1|MD5 +aaa55f1e48aba8856661fedc0074e81a|2022_04_metas_adversarial_threat_report_q1|MD5 +ab533be4ff9c99e8a03bc4cd413badb6|2022_04_metas_adversarial_threat_report_q1|MD5 +abb02750c3801e1ef5c1617adac2d014ba8e3d2538c0ef7fceea768b7bc68691|2023_05_malware_iocs|SHA256 +ac5763000ae435875f3b709a5f23ecc0|201707_InsiderInfo|MD5 +adf1b8a1b5b9f2d36ce716b39f478fffd0bbf823449bb1c972cad539619e8f27|2023_05_malware_iocs|SHA256 +aeb0c38219e714ab881d0065b9fc1915ba84ad5b86916a82814d056f1dfaf66d|2021_04_taking_action_against_hackers_in_palestine|SHA256 +b06e2f95ecf7012138bee314be9baed9|2022_08_metas_adversarial_threat_report_q2|MD5 +b1c114ae9172a3bacc5c6b30c410f354|201808_FamiliarFeeling|MD5 +b3510e0a8775d9ab5c8409510041dc1e7da47923d5bf3e8f0848a4a3970ffca7|2022_08_metas_adversarial_threat_report_q2|SHA256 +b4121c3a1892332402000ef0d587c0ee|201608_Group5|MD5 +b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88|201909_MissingLink|SHA256 +bb080489dbc98a59cac130475e019fb2|201707_InsiderInfo|MD5 +bbe4dddc09dcef160db0fd4c24c4f052|2021_04_taking_action_against_hackers_in_palestine|MD5 +bc31493e996db7fe45b7ed7aaa51fd54|201905_EndlessMayfly|MD5 +bc97437fec7e7e8634c2eabae3cc4832|201512_PackRAT|MD5 +be6f2a03dfddbaf1166854730961d13c|201803_BadTraffic|MD5 +be8a344487bcfea66de8e0f0f14d869e|201803_BadTraffic|MD5 +bf61c078157dd7523cb580672273190de5de3d41577f5d66c5afcdfeade09213|2021_04_taking_action_against_hackers_in_palestine|SHA256 +c1dabd54a672cbc2747c53a8041d5602|201707_InsiderInfo|MD5 +c2237e9d415f542ce6e73adb260af123|201512_PackRAT|MD5 +c25acaa45b0cf65a39c8413fa99e1fe8|201808_FamiliarFeeling|MD5 +c2e55b0d7be1c1991a5b70be7280e528|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +c3a7779e3eee4885078e03601fb2648b|2021_04_taking_action_against_hackers_in_palestine|MD5 +c4c147bdfddffec2eea6bf99661e69ee|201510_NGO_Burma|MD5 +c5b5f01ba24d6c02636388809f44472e|201611_KeyBoy|MD5 +c9eabbca8b54f8e4d794702f3e270150c9e0e765b0724e69c5ead0c091bce4ef|2023_05_malware_iocs|SHA256 +ca1d9908f32ee5c0bdd9b4efec79108f|2021_04_taking_action_against_hackers_in_palestine|MD5 +cc3a42d62f6f1f3ea4043a154d656f319806226628f488d7459a26e6e9c61e77|2023_05_malware_iocs|SHA256 +ccabc8f4868184a04b032b34d9303810|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +ce274c0bd0743695529a43d7992e2d2c|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +ce6065346a918a813eeb58bbb0814a23|201512_PackRAT|MD5 +ce8ec932be16b69ffa06626b3b423395|201604_UP007_SLServer|MD5 +cec071424d417a095221bf8992819388|201510_NGO_Burma|MD5 +cee04466df0fef3c70d28586dd20b5f1936725e574170d873620621a3cbaf611|2023_05_malware_iocs|SHA256 +cfcd2a90e87156e1a811f9c7b0051002|201604_UP007_SLServer|MD5 +d07b2738840ce3419df651d3a0a3a246|201604_UP007_SLServer|MD5 +d188115cbf404d96a8ee9c4df6a38787428f5ba31525b42ac0074ccda63913f4|2023_05_malware_iocs|SHA256 +d2787aff6e827809b836e62b06cca68bec92b3e2144f132a0015ce397cf3cac2|2021_04_taking_action_against_hackers_in_palestine|SHA256 +d2adecc6287dd4d559fe6ce2ce7a7e31|201512_PackRAT|MD5 +d2e9412428c3bcf3ec98dba8a78adb7b|201603_Shifting_Tactics|MD5 +d2f151312f7dee2483ddcab9766b56db|201512_PackRAT|MD5 +d579d7a42ff140952da57264614c37bc|201604_UP007_SLServer|MD5 +d7ec065cc3f563928504f80692578d2f|201803_BadTraffic|MD5 +d7f34168b1a7dd7cbd8e62a5ab1ebc0e|201512_PackRAT|MD5 +d80fc6a4f175e3ab417b9f96c3b37c73|201707_InsiderInfo|MD5 +d8becbd6f188e3fb2c4d23a2d36d137b|201604_UP007_SLServer|MD5 +d8ede9e6c3a1a30398b0b98130ee3b38|201604_UP007_SLServer|MD5 +d9a39c41e9f599766b5527986e807840|2022_08_metas_adversarial_threat_report_q2|MD5 +dc195d814ec16fe91690b7e949e696f6|201604_UP007_SLServer|MD5 +dd1101adc86fd282f5f183942cc2f3b7|201512_PackRAT|MD5 +dd5bedd915967c5efe00733cf7478cb4|201608_Group5|MD5 +dd8485d87d8998d47de4f5dfcc9213e1|2021_04_taking_action_against_hackers_in_palestine|MD5 +df0045bd4168893922480f7ccb29860a|201803_BadTraffic|MD5 +df196bd42e1da1d34c23c8d947561618|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +e0338b1f010fdc4751de5f58e4acf2ad|201707_InsiderInfo|MD5 +e03be1849ad7cecba1e20923074cd22f|201512_PackRAT|MD5 +e0eb981ad6be0bd16246d5d442028687|201604_UP007_SLServer|MD5 +e1b03f5837533ecc9a05e19650d68e1d|201808_FamiliarFeeling|MD5 +e20473bea7fe5968f0a032303838b601|2022_08_metas_adversarial_threat_report_q2|MD5 +e36df1e426a2da7f98bc2ed336472068335b0201a05e24ed86bac3a6ae60ef31|2023_05_malware_iocs|SHA256 +e436e849d9496ef3f651c1904786c78f|201803_BadTraffic|MD5 +e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3|201909_MissingLink|SHA256 +e567efd5c800c5b0c6eb5aa0bccc10e9|2021_04_taking_action_against_hackers_in_palestine|MD5 +e80d8a0c35133f7485d8e87ade903919|201803_BadTraffic|MD5 +e841ecaa44b3589120b72e60b53f39c6|201707_InsiderInfo|MD5 +e8a528491b28e4d62a472da7396c7047|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +e8effd3ad2069ff8ff6344b85fc12dd6|2021_04_taking_action_against_hackers_in_palestine|MD5 +ea45265fe98b25e719d5a9cc3b412d66|201603_Shifting_Tactics|MD5 +ea50bf8abcf9c0c40c4490dc15fb0a2a|201512_PackRAT|MD5 +ea7bcf58a4ccdecb0c64e56b9998a4ac|201512_PackRAT|MD5 +ed8d7ed45b64890b8901b735018318f3|201512_PackRAT|MD5 +efc0009d76a2057f86c5f00030378c72|201512_PackRAT|MD5 +f1f84ea3229dca0ccacb7381a2f49f99|201608_Group5|MD5 +f25466e4820404c817eaf75818b7177891735886|201605_Stealth_Falcon|SHA1 +f282fd20d7eaebe848b5111ecdae82a6|201707_InsiderInfo|MD5 +f344da38958dbc730ddebc10660cd451|201803_BadTraffic|MD5 +f36e67109ae368c9db109d0a41b5817c|201803_BadTraffic|MD5 +f70b295c6a5121b918682310ce0c2165|201604_UP007_SLServer|MD5 +f7ea82e4c329bf8e29e9da37fcaf35201dd79c2fc55cc0feb88aedf0b2d26ec2|2021_04_taking_action_against_hackers_in_palestine|SHA256 +f80edbb0fcfe7cec17592f61a06e4df2|201604_UP007_SLServer|MD5 +fa90508007b94a4dbfeb8b48d5443ec8|201803_BadTraffic|MD5 +fbb887dbcbac146adde68ae15bf0fadab144f2ed60e2db62a6acf5f13e31b80e|2023_05_malware_iocs|SHA256 +fcf357556c3af14bab820810f5e94436|2021_11_action_against_hackers_in_pakistan_and_syria|MD5 +fd7b5a118ce118698694c081de863e2e9bcc79acc44411cf24956648a94ddef7|2023_05_malware_iocs|SHA256 +fd8da30dd9e45bd31af79a9652d50ece|2021_03_taking_action_against_hackers_in_china|MD5 +fe77e052dc1a8ebea389bc0d017191e0f41d8e47d034c30df95e3d0dc33cfe10|2021_04_taking_action_against_hackers_in_palestine|SHA256 +fef27f432e0ae8218143bc410fda340e|201603_Shifting_Tactics|MD5 diff --git a/vigil/ioc/hosts.txt b/vigil/ioc/hosts.txt new file mode 100644 index 0000000..743e3e9 --- /dev/null +++ b/vigil/ioc/hosts.txt @@ -0,0 +1,4494 @@ +# Vigil IOC: Hosts blocklist (C2 + tracking domains) +# Format: 0.0.0.0 domain +0.0.0.0 11111.pl +0.0.0.0 12d60.appspot.com +0.0.0.0 12d60.firebaseio.com +0.0.0.0 13-5.org +0.0.0.0 13-5.ru +0.0.0.0 1688-global.cn-hongkong.log.aliyuncs.com +0.0.0.0 1ca43.appspot.com +0.0.0.0 1drivestorage.com +0.0.0.0 1g7kvrv.xyz +0.0.0.0 1st-smtp2go.email +0.0.0.0 1topspy.com +0.0.0.0 20minuts.com +0.0.0.0 24.com +0.0.0.0 2fapass.club +0.0.0.0 2fnoqifq.com +0.0.0.0 2g8cvdii.com +0.0.0.0 2j1i9uqw.oss-eu-central-1.aliyuncs.com +0.0.0.0 2mata.net +0.0.0.0 2mblk.com +0.0.0.0 2nd-smtp2go.email +0.0.0.0 2oafxcbq.xyz +0.0.0.0 2y4nothing.xyz +0.0.0.0 3rd-smtp2go.email +0.0.0.0 4-dot-all-tracker.appspot.com +0.0.0.0 404mobi.com +0.0.0.0 4jslg.11111.pl +0.0.0.0 4mblk.com +0.0.0.0 4th-smtp2go.email +0.0.0.0 519c195138.xyz +0.0.0.0 51ginkgo.com +0.0.0.0 5m5.io +0.0.0.0 5rfvbnji9.com +0.0.0.0 6-dot-all-tracker.appspot.com +0.0.0.0 6287970dd9.era3000.com +0.0.0.0 678ikmbtui.com +0.0.0.0 6kvses.com +0.0.0.0 7hn706pwsj.execute-api.ap-southeast-1.amazonaws.com +0.0.0.0 7lc6jc.xyz +0.0.0.0 7nvdx0.xyz +0.0.0.0 83dd4.appspot.com +0.0.0.0 8916f.appspot.com +0.0.0.0 89685.firebaseio.com +0.0.0.0 8balwalz1i.execute-api.us-east-2.amazonaws.com +0.0.0.0 8sghnct.xyz +0.0.0.0 97.logger.mobi +0.0.0.0 Market.dedyn.io +0.0.0.0 a-qa3.thd.cc +0.0.0.0 a-spy.com +0.0.0.0 a-video.vip +0.0.0.0 a.hdmodecam.live +0.0.0.0 a.hw.cab +0.0.0.0 a.hwa.cab +0.0.0.0 a.pricetaco.de +0.0.0.0 a.syncvch.com +0.0.0.0 a.thd.cc +0.0.0.0 a1.etrality.com +0.0.0.0 a2.etrality.com +0.0.0.0 a342f.appspot.com +0.0.0.0 a71f4.firebaseio.com +0.0.0.0 aalaan.tv +0.0.0.0 aax.me +0.0.0.0 abforbrowser.com +0.0.0.0 ablyazovangels.com +0.0.0.0 ablyazovcog.com +0.0.0.0 ablyazovcrimestory.com +0.0.0.0 ablyazovcrimesyndicate.com +0.0.0.0 ablyazovcriminalgang.com +0.0.0.0 ablyazovcriminals.com +0.0.0.0 ablyazovgang.com +0.0.0.0 ablyazovmafia.com +0.0.0.0 ablyazovorganisedcrime.com +0.0.0.0 absolutesoftsystem.in +0.0.0.0 absolutestoreindia.com +0.0.0.0 ac.iprocam.xyz +0.0.0.0 ac480.firebaseio.com +0.0.0.0 account-google.serveftp.com +0.0.0.0 account-gooogle.info +0.0.0.0 account.cellphone-remote-tracker.com +0.0.0.0 account.childsafetytrackerapp.com +0.0.0.0 account.logger.mobi +0.0.0.0 account.mobile-remote-tracker.com +0.0.0.0 account.refog.com +0.0.0.0 account.spytomobile.com +0.0.0.0 account.trackerplus.ru +0.0.0.0 accountgoogle.firewall-gateway.com +0.0.0.0 accounts-email.space +0.0.0.0 accounts-goog-le.com +0.0.0.0 accounts-goog1e.com +0.0.0.0 accounts-goog1e.in +0.0.0.0 accounts-goog1e.info +0.0.0.0 accounts-google.cc +0.0.0.0 accounts-google.co.in +0.0.0.0 accounts-google.firewall-gateway.com +0.0.0.0 accounts-google.gq +0.0.0.0 accounts-google.info +0.0.0.0 accounts-gooog1e.asia +0.0.0.0 accounts-gooog1e.info +0.0.0.0 accounts-gooog1e.online +0.0.0.0 accounts-gooog1e.space +0.0.0.0 accounts-mail.space +0.0.0.0 accounts-mailbox.space +0.0.0.0 accounts.cam +0.0.0.0 accounts.gooog1e.com +0.0.0.0 accounts.loginshare.info +0.0.0.0 accounts.mx +0.0.0.0 accounts.pgv4.com +0.0.0.0 accounts.spyapp.ro +0.0.0.0 accountsgoog1e.info +0.0.0.0 accountsgoogle.firewall-gateway.com +0.0.0.0 accountsgoogles.firewall-gateway.com +0.0.0.0 acd.kcpro.ga +0.0.0.0 activate-google.servehttp.com +0.0.0.0 activate-your-account-now.com +0.0.0.0 activation.spytec.com +0.0.0.0 activesessions.me +0.0.0.0 actv8technologies.com +0.0.0.0 ad.iprocam.xyz +0.0.0.0 ad.mobnv.com +0.0.0.0 adblox.org +0.0.0.0 adbsc.flyermobi.com +0.0.0.0 adbsc.ikmytech.com +0.0.0.0 adbsdk.flyermobi.com +0.0.0.0 addons.news +0.0.0.0 adeco.adecosystems.com +0.0.0.0 adhostingcache.com +0.0.0.0 adhostingcaches.com +0.0.0.0 adibjan.net +0.0.0.0 adjust-local-settings.com +0.0.0.0 admin.dofunapps.com +0.0.0.0 admin.fenced.ai +0.0.0.0 admin.flexispy.com +0.0.0.0 admin.nemospy.com +0.0.0.0 admin.surf-admin.link +0.0.0.0 admin.webdetetive.com.br +0.0.0.0 adobes.software +0.0.0.0 ads.dofunapps.com +0.0.0.0 ads.flyermobi.com +0.0.0.0 adserver.hahamobi.com +0.0.0.0 adservices.gr.com +0.0.0.0 adultpcz.xyz +0.0.0.0 advance-chat-app.appspot.com +0.0.0.0 advance-chat-app.firebaseio.com +0.0.0.0 advanced-files.club +0.0.0.0 advertsservices.com +0.0.0.0 advfb.xyz +0.0.0.0 ae.mveditor.xyz +0.0.0.0 aecodero.com +0.0.0.0 af.to.123games.club +0.0.0.0 aff.fortunnecat.com +0.0.0.0 affiliate.spyera.com +0.0.0.0 affiliatedomainservice.com +0.0.0.0 affinemainung.fun +0.0.0.0 affinemainung.online +0.0.0.0 affinemainung.space +0.0.0.0 affinemainung.website +0.0.0.0 affinemaiunng.fun +0.0.0.0 affinemaiunng.online +0.0.0.0 affinemaiunng.site +0.0.0.0 affinemaiunng.space +0.0.0.0 affinemaiunng.website +0.0.0.0 affinemanung.fun +0.0.0.0 affinemanung.site +0.0.0.0 affinemanung.website +0.0.0.0 affineminung.fun +0.0.0.0 affineminung.online +0.0.0.0 affineminung.site +0.0.0.0 affinemiunng.fun +0.0.0.0 affinemiunng.site +0.0.0.0 affinemiunng.space +0.0.0.0 affinemiunng.website +0.0.0.0 affise.app +0.0.0.0 affliatedomainservice.com +0.0.0.0 ai-pilot.cn-shanghai.log.aliyuncs.com +0.0.0.0 ai.parentalsearch.xyz +0.0.0.0 airlineadverts.com +0.0.0.0 aispyer.com +0.0.0.0 aivideoedit.com +0.0.0.0 akhbar-arabia.com +0.0.0.0 aki.kcpro.ga +0.0.0.0 aksoft.gq +0.0.0.0 alaiblompass.com +0.0.0.0 alawaeltech.com +0.0.0.0 alb.bearclod.com +0.0.0.0 alert.bk128.com +0.0.0.0 alert.xiz4me.com +0.0.0.0 alharbitelecom.co +0.0.0.0 alhds.net +0.0.0.0 ali.panspy.com +0.0.0.0 alidocs.dingtalk.com +0.0.0.0 alishatnixon.site +0.0.0.0 all-sales.info +0.0.0.0 all-tracker.appspot.com +0.0.0.0 all-tracker.firebaseio.com +0.0.0.0 allaboutiot.website +0.0.0.0 alldrings.online +0.0.0.0 alldrings.pw +0.0.0.0 alldrings.space +0.0.0.0 alldrings.website +0.0.0.0 alledrigns.online +0.0.0.0 alledrigns.pw +0.0.0.0 alledrigns.site +0.0.0.0 alledrigns.space +0.0.0.0 alledrigns.website +0.0.0.0 alledrngs.online +0.0.0.0 alledrngs.pw +0.0.0.0 alledrngs.space +0.0.0.0 alledrngs.website +0.0.0.0 allelpcoonmber.com +0.0.0.0 allerdigns.online +0.0.0.0 allerdigns.pw +0.0.0.0 allerdigns.site +0.0.0.0 allerdigns.space +0.0.0.0 allerdigns.website +0.0.0.0 alljazeera.co +0.0.0.0 alltracker.org +0.0.0.0 almal-news.com +0.0.0.0 almasryelyuom.com +0.0.0.0 alog.umeng.com +0.0.0.0 alospy.com +0.0.0.0 alpineai.uk +0.0.0.0 alraeeenews.com +0.0.0.0 alraeesnews.net +0.0.0.0 alter757.info +0.0.0.0 altsantiri.news +0.0.0.0 alttaeb.info +0.0.0.0 aly.bearclod.com +0.0.0.0 alz.bearclod.com +0.0.0.0 amanda-hart.website +0.0.0.0 amazing.lab +0.0.0.0 amazingvideoeditor.club +0.0.0.0 ami0wned.com +0.0.0.0 amiowned.com +0.0.0.0 amon.android-monitor.ru +0.0.0.0 amon1.android-monitor.ru +0.0.0.0 amyacunningham.us +0.0.0.0 analytics.hahamobi.com +0.0.0.0 analytics.localytics.com +0.0.0.0 analytics.rayjump.com +0.0.0.0 analytics.salmonads.com +0.0.0.0 analytics.trackview.net +0.0.0.0 analyzeryandex.000webhostapp.com +0.0.0.0 anayurt.net +0.0.0.0 ancienthistory.xyz +0.0.0.0 and.info-taxi.info +0.0.0.0 and.retardrattle.website +0.0.0.0 andmon.name +0.0.0.0 androappstore.com +0.0.0.0 android-api.umobix.com +0.0.0.0 android-apk.android-monitor.ru +0.0.0.0 android-apps.s3.amazonaws.com +0.0.0.0 android-apps.tech +0.0.0.0 android-flash.com +0.0.0.0 android-monitor.ru +0.0.0.0 android-monitor1.android-monitor.ru +0.0.0.0 android-police.android-monitor.ru +0.0.0.0 android-police.ru +0.0.0.0 android-quinoa-config-prod.sense360eng.com +0.0.0.0 android.chyldmonitor.com +0.0.0.0 android.spy24.app +0.0.0.0 android.spytoapp.com +0.0.0.0 android.viptrack.ro +0.0.0.0 android007.com +0.0.0.0 androidapk.biz +0.0.0.0 androidlost.appspot.com +0.0.0.0 androidlost.com +0.0.0.0 androidlost.firebaseio.com +0.0.0.0 androidmonitor.com +0.0.0.0 androidradio.life +0.0.0.0 androidspy.info +0.0.0.0 anguaganslatast.com +0.0.0.0 anitmationworldnews.com +0.0.0.0 anmon.android-monitor.ru +0.0.0.0 anmon.name +0.0.0.0 anmon.ru +0.0.0.0 anmon.su +0.0.0.0 anmon1.android-monitor.ru +0.0.0.0 anna-sanchez.online +0.0.0.0 anonymous.browse.live +0.0.0.0 anothershortnr.com +0.0.0.0 ansa.ltd +0.0.0.0 ansonwhitmore.live +0.0.0.0 anti-corona.app +0.0.0.0 antifurtodroid.com +0.0.0.0 antitheft-88554.firebaseio.com +0.0.0.0 antmoving.online +0.0.0.0 antranslaro.com +0.0.0.0 aovivo.foxspy.com.br +0.0.0.0 ap.chyldmonitor.com +0.0.0.0 ap.iprocam.xyz +0.0.0.0 apd1.thunup.com +0.0.0.0 apd1.warnlog.com +0.0.0.0 api-apple-buy.com +0.0.0.0 api-gateway.creatant.com +0.0.0.0 api-gateway.franceverif.fr +0.0.0.0 api-llm.prd.alva.xyz +0.0.0.0 api-new.gocashback.com +0.0.0.0 api-production-v4.actv8technologies.com +0.0.0.0 api-project-285519687053.firebaseio.com +0.0.0.0 api-project-999803017449.firebaseio.com +0.0.0.0 api-telecommunication.com +0.0.0.0 api.aliprice.com +0.0.0.0 api.allblock.app +0.0.0.0 api.asbipartnerdb.com +0.0.0.0 api.awarenesstechnologies.com +0.0.0.0 api.bibigpt.co +0.0.0.0 api.branch.io +0.0.0.0 api.bytepioner.com +0.0.0.0 api.cardlift.co +0.0.0.0 api.childsafetytrackerapp.com +0.0.0.0 api.cleanmasters.store +0.0.0.0 api.clearlyreader.com +0.0.0.0 api.clevguard.com +0.0.0.0 api.corn-cob.com +0.0.0.0 api.cp.onemonitar.com +0.0.0.0 api.dev.chat.roimaster.site +0.0.0.0 api.findgravy.com +0.0.0.0 api.findmykids.org +0.0.0.0 api.flexispy.com +0.0.0.0 api.foozor.com +0.0.0.0 api.free-spy.com +0.0.0.0 api.hashdit.io +0.0.0.0 api.huqindustries.co.uk +0.0.0.0 api.joinsmarty.com +0.0.0.0 api.kallo.io +0.0.0.0 api.lifecircle.app +0.0.0.0 api.lingoway.net +0.0.0.0 api.lingowhale.com +0.0.0.0 api.lunabot.ai +0.0.0.0 api.mainrepo.org +0.0.0.0 api.mamma.com +0.0.0.0 api.mixpanel.com +0.0.0.0 api.mobilebackup.biz +0.0.0.0 api.mobilespy.at +0.0.0.0 api.mousegesturesapi.com +0.0.0.0 api.mycellspy.com +0.0.0.0 api.myendpoint.io +0.0.0.0 api.nextialive.roimaster.site +0.0.0.0 api.odskguo.xyz +0.0.0.0 api.ogymogy.com +0.0.0.0 api.onmanzbien.com +0.0.0.0 api.origano.xyz +0.0.0.0 api.phia.com +0.0.0.0 api.pnt.is +0.0.0.0 api.pythonexample.com +0.0.0.0 api.relingo.net +0.0.0.0 api.safegraph.com +0.0.0.0 api.salmonads.com +0.0.0.0 api.seniorsafetyapp.com +0.0.0.0 api.simpleallowcopy.com +0.0.0.0 api.simplycodes.com +0.0.0.0 api.slovarek.hrprime.ru +0.0.0.0 api.smartechmetrics.com +0.0.0.0 api.snoopza.com +0.0.0.0 api.speedspot.org +0.0.0.0 api.spylix.com +0.0.0.0 api.thd.cc +0.0.0.0 api.tllms.com +0.0.0.0 api.trackview.lifecircle.app +0.0.0.0 api.ttspy.com +0.0.0.0 api.ultrablock.org +0.0.0.0 api.witheden.ai +0.0.0.0 api.wzrkt.com +0.0.0.0 api.yapthread.com +0.0.0.0 api.zave.it +0.0.0.0 api007.foxspy.com.br +0.0.0.0 api1.easydoc.info +0.0.0.0 api2.mytranslator.app +0.0.0.0 api3.easydoc.info +0.0.0.0 api4.truecaller.com +0.0.0.0 apidemo.spylix.com +0.0.0.0 apispyhuman.com +0.0.0.0 apitest.awarenesstechnologies.com +0.0.0.0 apiv4.alter757.info +0.0.0.0 apk.mtf.re +0.0.0.0 apk01.spytoapp.com +0.0.0.0 apk02.spytoapp.com +0.0.0.0 apk03.spytoapp.com +0.0.0.0 apk04.spytoapp.com +0.0.0.0 apk7.biz +0.0.0.0 apkcar.com +0.0.0.0 apkhl.pw +0.0.0.0 apkprue.info +0.0.0.0 apkpure.bz +0.0.0.0 apkstore.filehubspot.com +0.0.0.0 apkv2.qwertykeypad.host +0.0.0.0 apkv5.ppadaolnwod.xyz +0.0.0.0 apkv6.endurecif.top +0.0.0.0 aplsrvrer.com +0.0.0.0 apollospy.com +0.0.0.0 app-api.phonedata.me +0.0.0.0 app-api.spyzie.com +0.0.0.0 app-chat1.atwebpages.com +0.0.0.0 app-market.online +0.0.0.0 app-measurement.com +0.0.0.0 app-showchat.atwebpages.com +0.0.0.0 app-stats.net2share.com +0.0.0.0 app.aflink.com +0.0.0.0 app.antifurtodroid.com +0.0.0.0 app.api.spyzie.wondershare.cn +0.0.0.0 app.appspy.net +0.0.0.0 app.appspyfree.com +0.0.0.0 app.buenosocial.club +0.0.0.0 app.fonetracker.com +0.0.0.0 app.foreverspy.com +0.0.0.0 app.freephonespy.net +0.0.0.0 app.givefreely.com +0.0.0.0 app.mobilespyfree.net +0.0.0.0 app.mobiletracking.app +0.0.0.0 app.mobnv.com +0.0.0.0 app.numici.com +0.0.0.0 app.ogymogy.com +0.0.0.0 app.onemonitar.com +0.0.0.0 app.phonespying.com +0.0.0.0 app.snoopza.com +0.0.0.0 app.xdspy.app +0.0.0.0 app.xpspy.com +0.0.0.0 app.xyspy.com +0.0.0.0 app2.appvlc.com +0.0.0.0 app2.snoopza.com +0.0.0.0 appbriar.com +0.0.0.0 appeur.gnway.cc +0.0.0.0 appinstall-mail.space +0.0.0.0 appjiagu.com +0.0.0.0 applepps.com +0.0.0.0 application.opence.fr +0.0.0.0 applispy.com +0.0.0.0 apply-jobs.com +0.0.0.0 applytalents.com +0.0.0.0 appmia.com +0.0.0.0 appmia.com.es +0.0.0.0 appmia.fr +0.0.0.0 appmia.it +0.0.0.0 appprotonvpn.com +0.0.0.0 apppure.cf +0.0.0.0 approve.aegisweb3.com +0.0.0.0 apprtc.appspot.com +0.0.0.0 apps-download.store +0.0.0.0 apps-ios.net +0.0.0.0 apps-store.online +0.0.0.0 appslocallogin.online +0.0.0.0 appspy-net.firebaseio.com +0.0.0.0 appspy.com +0.0.0.0 appspy.net +0.0.0.0 appspyfree.com +0.0.0.0 appsstore.in +0.0.0.0 appsupdate.net +0.0.0.0 apptracker.net +0.0.0.0 aps12.spyhuman.com +0.0.0.0 aps13.spyhuman.com +0.0.0.0 aps14.spyhuman.com +0.0.0.0 aps15.spyhuman.com +0.0.0.0 aps16.spyhuman.com +0.0.0.0 aps16042016.spyhuman.com +0.0.0.0 aps17.spyhuman.com +0.0.0.0 aps18data.securebackuponline.net +0.0.0.0 aps18file.securebackuponline.net +0.0.0.0 aps2.spyhuman.com +0.0.0.0 aps22.spyhuman.com +0.0.0.0 arabnews365.com +0.0.0.0 arabworld.biz +0.0.0.0 aralaper.com +0.0.0.0 aramex-shipping.servehttp.com +0.0.0.0 aramexegypt.com +0.0.0.0 archery.dedyn.io +0.0.0.0 archiverst.com +0.0.0.0 arcpi.nextialive.roimaster.site +0.0.0.0 arduous.work +0.0.0.0 area.spyapp.ch +0.0.0.0 arindocation.com +0.0.0.0 arr.kcpro.tk +0.0.0.0 artateulseonitor.com +0.0.0.0 asambleanacional-gob-ec.cu9.co +0.0.0.0 asgard-f8c53.firebaseio.com +0.0.0.0 asgardtech.ru +0.0.0.0 asrararabiya.co +0.0.0.0 asrararablya.com +0.0.0.0 asrarrarabiya.com +0.0.0.0 ass.absolutesoftsystem.in +0.0.0.0 assadcrimes.info +0.0.0.0 asset.bk128.com +0.0.0.0 asset.xiz4me.com +0.0.0.0 assuredreturnplan.com +0.0.0.0 at.gogameportal.club +0.0.0.0 atb.bearclod.com +0.0.0.0 atheere.com +0.0.0.0 ats.flyermobi.com +0.0.0.0 ats.ikmytech.com +0.0.0.0 attorney-client-privileged.com +0.0.0.0 attorney-client.org +0.0.0.0 attorneyclientprivileged.com +0.0.0.0 audit-pvv.com +0.0.0.0 auditionregistrationonline.com +0.0.0.0 auth.forwardtoken.website +0.0.0.0 autlook.live +0.0.0.0 auto-forward.com +0.0.0.0 autocoupon.net +0.0.0.0 autoforward-8433d.firebaseio.com +0.0.0.0 autoforward.app +0.0.0.0 autoforward.co +0.0.0.0 av2wg.rt14v.com +0.0.0.0 avisindependent.eu +0.0.0.0 awamisolution.com +0.0.0.0 awarenesstechnologies.com +0.0.0.0 awsapi.io +0.0.0.0 b.appjiagu.com +0.0.0.0 b.freespy1.ml +0.0.0.0 b.freespy1.tk +0.0.0.0 b.hdmodecam.live +0.0.0.0 b1.etrality.com +0.0.0.0 b2.etrality.com +0.0.0.0 b3.etrality.com +0.0.0.0 b55y.net +0.0.0.0 b7.photoeffect.xyz +0.0.0.0 b8c.mveditor.xyz +0.0.0.0 ba.beautycam.xyz +0.0.0.0 ba3.photoeffect.xyz +0.0.0.0 back.brunoespiao.com.br +0.0.0.0 backup-a71f4.firebaseio.com +0.0.0.0 backupsoft.eu +0.0.0.0 backwaterreservoir.com +0.0.0.0 badr-regex.fastytb.com +0.0.0.0 bagscaner.com +0.0.0.0 bahrainsms.co +0.0.0.0 bahri.site +0.0.0.0 bank-alahly.com +0.0.0.0 bark-android-media.s3.amazonaws.com +0.0.0.0 bark.us +0.0.0.0 basemailservice.com +0.0.0.0 baseserveremailbg.com +0.0.0.0 basichostingrussia.com +0.0.0.0 basichostnetservice.com +0.0.0.0 basicmyoffshore.com +0.0.0.0 basicruoffshore.com +0.0.0.0 basicservicehk.com +0.0.0.0 basicservicelux.com +0.0.0.0 basicservicemy.com +0.0.0.0 basicservicerus.com +0.0.0.0 basicservicesg.com +0.0.0.0 basicsgoffshore.com +0.0.0.0 batterychargingeffect.club +0.0.0.0 batterylivewallpaperhd.club +0.0.0.0 bbc-africa.com +0.0.0.0 bbcnews.email +0.0.0.0 bbcsworld.com +0.0.0.0 bbiindia.com +0.0.0.0 bbrp.co +0.0.0.0 be.startdownload.mobi +0.0.0.0 beachhackerspace.com +0.0.0.0 beauty-msg.com +0.0.0.0 beemail.online +0.0.0.0 belcherjacky.info +0.0.0.0 bellsouthnetwork.com +0.0.0.0 belowmargins.com +0.0.0.0 berf4o.xyz +0.0.0.0 best-mobile-spy.com +0.0.0.0 best-spy-apps.com +0.0.0.0 bestairlinepricetags.com +0.0.0.0 bestcellphonespyapps.com +0.0.0.0 beststores4u.com +0.0.0.0 beta-api.logger.mobi +0.0.0.0 beta.logger.mobi +0.0.0.0 beta.smstracker.com +0.0.0.0 beta.spyapp.ro +0.0.0.0 betly.me +0.0.0.0 bf.mk +0.0.0.0 bff.ecoindex.fr +0.0.0.0 bi.thd.cc +0.0.0.0 bi.tly.gr.com +0.0.0.0 bi.tly.link +0.0.0.0 bigdata800.com +0.0.0.0 bild.asia +0.0.0.0 bild.eu.com +0.0.0.0 bild.expert +0.0.0.0 bild.llc +0.0.0.0 bild.pics +0.0.0.0 bild.vip +0.0.0.0 bild.work +0.0.0.0 bild.ws +0.0.0.0 bill-msp.app +0.0.0.0 billing.chyldmonitor.com +0.0.0.0 bin5y4muil.execute-api.us-east-1.amazonaws.com +0.0.0.0 bincdi.6kvses.com +0.0.0.0 bincdi.birxpk.com +0.0.0.0 birxpk.com +0.0.0.0 bit-li.com +0.0.0.0 bit-li.ws +0.0.0.0 bit-ly.link +0.0.0.0 bit-ly.org +0.0.0.0 bitlinkin.xyz +0.0.0.0 bitlly.live +0.0.0.0 bitly.cam +0.0.0.0 bitlyrs.com +0.0.0.0 bitserverhk.com +0.0.0.0 bitserverlux.com +0.0.0.0 bitt.fi +0.0.0.0 biturl.cx +0.0.0.0 bity.ws +0.0.0.0 bityl.me +0.0.0.0 bivitis.bearclod.com +0.0.0.0 bk128.com +0.0.0.0 bl.publicapi.semrush.com +0.0.0.0 blackboxmusic.co +0.0.0.0 blackdragon.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 blackdragon03.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 blacktrail.xyz +0.0.0.0 blfnf9y.com +0.0.0.0 blog.flexispy.com +0.0.0.0 blogforpranks.com +0.0.0.0 blogserverlx.com +0.0.0.0 blompascator.com +0.0.0.0 blurspy.com +0.0.0.0 bmw.gr.com +0.0.0.0 bnc.lt +0.0.0.0 bnt2.live +0.0.0.0 bombinate.winload.info +0.0.0.0 bookjob.club +0.0.0.0 boostvocab.com +0.0.0.0 bosspy.com +0.0.0.0 botfortickets.site +0.0.0.0 bourneliam.info +0.0.0.0 bowenpres.com +0.0.0.0 bowenpress.net +0.0.0.0 bowenpress.org +0.0.0.0 bowenpross.com +0.0.0.0 br.loverman.net +0.0.0.0 br.mobile-tracker-free.com +0.0.0.0 br.pgv4.com +0.0.0.0 br.refog.com +0.0.0.0 brdcst.email +0.0.0.0 briarapppro.org +0.0.0.0 brilliant-flame-585.appspot.com +0.0.0.0 brilliant-flame-585.firebaseio.com +0.0.0.0 brlyp4pg.com +0.0.0.0 browsercheck.services +0.0.0.0 browserdirectservice.com +0.0.0.0 browserextensions.info +0.0.0.0 browserredirect.com +0.0.0.0 brt.bearclod.com +0.0.0.0 brul.bearclod.com +0.0.0.0 brunoespiao.com +0.0.0.0 brunoespiao.com.br +0.0.0.0 brunoespiao2.s3.amazonaws.com +0.0.0.0 bsrvrer.com +0.0.0.0 budgtoffmy.com +0.0.0.0 budgtoffru.com +0.0.0.0 bulbazaur.com +0.0.0.0 bulk.fun +0.0.0.0 bumabara.bid +0.0.0.0 burgerprince.us +0.0.0.0 burivingsim.com +0.0.0.0 bus-metrolis.com +0.0.0.0 businesnews.net +0.0.0.0 buyeasyspy.com +0.0.0.0 buzzoffbul.com +0.0.0.0 buzzoffhk.com +0.0.0.0 buzzoffmy.com +0.0.0.0 buzzoffru.com +0.0.0.0 buzzoffsg.com +0.0.0.0 c-phone.ru +0.0.0.0 c.appjiagu.com +0.0.0.0 c.betly.me +0.0.0.0 c.freespy1.ml +0.0.0.0 c.freespy1.tk +0.0.0.0 c.webengage.com +0.0.0.0 c1.etrality.com +0.0.0.0 c1.panspy.com +0.0.0.0 c2.etrality.com +0.0.0.0 c3.etrality.com +0.0.0.0 c4.etrality.com +0.0.0.0 c9db9bbc8d.era3000.com +0.0.0.0 cabinet.ecohouse-eg.com +0.0.0.0 cabinet.gps-monitor.uz +0.0.0.0 cabinet.kfnm.ru +0.0.0.0 cabinet.thecybernanny.com +0.0.0.0 cabinet.vegosm.ru +0.0.0.0 cabinet.vkur.se +0.0.0.0 cabinet.vkur1.se +0.0.0.0 cailrecorder.com +0.0.0.0 calculator-1e016.appspot.com +0.0.0.0 calculator-1e016.firebaseio.com +0.0.0.0 callerids.club +0.0.0.0 callrecordpro.club +0.0.0.0 callsmstracker.com +0.0.0.0 callwhozdine.com +0.0.0.0 camera.dvrcam.info +0.0.0.0 camerdentifier.com +0.0.0.0 campaignmanager.fun.moobig.com +0.0.0.0 canary.wakweli.com +0.0.0.0 canopoument.com +0.0.0.0 canyouc.xyz +0.0.0.0 capitalinvestmentsllp.com +0.0.0.0 careeronestop.site +0.0.0.0 careers-finder.com +0.0.0.0 carmesin.me +0.0.0.0 carracer.club +0.0.0.0 carrefourmisr.com +0.0.0.0 cart.mspy.com +0.0.0.0 cart.spynger.net +0.0.0.0 cathostingservice.com +0.0.0.0 cathy-seliver.icu +0.0.0.0 catwatchful-e03b8-2.firebaseio.com +0.0.0.0 catwatchful-e03b8.appspot.com +0.0.0.0 catwatchful-e03b8.firebaseio.com +0.0.0.0 catwatchful.com +0.0.0.0 catwatchful.online +0.0.0.0 catwatchful.pink +0.0.0.0 cb.wzrkt.com +0.0.0.0 cbapi.rewardsbunny.com +0.0.0.0 cbbc01.xyz +0.0.0.0 cbphe.com +0.0.0.0 cbpheback.com +0.0.0.0 cc-mail-secret.com +0.0.0.0 cc-security-inc.email +0.0.0.0 ccallerx.com +0.0.0.0 ccsecurity-mail-inc.email +0.0.0.0 ccsecurity-mail-inc.services +0.0.0.0 cdn-upd-ms6.com +0.0.0.0 cdn.branch.io +0.0.0.0 cdn.optimizely.com +0.0.0.0 cdn.owebanalytics.com +0.0.0.0 cef.kcpro.tk +0.0.0.0 celebrnewz.xyz +0.0.0.0 cell-phones-tracker.net +0.0.0.0 cell-tracker-green.firebaseio.com +0.0.0.0 cell-tracker-updated.firebaseio.com +0.0.0.0 cellconn.net +0.0.0.0 cellmonitoring.co +0.0.0.0 cellphone-remote-tracker.com +0.0.0.0 cellphoneservices.info +0.0.0.0 cellphonespyappon.com +0.0.0.0 cellphonetrackers.org +0.0.0.0 celltracker.io +0.0.0.0 celltracker.mobi +0.0.0.0 celltrackernew.firebaseio.com +0.0.0.0 celular007.s3.amazonaws.com +0.0.0.0 cerberusapp.com +0.0.0.0 cerberusbrasil.com +0.0.0.0 cezz.me +0.0.0.0 cfg.inappertising.org +0.0.0.0 cfs.kcpro.ga +0.0.0.0 chad-jessie.info +0.0.0.0 charles.huqindustries.co.uk +0.0.0.0 charmainellauzier.host +0.0.0.0 charmander.xyz +0.0.0.0 chat-14bb1.appspot.com +0.0.0.0 chat-14bb1.firebaseio.com +0.0.0.0 chat-support.support +0.0.0.0 chat-transa.com +0.0.0.0 chat-update.live +0.0.0.0 chatluongvacuocsong.vn +0.0.0.0 chatsafe.tecnova.com.br +0.0.0.0 chatserverrussia.com +0.0.0.0 chatwithme.store +0.0.0.0 chaty-98547.appspot.com +0.0.0.0 chaty-98547.firebaseio.com +0.0.0.0 chavistas24.com +0.0.0.0 cheapapartmentsaroundme.com +0.0.0.0 checkheart.club +0.0.0.0 checkinonlinehere.com +0.0.0.0 checkmailserverhk.com +0.0.0.0 childmonitoringsystem.com +0.0.0.0 childsafetytrackerapp.com +0.0.0.0 chipp.pw +0.0.0.0 chome.zstone.co +0.0.0.0 chromehistory.herokuapp.com +0.0.0.0 chromeperfection.com +0.0.0.0 chulahfi.xyz +0.0.0.0 chyldmonitor.com +0.0.0.0 ciaolvc.com +0.0.0.0 cibeg.online +0.0.0.0 citroen.gr.com +0.0.0.0 citymyworkday.com +0.0.0.0 cityofberkeley.support +0.0.0.0 ck-running-apps-700f1.firebaseio.com +0.0.0.0 ckforward.one +0.0.0.0 claptfindzmphone.com +0.0.0.0 claytoniosep.live +0.0.0.0 clevguard.com +0.0.0.0 clevguard.net +0.0.0.0 clickstatistic.com +0.0.0.0 client.mobilefonex.com +0.0.0.0 client.spyhide.com +0.0.0.0 client.spyhide.ir +0.0.0.0 clienti.securspy.com +0.0.0.0 clientreport.info +0.0.0.0 clipbuddy.club +0.0.0.0 clockupdate.com +0.0.0.0 cloud.nathompsstra.com +0.0.0.0 cloud.onemonitar.com +0.0.0.0 cloud.ttspy.com +0.0.0.0 cloudgoogle.co +0.0.0.0 cloudstatistics.net +0.0.0.0 cloudtimesync.com +0.0.0.0 cloudwatchtower.com +0.0.0.0 clues.link +0.0.0.0 clues4.com +0.0.0.0 cluestr.com +0.0.0.0 cmvkvncsse.xyz +0.0.0.0 cnapi.trackview.net +0.0.0.0 cnbcnews.email +0.0.0.0 cnn-africa.co +0.0.0.0 cnn.gr.com +0.0.0.0 cnnnews.global +0.0.0.0 co.akisinn.info +0.0.0.0 co.dewrain.life +0.0.0.0 co.vaicore.site +0.0.0.0 co.vaicore.xyz +0.0.0.0 cocachar.com +0.0.0.0 cockpit.chyldmonitor.com +0.0.0.0 cocospy.com +0.0.0.0 cocospy.net +0.0.0.0 codejquery-ui.com +0.0.0.0 coinsearch.cash +0.0.0.0 color.joarteauxelb.com +0.0.0.0 colorizerset.club +0.0.0.0 com-account-challenge.email +0.0.0.0 com-ar-en-us.com +0.0.0.0 com-authmail.com +0.0.0.0 com-biz.website +0.0.0.0 com-com-us.com +0.0.0.0 com-com.website +0.0.0.0 com-en-us.co.uk +0.0.0.0 com-er-en-us.com +0.0.0.0 com-hl-en-us.com +0.0.0.0 com-io-en-us.com +0.0.0.0 com-mail-us.com +0.0.0.0 com-mail.net +0.0.0.0 com-nh-en-us.com +0.0.0.0 com-oa-en-us.com +0.0.0.0 com-securitysettingpage.tk +0.0.0.0 com-signin-v2.email +0.0.0.0 com-us-en-us.com +0.0.0.0 com-website33.biz +0.0.0.0 com-website33.com +0.0.0.0 com-website33.info +0.0.0.0 com-website33.net +0.0.0.0 com-website33.org +0.0.0.0 comclap.club +0.0.0.0 comemail.email +0.0.0.0 comemails.email +0.0.0.0 comlogin.online +0.0.0.0 comlogin.services +0.0.0.0 commail.co +0.0.0.0 community.flexispy.com +0.0.0.0 community.sidenoteapp.com +0.0.0.0 comphotolab.club +0.0.0.0 compte.applispy.com +0.0.0.0 computer.security-centers.com +0.0.0.0 computing.downloaders.today +0.0.0.0 comqubla.club +0.0.0.0 comservicelogin.com +0.0.0.0 config.unityads.unity3d.com +0.0.0.0 config.unityads.unitychina.cn +0.0.0.0 conhost.servehttp.com +0.0.0.0 connectivitycheck.live +0.0.0.0 connectivitycheck.online +0.0.0.0 connectivitychecker.com +0.0.0.0 consilio.lawyer +0.0.0.0 consiliolaw.com +0.0.0.0 console.presto.oystr.com.br +0.0.0.0 continue-to-get-content-now.com +0.0.0.0 control-phone-a05a3.firebaseio.com +0.0.0.0 control.teragence.net +0.0.0.0 controlcenterios.club +0.0.0.0 controllo.spystoreitalia.com +0.0.0.0 converse-app.org +0.0.0.0 cophico.pw +0.0.0.0 copy9.com +0.0.0.0 copy9db.com +0.0.0.0 copyleft.today +0.0.0.0 core.knowee.ai +0.0.0.0 corn-cob.com +0.0.0.0 corn-en-gb.com +0.0.0.0 corn-en-us.com +0.0.0.0 corn-fr-fr.com +0.0.0.0 corn-lang-eng.com +0.0.0.0 corn-loginservicesverified.com +0.0.0.0 corn-msrvrgr.com +0.0.0.0 corn-servicelogin.com +0.0.0.0 corn-ukr.com +0.0.0.0 cortanaservice.com +0.0.0.0 cortanaupdate.co +0.0.0.0 coupletracker.com +0.0.0.0 coupongiftsnstashop.com +0.0.0.0 coupons.comagno.com +0.0.0.0 covid19-ca.link +0.0.0.0 covid19masks.shop +0.0.0.0 cp.appmia.com +0.0.0.0 cp.mspyonline.com +0.0.0.0 cp.onemonitar.com +0.0.0.0 cp.thewispy.com +0.0.0.0 cp.xnspy.com +0.0.0.0 cpcalendars.spymasterpro.com +0.0.0.0 cpcontacts.spymasterpro.com +0.0.0.0 crashonline.site +0.0.0.0 crisiswatchsupport.shop +0.0.0.0 csa.naaronegya.com +0.0.0.0 csrvrer.com +0.0.0.0 ctrl-msp.app +0.0.0.0 cu9.co +0.0.0.0 cut.red +0.0.0.0 cutcutpro.club +0.0.0.0 cvectorart.club +0.0.0.0 cwkjravqsj.xyz +0.0.0.0 cyber.country +0.0.0.0 cyberanalyticals.com +0.0.0.0 cyberserverusa.com +0.0.0.0 cynthiaecook.club +0.0.0.0 d-app-apk.com +0.0.0.0 d.appjiagu.com +0.0.0.0 d.corn-cob.com +0.0.0.0 d.d-app-apk.com +0.0.0.0 d.freespy1.ml +0.0.0.0 d.freespy1.tk +0.0.0.0 d.tispy.net +0.0.0.0 d1.panspy.com +0.0.0.0 d1gslyvqtipqvi.cloudfront.net +0.0.0.0 d24lo6rmha82nf.cloudfront.net +0.0.0.0 d2nipadu1fr4ne.cloudfront.net +0.0.0.0 d3.mveditor.xyz +0.0.0.0 d3cameraplan.com +0.0.0.0 d3clybje3sun07.cloudfront.net +0.0.0.0 d3ftgl1xpkr9bu.cloudfront.net +0.0.0.0 d3g4zswpacwtfb.cloudfront.net +0.0.0.0 daily-sport.news +0.0.0.0 dailymail.cam +0.0.0.0 dailymail.cfd +0.0.0.0 dailymail.top +0.0.0.0 dalailama.space +0.0.0.0 dalbam.vip +0.0.0.0 damanhealth.online +0.0.0.0 danas.bid +0.0.0.0 darknetinfo.com +0.0.0.0 darrell-ferris.site +0.0.0.0 dash-chat-c02b3.appspot.com +0.0.0.0 dash-chat-c02b3.firebaseio.com +0.0.0.0 dash-chat.site +0.0.0.0 dashboard.linkpublishers.com +0.0.0.0 dassprachrohr.online +0.0.0.0 dassprachrohr.site +0.0.0.0 dassprachrohr.space +0.0.0.0 dassprachrohr.website +0.0.0.0 dassprahcrohr.online +0.0.0.0 dassprahcrohr.site +0.0.0.0 dassprahcrohr.space +0.0.0.0 dassprahcrohr.website +0.0.0.0 dassprhcorhr.online +0.0.0.0 dassprhcorhr.site +0.0.0.0 dassprhcorhr.space +0.0.0.0 dassrpahcorhr.online +0.0.0.0 dassrpahcorhr.site +0.0.0.0 dassrpahcorhr.space +0.0.0.0 dassrpahcorhr.website +0.0.0.0 dasvidaniya.ddns.net +0.0.0.0 dat.funheroic.com +0.0.0.0 data-api.phonedata.me +0.0.0.0 data-api.similarsites.com +0.0.0.0 data-api.spyzie.com +0.0.0.0 data-webwatcherdata-alb-1451089636.us-west-2.elb.amazonaws.com +0.0.0.0 data.api.spyzie.wondershare.cn +0.0.0.0 data.mistat.india.xiaomi.com +0.0.0.0 data.mistat.intl.xiaomi.com +0.0.0.0 data.mistat.rus.xiaomi.com +0.0.0.0 data.popup-blocker.org +0.0.0.0 data.qa.webwatcherdata.com +0.0.0.0 data.reptilicus.net +0.0.0.0 data.webwatcherdata.com +0.0.0.0 data.youtube-adblock.pro +0.0.0.0 data240.mrec24.com +0.0.0.0 data241.mrec24.com +0.0.0.0 datacatch.xyz +0.0.0.0 dataillusionist.com +0.0.0.0 datalink.one +0.0.0.0 datingappswmt.com +0.0.0.0 day-on.site +0.0.0.0 daynew.today +0.0.0.0 daynews.sytes.net +0.0.0.0 daynews.today +0.0.0.0 dayzim.org +0.0.0.0 dc-407883c18502.mspyitaly.com +0.0.0.0 dcylog.com +0.0.0.0 dd.adecosystems.com +0.0.0.0 ddiutilities.com +0.0.0.0 de.mobilespy.at +0.0.0.0 de.refog.com +0.0.0.0 decide.mixpanel.com +0.0.0.0 defenderupdate.ddns.net +0.0.0.0 deferrer.website +0.0.0.0 dehcoveanager.com +0.0.0.0 deknuzesrtnach.fun +0.0.0.0 deknuzesrtnach.online +0.0.0.0 deknuzesrtnach.pw +0.0.0.0 deknuzesrtnach.site +0.0.0.0 deknuzesrtnach.space +0.0.0.0 deknuzesrtnach.website +0.0.0.0 deknzuersntch.site +0.0.0.0 deknzuerstnch.fun +0.0.0.0 deknzuerstnch.pw +0.0.0.0 deknzuerstnch.site +0.0.0.0 deknzuerstnch.website +0.0.0.0 deknzursntch.fun +0.0.0.0 deknzursntch.online +0.0.0.0 deknzursntch.pw +0.0.0.0 deknzursntch.site +0.0.0.0 deknzursntch.space +0.0.0.0 deknzursntch.website +0.0.0.0 deknzusrtnach.fun +0.0.0.0 deknzusrtnach.online +0.0.0.0 deknzusrtnach.pw +0.0.0.0 deknzusrtnach.site +0.0.0.0 deknzusrtnach.space +0.0.0.0 deknzusrtnach.website +0.0.0.0 delfi.life +0.0.0.0 delfi.today +0.0.0.0 delfi.top +0.0.0.0 demo.fenced.ai +0.0.0.0 demo.snoopza.com +0.0.0.0 demo.traccar.org +0.0.0.0 demo.ultimatephonespy.com +0.0.0.0 demoprojectsuk.com +0.0.0.0 denkuzesrtnch.fun +0.0.0.0 denkuzesrtnch.online +0.0.0.0 denkuzesrtnch.site +0.0.0.0 denkuzesrtnch.space +0.0.0.0 denkuzesrtnch.website +0.0.0.0 denkzusrntch.fun +0.0.0.0 denkzusrntch.online +0.0.0.0 denkzusrntch.pw +0.0.0.0 denkzusrntch.site +0.0.0.0 denkzusrntch.website +0.0.0.0 detail43.myfirewall.org +0.0.0.0 dev.chat.roimaster.site +0.0.0.0 dev.hoverwatch.com +0.0.0.0 dev.nodle.io +0.0.0.0 dev.safeguarde.com +0.0.0.0 dev.snoopza.com +0.0.0.0 dev2.refog.com +0.0.0.0 devassist-api.onrender.com +0.0.0.0 device-ac480.appspot.com +0.0.0.0 device-ac480.firebaseio.com +0.0.0.0 device-activation.servehttp.com +0.0.0.0 devices.starbolt.io +0.0.0.0 deyrep.com +0.0.0.0 deyrep24.ddns.net +0.0.0.0 dgmxn.c8xwor.com +0.0.0.0 dh135.world +0.0.0.0 dhfvbsihjf.com +0.0.0.0 digital-apps.store +0.0.0.0 digitalsecurityworld.com +0.0.0.0 dinneraroundyou.com +0.0.0.0 diretube.co.uk +0.0.0.0 discover-api.flashintel.ai +0.0.0.0 disp2.mrec24.com +0.0.0.0 dispatcher.mrecorder.com +0.0.0.0 distedc.com +0.0.0.0 djp.bz +0.0.0.0 dknuzersntch.online +0.0.0.0 dknuzersntch.pw +0.0.0.0 dknuzersntch.site +0.0.0.0 dknuzersntch.website +0.0.0.0 dknuzrstnach.online +0.0.0.0 dknuzrstnach.pw +0.0.0.0 dknuzrstnach.site +0.0.0.0 dknuzrstnach.space +0.0.0.0 dknuzrstnach.website +0.0.0.0 dknuzsrntch.fun +0.0.0.0 dknuzsrntch.online +0.0.0.0 dknuzsrntch.pw +0.0.0.0 dknuzsrntch.site +0.0.0.0 dknuzsrntch.space +0.0.0.0 dknuzsrntch.website +0.0.0.0 dknzursntach.online +0.0.0.0 dknzursntach.pw +0.0.0.0 dknzursntach.site +0.0.0.0 dknzursntach.space +0.0.0.0 dknzursntach.website +0.0.0.0 dllhost.servehttp.com +0.0.0.0 dmp.starbolt.io +0.0.0.0 dmw.bz +0.0.0.0 dmw.cc +0.0.0.0 dnkzuesrtnach.pw +0.0.0.0 dnkzuesrtnach.website +0.0.0.0 dns.bowenpress.org +0.0.0.0 dns1.sdkbalance.com +0.0.0.0 dns2.sdkbalance.com +0.0.0.0 dns3.sdkbalance.com +0.0.0.0 dnsserverprv.com +0.0.0.0 docs-mail-google.us +0.0.0.0 docs-mail.space +0.0.0.0 docs-mails.servehttp.com +0.0.0.0 document.downloadingsystem.com +0.0.0.0 dollrealdoll.com +0.0.0.0 dollrealdoll.online +0.0.0.0 domainblacklistcheck.com +0.0.0.0 domainemailhostings.com +0.0.0.0 domainexpertswebuk.com +0.0.0.0 domainforhostuk.com +0.0.0.0 domainformailinguk.com +0.0.0.0 domainhostnetworkuk.com +0.0.0.0 domainhostnetworkusa.com +0.0.0.0 domainhostworkeu.com +0.0.0.0 domainlocalhostingeu.com +0.0.0.0 domainlocalhostinghk.com +0.0.0.0 domainlocalhostinguk.com +0.0.0.0 domainmanager33.com +0.0.0.0 domainmanager33.site +0.0.0.0 domainmanager33.website +0.0.0.0 domainserver322.com +0.0.0.0 domainserver399.com +0.0.0.0 domainserveractive.com +0.0.0.0 domainsforfreehosting.com +0.0.0.0 domainsforsupport.com +0.0.0.0 domainsfortechhelp.com +0.0.0.0 domainsserver4f.com +0.0.0.0 donnamfelton.club +0.0.0.0 dotnerserversg.com +0.0.0.0 dotnetserverhk.com +0.0.0.0 down.tracksz.co +0.0.0.0 downapk.spytoapp.com +0.0.0.0 downdating.club +0.0.0.0 download-file.top +0.0.0.0 download-revo.vercel.app +0.0.0.0 download-telegram.vercel.app +0.0.0.0 download.downloadering.co +0.0.0.0 download.downloading.shop +0.0.0.0 download.freespyphone.net +0.0.0.0 download.mobile-tracker-free.me +0.0.0.0 download.syriantelecommunications.co +0.0.0.0 download.webwatcherdata.com +0.0.0.0 download4you.xyz +0.0.0.0 downloading.internetdownloading.co +0.0.0.0 downloading.syriantelecom.co +0.0.0.0 downloads.refog.com +0.0.0.0 downloads.shadow-spy.com +0.0.0.0 dragonair.xyz +0.0.0.0 drive-accounts-goog1e.cf +0.0.0.0 drive-accounts-google.com +0.0.0.0 drive-accounts-google.ga +0.0.0.0 drive-accounts-google.ml +0.0.0.0 drive-accounts-gooogle.com +0.0.0.0 drive-goo.space +0.0.0.0 drive-goog1e.com +0.0.0.0 drive-google.cf +0.0.0.0 drive-google.gq +0.0.0.0 drive-google.me +0.0.0.0 drive-google.ml +0.0.0.0 drive-google.space +0.0.0.0 drive-gooog1e.space +0.0.0.0 drive-mail-google.cf +0.0.0.0 drive-mail-google.com +0.0.0.0 drive-mail.info +0.0.0.0 drive-mail.online +0.0.0.0 drive-mail.us +0.0.0.0 drive.accounts-gooog1e.online +0.0.0.0 drive.gooog1e.com +0.0.0.0 drive.mail-status.com +0.0.0.0 drive.myaccount-mail.com +0.0.0.0 drive.postmailsecret.com +0.0.0.0 drivegoogle.biz +0.0.0.0 driveriders.club +0.0.0.0 drivesuplouders.000webhostapp.com +0.0.0.0 drivgoogle.firewall-gateway.com +0.0.0.0 drivingexpiriencesimulator.club +0.0.0.0 drlve-gooog1e.com +0.0.0.0 droimon20.ru +0.0.0.0 dropbox-service.serveftp.com +0.0.0.0 dropbox-sign.servehttp.com +0.0.0.0 dropbox-verfy.servehttp.com +0.0.0.0 dropboxnotification.servehttp.com +0.0.0.0 dropboxsupport.servehttp.com +0.0.0.0 druze.life +0.0.0.0 dsfhskln.com +0.0.0.0 dsrvrer.com +0.0.0.0 dto.kcpro.ga +0.0.0.0 dwn.vys.me +0.0.0.0 dz7.wethnc067.xyz +0.0.0.0 e-spy.app +0.0.0.0 e-spy.org +0.0.0.0 e.appjiagu.com +0.0.0.0 e.crashlytics.com +0.0.0.0 e.freespy1.ml +0.0.0.0 e2c64.firebaseio.com +0.0.0.0 eagerfox.xyz +0.0.0.0 eaglespy.com.br +0.0.0.0 easemon.com +0.0.0.0 eastafro.net +0.0.0.0 easybassbooster.club +0.0.0.0 easycalea.com +0.0.0.0 easydoc.info +0.0.0.0 easyloggerbeta.azurewebsites.net +0.0.0.0 easyphonetrack.com +0.0.0.0 easyvshow.com +0.0.0.0 ebill.cosmote.center +0.0.0.0 ec.cu9.co +0.0.0.0 ecom-servicelogin.com +0.0.0.0 ecom.flexispy.com +0.0.0.0 economyfeeds.com +0.0.0.0 economyservicesil.com +0.0.0.0 ecoserveraus.com +0.0.0.0 ecuadorenvivo.co +0.0.0.0 ecuadorenvivo.com +0.0.0.0 edge-cloudservices.com +0.0.0.0 edgecacheimagehosting.com +0.0.0.0 edit-ymail.space +0.0.0.0 editsbackground.club +0.0.0.0 efsyn.online +0.0.0.0 egyqaz.com +0.0.0.0 einformatiks.com +0.0.0.0 ejn.kcpro.ga +0.0.0.0 eksndtpf.org +0.0.0.0 elcore-api.azurewebsites.net +0.0.0.0 elecresearch.org +0.0.0.0 em.awsapi.io +0.0.0.0 email-163.space +0.0.0.0 email-netvigator.info +0.0.0.0 email23.secuerserver.com +0.0.0.0 emailauthservice.com +0.0.0.0 emailbaseserverhl.com +0.0.0.0 emaildeliverysuccess.com +0.0.0.0 emailhostholland.com +0.0.0.0 emailhostsecurehk.com +0.0.0.0 emailmappingservice.com +0.0.0.0 emailsecurenode.com +0.0.0.0 emailserver399.com +0.0.0.0 emailserver4859.com +0.0.0.0 emailserver499.com +0.0.0.0 emailserverhk48.com +0.0.0.0 emailserverholland.com +0.0.0.0 emailservername299.com +0.0.0.0 emailseverrus23.com +0.0.0.0 emailvalidateservice.com +0.0.0.0 emcpanel.com +0.0.0.0 emiratesfoundation.net +0.0.0.0 emmashop.app +0.0.0.0 emraiyz.xyz +0.0.0.0 en.ownspy.com +0.0.0.0 enerflex.ddns.net +0.0.0.0 enerflex.org +0.0.0.0 energy-mail.org +0.0.0.0 engine.ninja +0.0.0.0 enigmase.xyz +0.0.0.0 enikos.news +0.0.0.0 enough-hamas.000webhostapp.com +0.0.0.0 enterprise.cerberusapp.com +0.0.0.0 enti5abat.pw +0.0.0.0 entrust.work +0.0.0.0 eok8wd5v.net +0.0.0.0 epiphany.download-document.world +0.0.0.0 epoch.englishdownloaders.today +0.0.0.0 epoch.uploaders.online +0.0.0.0 epoch.wind-files.today +0.0.0.0 epochatimes.com +0.0.0.0 epochtimes.space +0.0.0.0 era3000.com +0.0.0.0 erbfzk.com +0.0.0.0 ereportaz.news +0.0.0.0 erictrumpfundation.com +0.0.0.0 ern.kcpro.ga +0.0.0.0 ersokbkj.com +0.0.0.0 es-last-telegram.appspot.com +0.0.0.0 es-last-telegram.firebaseio.com +0.0.0.0 es.mobilespy.at +0.0.0.0 es.mobiplus.me +0.0.0.0 es.refog.com +0.0.0.0 espiao.meuspy.com +0.0.0.0 espiaodecelulargratis.com.br +0.0.0.0 espressonews.gr.com +0.0.0.0 esrvrer.com +0.0.0.0 etcotater.com +0.0.0.0 etisalategypt.tech +0.0.0.0 etisalatgreen.com +0.0.0.0 etisalatonline.com +0.0.0.0 etpweb.answerai.pro +0.0.0.0 eu1-spiky.wzrkt.com +0.0.0.0 eu1.alb.wzrkt.com +0.0.0.0 eu1.wzrkt.com +0.0.0.0 euanticorruption.com +0.0.0.0 evaspy.com +0.0.0.0 evt17.com +0.0.0.0 ewish.cards +0.0.0.0 exactspy.com +0.0.0.0 exchangeserver2345.com +0.0.0.0 exchangeserverformailing.com +0.0.0.0 explorer.sikayetvar.com +0.0.0.0 expresscreditcash.com +0.0.0.0 exprogroup.org +0.0.0.0 extapp.globalsou.com +0.0.0.0 extension.1dasou.com +0.0.0.0 extension.ground.news +0.0.0.0 extranetserviceonline.com +0.0.0.0 extremeexploits.com +0.0.0.0 extremeexploits.org +0.0.0.0 eyezyapp.thd.cc +0.0.0.0 f-b.today +0.0.0.0 f.appjiagu.com +0.0.0.0 f.freespy1.ml +0.0.0.0 f.freespy1.tk +0.0.0.0 f0.photoeffect.xyz +0.0.0.0 f6.beautycam.xyz +0.0.0.0 f8a.beautycam.xyz +0.0.0.0 fa.gifcam.xyz +0.0.0.0 faccebookaccunt.blogspot.com +0.0.0.0 face-book.xyz +0.0.0.0 facebook-helps-center.com +0.0.0.0 facebookdeck.com +0.0.0.0 facebooks.ddns.me +0.0.0.0 facebookservices.gq +0.0.0.0 facenalyer.com +0.0.0.0 fariepoziitn.online +0.0.0.0 fariepoziitn.site +0.0.0.0 fariepoziitn.space +0.0.0.0 fariepoziitn.website +0.0.0.0 faripoziiton.fun +0.0.0.0 faripoziiton.online +0.0.0.0 faripoziiton.space +0.0.0.0 faripoziiton.website +0.0.0.0 fasbcaok.com +0.0.0.0 fasebaak.com +0.0.0.0 faseback.com +0.0.0.0 fasebaok.co +0.0.0.0 fasebaok.com +0.0.0.0 fasebaook.com +0.0.0.0 fasebcak.co +0.0.0.0 fasebcak.com +0.0.0.0 fasebcck.com +0.0.0.0 fasebcoki.com +0.0.0.0 fasibauik.co +0.0.0.0 fasitoak.com +0.0.0.0 faspulhearratmoni.com +0.0.0.0 fast-download.pro +0.0.0.0 fastdownload.me +0.0.0.0 fastserverasia.com +0.0.0.0 fastservereurope.com +0.0.0.0 fastserveruk.com +0.0.0.0 fastserverusa.com +0.0.0.0 fasttravelclearance.com +0.0.0.0 fastuploads.xyz +0.0.0.0 faz.agency +0.0.0.0 faz.life +0.0.0.0 faz.ltd +0.0.0.0 fb-accounts.com +0.0.0.0 fb.gifcam.xyz +0.0.0.0 fblogin.me +0.0.0.0 fcaibaak.com +0.0.0.0 fdfjhks.com +0.0.0.0 feartranslator.com +0.0.0.0 fecolooklegon.000webhostapp.com +0.0.0.0 fedex-mail.servehttp.com +0.0.0.0 fedex-notification.servehttp.com +0.0.0.0 fedex-s.servehttp.com +0.0.0.0 fedex-shipping.servehttp.com +0.0.0.0 fedex-sign.servehttp.com +0.0.0.0 fenced.ai +0.0.0.0 ferehtdwrhl.fun +0.0.0.0 ferehtdwrhl.pw +0.0.0.0 ferehtdwrhl.site +0.0.0.0 ferehtdwrhl.space +0.0.0.0 ferehtdwrhl.website +0.0.0.0 ferhedtewrahl.pw +0.0.0.0 ferhedtewrahl.site +0.0.0.0 ferhedtewrahl.website +0.0.0.0 feriehtdewrahl.pw +0.0.0.0 feriehtdewrahl.site +0.0.0.0 feriehtdewrahl.space +0.0.0.0 feriehtdewrahl.website +0.0.0.0 ferihetderwahl.online +0.0.0.0 ferihetderwahl.website +0.0.0.0 ferrari.gr.com +0.0.0.0 fetch.mangoerp.com +0.0.0.0 ffitnesstrainer.club +0.0.0.0 ffnbafc.xyz +0.0.0.0 ffoxnewz.com +0.0.0.0 fgcxweasqw.oss-eu-central-1.aliyuncs.com +0.0.0.0 fiddaz.club +0.0.0.0 fif0.top +0.0.0.0 fileblade.ga +0.0.0.0 filegoogle.firewall-gateway.com +0.0.0.0 files-gooog1e.space +0.0.0.0 files-mail-google.ml +0.0.0.0 files-mail-qq.online +0.0.0.0 files-mail.space +0.0.0.0 files-store.host +0.0.0.0 filestudios.net +0.0.0.0 filtersapp-715ee.appspot.com +0.0.0.0 filtersapp-715ee.firebaseio.com +0.0.0.0 fimes.gr.com +0.0.0.0 fincconttact.com +0.0.0.0 find-my-phone-prod.herokuapp.com +0.0.0.0 find-myphone.com +0.0.0.0 findcareersatusbofa.com +0.0.0.0 findmykids.org +0.0.0.0 findmyphone.mangobird.com +0.0.0.0 findmyplants.com +0.0.0.0 fingdefend.com +0.0.0.0 fingerprihanger.com +0.0.0.0 fire-upload.host +0.0.0.0 firebase-settings.crashlytics.com +0.0.0.0 fireup.xyz +0.0.0.0 firewallupdate.firewall-gateway.com +0.0.0.0 firewallupdate.firewall-gateway.net +0.0.0.0 fiservcareers.com +0.0.0.0 fisherman.engine.ninja +0.0.0.0 fitnessdias.club +0.0.0.0 fitnessgymup.club +0.0.0.0 fitnesspoint.club +0.0.0.0 fitnessstrategy.xyz +0.0.0.0 fl.gifcam.xyz +0.0.0.0 flashkeylogger.com +0.0.0.0 flexipagez.com +0.0.0.0 flexispy.com +0.0.0.0 flexispy.mobileapps.com.my +0.0.0.0 flickry.xyz +0.0.0.0 flower.snoopza.com +0.0.0.0 fluency.ryboucoathom.com +0.0.0.0 flushdata.1topspy.com +0.0.0.0 flushdata.copy9db.com +0.0.0.0 flushdata.hellospy.com +0.0.0.0 flushdata2.hellospy.com +0.0.0.0 flushdata3.hellospy.com +0.0.0.0 flushdata4.hellospy.com +0.0.0.0 flushdata5.hellospy.com +0.0.0.0 flushdbd.maxxspy.com +0.0.0.0 flyermobi.com +0.0.0.0 fmk.god-xc.com +0.0.0.0 fnbdeiegpslocoiatntcrkaer.com +0.0.0.0 focusecuador.net +0.0.0.0 focusecuador.tk +0.0.0.0 fonemonitor.co +0.0.0.0 fonemonitor.vip +0.0.0.0 fonetracker.com +0.0.0.0 foodin.site +0.0.0.0 foreverspy.com +0.0.0.0 formmail.com +0.0.0.0 forum.spytomobile.com +0.0.0.0 forumtechtopic.com +0.0.0.0 forwardeshoptt.com +0.0.0.0 forzahmobile.com +0.0.0.0 foxspy.com.br +0.0.0.0 fr.chillaxgames.mobi +0.0.0.0 fr.mobilespy.at +0.0.0.0 fr.refog.com +0.0.0.0 fraiepozition.live +0.0.0.0 fraiepozition.online +0.0.0.0 fraiepozition.site +0.0.0.0 fraiepozition.store +0.0.0.0 fraiesvolk.com +0.0.0.0 fraiopziiton.online +0.0.0.0 fraiopziiton.site +0.0.0.0 fraudpreventionsys.com +0.0.0.0 frecalwolwid.com +0.0.0.0 free-spy.com +0.0.0.0 free.apptracker.net +0.0.0.0 free.spycell.net +0.0.0.0 freeandroidspy.com +0.0.0.0 freechess.live +0.0.0.0 freecoupon21.com +0.0.0.0 freefonespy.com +0.0.0.0 freemobilespy.net +0.0.0.0 freephonespy.net +0.0.0.0 freespy.cf +0.0.0.0 freespyapp.com +0.0.0.0 freespyphone.net +0.0.0.0 frowtisice.club +0.0.0.0 frwrdrurl.com +0.0.0.0 frwrdrwr.com +0.0.0.0 ftp.ftpserver.com +0.0.0.0 ftp.info-taxi.info +0.0.0.0 ftp.server.com +0.0.0.0 ftphotom.com +0.0.0.0 full.naturalpercent.life +0.0.0.0 funnychess.online +0.0.0.0 fxkwboard.com +0.0.0.0 g.appjiagu.com +0.0.0.0 g.freespy1.ml +0.0.0.0 g.freespy1.tk +0.0.0.0 g1790.rt14v.com +0.0.0.0 gallant-william.icu +0.0.0.0 gallery.play-protect.com +0.0.0.0 gateway.unityads.unity3d.com +0.0.0.0 gbcf.odskguo.xyz +0.0.0.0 gd-1301476296.cos.na-toronto.myqcloud.com +0.0.0.0 gemtool.sytes.net +0.0.0.0 geniesoftsystem.com +0.0.0.0 geo2ipapi.org +0.0.0.0 get-your-access-now.com +0.0.0.0 get.adobe.com.bowenpress.org +0.0.0.0 get.snoopza.com +0.0.0.0 getadobe.ddns.net +0.0.0.0 getadobe.net +0.0.0.0 getadobeplayer.com +0.0.0.0 getelements.xyz +0.0.0.0 getemailopens.com +0.0.0.0 getmspy.net +0.0.0.0 getreadytorunhalfmarathon.com +0.0.0.0 getsetgoforhealth.com +0.0.0.0 getsignalapps.com +0.0.0.0 getsignalapps.live +0.0.0.0 getspyapps.com +0.0.0.0 getspylix.io +0.0.0.0 getupdatesnow.xyz +0.0.0.0 giftmio.com +0.0.0.0 gifts-store.net +0.0.0.0 gleancorp.com +0.0.0.0 globaltalent.in +0.0.0.0 gmail-profile.com +0.0.0.0 gmail-relation.tk +0.0.0.0 gmail-retry.tk +0.0.0.0 gmail-safety.pw +0.0.0.0 gmail-secure.tk +0.0.0.0 gmail-ssl.tk +0.0.0.0 gmail.com.msg07.xyz +0.0.0.0 gmailapp.me +0.0.0.0 go.creativemobilemarketing.com +0.0.0.0 go.fastfinderworld.com +0.0.0.0 go.grandprizewinners.com +0.0.0.0 go.interlinkinternet.com +0.0.0.0 go.protectyoursearch.com +0.0.0.0 go.trackitalltheway.com +0.0.0.0 go.trackiteazy.com +0.0.0.0 go.watchwiser.com +0.0.0.0 go.whatabookmark.com +0.0.0.0 goerge-amper.website +0.0.0.0 goldenscent.net +0.0.0.0 goldenscint.com +0.0.0.0 goldescent.com +0.0.0.0 goo-ply-download.com +0.0.0.0 goodreads.rest +0.0.0.0 goodwork-25869.appspot.com +0.0.0.0 goodwork-25869.firebaseio.com +0.0.0.0 goog1e.space +0.0.0.0 googl.club +0.0.0.0 google-authorize.gq +0.0.0.0 google-drive.gq +0.0.0.0 google-issue.tk +0.0.0.0 google-maps.servehttp.com +0.0.0.0 google-post.com +0.0.0.0 google-protected.gq +0.0.0.0 google-secret.com +0.0.0.0 google-secure.gq +0.0.0.0 google-settings.ml +0.0.0.0 google-sign.tk +0.0.0.0 google.comemail.email +0.0.0.0 google.comemails.email +0.0.0.0 google.commail.co +0.0.0.0 google.commail.email +0.0.0.0 google.loginto.me +0.0.0.0 googledrive-sign.servehttp.com +0.0.0.0 googledriver-sign.ddns.net +0.0.0.0 googlefile.firewall-gateway.net +0.0.0.0 googlemaps.servehttp.com +0.0.0.0 googleplay-store.com +0.0.0.0 googlesecure-serv.servehttp.com +0.0.0.0 googleservices.co +0.0.0.0 googlesignin.servehttp.com +0.0.0.0 googleupdate.co +0.0.0.0 googleverify-signin.servehttp.com +0.0.0.0 goomail.ml +0.0.0.0 gooog1e.com +0.0.0.0 gosignal.org +0.0.0.0 gosokm.com +0.0.0.0 gotossl.ml +0.0.0.0 gp-market.com +0.0.0.0 gpsphonuetrackerfamilylocator.com +0.0.0.0 gravyanalytics.com +0.0.0.0 grd77.cn +0.0.0.0 greenwich-for-chrome.replit.app +0.0.0.0 groovefitness.xyz +0.0.0.0 gropinggo.com +0.0.0.0 guardian-tt.me +0.0.0.0 guardnews.live +0.0.0.0 guestspy.com +0.0.0.0 gurley.s3.ap-southeast-1.wasabisys.com +0.0.0.0 h.appjiagu.com +0.0.0.0 h.freespy1.ml +0.0.0.0 h.freespy1.tk +0.0.0.0 hadfnews.000webhostapp.com +0.0.0.0 hail-reporting.tutelatechnologies.com +0.0.0.0 hamas31.000webhostapp.com +0.0.0.0 hannah-parsons.info +0.0.0.0 hanstrackr.com +0.0.0.0 hardcoretechnologiesllp.com +0.0.0.0 hathwaynetwork.com +0.0.0.0 hatvax.com +0.0.0.0 hawkeye-us.us-west-1.log.aliyuncs.com +0.0.0.0 hbh-europe-ripoff-report.com +0.0.0.0 heartrateandmealtracker.com +0.0.0.0 heartrateproxhealthmonitor.com +0.0.0.0 heartratteandpulsetracker.com +0.0.0.0 heartrhythm.club +0.0.0.0 heaven.army +0.0.0.0 heidi-minaya.host +0.0.0.0 heiiasjournai.com +0.0.0.0 hellasjournal.company +0.0.0.0 hellasjournal.website +0.0.0.0 hellospy.com +0.0.0.0 hellottec.art +0.0.0.0 helloworld.bounceme.net +0.0.0.0 help.domainoutlet.site +0.0.0.0 helpdesk-product.com +0.0.0.0 hempower.shop +0.0.0.0 herman-poore.info +0.0.0.0 hespyapp.com +0.0.0.0 hex6mak5z98nubb9vpd6t36cydkncfci9im872qx6hjci2egx8irq3qyt9pj.online +0.0.0.0 hfstat.bearclod.com +0.0.0.0 hidden-chat-e58d7.appspot.com +0.0.0.0 hidden-chat-e58d7.firebaseio.com +0.0.0.0 hidden-chat.online +0.0.0.0 hiddensmstracker.com +0.0.0.0 hiddensystemhealth.com +0.0.0.0 highstermobi.com +0.0.0.0 highstermobile.co +0.0.0.0 highstermobile.com +0.0.0.0 hike.in +0.0.0.0 hike.studio +0.0.0.0 hiremilitaryheroes.com +0.0.0.0 hiretechservicehg.com +0.0.0.0 histre.com +0.0.0.0 hk.secuerserver.com +0.0.0.0 hkdrillonline.com +0.0.0.0 hkemail.f3322.org +0.0.0.0 hklinbas.com +0.0.0.0 hkn01.bearclod.com +0.0.0.0 hn.algolia.com +0.0.0.0 hollandtourandtravel.com +0.0.0.0 home.everaccountable.com +0.0.0.0 homeforallorphans.com +0.0.0.0 homeremedytipntricks.com +0.0.0.0 homeserver87.com +0.0.0.0 hongkongshippingcompany.com +0.0.0.0 hookupdating.club +0.0.0.0 hookupmsg.club +0.0.0.0 hoolives.com +0.0.0.0 hopnope.xyz +0.0.0.0 horan-free.com +0.0.0.0 horoscopefortune.club +0.0.0.0 hostbasichk.com +0.0.0.0 hostbasicholl.com +0.0.0.0 hostbasicmy.com +0.0.0.0 hostbasicru.com +0.0.0.0 hostbasicsg.com +0.0.0.0 hosted-microsoft.com +0.0.0.0 hostemailsecureserver.com +0.0.0.0 hostemailserver.com +0.0.0.0 hostfeasta.com +0.0.0.0 hostingserviceclean.com +0.0.0.0 hostingserviceforall.com +0.0.0.0 hostingservicesloyal.com +0.0.0.0 hostingservicesukit.com +0.0.0.0 hostmailsecure.com +0.0.0.0 hostmailsecureserver.com +0.0.0.0 hostsecuremail.com +0.0.0.0 hostsecuremail544.com +0.0.0.0 hostserverrus.com +0.0.0.0 hostusewithtech.com +0.0.0.0 hotchat-f0c0e.appspot.com +0.0.0.0 hotmail-sign.com +0.0.0.0 hotnewchat.appspot.com +0.0.0.0 hotofecro.com +0.0.0.0 housesfurniture.com +0.0.0.0 hover.watch +0.0.0.0 hoverwatch.com +0.0.0.0 hrvxkxq.xyz +0.0.0.0 htapi.getapiv8.com +0.0.0.0 https-drive-accounts-goog1e.cf +0.0.0.0 https-drive-google.cf +0.0.0.0 https-drive-google.com +0.0.0.0 https-drive-google.gq +0.0.0.0 https-drive-google.ml +0.0.0.0 https-google-drive.ml +0.0.0.0 https-mail-google.gq +0.0.0.0 https-mail-google.ml +0.0.0.0 https-my-accounts-google.gq +0.0.0.0 https-myaccounts-google.space +0.0.0.0 https.drive-google.gq +0.0.0.0 httpsaccount-google.gq +0.0.0.0 httpsaccounts-drive-google.gq +0.0.0.0 httpsaccounts-google.cf +0.0.0.0 httpsaccounts-google.com +0.0.0.0 httpsaccounts-google.ga +0.0.0.0 httpsaccounts-google.info +0.0.0.0 httpsaccounts-google.pw +0.0.0.0 httpsaccounts-google.site +0.0.0.0 httpsdocs-google.info +0.0.0.0 httpsdrive-accounts-google.site +0.0.0.0 httpsdrive-google.gq +0.0.0.0 httpsdrive-google.net +0.0.0.0 httpsdrive-google.pw +0.0.0.0 httpsdrive-google.site +0.0.0.0 httpsdrive-google.space +0.0.0.0 httpsdrive-mail-google.gq +0.0.0.0 httpsdrive-myaccounts-google.cf +0.0.0.0 httpsgoogle-drive.gq +0.0.0.0 httpsmail-google.cf +0.0.0.0 httpsmail-google.ml +0.0.0.0 httpsmyaccount-google.info +0.0.0.0 httpsmyaccounts-google.space +0.0.0.0 httpsmydrive-accounts-goog1e.gq +0.0.0.0 hu.refog.com +0.0.0.0 humanrights-1398b.appspot.com +0.0.0.0 humanrights-1398b.firebaseio.com +0.0.0.0 huntcontactz.com +0.0.0.0 hw.cab +0.0.0.0 hwa.cab +0.0.0.0 hwm.cab +0.0.0.0 hws.icu +0.0.0.0 hww.cab +0.0.0.0 hxg.kcpro.ga +0.0.0.0 hydro-ca.link +0.0.0.0 hz-service.thd.cc +0.0.0.0 hz7.thd.cc +0.0.0.0 hzdy.birxpk.com +0.0.0.0 i.cocospy.com +0.0.0.0 i.fonemonitor.co +0.0.0.0 i.freespy1.ml +0.0.0.0 i.freespy1.tk +0.0.0.0 i.hoverwatch.com +0.0.0.0 i.minspy.com +0.0.0.0 i.neatspy.com +0.0.0.0 i.safespy.com +0.0.0.0 i.spyic.com +0.0.0.0 i.spyier.com +0.0.0.0 i.spyine.com +0.0.0.0 i.spyzie.io +0.0.0.0 i.teensafe.net +0.0.0.0 i1.hoverwatch.com +0.0.0.0 i10.clientreport.info +0.0.0.0 i11.clientreport.info +0.0.0.0 i12.clientreport.info +0.0.0.0 i13.clientreport.info +0.0.0.0 i151125.infourl.net +0.0.0.0 i6.clientreport.info +0.0.0.0 i7.clientreport.info +0.0.0.0 i8.clientreport.info +0.0.0.0 i9.clientreport.info +0.0.0.0 iblompass.com +0.0.0.0 icloudappe.com +0.0.0.0 icloudcacher.com +0.0.0.0 icloudeu.com +0.0.0.0 icloudflair.com +0.0.0.0 iconylc.com +0.0.0.0 icoonectedtrack.com +0.0.0.0 icptime.com +0.0.0.0 icrcworld.com +0.0.0.0 id4242.ga +0.0.0.0 id833.ga +0.0.0.0 id834.ga +0.0.0.0 id9954.gq +0.0.0.0 ideas-telcel.com.mx +0.0.0.0 idevs.co +0.0.0.0 idme.org +0.0.0.0 iemail.today +0.0.0.0 iibt.xyz +0.0.0.0 ikea-egypt.net +0.0.0.0 ikeymonitor.com +0.0.0.0 ikeymonitor.fr +0.0.0.0 iklood.co +0.0.0.0 ikm.awsapi.io +0.0.0.0 ikoad.co +0.0.0.0 il0baz.com +0.0.0.0 ilfmobileapps.com +0.0.0.0 ilnk.xyz +0.0.0.0 im.brunoespiao.com.br +0.0.0.0 im.theonespy.com +0.0.0.0 image.loadingmessage.info +0.0.0.0 imageview.xyz +0.0.0.0 imapserverholland.com +0.0.0.0 img01.findgravy.com +0.0.0.0 img02.findgravy.com +0.0.0.0 img03.findgravy.com +0.0.0.0 img04.findgravy.com +0.0.0.0 imgsrvrer.com +0.0.0.0 imobispy.com +0.0.0.0 imonitor-da8b2.firebaseio.com +0.0.0.0 imonitorke.com +0.0.0.0 imonitorsoft.cn +0.0.0.0 imonitorsoft.com +0.0.0.0 in-politics.com +0.0.0.0 in.cb.wzrkt.com +0.0.0.0 in.cuebiq.com +0.0.0.0 in.wzrkt.com +0.0.0.0 in1-spiky.wzrkt.com +0.0.0.0 in1.alb.wzrkt.com +0.0.0.0 in1.wzrkt.com +0.0.0.0 inapturst.top +0.0.0.0 incapsulawebcache.com +0.0.0.0 incognito.today +0.0.0.0 indelibleblue.net +0.0.0.0 indelibleblueinc.net +0.0.0.0 info-taxi.info +0.0.0.0 infoga.cam +0.0.0.0 informnapalm.net +0.0.0.0 infosms-a.site +0.0.0.0 ingestion-api.kiwi.sand.cuebiq.ai +0.0.0.0 init.supersonicads.com +0.0.0.0 innoaspy.com +0.0.0.0 innovaspy.com +0.0.0.0 inospy.com +0.0.0.0 inrsrvrer.com +0.0.0.0 inservices.digital +0.0.0.0 insider.gr.com +0.0.0.0 insights.getblockify.com +0.0.0.0 instagam.click +0.0.0.0 instagam.in +0.0.0.0 instagam.photos +0.0.0.0 installam.com +0.0.0.0 instantspeechtranslation.club +0.0.0.0 instegram.co +0.0.0.0 int.akisinn.info +0.0.0.0 int.akisinn.me +0.0.0.0 int.akisinn.site +0.0.0.0 int.dewrain.life +0.0.0.0 int.dewrain.site +0.0.0.0 int.dewrain.world +0.0.0.0 int.vaicore.site +0.0.0.0 int.vaicore.store +0.0.0.0 int.vaicore.xyz +0.0.0.0 int.vlancaa.fun +0.0.0.0 int.vlancaa.site +0.0.0.0 intelgenttran.com +0.0.0.0 intellens-api.aigos.io +0.0.0.0 interguardsoftware.com +0.0.0.0 internet.document-management.today +0.0.0.0 internet.downloadingdocuments.com +0.0.0.0 internetcartography.com +0.0.0.0 internetcartography.net +0.0.0.0 internetcartography.org +0.0.0.0 internetmarketingservicehg.com +0.0.0.0 interserver439.com +0.0.0.0 intrsrvrer.com +0.0.0.0 inv.logger.mobi +0.0.0.0 invoker.icu +0.0.0.0 ioi.life +0.0.0.0 ios-apps.store +0.0.0.0 ios-gw.spynger.net +0.0.0.0 iosmnbg.com +0.0.0.0 iqtel.org +0.0.0.0 ircleocatinder.com +0.0.0.0 irenewansley.icu +0.0.0.0 irtreporter.com +0.0.0.0 isaac-rowland.space +0.0.0.0 islam-360-plus.com +0.0.0.0 islsrickers.com +0.0.0.0 ispyoo.com +0.0.0.0 ispytic.com +0.0.0.0 isrvrer.com +0.0.0.0 istiqlaihaber.com +0.0.0.0 it.mobilespy.at +0.0.0.0 it.refog.com +0.0.0.0 itcgr.live +0.0.0.0 itiee.life +0.0.0.0 itieee.life +0.0.0.0 itly.link +0.0.0.0 itranstxtvoicepht.com +0.0.0.0 itter.me +0.0.0.0 iusacell-movil.com.mx +0.0.0.0 iveilembercker.com +0.0.0.0 ivlewepapallrbkragonucd.com +0.0.0.0 ixhtb.s9gxw8.com +0.0.0.0 iyouthen.com +0.0.0.0 izapk.xyz +0.0.0.0 izelense.com +0.0.0.0 izkid.com +0.0.0.0 izspy-1313.firebaseio.com +0.0.0.0 j.freespy1.ml +0.0.0.0 j.freespy1.tk +0.0.0.0 jailbreak-gateway.thd.cc +0.0.0.0 jamila-c8420.appspot.com +0.0.0.0 jamila-c8420.firebaseio.com +0.0.0.0 jamilabouhaird-c0935.appspot.com +0.0.0.0 jamilabouhaird-c0935.firebaseio.com +0.0.0.0 javaservermy.com +0.0.0.0 jayboyadams.club +0.0.0.0 jduzuyd.com +0.0.0.0 jennifer-marler.pw +0.0.0.0 jeremy-tanner.live +0.0.0.0 jessicamcgill.life +0.0.0.0 jjspy.com +0.0.0.0 jjspy.ml +0.0.0.0 jk8681oy.oss-eu-central-1.aliyuncs.com +0.0.0.0 jobs.illaewinstralinc.com +0.0.0.0 jodiecarey.live +0.0.0.0 joe-rumley.pw +0.0.0.0 join.crazymob.co +0.0.0.0 join.officeframe.work +0.0.0.0 joincharitytree.com +0.0.0.0 jquery-updater.xyz +0.0.0.0 jqueryui-code.com +0.0.0.0 js.intercomcdn.com +0.0.0.0 jsdfbhsa.com +0.0.0.0 judystevenson.info +0.0.0.0 juju.co.ke +0.0.0.0 julie-parker.top +0.0.0.0 jumhuria.com +0.0.0.0 justicia-desvinculados.com +0.0.0.0 justseries.net +0.0.0.0 jydfoafcaf.xyz +0.0.0.0 k.freespy1.ml +0.0.0.0 k.freespy1.tk +0.0.0.0 kartick.net +0.0.0.0 kaspersky.team +0.0.0.0 katesalinas.icu +0.0.0.0 kathimerini.news +0.0.0.0 kavkazru.press +0.0.0.0 kennediewahrheit.live +0.0.0.0 kentporter.site +0.0.0.0 kenyasms.org +0.0.0.0 kevin-good.top +0.0.0.0 key-logger-90fff.firebaseio.com +0.0.0.0 keyboardthemes.club +0.0.0.0 kfcwsa.com +0.0.0.0 kgr0aixa.xyz +0.0.0.0 khaleejtimes.co +0.0.0.0 kidlogger.net +0.0.0.0 kidsecured.com +0.0.0.0 kidsguard-6c6a9.firebaseio.com +0.0.0.0 kidsshield.net +0.0.0.0 kimberlycamp.club +0.0.0.0 kinder.engine.ninja +0.0.0.0 kinesis.ap-southeast-1.amazonaws.com +0.0.0.0 kingdom-deals.com +0.0.0.0 kingdom-news.com +0.0.0.0 klg.a-spy.com +0.0.0.0 knowledgebaseonlineuk.com +0.0.0.0 koenigseggg.com +0.0.0.0 kohaicorp.com +0.0.0.0 kokum.ru +0.0.0.0 koora-egypt.com +0.0.0.0 koreavopi.kro.kr +0.0.0.0 kormoran.bid +0.0.0.0 kpsbproxy.kiddoware.com +0.0.0.0 kranos.gr.com +0.0.0.0 krasil-anthony.icu +0.0.0.0 krkmyvlmdg.xyz +0.0.0.0 kuuvv.com +0.0.0.0 kvprojectop.com +0.0.0.0 kvshdi.birxpk.com +0.0.0.0 kypler.com +0.0.0.0 l.freespy1.ml +0.0.0.0 l.freespy1.tk +0.0.0.0 l.hdmodecam.live +0.0.0.0 l.servidor.in +0.0.0.0 laalaslirayeblection.com +0.0.0.0 labrador.ua +0.0.0.0 laced-brass-honeysuckle.glitch.me +0.0.0.0 ladysizi.top +0.0.0.0 lamat-horan.com +0.0.0.0 lamborghini-s.shop +0.0.0.0 landingpg.xyz +0.0.0.0 landingpge.xyz +0.0.0.0 laodaoo.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 lasouncherio.com +0.0.0.0 latinoamericareporta.com +0.0.0.0 laucass.forumactif.org +0.0.0.0 lavozamericana.info +0.0.0.0 lavozmericana.info +0.0.0.0 lb.theonespy.com +0.0.0.0 lbjg7.com +0.0.0.0 leanwithme.xyz +0.0.0.0 lending-online.club +0.0.0.0 lenreuzdeknen.online +0.0.0.0 lenreuzdeknen.site +0.0.0.0 lenreuzdeknen.space +0.0.0.0 lenreuzdeknen.website +0.0.0.0 lenruzdeknn.online +0.0.0.0 lenruzdeknn.site +0.0.0.0 lenruzdeknn.space +0.0.0.0 lenruzdeknn.website +0.0.0.0 lenrzuednken.online +0.0.0.0 lenrzuednken.site +0.0.0.0 lenrzuednken.space +0.0.0.0 lenrzuednken.website +0.0.0.0 lepamcker.com +0.0.0.0 lernezudeknen.online +0.0.0.0 lernezudeknen.site +0.0.0.0 lernezudeknen.space +0.0.0.0 lernezudeknen.website +0.0.0.0 lernezuednkn.online +0.0.0.0 lernezuednkn.site +0.0.0.0 lernezuednkn.space +0.0.0.0 lernezuednkn.website +0.0.0.0 lernuzdenken.online +0.0.0.0 lernuzdenken.website +0.0.0.0 leticialittle.pro +0.0.0.0 letmespy.com +0.0.0.0 lets-msger.fun +0.0.0.0 leunoon.com +0.0.0.0 lexpress.me +0.0.0.0 lg.luckyforworlds.com +0.0.0.0 lg.requestads.com +0.0.0.0 lg.smardroid.com +0.0.0.0 lgdzbch.com +0.0.0.0 liahkhe.xyz +0.0.0.0 librarycollection.org +0.0.0.0 lif0.top +0.0.0.0 lifecircle-223805.firebaseio.com +0.0.0.0 lifecircle.app +0.0.0.0 lifeel-scan.com +0.0.0.0 lifestyleshops.net +0.0.0.0 limk.one +0.0.0.0 linda-callaghan.icu +0.0.0.0 link-m.xyz +0.0.0.0 link-protection.com +0.0.0.0 linkedinz.me +0.0.0.0 linkfollowservice.com +0.0.0.0 linkforwrder.com +0.0.0.0 linkgen.me +0.0.0.0 linkit.digital +0.0.0.0 linksbit.com +0.0.0.0 linkshortnr.com +0.0.0.0 linkshrtnr22.com +0.0.0.0 linksrtnr.com +0.0.0.0 linktothisa.xyz +0.0.0.0 linphone-app.com +0.0.0.0 linq.ink +0.0.0.0 linuxbasichk.com +0.0.0.0 linuxbasichk1.com +0.0.0.0 linuxbasicmy.com +0.0.0.0 linuxbasicru.com +0.0.0.0 linuxbasicru1.com +0.0.0.0 linuxbasicru3.com +0.0.0.0 linuxbasicsg.com +0.0.0.0 linuxbasicsg1.com +0.0.0.0 linuxhostingplatformuk.com +0.0.0.0 linuxserverfast.com +0.0.0.0 lion20810397.ddns.net +0.0.0.0 lionflix.club +0.0.0.0 liponals.store +0.0.0.0 lippi-doc-portal-frontend.cn-hangzhou.log.aliyuncs.com +0.0.0.0 lisslpagestat.panel.kantartns.lt +0.0.0.0 listen-books.com +0.0.0.0 littoralventures.com +0.0.0.0 live-live.vip +0.0.0.0 liveleak.cam +0.0.0.0 livetalk.top +0.0.0.0 livetalk.vip +0.0.0.0 liveuamap.live +0.0.0.0 livingwithbadkidny.xyz +0.0.0.0 llinkedin.net +0.0.0.0 lljmbbk.com +0.0.0.0 lmbbnrhiuj.xyz +0.0.0.0 lnkedin.org +0.0.0.0 lnkshrtnr.com +0.0.0.0 lnruzdeknn.online +0.0.0.0 lnruzdeknn.site +0.0.0.0 lnruzdeknn.space +0.0.0.0 lnruzdeknn.website +0.0.0.0 localadmin.online +0.0.0.0 localadmin.ru +0.0.0.0 localegem.net +0.0.0.0 localhostinguk.com +0.0.0.0 localserversa.com +0.0.0.0 locatinfind.com +0.0.0.0 locatorprivacy.com +0.0.0.0 locatorqiafindlocation.com +0.0.0.0 locatorshar.com +0.0.0.0 lockaaocker.com +0.0.0.0 lockheedmartinjobs.us +0.0.0.0 lockul.com +0.0.0.0 locxfindxlocx.com +0.0.0.0 log-yoahao.co +0.0.0.0 log-yoheo.info +0.0.0.0 log.adywind.com +0.0.0.0 log.felo.ai +0.0.0.0 log.mobpowertech.com +0.0.0.0 logger.mobi +0.0.0.0 login-live.space +0.0.0.0 login-live.us +0.0.0.0 login-office365.com +0.0.0.0 login.evaspy.com +0.0.0.0 login.quanly24h.net +0.0.0.0 login.spylogs.com +0.0.0.0 login.webwatcher.com +0.0.0.0 loginaccount.email +0.0.0.0 loginauths-service.com +0.0.0.0 logincontrolserver.com +0.0.0.0 loginservercheck.com +0.0.0.0 loginservicebasic.com +0.0.0.0 loginservicehelp.com +0.0.0.0 loginservicesmailsonlinesaccounts.com +0.0.0.0 loginserviceunified.com +0.0.0.0 logln-yahoo.com +0.0.0.0 logonexchangeonline.com +0.0.0.0 logonmicrosoftonline.com +0.0.0.0 logs.supersonic.com +0.0.0.0 logserver39.com +0.0.0.0 logx.optimizely.com +0.0.0.0 lolinha.no-ip.org +0.0.0.0 lonakodas.club +0.0.0.0 look-com.org +0.0.0.0 lordblackwood.club +0.0.0.0 lorketstonker.store +0.0.0.0 loverman.net +0.0.0.0 loversfinder.xyz +0.0.0.0 lowlight.xyz +0.0.0.0 loyronald.site +0.0.0.0 lp.shoopadoo.com +0.0.0.0 lrneuzdenken.online +0.0.0.0 lrneuzdenken.site +0.0.0.0 lrneuzdenken.space +0.0.0.0 lrneuzdenken.website +0.0.0.0 lrneuzednken.online +0.0.0.0 lrneuzednken.site +0.0.0.0 lrneuzednken.space +0.0.0.0 lrneuzednken.website +0.0.0.0 lsepeanitor.com +0.0.0.0 lskjirn.life +0.0.0.0 ludamec.com +0.0.0.0 ludospeakeasy.club +0.0.0.0 ludospeakv2.club +0.0.0.0 lukoil.in +0.0.0.0 luxlinbas.com +0.0.0.0 luxoreditor.club +0.0.0.0 lwvurdsjk.org +0.0.0.0 lxghjoxzns.com +0.0.0.0 lylink.online +0.0.0.0 m-media.thd.cc +0.0.0.0 m-services.app +0.0.0.0 m.a-spy.com +0.0.0.0 m.asgardtech.ru +0.0.0.0 m.freespy1.ml +0.0.0.0 m.freespy1.tk +0.0.0.0 m.lifecircle.app +0.0.0.0 m.pgv4.com +0.0.0.0 m.surepointspy.com +0.0.0.0 m11.slimedit.live +0.0.0.0 m12.slimedit.live +0.0.0.0 m13.slimedit.live +0.0.0.0 magic-smile.co +0.0.0.0 magic-smile.fun +0.0.0.0 magic-store.online +0.0.0.0 magic4smile.com +0.0.0.0 magicchat-1f275.firebaseio.com +0.0.0.0 magicsmile.fun +0.0.0.0 maglook.eu +0.0.0.0 mail-163.tk +0.0.0.0 mail-account-update.com +0.0.0.0 mail-accounts-google.online +0.0.0.0 mail-aol.space +0.0.0.0 mail-attachment-usercontent.space +0.0.0.0 mail-com.org +0.0.0.0 mail-continue.space +0.0.0.0 mail-defend.space +0.0.0.0 mail-defense.space +0.0.0.0 mail-defense.tk +0.0.0.0 mail-doubt.com +0.0.0.0 mail-dsi-go.space +0.0.0.0 mail-epochtimes.space +0.0.0.0 mail-extend.space +0.0.0.0 mail-google-com.gq +0.0.0.0 mail-google-login.blogspot.com +0.0.0.0 mail-gooog1e.info +0.0.0.0 mail-guazi.com +0.0.0.0 mail-guazi.space +0.0.0.0 mail-info.space +0.0.0.0 mail-logger.com +0.0.0.0 mail-mg16-yahoo.cf +0.0.0.0 mail-modular.space +0.0.0.0 mail-msrgr.info +0.0.0.0 mail-package.space +0.0.0.0 mail-platform.space +0.0.0.0 mail-protect.space +0.0.0.0 mail-qq.online +0.0.0.0 mail-secret.com +0.0.0.0 mail-secret.info +0.0.0.0 mail-secret.online +0.0.0.0 mail-sina.space +0.0.0.0 mail-status.com +0.0.0.0 mail-youxinpai.com +0.0.0.0 mail.asambleanacional.gob.ec +0.0.0.0 mail.google.commail.co +0.0.0.0 mail1.nsogroup.com +0.0.0.0 mail2go.live +0.0.0.0 mail2go.online +0.0.0.0 mail2u.live +0.0.0.0 mailaccountlive.email +0.0.0.0 mailaccountlive.support +0.0.0.0 mailanalysis.services +0.0.0.0 mailannounceservice.com +0.0.0.0 mailapiservice.com +0.0.0.0 mailauthenticatorservice.com +0.0.0.0 mailauthorizationservice.com +0.0.0.0 mailauthservice.com +0.0.0.0 mailauthservice399.com +0.0.0.0 mailchimpservice.com +0.0.0.0 mailcollectorservice.com +0.0.0.0 mailcommunicationservice.com +0.0.0.0 mailcommute.com +0.0.0.0 mailcontactanalysis.online +0.0.0.0 maildeliveryagent.com +0.0.0.0 mailer-domain.com +0.0.0.0 mailerdomain56.com +0.0.0.0 mailgatorservice.com +0.0.0.0 mailgooglesign.servehttp.com +0.0.0.0 mailhostingsecurenet.com +0.0.0.0 mailingserver938.com +0.0.0.0 maillinkservice.com +0.0.0.0 mailmarknotes.com +0.0.0.0 mailmarkservice.com +0.0.0.0 mailnotes.online +0.0.0.0 mailpostsecure.com +0.0.0.0 mailpostsecureservice.com +0.0.0.0 mailpublisher.live +0.0.0.0 mailrockservice.com +0.0.0.0 mails.center +0.0.0.0 mailsecurehost.com +0.0.0.0 mailsecureservers.com +0.0.0.0 mailserver39.com +0.0.0.0 mailserver89.com +0.0.0.0 mailserver89.net +0.0.0.0 mailserver89.org +0.0.0.0 mailserverdirect3994.com +0.0.0.0 mailserverenterprise.com +0.0.0.0 mailservereurope.com +0.0.0.0 mailserveroutlook.com +0.0.0.0 mailserverru2099.com +0.0.0.0 mailservershare.com +0.0.0.0 mailserveruk.com +0.0.0.0 mailserveruk89.com +0.0.0.0 mailserveruk89.net +0.0.0.0 mailserveruk89.org +0.0.0.0 mailserviceloginonline.com +0.0.0.0 mailtickr.com +0.0.0.0 mailtransferserver.com +0.0.0.0 main.protico.io +0.0.0.0 makeitshort.xyz +0.0.0.0 mangasiso.top +0.0.0.0 manoraonline.net +0.0.0.0 margarita-smith.host +0.0.0.0 market.vinam.me +0.0.0.0 marketinfo.tips +0.0.0.0 marketing.tllms.com +0.0.0.0 martpolocator.com +0.0.0.0 marty-colvard.top +0.0.0.0 marwapetersson.info +0.0.0.0 mastergatevpn.com +0.0.0.0 matchos.price.com +0.0.0.0 maxlaboratories.com +0.0.0.0 maxxspy.com +0.0.0.0 mbill.app +0.0.0.0 mblk1.com +0.0.0.0 mcloud-api.thd.cc +0.0.0.0 mcontrolapp.com +0.0.0.0 md-news-direct.com +0.0.0.0 mda.kcpro.ga +0.0.0.0 measurelib.com +0.0.0.0 measurementsys.com +0.0.0.0 media-sync-a.copy9.com +0.0.0.0 media-sync-a.exactspy.com +0.0.0.0 media-sync-a.fonetracker.com +0.0.0.0 media-sync-a.ispyoo.com +0.0.0.0 media-sync-a.thetruthspy.com +0.0.0.0 media-sync-a100.fonetracker.com +0.0.0.0 media-sync-a100.thetruthspy.com +0.0.0.0 media-sync-a600.fonetracker.com +0.0.0.0 media-sync-a621.fonetracker.com +0.0.0.0 media-sync-a696.fonetracker.com +0.0.0.0 media-sync-a710.fonetracker.com +0.0.0.0 media-sync-a740.thetruthspy.com +0.0.0.0 media-sync-a743.thetruthspy.com +0.0.0.0 media-sync-a746.thetruthspy.com +0.0.0.0 media-sync-a747.thetruthspy.com +0.0.0.0 media-sync-a748.thetruthspy.com +0.0.0.0 media-sync-a749.thetruthspy.com +0.0.0.0 media-sync-a780.fonetracker.com +0.0.0.0 media-sync-a785.fonetracker.com +0.0.0.0 media-sync-a7xx.thetruthspy.com +0.0.0.0 media-sync-a810.thetruthspy.com +0.0.0.0 media-sync-a820.thetruthspy.com +0.0.0.0 media-sync-a825.thetruthspy.com +0.0.0.0 media-sync-a830.thetruthspy.com +0.0.0.0 media-sync-a835.thetruthspy.com +0.0.0.0 media-sync-a895.thetruthspy.com +0.0.0.0 media-sync-a8xx.thetruthspy.com +0.0.0.0 media-sync-a910.thetruthspy.com +0.0.0.0 media-sync-a915.thetruthspy.com +0.0.0.0 media-sync-a920.thetruthspy.com +0.0.0.0 media-sync-a925.thetruthspy.com +0.0.0.0 media-sync-a930.thetruthspy.com +0.0.0.0 media-sync-a935.thetruthspy.com +0.0.0.0 media-sync-a940.thetruthspy.com +0.0.0.0 media-sync-a941.thetruthspy.com +0.0.0.0 media-sync-a942.thetruthspy.com +0.0.0.0 media-sync-a943.thetruthspy.com +0.0.0.0 media-sync-a944.thetruthspy.com +0.0.0.0 media-sync-a945.thetruthspy.com +0.0.0.0 media-sync-a946.thetruthspy.com +0.0.0.0 media-sync-a947.thetruthspy.com +0.0.0.0 media-sync.systemserviceprovider.com +0.0.0.0 media.thetruthspy.com +0.0.0.0 medizz.co +0.0.0.0 meetingonlinechat.club +0.0.0.0 melissa-garcia.site +0.0.0.0 melissa-gonzalez.com +0.0.0.0 meskereme.net +0.0.0.0 mespiao.com.br +0.0.0.0 message-tracker-98822.firebaseio.com +0.0.0.0 messages01.smstracker.com +0.0.0.0 messages02.smstracker.com +0.0.0.0 messengers.video +0.0.0.0 mesvr.com +0.0.0.0 metacafe.live +0.0.0.0 meuspy.com +0.0.0.0 mflx.biz +0.0.0.0 mg-mail-yahoo.us +0.0.0.0 mg-spyzie.oss-us-west-1.aliyuncs.com +0.0.0.0 mg.sdkbalance.com +0.0.0.0 mgo.kcpro.ga +0.0.0.0 mgoogle.us +0.0.0.0 mgrsr.com +0.0.0.0 mi.thd.cc +0.0.0.0 micorsoftonilne.com +0.0.0.0 micorsoftonline.website +0.0.0.0 micorsoftonline.xyz +0.0.0.0 microsoft-inc.us +0.0.0.0 microsoftcdn.co +0.0.0.0 microsoftdefender.info +0.0.0.0 microsoftedgesh.info +0.0.0.0 microsoftoffice.systems +0.0.0.0 microsoftonilne.cloud +0.0.0.0 microtracker-1ca43.firebaseio.com +0.0.0.0 mideast-today.com +0.0.0.0 mideasthiring.com +0.0.0.0 mifcbook.link +0.0.0.0 mikkelbourke.pro +0.0.0.0 mimestyle.xyz +0.0.0.0 mimeversion.top +0.0.0.0 mimi18s.top +0.0.0.0 mimibox.top +0.0.0.0 mimicwt.net +0.0.0.0 mimimsg.net +0.0.0.0 miniiosapps.xyz +0.0.0.0 ministrynewschannel.com +0.0.0.0 ministrynewsinfo.com +0.0.0.0 minrsrvr.com +0.0.0.0 minspy.com +0.0.0.0 mintrack.vip +0.0.0.0 mirrorscreencasttvv.com +0.0.0.0 mispace.cam +0.0.0.0 misran.org +0.0.0.0 mitube1.link +0.0.0.0 mix-store.online +0.0.0.0 mkid.app +0.0.0.0 mkidctrl.app +0.0.0.0 mkidsecure.com +0.0.0.0 mlinks.ws +0.0.0.0 mlite-app.livekit.cloud +0.0.0.0 mlite-app.thd.cc +0.0.0.0 mlite-socket.thd.cc +0.0.0.0 mliteapp.alter757.info +0.0.0.0 mliteapp.com +0.0.0.0 mmbox.top +0.0.0.0 mnesytrlatr.com +0.0.0.0 mnfbodivbv.com +0.0.0.0 mnrsrvrer.com +0.0.0.0 mob.eurotrans.kz +0.0.0.0 mobeespy.com +0.0.0.0 mobellspy.com +0.0.0.0 mobi22.com +0.0.0.0 mobidad.app +0.0.0.0 mobiispy.com +0.0.0.0 mobil-kem.com +0.0.0.0 mobile-collector.newrelic.com +0.0.0.0 mobile-crash.newrelic.com +0.0.0.0 mobile-gw.thd.cc +0.0.0.0 mobile-remote-tracker.com +0.0.0.0 mobile-sdk-api.intercom.io +0.0.0.0 mobile-spy.co.za +0.0.0.0 mobile-tracker-data.com +0.0.0.0 mobile-tracker-family.com +0.0.0.0 mobile-tracker-free.be +0.0.0.0 mobile-tracker-free.biz +0.0.0.0 mobile-tracker-free.co +0.0.0.0 mobile-tracker-free.com +0.0.0.0 mobile-tracker-free.de +0.0.0.0 mobile-tracker-free.es +0.0.0.0 mobile-tracker-free.eu +0.0.0.0 mobile-tracker-free.fr +0.0.0.0 mobile-tracker-free.info +0.0.0.0 mobile-tracker-free.ir +0.0.0.0 mobile-tracker-free.it +0.0.0.0 mobile-tracker-free.me +0.0.0.0 mobile-tracker-free.mobi +0.0.0.0 mobile-tracker-free.name +0.0.0.0 mobile-tracker-free.net +0.0.0.0 mobile-tracker-free.org +0.0.0.0 mobile-tracker.mobi +0.0.0.0 mobile.ams2.measurelib.com +0.0.0.0 mobile.fra2.measurelib.com +0.0.0.0 mobile.measurelib.com +0.0.0.0 mobileapps.com.my +0.0.0.0 mobilebackup.biz +0.0.0.0 mobilefonex.com +0.0.0.0 mobileinnova.net +0.0.0.0 mobilenannylogs.com +0.0.0.0 mobilerecorder-1277.firebaseio.com +0.0.0.0 mobilerecorder24.com +0.0.0.0 mobilespy.at +0.0.0.0 mobilespy.io +0.0.0.0 mobilespyblog.com +0.0.0.0 mobilespyfree.net +0.0.0.0 mobilespyonline.com +0.0.0.0 mobiletool.ru +0.0.0.0 mobispy.net +0.0.0.0 mobistealth.com +0.0.0.0 mobitrackapps.com +0.0.0.0 mobleingsder.com +0.0.0.0 mobnetlink1.com +0.0.0.0 mobnetlink2.com +0.0.0.0 mobnetlink3.com +0.0.0.0 mocospy.com +0.0.0.0 moggfelicio.info +0.0.0.0 moi-gov.serveftp.com +0.0.0.0 moi-pna.pw +0.0.0.0 momomsg.top +0.0.0.0 monitor-android.android-monitor.ru +0.0.0.0 monitor-ua.com +0.0.0.0 monitor-ultra.com +0.0.0.0 monitorecell.com.br +0.0.0.0 monitorminor.com.tr +0.0.0.0 moone-b9497.appspot.com +0.0.0.0 moone-b9497.firebaseio.com +0.0.0.0 movimientoanticorreista.com +0.0.0.0 mozillaupdate.xyz +0.0.0.0 mpotect.app +0.0.0.0 mrec24.com +0.0.0.0 mrecorder.com +0.0.0.0 mrgrhr.com +0.0.0.0 mrswd.wo87sf.com +0.0.0.0 ms-cdn-88.com +0.0.0.0 msafe.xyz +0.0.0.0 msafety.app +0.0.0.0 msap.services +0.0.0.0 msas.ws +0.0.0.0 msecureapp.com +0.0.0.0 msgrdrg.com +0.0.0.0 msol.live +0.0.0.0 msonline.live +0.0.0.0 msp-control.app +0.0.0.0 mspkid.app +0.0.0.0 mspy.alter757.info +0.0.0.0 mspy.co.il +0.0.0.0 mspy.co.uk +0.0.0.0 mspy.com +0.0.0.0 mspy.com.ar +0.0.0.0 mspy.com.br +0.0.0.0 mspy.com.cn +0.0.0.0 mspy.com.es +0.0.0.0 mspy.fr +0.0.0.0 mspy.in +0.0.0.0 mspy.it +0.0.0.0 mspy.jp +0.0.0.0 mspy.net +0.0.0.0 mspy.nl +0.0.0.0 mspy.support +0.0.0.0 mspyitaly.com +0.0.0.0 mspylite.com +0.0.0.0 mspymax.com +0.0.0.0 mspyonline.com +0.0.0.0 mspyplus.com +0.0.0.0 mspytrackercom.alter757.info +0.0.0.0 msrdr.com +0.0.0.0 msrfrgr.com +0.0.0.0 msrvrgeh.com +0.0.0.0 msrvrgh.com +0.0.0.0 msrwr.com +0.0.0.0 mssecurityaccount.online +0.0.0.0 mt2-sdp4.mt-2.co +0.0.0.0 mt5vsuf1.net +0.0.0.0 mtechn.zendesk.com +0.0.0.0 mtf.re +0.0.0.0 mtm1nwmx-api.findgravy.com +0.0.0.0 mtoolapp.biz +0.0.0.0 mtoolapp.net +0.0.0.0 mtracker.fortess.net +0.0.0.0 multilingualbackend.azurewebsites.net +0.0.0.0 muslim-world.info +0.0.0.0 muslimasauda.com +0.0.0.0 mvrsrvrer.com +0.0.0.0 mxout.net +0.0.0.0 mxspy.com +0.0.0.0 my-office.cf +0.0.0.0 my-player.vip +0.0.0.0 my-spy-a9c92.firebaseio.com +0.0.0.0 my.a-spy.com +0.0.0.0 my.aispyer.com +0.0.0.0 my.androidmonitor.com +0.0.0.0 my.copy9.com +0.0.0.0 my.hws.icu +0.0.0.0 my.ispyoo.com +0.0.0.0 my.jjspy.com +0.0.0.0 my.kidsecured.com +0.0.0.0 my.mobiletool.ru +0.0.0.0 my.mobispy.net +0.0.0.0 my.mrec24.com +0.0.0.0 my.mspyonline.com +0.0.0.0 my.mtoolapp.net +0.0.0.0 my.nexspy.com +0.0.0.0 my.phonsee.com +0.0.0.0 my.securechildren.online +0.0.0.0 my.snoopza.com +0.0.0.0 my.spylix.com +0.0.0.0 my.spynger.net +0.0.0.0 my.spyzie.com +0.0.0.0 my.thespyapp.com +0.0.0.0 my.thetruthspy.com +0.0.0.0 my2.snoopza.com +0.0.0.0 myaccount-mail.com +0.0.0.0 myaccount.servehttp.com +0.0.0.0 myaccounts-google.info +0.0.0.0 myaccounts-google.online +0.0.0.0 myaccounts-google.space +0.0.0.0 myaccounts-google.tk +0.0.0.0 myaccounts-gooog1e.com +0.0.0.0 myaccounts-gooog1e.space +0.0.0.0 myaccounts-mail.com +0.0.0.0 myaccountsgoogle.info +0.0.0.0 myaddress.today +0.0.0.0 myapp-gooog1e.com +0.0.0.0 myappmobile-537f7.firebaseio.com +0.0.0.0 mycellspy.com +0.0.0.0 mychattranslator.club +0.0.0.0 mycloud.wisemo.com +0.0.0.0 mycloud1.wisemo.com +0.0.0.0 mycoffeeshop.shop +0.0.0.0 mydomainxyz.xyz +0.0.0.0 mydrive-accounts-google.ml +0.0.0.0 mydrive-google.asia +0.0.0.0 mydrive-google.com +0.0.0.0 mydrive-google.online +0.0.0.0 mydrive-google.space +0.0.0.0 mydrive-mail.asia +0.0.0.0 mydwnd.com +0.0.0.0 myfacetik.cf +0.0.0.0 myfcbk.net +0.0.0.0 myfonemate.com +0.0.0.0 mylinbas.com +0.0.0.0 mylocatorplus.club +0.0.0.0 mymensaje-sms.com +0.0.0.0 myspyapps.com +0.0.0.0 mytrips.quest +0.0.0.0 myutbe.net +0.0.0.0 mywebredirect.info +0.0.0.0 mywebsitevpstest.xyz +0.0.0.0 mz-vodacom.info +0.0.0.0 mzanzispy.co.za +0.0.0.0 mzpgfh.uhabq9.com +0.0.0.0 n.appspool.net +0.0.0.0 n.freespy1.ml +0.0.0.0 n.freespy1.tk +0.0.0.0 n.servidor.in +0.0.0.0 n.systemlog.me +0.0.0.0 n.umobix.com +0.0.0.0 n1.flyermobi.com +0.0.0.0 n1.lavozamericana.info +0.0.0.0 n1.login-office365.com +0.0.0.0 n1.support-java.com +0.0.0.0 n1.update-outlook.info +0.0.0.0 n2.login-office365.com +0.0.0.0 n3.pancaliente.info +0.0.0.0 n4.pancaliente.info +0.0.0.0 n47n.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 n6sm2m.celltracker.io +0.0.0.0 nabd.site +0.0.0.0 nabde.app +0.0.0.0 nachat-152615.appspot.com +0.0.0.0 nachat-152615.firebaseio.com +0.0.0.0 nameserver3476.com +0.0.0.0 nameserverredirect.com +0.0.0.0 nassosblog.gr.com +0.0.0.0 nation-news.com +0.0.0.0 nav.telematicsdirect.com +0.0.0.0 nd-aktuell.co +0.0.0.0 nd-aktuell.net +0.0.0.0 nd-aktuell.pro +0.0.0.0 ndagri.com +0.0.0.0 neatspy.com +0.0.0.0 neatspy.vip +0.0.0.0 nemaeovies.com +0.0.0.0 nemospy.com +0.0.0.0 nemshi-news.xyz +0.0.0.0 nemshi.net +0.0.0.0 neospy.net +0.0.0.0 neospy.pro +0.0.0.0 neospy.tech +0.0.0.0 net.cleverjp.com +0.0.0.0 net.etrality.com +0.0.0.0 net.hahamobi.com +0.0.0.0 net.salmonads.com +0.0.0.0 netcomserviceonline.com +0.0.0.0 netgeoserversg.com +0.0.0.0 netmapservice.com +0.0.0.0 netsecureemailservice.com +0.0.0.0 netsecurehostingmy.com +0.0.0.0 netsecuremailhosting.com +0.0.0.0 netsecureserver399.com +0.0.0.0 netserviceru.com +0.0.0.0 netspy-7b8ec.firebaseio.com +0.0.0.0 netspy.net +0.0.0.0 network190.com +0.0.0.0 networkcartography.com +0.0.0.0 networkcartography.net +0.0.0.0 networkcartography.org +0.0.0.0 networkenterprise.net +0.0.0.0 networkmiddleast.net +0.0.0.0 networkshareserver.com +0.0.0.0 neuigkeitenfursie.tech +0.0.0.0 new.androidlost.com +0.0.0.0 newdemo.snoopza.com +0.0.0.0 newdulcina.com +0.0.0.0 news-fbcb4.appspot.com +0.0.0.0 news-fbcb4.firebaseio.com +0.0.0.0 news-gazette.info +0.0.0.0 news-smtp2go.email +0.0.0.0 news.firewall-gateway.com +0.0.0.0 newsbeast.gr.com +0.0.0.0 newserver39.com +0.0.0.0 newsl.ink +0.0.0.0 newslive2.xyz +0.0.0.0 newtarrifs.net +0.0.0.0 newyorkingsite.com +0.0.0.0 newzeto.xyz +0.0.0.0 newzgroup.xyz +0.0.0.0 nexspy.com +0.0.0.0 nextialive.roimaster.site +0.0.0.0 nfrmg1y.xyz +0.0.0.0 ngc77.com +0.0.0.0 nhansudaihoi13.org +0.0.0.0 niceonase.com +0.0.0.0 niceonesa.net +0.0.0.0 nicoledotson.icu +0.0.0.0 nigeriaoilleaks.com +0.0.0.0 nikjol.xyz +0.0.0.0 nimbus.bitdefender.net +0.0.0.0 nineth03.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 nissan.gr.com +0.0.0.0 nl.refog.com +0.0.0.0 no.response.delivery.es +0.0.0.0 node-api.theonespy.com +0.0.0.0 node1.theonespy.com +0.0.0.0 node2.theonespy.com +0.0.0.0 node3.theonespy.com +0.0.0.0 node4.theonespy.com +0.0.0.0 node5.theonespy.com +0.0.0.0 nodejs.spyhuman.com +0.0.0.0 nodeserver50.com +0.0.0.0 norayowell.info +0.0.0.0 noreplay.email +0.0.0.0 notification-team.servehttp.com +0.0.0.0 notifications-sec.com +0.0.0.0 notifications.wa-info.com +0.0.0.0 noujx.s9gxw8.com +0.0.0.0 nouvelles247.com +0.0.0.0 novafile.tk +0.0.0.0 novasdk.oss-cn-beijing.aliyuncs.com +0.0.0.0 novosti.bid +0.0.0.0 nrgrsrvrer.com +0.0.0.0 ns.update-outlook.info +0.0.0.0 ns1.deyrep.com +0.0.0.0 ns1.hostinger.ru +0.0.0.0 ns1.ukraine.com.ua +0.0.0.0 ns2.deyrep.com +0.0.0.0 nsoqa.com +0.0.0.0 nwluoodzct.xyz +0.0.0.0 nwzhmwux-api.findgravy.com +0.0.0.0 o.freespy1.ml +0.0.0.0 o.freespy1.tk +0.0.0.0 observer.back4app.io +0.0.0.0 ocheyhv.xyz +0.0.0.0 offebnarugn.online +0.0.0.0 offebnarugn.site +0.0.0.0 offebnarugn.space +0.0.0.0 offebnarugn.website +0.0.0.0 offebnurgn.online +0.0.0.0 offebnurgn.site +0.0.0.0 offebnurgn.space +0.0.0.0 offebnurgn.website +0.0.0.0 offenbarugn.online +0.0.0.0 offenbarugn.site +0.0.0.0 offenbarugn.space +0.0.0.0 offenbarugn.website +0.0.0.0 offenbaurgn.online +0.0.0.0 offenbaurgn.site +0.0.0.0 offenbaurgn.space +0.0.0.0 offenbaurgn.website +0.0.0.0 office-shop.me +0.0.0.0 office.hw.cab +0.0.0.0 offinemaining.fun +0.0.0.0 offinemaining.online +0.0.0.0 offinemaining.pw +0.0.0.0 offinemaining.site +0.0.0.0 offinemaining.website +0.0.0.0 offinemainung.info +0.0.0.0 offinemainung.live +0.0.0.0 offinemaiunng.online +0.0.0.0 offinemaiunng.pw +0.0.0.0 offinemaiunng.space +0.0.0.0 offinemanung.online +0.0.0.0 offinemanung.site +0.0.0.0 offinemanung.website +0.0.0.0 offinemaunng.online +0.0.0.0 offineminung.online +0.0.0.0 offineminung.pw +0.0.0.0 offineminung.site +0.0.0.0 offineminung.space +0.0.0.0 offineminung.website +0.0.0.0 offinemiunng.online +0.0.0.0 offinemiunng.space +0.0.0.0 offinemizung.online +0.0.0.0 offinemizung.website +0.0.0.0 offinemnung.online +0.0.0.0 offinemnung.space +0.0.0.0 offinemunng.online +0.0.0.0 offinemunng.website +0.0.0.0 offroaderssurvive.club +0.0.0.0 offshorecompanyllp.com +0.0.0.0 offshoretoursntravels.com +0.0.0.0 ogymoggy.firebaseio.com +0.0.0.0 ogymogy.com +0.0.0.0 oilgy.xyz +0.0.0.0 okjojihgv.com +0.0.0.0 olexegy.com +0.0.0.0 olimob.net +0.0.0.0 olurdaolurdediler.shop +0.0.0.0 olxeg.com +0.0.0.0 omanreal.net +0.0.0.0 omeega.xyz +0.0.0.0 onarchbylap.com +0.0.0.0 oncamera.top +0.0.0.0 oncamera.vip +0.0.0.0 oncast.top +0.0.0.0 ondemand.pushthisurl.com +0.0.0.0 onedrivelive.me +0.0.0.0 onedriveupdate.net +0.0.0.0 onelink.me +0.0.0.0 onelnk.com +0.0.0.0 onelocator.com +0.0.0.0 onemonitar.com +0.0.0.0 onespy-in-196211.firebaseio.com +0.0.0.0 onespy-in-d.s3.eu-central-1.amazonaws.com +0.0.0.0 onespy.com +0.0.0.0 onetouchsecurities.com +0.0.0.0 online-audible.com +0.0.0.0 online-chess.live +0.0.0.0 onlinecontrol.app +0.0.0.0 onlinefundb.com +0.0.0.0 onlineloginportal.com +0.0.0.0 onlineloginportalhk.com +0.0.0.0 onlineloginportalmy.com +0.0.0.0 onlineloginportalsg.com +0.0.0.0 onlineloginserviceeu.com +0.0.0.0 onlineloginserviceuk.com +0.0.0.0 onlineloginserviceusa.com +0.0.0.0 onlinemusicstoreuk.com +0.0.0.0 onlinenetworkinghelp.com +0.0.0.0 onlinesecure.app +0.0.0.0 onlineservices.gr.com +0.0.0.0 onpointcorp.co +0.0.0.0 ooredoodeals.com +0.0.0.0 openserverholland.com +0.0.0.0 opensourcecontext.com +0.0.0.0 opispy.net +0.0.0.0 oppleman.org +0.0.0.0 optimizedimghosting.com +0.0.0.0 optionalblogging.com +0.0.0.0 optionalblogginges.com +0.0.0.0 optionalbloggingeu.com +0.0.0.0 optionalblogginguk.com +0.0.0.0 optionaldesigners.com +0.0.0.0 optionsothego.com +0.0.0.0 orangegypt.co +0.0.0.0 orchomenos.news +0.0.0.0 order.80876dd5.shop +0.0.0.0 oroscopemestry.com +0.0.0.0 ortn13der.xyz +0.0.0.0 oscontext.com +0.0.0.0 oso.kcpro.ga +0.0.0.0 ospocatracker.com +0.0.0.0 otaupdatesios.com +0.0.0.0 outcome-ssp.supersonicads.com +0.0.0.0 outline.abunddhighett.com +0.0.0.0 outline.truecaller.com +0.0.0.0 outlook-login.com +0.0.0.0 outlook-services.com +0.0.0.0 outlookde.live +0.0.0.0 outlookdelivery.com +0.0.0.0 outlookservices.live +0.0.0.0 outlookservices.me +0.0.0.0 outube.live +0.0.0.0 overingtonray.info +0.0.0.0 ownspy.com +0.0.0.0 ownspy.es +0.0.0.0 oxy.nexspy.com +0.0.0.0 p.baoyueai.com +0.0.0.0 p.freespy1.ml +0.0.0.0 p.freespy1.tk +0.0.0.0 p.webengage.com +0.0.0.0 package.mrec24.com +0.0.0.0 package2.mrec24.com +0.0.0.0 pageredirectservice.com +0.0.0.0 pageserver299.com +0.0.0.0 pageserver77.com +0.0.0.0 pageserverru.com +0.0.0.0 palpolice.icu +0.0.0.0 pancaliente.info +0.0.0.0 panel.clevguard.com +0.0.0.0 panel.spy24.net +0.0.0.0 panel.webdetetive.com.br +0.0.0.0 panel24.org +0.0.0.0 panspy-1.oss-us-west-1.aliyuncs.com +0.0.0.0 panspy.com +0.0.0.0 panspy.me +0.0.0.0 paok-24.com +0.0.0.0 parent-msp.app +0.0.0.0 parser.cufinder.io +0.0.0.0 partner.securspy.com +0.0.0.0 pastepast.net +0.0.0.0 pathanalyzer.com +0.0.0.0 pathanalyzerpro.com +0.0.0.0 paulycongalton.pro +0.0.0.0 pc.backupsoft.eu +0.0.0.0 pc.brunoespiao.com.br +0.0.0.0 pc.foxspy.com.br +0.0.0.0 pc.freespyapp.com +0.0.0.0 pc.myswiftmobilespy.co.za +0.0.0.0 pc.selfspy.com +0.0.0.0 pc.spykontrol.com +0.0.0.0 pc.spyone.pl +0.0.0.0 pc.viptelefonprogrami.com +0.0.0.0 pc1.brunoespiao.com.br +0.0.0.0 pctattletale.com +0.0.0.0 pctattletalev2.s3.amazonaws.com +0.0.0.0 pdfviewer.app +0.0.0.0 pemuti.com +0.0.0.0 perargero.com +0.0.0.0 personaldoaminru.com +0.0.0.0 personaldoaminsg.com +0.0.0.0 pflix.camdvr.org +0.0.0.0 pfsense02-01.is-61194.teragence.net +0.0.0.0 pgv4.com +0.0.0.0 pharaohsadventure.club +0.0.0.0 phone-backup-service.firebaseio.com +0.0.0.0 phone-spy.com +0.0.0.0 phoneboster.com +0.0.0.0 phonecallerscreen.com +0.0.0.0 phonecontrolapp-e2c64.firebaseio.com +0.0.0.0 phonecontrolblockspamcalls.com +0.0.0.0 phonedata.me +0.0.0.0 phonemonitor.com +0.0.0.0 phoneparental.com +0.0.0.0 phonesheriff.com +0.0.0.0 phonespector-b2f13.firebaseio.com +0.0.0.0 phonespector.com +0.0.0.0 phonespying.com +0.0.0.0 phonetrack.com +0.0.0.0 phonetracker.com +0.0.0.0 phonetracker95gpsonly.firebaseio.com +0.0.0.0 phonetracking-dd226.firebaseio.com +0.0.0.0 phonetracking.net +0.0.0.0 phonfinbyclap.com +0.0.0.0 phonsee.com +0.0.0.0 photoeditorbest.club +0.0.0.0 phpinfo.pw +0.0.0.0 phpwebserver34.best +0.0.0.0 phpwebserver34.site +0.0.0.0 phpwebserver34.tech +0.0.0.0 phpwebserver34.xyz +0.0.0.0 pi.info-taxi.info +0.0.0.0 pic-shareonline.com +0.0.0.0 pickuchu.com +0.0.0.0 piction.club +0.0.0.0 pie.wirelessregistry.com +0.0.0.0 pikchoeditor.com +0.0.0.0 pin.pgv4.com +0.0.0.0 pin.spyapp.ro +0.0.0.0 pipe.thd.cc +0.0.0.0 pixelprose.fr +0.0.0.0 pixlr.live +0.0.0.0 pixlr.myftp.org +0.0.0.0 planyourexoticvacation.com +0.0.0.0 play-protect.com +0.0.0.0 play-store-3bb64.firebaseio.com +0.0.0.0 play-store-51182.appspot.com +0.0.0.0 play-store-51182.firebaseio.com +0.0.0.0 play.google.com.whatsapp.playapps.ga +0.0.0.0 playestore.net +0.0.0.0 playgoog1e.com +0.0.0.0 plug2025.bm-com.com +0.0.0.0 pluginapi.chajianapi.com +0.0.0.0 ply.bearclod.com +0.0.0.0 pma-234fsfsddfsdfds09.onemonitar.com +0.0.0.0 pn8sm7rjuc.execute-api.us-east-1.amazonaws.com +0.0.0.0 pocopoc.xyz +0.0.0.0 poiuwhejgr.com +0.0.0.0 polarismail.services +0.0.0.0 policy.getdownloadtime.com +0.0.0.0 politica.in.ua +0.0.0.0 politika.bid +0.0.0.0 politique-koaci.info +0.0.0.0 ponyvideochat.com +0.0.0.0 pop.secuerserver.com +0.0.0.0 portal.android007.com +0.0.0.0 portal.flexispy.com +0.0.0.0 portal.mobilebackup.biz +0.0.0.0 portal.spytek.co.za +0.0.0.0 portal.topzaloha.cz +0.0.0.0 portal.unipass.top +0.0.0.0 portfoliofasinating.com +0.0.0.0 positivefitness.club +0.0.0.0 post-jquery.com +0.0.0.0 post-manager.com +0.0.0.0 postmailsecret.com +0.0.0.0 postmarkapiservice.com +0.0.0.0 postserverem.com +0.0.0.0 postserviceemaildomain.com +0.0.0.0 power-messenger.com +0.0.0.0 ppleid.org +0.0.0.0 pql.kcpro.ga +0.0.0.0 precise.fit +0.0.0.0 prefiles.ml +0.0.0.0 preservtyg.com +0.0.0.0 pricetiger.org +0.0.0.0 prmopromo.com +0.0.0.0 pro.logger.mobi +0.0.0.0 productdemoservice.com +0.0.0.0 production.getpriceapp.com +0.0.0.0 products-office.online +0.0.0.0 profile.localytics.com +0.0.0.0 profotoeditor.com +0.0.0.0 prog-money.android-monitor.ru +0.0.0.0 prog-money.com +0.0.0.0 project-323448153542050953.firebaseio.com +0.0.0.0 project-7991479181228723357.firebaseio.com +0.0.0.0 projectormp.com +0.0.0.0 promosdereve.com +0.0.0.0 promotespritialbelief.com +0.0.0.0 pronews.gr.com +0.0.0.0 prontodigital.com.br +0.0.0.0 proocallerr.com +0.0.0.0 prospybubble.com +0.0.0.0 protocol-a.copy9.com +0.0.0.0 protocol-a.exactspy.com +0.0.0.0 protocol-a.fonetracker.com +0.0.0.0 protocol-a.guestspy.com +0.0.0.0 protocol-a.ispyoo.com +0.0.0.0 protocol-a.mxspy.com +0.0.0.0 protocol-a.thetruthspy.com +0.0.0.0 protocol-a100.fonetracker.com +0.0.0.0 protocol-a100.phoneparental.com +0.0.0.0 protocol-a100.thetruthspy.com +0.0.0.0 protocol-a5.guestspy.com +0.0.0.0 protocol-a58.guestspy.com +0.0.0.0 protocol-a59.guestspy.com +0.0.0.0 protocol-a6.thetruthspy.com +0.0.0.0 protocol-a60.guestspy.com +0.0.0.0 protocol-a600.fonetracker.com +0.0.0.0 protocol-a610.copy9.com +0.0.0.0 protocol-a610.thetruthspy.com +0.0.0.0 protocol-a611.copy9.com +0.0.0.0 protocol-a611.thetruthspy.com +0.0.0.0 protocol-a612.copy9.com +0.0.0.0 protocol-a614.copy9.com +0.0.0.0 protocol-a615.copy9.com +0.0.0.0 protocol-a616.copy9.com +0.0.0.0 protocol-a617.copy9.com +0.0.0.0 protocol-a618.copy9.com +0.0.0.0 protocol-a620.copy9.com +0.0.0.0 protocol-a621.copy9.com +0.0.0.0 protocol-a65.guestspy.com +0.0.0.0 protocol-a69.copy9.com +0.0.0.0 protocol-a696.copy9.com +0.0.0.0 protocol-a70.guestspy.com +0.0.0.0 protocol-a710.copy9.com +0.0.0.0 protocol-a712.fonetracker.com +0.0.0.0 protocol-a72.thetruthspy.com +0.0.0.0 protocol-a720.thetruthspy.com +0.0.0.0 protocol-a721.thetruthspy.com +0.0.0.0 protocol-a722.thetruthspy.com +0.0.0.0 protocol-a723.thetruthspy.com +0.0.0.0 protocol-a724.thetruthspy.com +0.0.0.0 protocol-a725.thetruthspy.com +0.0.0.0 protocol-a726.thetruthspy.com +0.0.0.0 protocol-a727.thetruthspy.com +0.0.0.0 protocol-a728.thetruthspy.com +0.0.0.0 protocol-a729.thetruthspy.com +0.0.0.0 protocol-a730.thetruthspy.com +0.0.0.0 protocol-a731.thetruthspy.com +0.0.0.0 protocol-a732.thetruthspy.com +0.0.0.0 protocol-a733.thetruthspy.com +0.0.0.0 protocol-a734.thetruthspy.com +0.0.0.0 protocol-a735.thetruthspy.com +0.0.0.0 protocol-a736.thetruthspy.com +0.0.0.0 protocol-a737.thetruthspy.com +0.0.0.0 protocol-a738.thetruthspy.com +0.0.0.0 protocol-a739.thetruthspy.com +0.0.0.0 protocol-a740.thetruthspy.com +0.0.0.0 protocol-a741.thetruthspy.com +0.0.0.0 protocol-a742.thetruthspy.com +0.0.0.0 protocol-a743.thetruthspy.com +0.0.0.0 protocol-a744.thetruthspy.com +0.0.0.0 protocol-a745.mxspy.com +0.0.0.0 protocol-a745.thetruthspy.com +0.0.0.0 protocol-a746.thetruthspy.com +0.0.0.0 protocol-a747.thetruthspy.com +0.0.0.0 protocol-a748.thetruthspy.com +0.0.0.0 protocol-a749.thetruthspy.com +0.0.0.0 protocol-a780.copy9.com +0.0.0.0 protocol-a780.fonetracker.com +0.0.0.0 protocol-a780.ispyoo.com +0.0.0.0 protocol-a780.mxspy.com +0.0.0.0 protocol-a785.copy9.com +0.0.0.0 protocol-a785.fonetracker.com +0.0.0.0 protocol-a810.ispyoo.com +0.0.0.0 protocol-a810.mxspy.com +0.0.0.0 protocol-a810.thetruthspy.com +0.0.0.0 protocol-a811.ispyoo.com +0.0.0.0 protocol-a811.mxspy.com +0.0.0.0 protocol-a880.ispyoo.com +0.0.0.0 protocol-a89.ispyoo.com +0.0.0.0 protocol-a89.mxspy.com +0.0.0.0 protocol-a910.thetruthspy.com +0.0.0.0 protocol-a915.thetruthspy.com +0.0.0.0 protocol-a920.thetruthspy.com +0.0.0.0 protocol-a925.thetruthspy.com +0.0.0.0 protocol-a930.thetruthspy.com +0.0.0.0 protocol-a935.thetruthspy.com +0.0.0.0 protocol-a940.thetruthspy.com +0.0.0.0 protocol-a941.thetruthspy.com +0.0.0.0 protocol-a942.thetruthspy.com +0.0.0.0 protocol-a943.thetruthspy.com +0.0.0.0 protocol-a944.thetruthspy.com +0.0.0.0 protocol-a945.thetruthspy.com +0.0.0.0 protocol-a946.thetruthspy.com +0.0.0.0 protocol-a947.thetruthspy.com +0.0.0.0 protocol-monitor.thetruthspy.com +0.0.0.0 protocol-viewer-a.copy9.com +0.0.0.0 protocol.copy9.com +0.0.0.0 protocol.guestspy.com +0.0.0.0 protocol.inospy.com +0.0.0.0 protocol.ispyoo.com +0.0.0.0 protocol.mxspy.com +0.0.0.0 protocol.systemserviceprovider.com +0.0.0.0 protocol.thetruthspy.com +0.0.0.0 protothema.live +0.0.0.0 proupload.xyz +0.0.0.0 proxy.reptilicus.net +0.0.0.0 proxy48.oss-eu-central-1.aliyuncs.com +0.0.0.0 prwebsiteuk.com +0.0.0.0 ps1link.xyz +0.0.0.0 ps2link.xyz +0.0.0.0 ps97mailer.logger.mobi +0.0.0.0 pssts1.nozonenet.com +0.0.0.0 pt.mobilespy.at +0.0.0.0 publicsgroupe.net +0.0.0.0 pulsesolutions-net-easy-logger.firebaseio.com +0.0.0.0 pupki.co +0.0.0.0 pure-talk.site +0.0.0.0 push.mobilefonex.com +0.0.0.0 pushapi.localytics.com +0.0.0.0 putanything.com +0.0.0.0 pwhois.net +0.0.0.0 pwhois.org +0.0.0.0 pwtgnp.pw +0.0.0.0 pwutc.live +0.0.0.0 q12z.net +0.0.0.0 q95294fs.beget.tech +0.0.0.0 qaintqa.com +0.0.0.0 qh2020.org +0.0.0.0 qibdirctiowa.com +0.0.0.0 qiberiblaon.com +0.0.0.0 qibla-quran.com +0.0.0.0 qibla-ultima.com +0.0.0.0 qiblassirection.com +0.0.0.0 qrcodesscan.com +0.0.0.0 qrreaderpro.com +0.0.0.0 qtwjhuj.com +0.0.0.0 quanly24h.net +0.0.0.0 quickupdates.xyz +0.0.0.0 quietquell.com +0.0.0.0 quinoa-personal-identify-prod.sense360eng.com +0.0.0.0 quota-notification.servehttp.com +0.0.0.0 qwert.xyz +0.0.0.0 qwxzyl.com +0.0.0.0 r.findmykids.org +0.0.0.0 racerscardriver.club +0.0.0.0 racksackserveruk.com +0.0.0.0 rackserver39.com +0.0.0.0 rali.live +0.0.0.0 randy-severs.info +0.0.0.0 rank.trellian.com +0.0.0.0 rastreadordenamorado.com.br +0.0.0.0 ratapi11223344786.azurewebsites.net +0.0.0.0 rbk.today +0.0.0.0 rc-api.lifecircle.app +0.0.0.0 rcomlogin.com +0.0.0.0 rctphvxwnjhx.pw +0.0.0.0 rdeskapi719543132892786.azurewebsites.net +0.0.0.0 readmytipsntricks.com +0.0.0.0 realtime-spy-mobile.com +0.0.0.0 rec.hw.cab +0.0.0.0 recomspy.com +0.0.0.0 recruitme.international +0.0.0.0 redcrossworld.com +0.0.0.0 redeitt.com +0.0.0.0 redirection.bid +0.0.0.0 redirectonline.xyz +0.0.0.0 redirectserviceonline.com +0.0.0.0 redvios.com +0.0.0.0 refinery.shopsavvy.com +0.0.0.0 refog.com +0.0.0.0 refog.de +0.0.0.0 refog.net +0.0.0.0 refog.org +0.0.0.0 registrationonlineeurope.com +0.0.0.0 registrations.smstracker.com +0.0.0.0 relay1.trackview.net +0.0.0.0 remgrogroup.com +0.0.0.0 remotecommands.com +0.0.0.0 remotesecurity-629f2.firebaseio.com +0.0.0.0 remotesecurityots.firebaseio.com +0.0.0.0 remoto.foxspy.com.br +0.0.0.0 repo.mspyonline.com +0.0.0.0 report.huqindustries.co.uk +0.0.0.0 reporting-util.tutelatechnologies.com +0.0.0.0 reporting.tutelatechnologies.com +0.0.0.0 reports.crashlytics.com +0.0.0.0 reptilicus.net +0.0.0.0 repubblica.life +0.0.0.0 restricted-videos.servehttp.com +0.0.0.0 retinax.com +0.0.0.0 revistadcr.com +0.0.0.0 rf.mk +0.0.0.0 rfjdhxbz.com +0.0.0.0 richardbeman.info +0.0.0.0 rinimae.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 riospy.net +0.0.0.0 rkarsin453287786.azurewebsites.net +0.0.0.0 ro.mobilespy.at +0.0.0.0 ro.pgv4.com +0.0.0.0 ro.refog.com +0.0.0.0 roaccount.pgv4.com +0.0.0.0 robert-conley.space +0.0.0.0 robertking.site +0.0.0.0 robotics.land +0.0.0.0 rockalab.com +0.0.0.0 rockerhostings.com +0.0.0.0 rooitor.com +0.0.0.0 rp.apollospy.com +0.0.0.0 rp.dedrone.com.ua +0.0.0.0 rp.labrador.ua +0.0.0.0 rp.liquidblue.com.ua +0.0.0.0 rportranslator.com +0.0.0.0 rrn.world +0.0.0.0 rrspy.com +0.0.0.0 rtc.ttspy.com +0.0.0.0 ru.neospy.net +0.0.0.0 ruba-bakkour-facebook.blogspot.com +0.0.0.0 rulapptoplan.com +0.0.0.0 ruley.no-ip.org +0.0.0.0 rulinuxbasic.com +0.0.0.0 runaki-support.appspot.com +0.0.0.0 ruslinbas.com +0.0.0.0 russialinuxbasic.com +0.0.0.0 rythemsjoy.club +0.0.0.0 rythergannon.info +0.0.0.0 rzhpe6vyf9.execute-api.eu-west-2.amazonaws.com +0.0.0.0 s.appjiagu.com +0.0.0.0 s.net2share.com +0.0.0.0 s.servidor.in +0.0.0.0 s1.mgoogle.us +0.0.0.0 s1.panspy.com +0.0.0.0 s1.spylive360.com +0.0.0.0 s1.support +0.0.0.0 s2.mgoogle.us +0.0.0.0 s2.spylive360.com +0.0.0.0 s3.spylive360.com +0.0.0.0 s3.thd.cc +0.0.0.0 s9gxw8.com +0.0.0.0 sa.api.india.miui.com +0.0.0.0 sa.api.intl.miui.com +0.0.0.0 sa.api.rus.miui.com +0.0.0.0 saahas.servecounterstrike.com +0.0.0.0 sabafon.info +0.0.0.0 sabic.work +0.0.0.0 safe-link.mobi +0.0.0.0 safe-root.com +0.0.0.0 safe.videoadblockerplus.com +0.0.0.0 safeguarde.com +0.0.0.0 safelock.club +0.0.0.0 safelyredirecting.com +0.0.0.0 safelyredirecting.digital +0.0.0.0 saferedirect.pw +0.0.0.0 saferspy.com +0.0.0.0 safespy.com +0.0.0.0 safespy.vip +0.0.0.0 safetyssl.security-centers.com +0.0.0.0 safeyourdata.xyz +0.0.0.0 sahar.oss-us-east-1.aliyuncs.com +0.0.0.0 saipem.org +0.0.0.0 samehnew-10a7c.appspot.com +0.0.0.0 samehnew-10a7c.firebaseio.com +0.0.0.0 sandbox97.childsafetytrackerapp.com +0.0.0.0 sandbox97.logger.mobi +0.0.0.0 sandbox97.seniorsafetyapp.com +0.0.0.0 sandra-franklin.fun +0.0.0.0 sandsngo.com +0.0.0.0 sanely.cc +0.0.0.0 santanaservice.com +0.0.0.0 sap4mobile-89685.firebaseio.com +0.0.0.0 sap4mobile.com +0.0.0.0 sapient-flight-837.firebaseio.com +0.0.0.0 sapserver39j.com +0.0.0.0 sapserverhg.com +0.0.0.0 sapserverhike.com +0.0.0.0 sapserverhipe.com +0.0.0.0 sauditourismguide.com +0.0.0.0 saudivisions2030.org +0.0.0.0 savemoneytrick.com +0.0.0.0 sbt.tv +0.0.0.0 scandocnotes.com +0.0.0.0 scar.unityads.unity3d.com +0.0.0.0 scfstats.alixblog.com +0.0.0.0 schlauespiel.de +0.0.0.0 scorerabbate.site +0.0.0.0 screentimelabs.appspot.com +0.0.0.0 screentimelabs.com +0.0.0.0 sdk-as.complementics.com +0.0.0.0 sdk.dofunapps.com +0.0.0.0 sdk.predic.io +0.0.0.0 sdk.sdkbalance.com +0.0.0.0 sdk.starbolt.io +0.0.0.0 seahome.top +0.0.0.0 search.matchy.ru +0.0.0.0 searchsimple.info +0.0.0.0 searchsimple.net +0.0.0.0 sec-flare.com +0.0.0.0 secondclone-2d312.firebaseio.com +0.0.0.0 secondclone.com +0.0.0.0 secontranslatpr.com +0.0.0.0 secuerserver.com +0.0.0.0 secure-access10.mx +0.0.0.0 secure-alert.servehttp.com +0.0.0.0 secure-msp.app +0.0.0.0 secure-team.servehttp.com +0.0.0.0 secureapplication.azurewebsites.net +0.0.0.0 securebackuponline.net +0.0.0.0 securechat.azurewebsites.net +0.0.0.0 securechildren.online +0.0.0.0 secureemailserver65.com +0.0.0.0 securemailhost46.com +0.0.0.0 secureserver9898.com +0.0.0.0 secureserverasia.com +0.0.0.0 secureservereurope.com +0.0.0.0 security-myaccount.servehttp.com +0.0.0.0 security.laikalabs.ai +0.0.0.0 securityaccountreply.com +0.0.0.0 securityteam-notify.servehttp.com +0.0.0.0 securspy.com +0.0.0.0 seery.online +0.0.0.0 selectedmaxstores.com +0.0.0.0 selectedservicemy.com +0.0.0.0 selectedserviceru.com +0.0.0.0 selectedservicesg.com +0.0.0.0 selectiveservicemax.com +0.0.0.0 selectyourgroom.com +0.0.0.0 selfspy.com +0.0.0.0 send.onemonitar.com +0.0.0.0 send.onespy.com +0.0.0.0 sendblaster.org +0.0.0.0 sender.gb.net +0.0.0.0 senior-safety-189010.firebaseio.com +0.0.0.0 seniorsafetyapp.com +0.0.0.0 senseye.spymasterpro.com +0.0.0.0 sentry-01.thd.cc +0.0.0.0 sentry-02.thd.cc +0.0.0.0 sentry-03.thd.cc +0.0.0.0 sentry-04.thd.cc +0.0.0.0 sentry-05.thd.cc +0.0.0.0 sentry-06.thd.cc +0.0.0.0 sentry-07.thd.cc +0.0.0.0 sentry-product-new.bbrp.co +0.0.0.0 sentrypc.com +0.0.0.0 sentrypc.net +0.0.0.0 sepenet.gr.com +0.0.0.0 sephoragroup.com +0.0.0.0 ser-chat.com +0.0.0.0 server.androidmonitor.com +0.0.0.0 server.freeandroidspy.com +0.0.0.0 server.pgv4.com +0.0.0.0 serverasiasap.com +0.0.0.0 serverdemoservice.com +0.0.0.0 serverforhelphk.com +0.0.0.0 serverforhelplux.com +0.0.0.0 serverforhelpmy.com +0.0.0.0 serverforhelpru.com +0.0.0.0 serverforhelpsg.com +0.0.0.0 serverforhiretech.com +0.0.0.0 serverforhome.com +0.0.0.0 serverformailings.com +0.0.0.0 serverfornetworks.com +0.0.0.0 serverforshort.com +0.0.0.0 serverfortechhelp.com +0.0.0.0 serverfortechies.com +0.0.0.0 serverforzapper.com +0.0.0.0 servergateway33.com +0.0.0.0 servergateway56.com +0.0.0.0 serverhello54.com +0.0.0.0 serverloadbalance.com +0.0.0.0 servermailing34.com +0.0.0.0 servermain43.com +0.0.0.0 servermappingserviceonline.com +0.0.0.0 servers-mobile.info +0.0.0.0 serversap54.com +0.0.0.0 service.n.weiguanai.cn +0.0.0.0 service.weiguanai.cn +0.0.0.0 serviceasneed.com +0.0.0.0 serviceforneworder.com +0.0.0.0 servicegoingfar.com +0.0.0.0 services.spyhuman.com +0.0.0.0 services.spytoapp.com +0.0.0.0 servicesloggermobi.azurewebsites.net +0.0.0.0 serviceupdaterequest.com +0.0.0.0 servidor.in +0.0.0.0 setting.rayjump.com +0.0.0.0 settings.crashlytics.com +0.0.0.0 setup.nemospy.com +0.0.0.0 setupmail-a.icloudappe.com +0.0.0.0 setupmail-a720.icloudappe.com +0.0.0.0 setupmail-a722.icloudappe.com +0.0.0.0 setupmail-a724.icloudappe.com +0.0.0.0 setupmail-a725.icloudappe.com +0.0.0.0 setupmail-a726.icloudappe.com +0.0.0.0 setupmail-a727.icloudappe.com +0.0.0.0 setupmail-a729.icloudappe.com +0.0.0.0 setupmail-a732.icloudappe.com +0.0.0.0 setupmail-a733.icloudappe.com +0.0.0.0 setupmail-a734.icloudappe.com +0.0.0.0 setupmail-a735.icloudappe.com +0.0.0.0 setupmail-a737.icloudappe.com +0.0.0.0 setupmail-a738.icloudappe.com +0.0.0.0 setupmail-a740.icloudappe.com +0.0.0.0 setupmail-a741.icloudappe.com +0.0.0.0 setupmail-a742.icloudappe.com +0.0.0.0 setupmail-a743.icloudappe.com +0.0.0.0 setupmail-a744.icloudappe.com +0.0.0.0 setupmail-a745.icloudappe.com +0.0.0.0 setupmail-a746.icloudappe.com +0.0.0.0 setupmail-a747.icloudappe.com +0.0.0.0 setupmail-a748.icloudappe.com +0.0.0.0 setupmail-a910.icloudappe.com +0.0.0.0 setupmail-a915.icloudappe.com +0.0.0.0 setupmail-a920.icloudappe.com +0.0.0.0 setupmail.icloudappe.com +0.0.0.0 sextape225.me +0.0.0.0 sg1-spiky.wzrkt.com +0.0.0.0 sg1.cb.wzrkt.com +0.0.0.0 sg1.wzrkt.com +0.0.0.0 sglinbas.com +0.0.0.0 sha-talk.co +0.0.0.0 shadow-logs.com +0.0.0.0 shadow-spy.com +0.0.0.0 shadowappbundle-default-rtdb.firebaseio.com +0.0.0.0 shadowlogspanel.firebaseio.com +0.0.0.0 shadymario.com +0.0.0.0 shadyspy.com +0.0.0.0 shareae.cf +0.0.0.0 shareflx.com +0.0.0.0 shareflx.createasocialcard.top +0.0.0.0 shareflx.social-card-share.top +0.0.0.0 shareflx.socialpreviews.top +0.0.0.0 sharepointnotify.com +0.0.0.0 shipnyatchholland.com +0.0.0.0 shlink.run +0.0.0.0 shlnk.run +0.0.0.0 shoponlinefreesg.com +0.0.0.0 shoponlinefreeuk.com +0.0.0.0 short-l.link +0.0.0.0 short-ner.com +0.0.0.0 shorten.fi +0.0.0.0 shortenup.com +0.0.0.0 shortenurls.me +0.0.0.0 shortenurlservices.com +0.0.0.0 shortesly.website +0.0.0.0 shortformurl.com +0.0.0.0 shortformurl.xyz +0.0.0.0 shortli.live +0.0.0.0 shortlinkcut.com +0.0.0.0 shortmee.one +0.0.0.0 shortnerserviceonline.com +0.0.0.0 shortserver1.com +0.0.0.0 shorturlservice.com +0.0.0.0 shortwidgets.com +0.0.0.0 shortxyz.com +0.0.0.0 showra-22501.appspot.com +0.0.0.0 showra-22501.firebaseio.com +0.0.0.0 showra-chat.atwebpages.com +0.0.0.0 shrinkandshareurl.com +0.0.0.0 shrinkthisurl.com +0.0.0.0 shrt.rip +0.0.0.0 shrtnerlnk.com +0.0.0.0 shuch6ba0w.spyrixweb.com +0.0.0.0 shur.live +0.0.0.0 shurl.site +0.0.0.0 side-talk.com +0.0.0.0 signal-live.vip +0.0.0.0 signal-premium-app.org +0.0.0.0 signal-premium.org +0.0.0.0 signalpremium.com +0.0.0.0 signalpro.org +0.0.0.0 signaltalk.top +0.0.0.0 signin.dedyn.io +0.0.0.0 sikhsiyasatapp.net +0.0.0.0 simetricode.uk +0.0.0.0 simpleadbanners.com +0.0.0.0 sinai-new.com +0.0.0.0 site1.life +0.0.0.0 siteadmineurope.com +0.0.0.0 siteadminhk.com +0.0.0.0 sitebloginfo.com +0.0.0.0 sitepref.xyz +0.0.0.0 sjkfsdkg.com +0.0.0.0 sk1-spiky.wzrkt.com +0.0.0.0 sk1-staging-1.wzrkt.com +0.0.0.0 sk1-staging-10.wzrkt.com +0.0.0.0 sk1-staging-2.wzrkt.com +0.0.0.0 sk1-staging-3.wzrkt.com +0.0.0.0 sk1-staging-4.wzrkt.com +0.0.0.0 sk1-staging-5.wzrkt.com +0.0.0.0 sk1-staging-6.wzrkt.com +0.0.0.0 sk1-staging-7.wzrkt.com +0.0.0.0 sk1-staging-8.wzrkt.com +0.0.0.0 sk1-staging-9.wzrkt.com +0.0.0.0 sk1.wzrkt.com +0.0.0.0 skelly-chester.icu +0.0.0.0 skycoachgg.club +0.0.0.0 sl360-7ba65.firebaseio.com +0.0.0.0 slimesimulator.club +0.0.0.0 smalllcalllrecorder.com +0.0.0.0 smart-messenger.online +0.0.0.0 smart.link +0.0.0.0 smartadblocker.com +0.0.0.0 smartback-12d60.appspot.com +0.0.0.0 smartback-12d60.firebaseio.com +0.0.0.0 smartguardapp.com +0.0.0.0 sms.webadv.co +0.0.0.0 smsandcalltracker.firebaseio.com +0.0.0.0 smscentro.com +0.0.0.0 smser.net +0.0.0.0 smsmensaje.mx +0.0.0.0 smstracker.com +0.0.0.0 smstrackerweb.com +0.0.0.0 smsuns.com +0.0.0.0 smtp-2go.com +0.0.0.0 smtp2go.best +0.0.0.0 smtp2go.club +0.0.0.0 smtp2go.email +0.0.0.0 smtp2go.fun +0.0.0.0 smtp2go.icu +0.0.0.0 smtp2go.live +0.0.0.0 smtp2go.me +0.0.0.0 smtp2go.pw +0.0.0.0 smtp2go.site +0.0.0.0 smtp2go.space +0.0.0.0 smtp2go.website +0.0.0.0 smtper.center +0.0.0.0 smtpout.secuerserver.com +0.0.0.0 smtpserver389.com +0.0.0.0 smtpserver466.com +0.0.0.0 smtptogo.pw +0.0.0.0 snapfire.xyz +0.0.0.0 snaphosterservice.com +0.0.0.0 snaplens-pt.com +0.0.0.0 sniper.pet +0.0.0.0 snoopza.com +0.0.0.0 snoopza.zendesk.com +0.0.0.0 soc-usa.email +0.0.0.0 social-life.info +0.0.0.0 social-store.online +0.0.0.0 sock.godforgiveuss.live +0.0.0.0 sock.hhhhrkanandda.xyz +0.0.0.0 sock.nmnmnmfsamsfan.xyz +0.0.0.0 socktest.ankatras.xyz +0.0.0.0 softnetworksolutions.com +0.0.0.0 softredirect.info +0.0.0.0 solargoup.xyz +0.0.0.0 solargroup.xyz +0.0.0.0 solitude.file-download.today +0.0.0.0 solitude.filedownloads.online +0.0.0.0 solvely.ai +0.0.0.0 sonar.actv8technologies.com +0.0.0.0 soporte-login-account-gmail.tk +0.0.0.0 soporte-login-account-yahoo.tk +0.0.0.0 soulscanneryh.com +0.0.0.0 soundcloud.fun +0.0.0.0 soundcloud.live +0.0.0.0 sp.kuuvv.com +0.0.0.0 sp18022019.firebaseio.com +0.0.0.0 spappmonitoring.com +0.0.0.0 sparrowsgroup.org +0.0.0.0 spartacuscrixus.club +0.0.0.0 spc-runtimes.s3.amazonaws.com +0.0.0.0 spectronet.pw +0.0.0.0 speedspot.speedspot.netdna-cdn.com +0.0.0.0 speedy.sbs +0.0.0.0 speedygonzales.xyz +0.0.0.0 speedymax.shop +0.0.0.0 spiegel.agency +0.0.0.0 spiegel.cab +0.0.0.0 spiegel.fun +0.0.0.0 spiegel.ink +0.0.0.0 spiegel.ltd +0.0.0.0 spiegel.pro +0.0.0.0 spiegel.quest +0.0.0.0 spiegel.today +0.0.0.0 spiegel.work +0.0.0.0 spiegeli.life +0.0.0.0 spiegeli.live +0.0.0.0 spiegeli.today +0.0.0.0 spiegelr.live +0.0.0.0 spiegelr.today +0.0.0.0 sport4ever.club +0.0.0.0 sports-mdg.xyz +0.0.0.0 sportsnewz.site +0.0.0.0 spreadme.international +0.0.0.0 sputniknews.news +0.0.0.0 spy-datacenter.com +0.0.0.0 spy-phone-app.com +0.0.0.0 spy24.app +0.0.0.0 spy24.net +0.0.0.0 spy2mobile-bb441.firebaseio.com +0.0.0.0 spy2mobile.com +0.0.0.0 spyacellphone.com +0.0.0.0 spyadvice.com +0.0.0.0 spyapp-8916f.firebaseio.com +0.0.0.0 spyapp.at +0.0.0.0 spyapp.ch +0.0.0.0 spyapp.es +0.0.0.0 spyapp.fr +0.0.0.0 spyapp.ro +0.0.0.0 spyapp.top +0.0.0.0 spyapp.uk +0.0.0.0 spyapps.net +0.0.0.0 spyaudiorecorder.firebaseio.com +0.0.0.0 spybrother.com +0.0.0.0 spybunker.com +0.0.0.0 spycell.net +0.0.0.0 spyera.com +0.0.0.0 spyera.postaffiliatepro.com +0.0.0.0 spyfer.info +0.0.0.0 spyfly.co.za +0.0.0.0 spyfone.com +0.0.0.0 spyhide.com +0.0.0.0 spyhide.ir +0.0.0.0 spyhuman-97943.firebaseio.com +0.0.0.0 spyhuman.com +0.0.0.0 spyic.biz +0.0.0.0 spyic.com +0.0.0.0 spyier.biz +0.0.0.0 spyier.com +0.0.0.0 spyine.biz +0.0.0.0 spyine.com +0.0.0.0 spyios8x.com +0.0.0.0 spykontrol.com +0.0.0.0 spylive360.com +0.0.0.0 spylix.com +0.0.0.0 spylogs.com +0.0.0.0 spymaster-e535b.firebaseio.com +0.0.0.0 spymasterpro.com +0.0.0.0 spynger.net +0.0.0.0 spynote.us +0.0.0.0 spyone.pl +0.0.0.0 spyphone.com +0.0.0.0 spyphonereview.com +0.0.0.0 spyren.com +0.0.0.0 spyrix-sfk.com +0.0.0.0 spyrix.com +0.0.0.0 spysetup.com +0.0.0.0 spyt.co +0.0.0.0 spytec.com +0.0.0.0 spytecgl300.com +0.0.0.0 spytecgps.io +0.0.0.0 spytech-web.com +0.0.0.0 spytek.co.za +0.0.0.0 spytekonline.co.za +0.0.0.0 spytoapp.com +0.0.0.0 spytomobile.com +0.0.0.0 spytrac-app1.s3.amazonaws.com +0.0.0.0 spytrac.com +0.0.0.0 spyzee.com +0.0.0.0 spyzie-a.firebaseio.com +0.0.0.0 spyzie.com +0.0.0.0 spyzie.io +0.0.0.0 spyzie.online +0.0.0.0 squishyp.com +0.0.0.0 src-ymlang.link +0.0.0.0 srtnr.co +0.0.0.0 srtnr.com +0.0.0.0 srvrgruk.com +0.0.0.0 sse.chyldmonitor.com +0.0.0.0 sslasmr.com +0.0.0.0 sslportservices.com +0.0.0.0 stable.icecyber.org +0.0.0.0 stacks-zadar.website +0.0.0.0 staging-all-tracker.appspot.com +0.0.0.0 staging.smstracker.com +0.0.0.0 stand-by-97c5c.appspot.com +0.0.0.0 stand-by-97c5c.firebaseio.com +0.0.0.0 stand-by.site +0.0.0.0 standardofficeholland.com +0.0.0.0 standardofficeil.com +0.0.0.0 standardofficeuk.com +0.0.0.0 static-graph.com +0.0.0.0 static.complementics.com +0.0.0.0 static.privacytrck.com +0.0.0.0 static.trckingbyte.com +0.0.0.0 static.trckpath.com +0.0.0.0 stats.buildwithkt.dev +0.0.0.0 stats.essayget.com +0.0.0.0 stats.inappertising.org +0.0.0.0 stevenfloyd.icu +0.0.0.0 stevensmalley.pro +0.0.0.0 stikerscloud.com +0.0.0.0 stonisi.news +0.0.0.0 storage.computingdownloads.life +0.0.0.0 store.dianmpsoathom.com +0.0.0.0 store.mycustomdevice.com +0.0.0.0 storeupdates.net +0.0.0.0 stream.meetextension.com +0.0.0.0 stream.redcoolmedia.net +0.0.0.0 streetprocarsracingss.com +0.0.0.0 streetracingg.club +0.0.0.0 strngbltru.com +0.0.0.0 strongbolthostinghk.com +0.0.0.0 strongwingtechnologies.com +0.0.0.0 strunhvgpk.com +0.0.0.0 strurl.click +0.0.0.0 studio11-7e288.firebaseio.com +0.0.0.0 su.onemonitar.com +0.0.0.0 sueddeutsche.cc +0.0.0.0 sueddeutsche.co +0.0.0.0 sueddeutsche.me +0.0.0.0 sueddeutsche.online +0.0.0.0 sunday-deals.com +0.0.0.0 super-voice.vip +0.0.0.0 supersonicads.com +0.0.0.0 superuser.onemonitar.com +0.0.0.0 support-java.com +0.0.0.0 support-login-validate-outlook.tk +0.0.0.0 support-securitymail.email +0.0.0.0 support-whatsapp.com +0.0.0.0 support-ymail-team.online +0.0.0.0 support.flexispy.com +0.0.0.0 support.loverman.net +0.0.0.0 support.mobile-tracker-free.com +0.0.0.0 support.mtoolapp.biz +0.0.0.0 support.phoneparental.com +0.0.0.0 support.spyera.com +0.0.0.0 supportgmai1.com +0.0.0.0 supportserviceeu.com +0.0.0.0 supportset.net +0.0.0.0 supportskype.com +0.0.0.0 surepointspy.com +0.0.0.0 surl.ist +0.0.0.0 surl.live +0.0.0.0 surveillance-enfants.com +0.0.0.0 surveilstar.com +0.0.0.0 survey-notify-event.sense360eng.com +0.0.0.0 suwayda-24.com +0.0.0.0 suzuki.gr.com +0.0.0.0 svetovid.bid +0.0.0.0 svlogin.asia +0.0.0.0 swiftmobilespy.co.za +0.0.0.0 sxde-download.spyrix-sfk.com +0.0.0.0 sxk8xrjtaikv3dxl7hgghw3vptvxpzzxeynrcltu4k3yeecjq3.online +0.0.0.0 symoty.com +0.0.0.0 sync-a.copy9.com +0.0.0.0 sync-a.exactspy.com +0.0.0.0 sync-a.fonetracker.com +0.0.0.0 sync-a.ispyoo.com +0.0.0.0 sync-a.mxspy.com +0.0.0.0 sync-a.thetruthspy.com +0.0.0.0 sync-a100.fonetracker.com +0.0.0.0 sync-a600.fonetracker.com +0.0.0.0 sync-a712.fonetracker.com +0.0.0.0 sync-a780.mxspy.com +0.0.0.0 sync-a7xx.thetruthspy.com +0.0.0.0 sync-a8xx.thetruthspy.com +0.0.0.0 sync-a925.thetruthspy.com +0.0.0.0 sync-a930.thetruthspy.com +0.0.0.0 sync-a935.thetruthspy.com +0.0.0.0 sync-a940.thetruthspy.com +0.0.0.0 sync-a941.thetruthspy.com +0.0.0.0 sync-a942.thetruthspy.com +0.0.0.0 sync.bk128.com +0.0.0.0 sync.xiz4me.com +0.0.0.0 syncservices.one +0.0.0.0 synctimestamp.com +0.0.0.0 syncupdate.site +0.0.0.0 sys.firewall-gateway.net +0.0.0.0 sys.spyapp.ch +0.0.0.0 system.documentations.live +0.0.0.0 system.filedownloaders.com +0.0.0.0 systembackend.site +0.0.0.0 t-bit.me +0.0.0.0 t-me.link +0.0.0.0 t-online.life +0.0.0.0 t-onlinl.life +0.0.0.0 t-onlinl.live +0.0.0.0 t-onlinl.today +0.0.0.0 t-onlinr.life +0.0.0.0 t-onlinr.live +0.0.0.0 t-onlinr.today +0.0.0.0 t.appsflyer.com +0.0.0.0 t.pie.org +0.0.0.0 t1.mailsecurityservice.com +0.0.0.0 t1.twmills.xyz +0.0.0.0 t1bet.net +0.0.0.0 t1k22.c8xwor.com +0.0.0.0 t2.mailsecurityservice.com +0.0.0.0 t2.twmills.xyz +0.0.0.0 t3.twmills.xyz +0.0.0.0 tagdps.ru +0.0.0.0 tagesspiegel.co +0.0.0.0 tagesspiegel.ltd +0.0.0.0 tags.illaryboucnc.com +0.0.0.0 talent-recruitment.org +0.0.0.0 talklog.tools +0.0.0.0 talktalky.azurewebsites.net +0.0.0.0 taskmgr.redirectme.com +0.0.0.0 taskmgr.redirectme.net +0.0.0.0 taskmgr.serveftp.com +0.0.0.0 taskmgr.servehttp.com +0.0.0.0 tchsrvce.com +0.0.0.0 techinnovative.net +0.0.0.0 techmahindra.support +0.0.0.0 teensafe.net +0.0.0.0 teensafe.vip +0.0.0.0 teensoftware.com +0.0.0.0 tel.forensis-lab.com +0.0.0.0 tele-gram.vip +0.0.0.0 telecomegy-ads.com +0.0.0.0 telegram-app.tech +0.0.0.0 telegram-pro.org +0.0.0.0 telegramapppro.org +0.0.0.0 telegrom.org +0.0.0.0 telenorconn.com +0.0.0.0 teleszpieg.pl +0.0.0.0 teleweb.world +0.0.0.0 tenday.mysecondarydns.com +0.0.0.0 tesla-s.shop +0.0.0.0 teslal.shop +0.0.0.0 teslal.xyz +0.0.0.0 teslali.com +0.0.0.0 test-client.mobilefonex.com +0.0.0.0 test.androidlost.com +0.0.0.0 test.onetouchsecurities.com +0.0.0.0 test.refog.com +0.0.0.0 test.send.onemonitar.com +0.0.0.0 test.udadblocker.com +0.0.0.0 testandroidopen.azurewebsites.net +0.0.0.0 testapi.foozor.com +0.0.0.0 tetra.email +0.0.0.0 tfk7r22klf8vtd8g90jq8qno1tpqhmpe.apps.googleusercontent.com +0.0.0.0 tgrthgsrgwrthwrtgwr.xyz +0.0.0.0 tgscontakcs.com +0.0.0.0 thainews.asia +0.0.0.0 thd.cc +0.0.0.0 theambix.org +0.0.0.0 thecybernanny.com +0.0.0.0 thefreemovies.net +0.0.0.0 thegardian.ml +0.0.0.0 thegaurdian.live +0.0.0.0 theguardian.co.com +0.0.0.0 theispyoo.com +0.0.0.0 theodoi24h.com +0.0.0.0 theonespy.com +0.0.0.0 thepopulator.tutelatechnologies.com +0.0.0.0 thepowerlinegroup.com +0.0.0.0 thepromise.standsapp.org +0.0.0.0 thespyapp.com +0.0.0.0 thetruth-db94a.firebaseio.com +0.0.0.0 thetruthspy.com +0.0.0.0 thetruthspys.com +0.0.0.0 thevendry.com +0.0.0.0 thiefguardbd.com +0.0.0.0 thomsonsreuters.email +0.0.0.0 thomsonsreuters.eu +0.0.0.0 thomsonsreuters.link +0.0.0.0 thomsonsreuters.net +0.0.0.0 thundernews.org +0.0.0.0 ti.domainforlite.com +0.0.0.0 tibet-office.net +0.0.0.0 tibetfrum.info +0.0.0.0 tibethouse.info +0.0.0.0 tibetnews.info +0.0.0.0 tibetnews.today +0.0.0.0 tibetvoices.com +0.0.0.0 tickeakhatsp.com +0.0.0.0 tifamily.net +0.0.0.0 tim-jordan.info +0.0.0.0 time-local.com +0.0.0.0 time-local.net +0.0.0.0 timestampsync.com +0.0.0.0 timeupdate.xyz +0.0.0.0 timeupdateservice.com +0.0.0.0 tineeurl.com +0.0.0.0 tinil.ink +0.0.0.0 tinly.me +0.0.0.0 tinmoivietnam.com +0.0.0.0 tiny.gr.com +0.0.0.0 tinylink.pro +0.0.0.0 tinylinks.live +0.0.0.0 tinyulrs.com +0.0.0.0 tinyurl.cloud +0.0.0.0 tinyurl.gold +0.0.0.0 tinyurlshortner.com +0.0.0.0 tiol.xyz +0.0.0.0 tips.ghetaldhighe.com +0.0.0.0 tispy.net +0.0.0.0 tiwpan.xyz +0.0.0.0 tly.gr.com +0.0.0.0 tly.link +0.0.0.0 tnyurlservice.com +0.0.0.0 tocaoonline.com +0.0.0.0 tocaoonline.org +0.0.0.0 tocast.vip +0.0.0.0 tok.vaicore.xyz +0.0.0.0 tommy-swope.site +0.0.0.0 tonline.cfd +0.0.0.0 tonline.life +0.0.0.0 tonline.today +0.0.0.0 top-best.com +0.0.0.0 topcontactco.com +0.0.0.0 topzaloha.cz +0.0.0.0 tos-assigned-build.sfo2.digitaloceanspaces.com +0.0.0.0 touch.ps +0.0.0.0 tovima.live +0.0.0.0 tox.cheap +0.0.0.0 tphmr.com +0.0.0.0 tqiblacompas.com +0.0.0.0 tr.appmia.com +0.0.0.0 traccar-client-app.firebaseio.com +0.0.0.0 traccar.org +0.0.0.0 tracerspy.net +0.0.0.0 track-your-fedex-package.org +0.0.0.0 track.odskguo.xyz +0.0.0.0 trackerfree.net +0.0.0.0 trackerplus.ru +0.0.0.0 trackier.vip +0.0.0.0 trackine.vip +0.0.0.0 tracking-smartphone.firebaseio.com +0.0.0.0 tracking.hexilo.com +0.0.0.0 tracking.india.miui.com +0.0.0.0 tracking.intl.miui.com +0.0.0.0 tracking.mliteapp.com +0.0.0.0 tracking.mspyonline.com +0.0.0.0 tracking.rus.miui.com +0.0.0.0 trackingsmartphone.com +0.0.0.0 trackji.com +0.0.0.0 trackmy.mobi +0.0.0.0 trackmyphones-pro.firebaseio.com +0.0.0.0 trackmyphones.com +0.0.0.0 trackpro.vip +0.0.0.0 trackserviceonline.xyz +0.0.0.0 tracksp-7743c.firebaseio.com +0.0.0.0 tracksp.in +0.0.0.0 trackview.net +0.0.0.0 trackview.recurly.com +0.0.0.0 transatitonneap.com +0.0.0.0 transferdomainhk.com +0.0.0.0 transferdomainlu.com +0.0.0.0 transferdomainmy.com +0.0.0.0 transferserver33.com +0.0.0.0 translations.matetranslate.com +0.0.0.0 trcalluecodr.com +0.0.0.0 treasury.email +0.0.0.0 trecv.xyz +0.0.0.0 trecvf.xyz +0.0.0.0 treporter.com +0.0.0.0 trfvbnji7.com +0.0.0.0 tricktravelbooking.com +0.0.0.0 trkc.online +0.0.0.0 trkps.com +0.0.0.0 truck-rouddrive.com +0.0.0.0 true-truck-86810.appspot.com +0.0.0.0 true-truck-86810.firebaseio.com +0.0.0.0 truewebmedia.com +0.0.0.0 trumphotel.net +0.0.0.0 trumpnationallosangeles.email +0.0.0.0 trumporganization.world +0.0.0.0 trumporganizations.com +0.0.0.0 trustcor.co +0.0.0.0 trustedserviceonline.com +0.0.0.0 trusteventservices.com +0.0.0.0 tsrt.xyz +0.0.0.0 tt.umobix.com +0.0.0.0 ttjj.ga +0.0.0.0 ttjj.ml +0.0.0.0 ttjj.tk +0.0.0.0 ttspy.com +0.0.0.0 ttspy.net +0.0.0.0 ttspy.top +0.0.0.0 turbophonepsy.com +0.0.0.0 turkeynewsupdates.com +0.0.0.0 turkishairines.info +0.0.0.0 tv-youtube.com +0.0.0.0 tw.itter.me +0.0.0.0 twi-tter.vip +0.0.0.0 twiitter.com.mx +0.0.0.0 twtter.net +0.0.0.0 u1.panspy.com +0.0.0.0 ua.brunoespiao.com.br +0.0.0.0 ua.evaspy.com +0.0.0.0 ua.tispy.me +0.0.0.0 ua.tispy.net +0.0.0.0 uaenews.online +0.0.0.0 uataz.quickolabs.com +0.0.0.0 ub.evaspy.com +0.0.0.0 ubanks.icu +0.0.0.0 ube.gr.com +0.0.0.0 uberegypt.cn.com +0.0.0.0 ublocker-chrome.com +0.0.0.0 uc.evaspy.com +0.0.0.0 ud.evaspy.com +0.0.0.0 udata.elephantdata.net +0.0.0.0 ue.brunoespiao.com.br +0.0.0.0 ue.evaspy.com +0.0.0.0 ue.maglook.eu +0.0.0.0 uf.brunoespiao.com.br +0.0.0.0 uf.evaspy.com +0.0.0.0 uf.maglook.eu +0.0.0.0 uf1.brunoespiao.com.br +0.0.0.0 ufz.doesxyz.com +0.0.0.0 ug.evaspy.com +0.0.0.0 ug1c5v.birxpk.com +0.0.0.0 uh.evaspy.com +0.0.0.0 uhtpuerdfbnm.com +0.0.0.0 ui.evaspy.com +0.0.0.0 uj.evaspy.com +0.0.0.0 uk.evaspy.com +0.0.0.0 ukraine2day.com +0.0.0.0 ul.evaspy.com +0.0.0.0 ultimatephonespy.com +0.0.0.0 ultimateresponseservice.com +0.0.0.0 ultronnetworksolution.com +0.0.0.0 um.evaspy.com +0.0.0.0 umobix.com +0.0.0.0 un-told.net +0.0.0.0 un.evaspy.com +0.0.0.0 uncherdroid.com +0.0.0.0 unisafe-a342f.firebaseio.com +0.0.0.0 unisafe.su +0.0.0.0 unisafe.techmas.ru +0.0.0.0 unityads.unity3d.com +0.0.0.0 univision.click +0.0.0.0 unonoticias.net +0.0.0.0 uo.evaspy.com +0.0.0.0 up.evaspy.com +0.0.0.0 upd-ms3-app-state.com +0.0.0.0 update-outlook.info +0.0.0.0 update-service-7e59f.firebaseio.com +0.0.0.0 update.crashlytics.com +0.0.0.0 updateddns.ddns.net +0.0.0.0 updatedefender.net +0.0.0.0 updatedns.ddns.net +0.0.0.0 updatenameserver45.com +0.0.0.0 updates4you.xyz +0.0.0.0 updateservice.center +0.0.0.0 updateservices.co +0.0.0.0 updatetime.zone +0.0.0.0 updatingnews.xyz +0.0.0.0 updete.xyz +0.0.0.0 updserv-east-cdn3.com +0.0.0.0 upgradetravelservice.com +0.0.0.0 upload-tutelawest.s3-accelerate.amazonaws.com +0.0.0.0 upload.weiguanai.cn +0.0.0.0 uploaderfile.cf +0.0.0.0 uq.evaspy.com +0.0.0.0 ur.brunoespiao.com.br +0.0.0.0 ur.evaspy.com +0.0.0.0 ur.spyone.pl +0.0.0.0 uri-ready.website +0.0.0.0 urirank.com +0.0.0.0 url-promo.club +0.0.0.0 url-redirect.website +0.0.0.0 url-tiny.app +0.0.0.0 urtyhfds.com +0.0.0.0 us-central1-api-project-285519687053.cloudfunctions.net +0.0.0.0 us-central1-catwatchful-e03b8.cloudfunctions.net +0.0.0.0 us-central1-production-242307.cloudfunctions.net +0.0.0.0 us.umobix.com +0.0.0.0 us.xnspy.pro +0.0.0.0 us01.salmonads.com +0.0.0.0 us1-spiky.wzrkt.com +0.0.0.0 us1.cb.wzrkt.com +0.0.0.0 us1.wzrkt.com +0.0.0.0 usacia.websecexp.com +0.0.0.0 usafbi.websecexp.com +0.0.0.0 usafe-ca594.firebaseio.com +0.0.0.0 usafe.ru +0.0.0.0 usdailypost.com +0.0.0.0 usdailypost.net +0.0.0.0 usdp.news +0.0.0.0 user.mycellspy.com +0.0.0.0 user.ownspy.es +0.0.0.0 user.trackview.net +0.0.0.0 user2.trackview.net +0.0.0.0 userauthen.pw +0.0.0.0 users.awosoft.com +0.0.0.0 users.easemon.com +0.0.0.0 users.thephonem.com +0.0.0.0 uservicescheck.com +0.0.0.0 uservicesforyou.com +0.0.0.0 usewithcareathome.com +0.0.0.0 utube.digital +0.0.0.0 uu.domainforlite.com +0.0.0.0 uyghur-news.com +0.0.0.0 uyghur-soft-market.com +0.0.0.0 uyghurhaber.com +0.0.0.0 v-talk.top +0.0.0.0 v-talk.vip +0.0.0.0 v.mobzones.com +0.0.0.0 v4vw4ytvo4.execute-api.us-east-2.amazonaws.com +0.0.0.0 v9czaci.xyz +0.0.0.0 vaccine-appointment.link +0.0.0.0 vaicore.xyz +0.0.0.0 vbchs.com +0.0.0.0 vbchs.org +0.0.0.0 vbhacker.space +0.0.0.0 vbhackerspace.com +0.0.0.0 vbhackerspace.org +0.0.0.0 vd.toobox.online +0.0.0.0 ve.toobox.online +0.0.0.0 vedioplayers2020.000webhostapp.com +0.0.0.0 venezuela365.com +0.0.0.0 verification-acc.servehttp.com +0.0.0.0 verification-team.servehttp.com +0.0.0.0 verify-gmail-support-secure.tk +0.0.0.0 verifyurl.me +0.0.0.0 vickeryduncan.site +0.0.0.0 video-recorder-c0419.firebaseio.com +0.0.0.0 video-url.tutelatechnologies.com +0.0.0.0 videos.ultrawidevideo.com +0.0.0.0 videosound.vip +0.0.0.0 viewer.snoopza.com +0.0.0.0 viptelefonprogrami.com +0.0.0.0 viptrack.pro +0.0.0.0 viptrack.ro +0.0.0.0 vipyoga.today +0.0.0.0 virsis.net +0.0.0.0 vista-chat.com +0.0.0.0 viva.gr.com +0.0.0.0 vkur.se +0.0.0.0 vkur1.se +0.0.0.0 vl.denrok.space +0.0.0.0 vodafoneegypt.tech +0.0.0.0 vodafonegypt.com +0.0.0.0 voicecontrol.top +0.0.0.0 voicesupport.vip +0.0.0.0 vortnomade.net +0.0.0.0 vostrom.ventures +0.0.0.0 vote2021.w3spaces.com +0.0.0.0 vpnzfep.com +0.0.0.0 vps.limited +0.0.0.0 vt.toobox.online +0.0.0.0 vtalk.vip +0.0.0.0 vys.me +0.0.0.0 w-video.vip +0.0.0.0 w9x7itu.xyz +0.0.0.0 wa-info.com +0.0.0.0 wa.zcnewy.com +0.0.0.0 wab-wahtsapp.com +0.0.0.0 wahrheitindenaugen.pw +0.0.0.0 walkingnote.online +0.0.0.0 wallvoluminousfourk.club +0.0.0.0 wannameet.co +0.0.0.0 wap.trend-tech.net +0.0.0.0 warhehit.fun +0.0.0.0 warhehit.online +0.0.0.0 warhehit.pw +0.0.0.0 warhehit.site +0.0.0.0 warhehit.space +0.0.0.0 warhehit.website +0.0.0.0 warhheiiptdaunegn.link +0.0.0.0 warhheiiptdaunegn.pw +0.0.0.0 warhheintbaunegn.pw +0.0.0.0 warhheintdaunegn.link +0.0.0.0 warhheintdaunegn.pw +0.0.0.0 warhheit.fun +0.0.0.0 warhheit.online +0.0.0.0 warhheit.site +0.0.0.0 warhheit.space +0.0.0.0 warhheit.website +0.0.0.0 watch-youtube.com +0.0.0.0 watchmanservice.com +0.0.0.0 watchyoutube.servehttp.com +0.0.0.0 wavekli.xyz +0.0.0.0 waws-prod-blu-247-e7b3.eastus.cloudapp.azure.com +0.0.0.0 waws-prod-blu-247.sip.azurewebsites.windows.net +0.0.0.0 wcf.seven1029.com +0.0.0.0 we-site.net +0.0.0.0 weathear.live +0.0.0.0 weather.play-protect.com +0.0.0.0 weatherclub.club +0.0.0.0 weathernewz.xyz +0.0.0.0 weathersite.online +0.0.0.0 web.ab-salute.com +0.0.0.0 web.chyldmonitor.com +0.0.0.0 web.fenced.ai +0.0.0.0 web.mobilespy.io +0.0.0.0 web.whatssapp.co +0.0.0.0 webadv.co +0.0.0.0 webaffise.com +0.0.0.0 webdetetive.com.br +0.0.0.0 webdetetive.era3000.com +0.0.0.0 webdomainexperts.com +0.0.0.0 webhostwebcare.com +0.0.0.0 webhttps.websecexp.com +0.0.0.0 webmail-dalailama.com +0.0.0.0 webmail-dalailama.space +0.0.0.0 webmail-mpt.space +0.0.0.0 webmail.dalailama.space +0.0.0.0 webmail.postmailsecret.com +0.0.0.0 webmailmanageruk.com +0.0.0.0 webmasterserver39.com +0.0.0.0 webnetonlineservice.com +0.0.0.0 webredirect.click +0.0.0.0 webredirect39.com +0.0.0.0 webrtc.thd.cc +0.0.0.0 webscan.cyber-risk.upguard.com +0.0.0.0 websecurehostings.com +0.0.0.0 webserver39.com +0.0.0.0 webserver39490.com +0.0.0.0 webserver91.website +0.0.0.0 webserverdomaineu.com +0.0.0.0 webserverdomainhk.com +0.0.0.0 webserverdomainuk.com +0.0.0.0 webserverdomainusa.com +0.0.0.0 webserverhollandservice.com +0.0.0.0 webserveroginusa.com +0.0.0.0 webserveronline9.com +0.0.0.0 webserverredirect99.com +0.0.0.0 webservicesdb.mobiispy.com +0.0.0.0 websiteadminuk.com +0.0.0.0 websitemanagerusa.com +0.0.0.0 websociofiles.com +0.0.0.0 webviewbridge.unityads.unity3d.com +0.0.0.0 webwatcher-child-app.firebaseio.com +0.0.0.0 webwatcher.com +0.0.0.0 webwatcherdata.com +0.0.0.0 webwatchernow.com +0.0.0.0 welt.ltd +0.0.0.0 welt.media +0.0.0.0 welt.tours +0.0.0.0 welt.ws +0.0.0.0 wendy-johnston.pw +0.0.0.0 wengiguowengui.space +0.0.0.0 werdunstorker.fun +0.0.0.0 werdunstorker.online +0.0.0.0 werdunstorker.pw +0.0.0.0 wethnc067.xyz +0.0.0.0 weysys.com +0.0.0.0 wfupppx.com +0.0.0.0 wha.tsapp.me +0.0.0.0 what-sapp.site +0.0.0.0 whatsapp-app.com +0.0.0.0 whatsapp-sy.com +0.0.0.0 whatsmesticker.club +0.0.0.0 whatspp.wa-info.com +0.0.0.0 whatssapp.co +0.0.0.0 where-is-my-children.firebase.io +0.0.0.0 wheresmydroid.com +0.0.0.0 whispers-talk.site +0.0.0.0 whoisanalyzer.com +0.0.0.0 whoisanalyzerpro.com +0.0.0.0 whrheit.fun +0.0.0.0 whrheit.online +0.0.0.0 whrheit.pw +0.0.0.0 whrheit.site +0.0.0.0 whrheit.space +0.0.0.0 whrheit.website +0.0.0.0 whynotworkonit.top +0.0.0.0 wikileaks.email +0.0.0.0 williedvazquez.club +0.0.0.0 win.spynger.net +0.0.0.0 window.processingdownloads.today +0.0.0.0 wine-talk.online +0.0.0.0 winetalk-9ff2d.appspot.com +0.0.0.0 winetalk-9ff2d.firebaseio.com +0.0.0.0 winupdate.space +0.0.0.0 wisemo.com +0.0.0.0 wjwj.no-ip.org +0.0.0.0 wjwjwj.no-ip.org +0.0.0.0 wjwjwjwj.no-ip.org +0.0.0.0 wmdcommander.appspot.com +0.0.0.0 wonderfulinsights.com +0.0.0.0 workshopplatform.network +0.0.0.0 worldnws.xyz +0.0.0.0 wpc.A3CD.edgecastcdn.net +0.0.0.0 wppspy.tech +0.0.0.0 wrhheit.fun +0.0.0.0 wrhheit.online +0.0.0.0 wrhheit.pw +0.0.0.0 wrhheit.site +0.0.0.0 wrhheit.space +0.0.0.0 wrhheit.website +0.0.0.0 ws.findgravy.com +0.0.0.0 ws.nextialive.roimaster.site +0.0.0.0 ws.ttspy.com +0.0.0.0 wss.findmykids.org +0.0.0.0 wt-spy.com +0.0.0.0 wtc1111.com +0.0.0.0 wtc2222.com +0.0.0.0 wtc3333.com +0.0.0.0 wts-app.info +0.0.0.0 wvv.kcpro.ga +0.0.0.0 www.11111.pl +0.0.0.0 www.a-spy.com +0.0.0.0 www.about.jkub.com +0.0.0.0 www.aispyer.com +0.0.0.0 www.alinbox.co +0.0.0.0 www.android-monitor.ru +0.0.0.0 www.android007.com +0.0.0.0 www.androidlost.com +0.0.0.0 www.androidmonitor.com +0.0.0.0 www.apk7.biz +0.0.0.0 www.apkcar.com +0.0.0.0 www.apkhl.pw +0.0.0.0 www.apkpure.bz +0.0.0.0 www.app-spy.com +0.0.0.0 www.apphububstore.in +0.0.0.0 www.appmarket.co +0.0.0.0 www.appspy.com +0.0.0.0 www.appspy.net +0.0.0.0 www.apptracker.net +0.0.0.0 www.backus.myftp.name +0.0.0.0 www.bark.us +0.0.0.0 www.bbiindia.com +0.0.0.0 www.blackboxmusic.co +0.0.0.0 www.blexb.com +0.0.0.0 www.blurspy.com +0.0.0.0 www.bowenpress.org +0.0.0.0 www.brunoespiao.com.br +0.0.0.0 www.cangquyun.com +0.0.0.0 www.cellmonitoring.co +0.0.0.0 www.cellphonespyappon.com +0.0.0.0 www.cerberusapp.com +0.0.0.0 www.cerberusbrasil.com +0.0.0.0 www.childsafetytrackerapp.com +0.0.0.0 www.clevguard.com +0.0.0.0 www.comemail.email +0.0.0.0 www.drive-mail.info +0.0.0.0 www.drive-mail.online +0.0.0.0 www.drive-mail.us +0.0.0.0 www.drlve-gooog1e.com +0.0.0.0 www.e-spy.org +0.0.0.0 www.einformatiks.com +0.0.0.0 www.eleven.mypop3.org +0.0.0.0 www.emobilespy.com +0.0.0.0 www.energy-mail.org +0.0.0.0 www.enhancedimageviewer.com +0.0.0.0 www.espiaodecelulargratis.com.br +0.0.0.0 www.everestnote.com +0.0.0.0 www.eyezy.com +0.0.0.0 www.flexispy.com +0.0.0.0 www.flyermobi.com +0.0.0.0 www.fonemonitor.co +0.0.0.0 www.freemobilespy.net +0.0.0.0 www.freephonespy.net +0.0.0.0 www.gmail-profile.com +0.0.0.0 www.google-sign.tk +0.0.0.0 www.google.comemails.email +0.0.0.0 www.hiddensmstracker.com +0.0.0.0 www.hiddensystemhealth.com +0.0.0.0 www.hoverwatch.com +0.0.0.0 www.imonitorsoft.cn +0.0.0.0 www.imonitorsoft.com +0.0.0.0 www.ioi.life +0.0.0.0 www.izkid.com +0.0.0.0 www.jjspy.com +0.0.0.0 www.jueoxdr.com +0.0.0.0 www.juju.co.ke +0.0.0.0 www.kidlogger.net +0.0.0.0 www.letmespy.com +0.0.0.0 www.liveupdate.cc +0.0.0.0 www.login-live.us +0.0.0.0 www.maglook.eu +0.0.0.0 www.mail-attachment-usercontent.space +0.0.0.0 www.mail-protect.space +0.0.0.0 www.mail.secuerserver.com +0.0.0.0 www.minspy.com +0.0.0.0 www.mnfbodivbv.com +0.0.0.0 www.mobile-spy.com +0.0.0.0 www.mobilespy.at +0.0.0.0 www.mobilespyfree.net +0.0.0.0 www.mobilestealthreview.com +0.0.0.0 www.mobiletool.ru +0.0.0.0 www.mobistealth.com +0.0.0.0 www.movimientoanticorreista.com +0.0.0.0 www.msafe.xyz +0.0.0.0 www.msap.services +0.0.0.0 www.mspy.com +0.0.0.0 www.mspyitaly.com +0.0.0.0 www.mspyonline.com +0.0.0.0 www.mtoolapp.net +0.0.0.0 www.mxspy.com +0.0.0.0 www.myandroid.org +0.0.0.0 www.mydwnd.com +0.0.0.0 www.mzeibiyr.com +0.0.0.0 www.netspy.net +0.0.0.0 www.observer.pw +0.0.0.0 www.offerslove.com +0.0.0.0 www.okjojihgv.com +0.0.0.0 www.olinaodi.com +0.0.0.0 www.onworks.net +0.0.0.0 www.pctattletale.com +0.0.0.0 www.pgv4.com +0.0.0.0 www.phone-spy.com +0.0.0.0 www.phonesheriff.com +0.0.0.0 www.phonespying.com +0.0.0.0 www.phonetracker.com +0.0.0.0 www.platstack.com +0.0.0.0 www.questionai.com +0.0.0.0 www.realtime-spy-mobile.com +0.0.0.0 www.recentnews.cc +0.0.0.0 www.refog.com +0.0.0.0 www.reptilicus.net +0.0.0.0 www.retinax.com +0.0.0.0 www.riospy.net +0.0.0.0 www.runapps.org +0.0.0.0 www.secuerserver.com +0.0.0.0 www.selfspy.com +0.0.0.0 www.seniorsafetyapp.com +0.0.0.0 www.sentrypc.com +0.0.0.0 www.sentrypc.download +0.0.0.0 www.sentrypc.net +0.0.0.0 www.sentrypconline.com +0.0.0.0 www.shadow-logs.com +0.0.0.0 www.shadow-spy.com +0.0.0.0 www.shadyspy.com +0.0.0.0 www.shopper.com +0.0.0.0 www.sikhsiyasatapp.net +0.0.0.0 www.smartguardapp.com +0.0.0.0 www.smstrackerweb.com +0.0.0.0 www.spappmonitoring.com +0.0.0.0 www.spclogs.com +0.0.0.0 www.speedcheck.org +0.0.0.0 www.speedspot1.com +0.0.0.0 www.speedspot2.com +0.0.0.0 www.speedspot3.com +0.0.0.0 www.speedspot4.com +0.0.0.0 www.speedspot5.com +0.0.0.0 www.speedspot6.com +0.0.0.0 www.speedspot7.com +0.0.0.0 www.spy-datacenter.com +0.0.0.0 www.spy-phone-app.com +0.0.0.0 www.spy2mobile.com +0.0.0.0 www.spyapp.ch +0.0.0.0 www.spyapp.ro +0.0.0.0 www.spybunker.com +0.0.0.0 www.spyequipmentuk.co.uk +0.0.0.0 www.spyhide.com +0.0.0.0 www.spyhide.ir +0.0.0.0 www.spyic.com +0.0.0.0 www.spykontrol.com +0.0.0.0 www.spylive360.com +0.0.0.0 www.spylix.com +0.0.0.0 www.spymasterpro.com +0.0.0.0 www.spynote.us +0.0.0.0 www.spyphone.com +0.0.0.0 www.spyphonereview.com +0.0.0.0 www.spyren.com +0.0.0.0 www.spyrix.com +0.0.0.0 www.spytec.com +0.0.0.0 www.spytech-web.com +0.0.0.0 www.spytomobile.com +0.0.0.0 www.spyzie.com +0.0.0.0 www.studentenkorting.nl +0.0.0.0 www.suppro.co +0.0.0.0 www.surepointspy.com +0.0.0.0 www.teensafe.net +0.0.0.0 www.teensoftware.com +0.0.0.0 www.teleszpieg.pl +0.0.0.0 www.theonespy.com +0.0.0.0 www.thewispy.com +0.0.0.0 www.timpromos.com.br +0.0.0.0 www.traccar.org +0.0.0.0 www.trackerfree.net +0.0.0.0 www.trackingsmartphone.com +0.0.0.0 www.trackmyphones.com +0.0.0.0 www.truckrental.cc +0.0.0.0 www.ttjj.tk +0.0.0.0 www.ttspy.com +0.0.0.0 www.uptoplay.net +0.0.0.0 www.vnews.hk +0.0.0.0 www.vys.me +0.0.0.0 www.webwatcher.com +0.0.0.0 www.webwatchernow.com +0.0.0.0 www.wheresmydroid.com +0.0.0.0 www.wisemo.com +0.0.0.0 www.xvids.us +0.0.0.0 www.yahoo-verification.us +0.0.0.0 www.ywupscsff.com +0.0.0.0 wwwhisp.com +0.0.0.0 wx.weiguanai.cn +0.0.0.0 wzrkt.com +0.0.0.0 x.pgv4.com +0.0.0.0 x.securspy.com +0.0.0.0 x.spyapp.ro +0.0.0.0 x1panel.com +0.0.0.0 xapi.shastic.com +0.0.0.0 xdspy.app +0.0.0.0 xf.actor +0.0.0.0 xiaoyuner.com +0.0.0.0 xin-corp.space +0.0.0.0 xiz4me.com +0.0.0.0 xmyevq.birxpk.com +0.0.0.0 xn--rumphotels-vcc.com +0.0.0.0 xn--twitte-u9a.com +0.0.0.0 xnore.com +0.0.0.0 xnspy.com +0.0.0.0 xnspy.pro +0.0.0.0 xnxx-hub.com +0.0.0.0 xoxospy.com +0.0.0.0 xpcpanel.com +0.0.0.0 xpertdomain.com +0.0.0.0 xpertmaildomain.com +0.0.0.0 xploitwizer.com +0.0.0.0 xpspy.com +0.0.0.0 xvids.us +0.0.0.0 xyvok.xyz +0.0.0.0 xyzsitexyz.xyz +0.0.0.0 y0utube.com.mx +0.0.0.0 y0vvbm.xyz +0.0.0.0 yahoo-device.tk +0.0.0.0 yahoo-edit.us +0.0.0.0 yahoo-images.com +0.0.0.0 yahoo-noreply.tk +0.0.0.0 yahoo-protect.com +0.0.0.0 yahoo-safety.com +0.0.0.0 yahoo-secure.tk +0.0.0.0 yahoo-verification.us +0.0.0.0 yahoomaintain.com +0.0.0.0 yallakora-egy.com +0.0.0.0 ycxrl.com +0.0.0.0 ydc.kcpro.ga +0.0.0.0 ymail-account.support +0.0.0.0 ymail-security-support.email +0.0.0.0 ymail-security.support +0.0.0.0 ymail-settings.space +0.0.0.0 ymailaccounts.us +0.0.0.0 ymailsupport.info +0.0.0.0 ymex.apkcar.com +0.0.0.0 ymlog.apkcar.com +0.0.0.0 ymsdk.apkcar.com +0.0.0.0 yo.utube.digital +0.0.0.0 yo.utube.to +0.0.0.0 yoga4u.xyz +0.0.0.0 youarefired.xyz +0.0.0.0 your-access-here.com +0.0.0.0 youranotherserver.com +0.0.0.0 yoursdrive.com +0.0.0.0 yout.ube.gr.com +0.0.0.0 youtu-be.net +0.0.0.0 youtub.app +0.0.0.0 youtube.gr.live +0.0.0.0 youtube.voto +0.0.0.0 youtubepremiumapp.com +0.0.0.0 youtubesyncapi.com +0.0.0.0 youtubewatch.co +0.0.0.0 yq0z3d.xyz +0.0.0.0 yqchpwxvbg.execute-api.us-east-1.amazonaws.com +0.0.0.0 yuom7.net +0.0.0.0 z2a.digital +0.0.0.0 z2adigital.cloud +0.0.0.0 z2digital.cloud +0.0.0.0 za.startdownload.mobi +0.0.0.0 zain.network +0.0.0.0 zdalnakontrola.pl +0.0.0.0 zerobt.net +0.0.0.0 zerobyte.top +0.0.0.0 zestiftung.com +0.0.0.0 zeusalmighty.club +0.0.0.0 zmq5ytc1-api.findgravy.com +0.0.0.0 zodiachand.club +0.0.0.0 zoo.bearclod.com +0.0.0.0 zoofanimalm.com +0.0.0.0 zougla.gr.com +0.0.0.0 zougla.news +0.0.0.0 zqn.kcpro.ga +0.0.0.0 zsrvrer.com +0.0.0.0 zsx.kcpro.ga +0.0.0.0 zumba.tampotrust.agency diff --git a/vigil/ioc/hosts_block.txt b/vigil/ioc/hosts_block.txt new file mode 100644 index 0000000..a707eae --- /dev/null +++ b/vigil/ioc/hosts_block.txt @@ -0,0 +1,2333 @@ +# Vigil Hosts Blocklist - Stalkerware, Spyware, and Governmentware C2 +# Standard hosts file format for DNS sinkholing +# Generated: 2026-03-30 | Entries: 2328 +# Sources: stalkerware-indicators, mobiletrackers, CitizenLab +# +0.0.0.0 12d60.appspot.com +0.0.0.0 12d60.firebaseio.com +0.0.0.0 13-5.org +0.0.0.0 13-5.ru +0.0.0.0 1688-global.cn-hongkong.log.aliyuncs.com +0.0.0.0 1ca43.appspot.com +0.0.0.0 1g7kvrv.xyz +0.0.0.0 1topspy.com +0.0.0.0 2fapass.club +0.0.0.0 2fnoqifq.com +0.0.0.0 2g8cvdii.com +0.0.0.0 2j1i9uqw.oss-eu-central-1.aliyuncs.com +0.0.0.0 2oafxcbq.xyz +0.0.0.0 2y4nothing.xyz +0.0.0.0 300624.com +0.0.0.0 4-dot-all-tracker.appspot.com +0.0.0.0 404mobi.com +0.0.0.0 519c195138.xyz +0.0.0.0 51ginkgo.com +0.0.0.0 5m5.io +0.0.0.0 5rfvbnji9.com +0.0.0.0 6-dot-all-tracker.appspot.com +0.0.0.0 678ikmbtui.com +0.0.0.0 6kvses.com +0.0.0.0 7hn706pwsj.execute-api.ap-southeast-1.amazonaws.com +0.0.0.0 7lc6jc.xyz +0.0.0.0 7nvdx0.xyz +0.0.0.0 83dd4.appspot.com +0.0.0.0 8916f.appspot.com +0.0.0.0 89685.firebaseio.com +0.0.0.0 8balwalz1i.execute-api.us-east-2.amazonaws.com +0.0.0.0 8sghnct.xyz +0.0.0.0 97.logger.mobi +0.0.0.0 a-qa3.thd.cc +0.0.0.0 a-spy.com +0.0.0.0 a-video.vip +0.0.0.0 a.hdmodecam.live +0.0.0.0 a.hw.cab +0.0.0.0 a.hwa.cab +0.0.0.0 a.pricetaco.de +0.0.0.0 a.syncvch.com +0.0.0.0 a.thd.cc +0.0.0.0 a1.etrality.com +0.0.0.0 a2.etrality.com +0.0.0.0 a342f.appspot.com +0.0.0.0 a71f4.firebaseio.com +0.0.0.0 aalaan.tv +0.0.0.0 abforbrowser.com +0.0.0.0 absolutesoftsystem.in +0.0.0.0 ac.iprocam.xyz +0.0.0.0 ac480.firebaseio.com +0.0.0.0 account.cellphone-remote-tracker.com +0.0.0.0 account.childsafetytrackerapp.com +0.0.0.0 account.logger.mobi +0.0.0.0 account.refog.com +0.0.0.0 account.trackerplus.ru +0.0.0.0 accountable2you-android.firebaseio.com +0.0.0.0 accountable2you.com +0.0.0.0 accounts.loginshare.info +0.0.0.0 accounts.mx +0.0.0.0 acd.kcpro.ga +0.0.0.0 activate-your-account-now.com +0.0.0.0 activity.kdlparentalcontrol.com +0.0.0.0 actv8technologies.com +0.0.0.0 ad.iprocam.xyz +0.0.0.0 ad.mobnv.com +0.0.0.0 adblox.org +0.0.0.0 adbsc.flyermobi.com +0.0.0.0 adbsc.ikmytech.com +0.0.0.0 adbsdk.flyermobi.com +0.0.0.0 addons.news +0.0.0.0 adeco.adecosystems.com +0.0.0.0 adibjan.net +0.0.0.0 adjust-local-settings.com +0.0.0.0 admin.dofunapps.com +0.0.0.0 admin.flexispy.com +0.0.0.0 admin.kdlparentalcontrol.com +0.0.0.0 admin.surf-admin.link +0.0.0.0 ads.dofunapps.com +0.0.0.0 ads.flyermobi.com +0.0.0.0 adserver.hahamobi.com +0.0.0.0 adservices.gr.com +0.0.0.0 adultpcz.xyz +0.0.0.0 advertsservices.com +0.0.0.0 advfb.xyz +0.0.0.0 ae.mveditor.xyz +0.0.0.0 aecodero.com +0.0.0.0 af.to.123games.club +0.0.0.0 aff.fortunnecat.com +0.0.0.0 affise.app +0.0.0.0 ai-pilot.cn-shanghai.log.aliyuncs.com +0.0.0.0 ai.parentalsearch.xyz +0.0.0.0 aki.kcpro.ga +0.0.0.0 alaiblompass.com +0.0.0.0 alawaeltech.com +0.0.0.0 alb.bearclod.com +0.0.0.0 alert.bk128.com +0.0.0.0 alert.xiz4me.com +0.0.0.0 ali.panspy.com +0.0.0.0 alidocs.dingtalk.com +0.0.0.0 all-tracker.appspot.com +0.0.0.0 all-tracker.firebaseio.com +0.0.0.0 allelpcoonmber.com +0.0.0.0 alljazeera.co +0.0.0.0 alltracker.org +0.0.0.0 almal-news.com +0.0.0.0 almasryelyuom.com +0.0.0.0 alog.umeng.com +0.0.0.0 alpineai.uk +0.0.0.0 alraeeenews.com +0.0.0.0 alraeesnews.net +0.0.0.0 alter757.info +0.0.0.0 altsantiri.news +0.0.0.0 aly.bearclod.com +0.0.0.0 alz.bearclod.com +0.0.0.0 amazing.lab +0.0.0.0 amazingvideoeditor.club +0.0.0.0 ami0wned.com +0.0.0.0 amiowned.com +0.0.0.0 amon.android-monitor.ru +0.0.0.0 amon1.android-monitor.ru +0.0.0.0 analytics.300624.com +0.0.0.0 analytics.hahamobi.com +0.0.0.0 analytics.localytics.com +0.0.0.0 analytics.rayjump.com +0.0.0.0 analytics.salmonads.com +0.0.0.0 analytics.trackview.net +0.0.0.0 anayurt.net +0.0.0.0 ancienthistory.xyz +0.0.0.0 and.info-taxi.info +0.0.0.0 and.retardrattle.website +0.0.0.0 andmon.name +0.0.0.0 android-api.umobix.com +0.0.0.0 android-apk.android-monitor.ru +0.0.0.0 android-apps.tech +0.0.0.0 android-monitor.ru +0.0.0.0 android-monitor1.android-monitor.ru +0.0.0.0 android-police.android-monitor.ru +0.0.0.0 android-police.ru +0.0.0.0 android-quinoa-config-prod.sense360eng.com +0.0.0.0 android.chyldmonitor.com +0.0.0.0 android.spy24.app +0.0.0.0 android.spytoapp.com +0.0.0.0 android.viptrack.ro +0.0.0.0 androidapk.biz +0.0.0.0 androidlost.appspot.com +0.0.0.0 androidlost.com +0.0.0.0 androidlost.firebaseio.com +0.0.0.0 androidradio.life +0.0.0.0 anguaganslatast.com +0.0.0.0 anmon.android-monitor.ru +0.0.0.0 anmon.name +0.0.0.0 anmon.ru +0.0.0.0 anmon.su +0.0.0.0 anmon1.android-monitor.ru +0.0.0.0 anonymous.browse.live +0.0.0.0 antitheft-88554.firebaseio.com +0.0.0.0 antranslaro.com +0.0.0.0 aovivo.foxspy.com.br +0.0.0.0 ap.iprocam.xyz +0.0.0.0 apd1.thunup.com +0.0.0.0 apd1.warnlog.com +0.0.0.0 api-apple-buy.com +0.0.0.0 api-cloudfront.life360.com +0.0.0.0 api-gateway.creatant.com +0.0.0.0 api-gateway.franceverif.fr +0.0.0.0 api-llm.prd.alva.xyz +0.0.0.0 api-new.gocashback.com +0.0.0.0 api-production-v4.actv8technologies.com +0.0.0.0 api-project-285519687053.firebaseio.com +0.0.0.0 api-project-999803017449.firebaseio.com +0.0.0.0 api-telecommunication.com +0.0.0.0 api.accountable2you.com +0.0.0.0 api.aliprice.com +0.0.0.0 api.allblock.app +0.0.0.0 api.asbipartnerdb.com +0.0.0.0 api.awarenesstechnologies.com +0.0.0.0 api.bibigpt.co +0.0.0.0 api.branch.io +0.0.0.0 api.bytepioner.com +0.0.0.0 api.cardlift.co +0.0.0.0 api.childsafetytrackerapp.com +0.0.0.0 api.cleanmasters.store +0.0.0.0 api.clearlyreader.com +0.0.0.0 api.clevguard.com +0.0.0.0 api.corn-cob.com +0.0.0.0 api.cp.onemonitar.com +0.0.0.0 api.dev.chat.roimaster.site +0.0.0.0 api.findgravy.com +0.0.0.0 api.findmykids.org +0.0.0.0 api.flexispy.com +0.0.0.0 api.foozor.com +0.0.0.0 api.free-spy.com +0.0.0.0 api.geozilla.com +0.0.0.0 api.hashdit.io +0.0.0.0 api.huqindustries.co.uk +0.0.0.0 api.joinsmarty.com +0.0.0.0 api.kallo.io +0.0.0.0 api.kid-control.com +0.0.0.0 api.lifecircle.app +0.0.0.0 api.lingoway.net +0.0.0.0 api.lingowhale.com +0.0.0.0 api.lunabot.ai +0.0.0.0 api.mainrepo.org +0.0.0.0 api.mamma.com +0.0.0.0 api.mixpanel.com +0.0.0.0 api.mobilebackup.biz +0.0.0.0 api.mobilespy.at +0.0.0.0 api.mousegesturesapi.com +0.0.0.0 api.mycellspy.com +0.0.0.0 api.myendpoint.io +0.0.0.0 api.nextialive.roimaster.site +0.0.0.0 api.odskguo.xyz +0.0.0.0 api.ogymogy.com +0.0.0.0 api.onmanzbien.com +0.0.0.0 api.origano.xyz +0.0.0.0 api.phia.com +0.0.0.0 api.pnt.is +0.0.0.0 api.pythonexample.com +0.0.0.0 api.relingo.net +0.0.0.0 api.safegraph.com +0.0.0.0 api.salmonads.com +0.0.0.0 api.seniorsafetyapp.com +0.0.0.0 api.simpleallowcopy.com +0.0.0.0 api.simplycodes.com +0.0.0.0 api.slovarek.hrprime.ru +0.0.0.0 api.smartechmetrics.com +0.0.0.0 api.snoopza.com +0.0.0.0 api.speedspot.org +0.0.0.0 api.spylix.com +0.0.0.0 api.thd.cc +0.0.0.0 api.tllms.com +0.0.0.0 api.trackview.lifecircle.app +0.0.0.0 api.ttspy.com +0.0.0.0 api.ultrablock.org +0.0.0.0 api.witheden.ai +0.0.0.0 api.wondershare.cc +0.0.0.0 api.wzrkt.com +0.0.0.0 api.yapthread.com +0.0.0.0 api.zave.it +0.0.0.0 api007.foxspy.com.br +0.0.0.0 api1.easydoc.info +0.0.0.0 api2.mytranslator.app +0.0.0.0 api3.easydoc.info +0.0.0.0 api4.truecaller.com +0.0.0.0 apidemo.spylix.com +0.0.0.0 apis.zoemob.com +0.0.0.0 apispyhuman.com +0.0.0.0 apitest.awarenesstechnologies.com +0.0.0.0 apiv4.alter757.info +0.0.0.0 apk.mtf.re +0.0.0.0 apk01.spytoapp.com +0.0.0.0 apk02.spytoapp.com +0.0.0.0 apk03.spytoapp.com +0.0.0.0 apk04.spytoapp.com +0.0.0.0 apk7.biz +0.0.0.0 apkcar.com +0.0.0.0 apkhl.pw +0.0.0.0 apkprue.info +0.0.0.0 apkpure.bz +0.0.0.0 apkv2.qwertykeypad.host +0.0.0.0 apkv5.ppadaolnwod.xyz +0.0.0.0 apkv6.endurecif.top +0.0.0.0 apollospy.com +0.0.0.0 app-api-pro.wondershare.cc +0.0.0.0 app-api.phonedata.me +0.0.0.0 app-api.spyzie.com +0.0.0.0 app-measurement.com +0.0.0.0 app-stats.net2share.com +0.0.0.0 app.aflink.com +0.0.0.0 app.antifurtodroid.com +0.0.0.0 app.api.spyzie.wondershare.cn +0.0.0.0 app.appspy.net +0.0.0.0 app.buenosocial.club +0.0.0.0 app.foreverspy.com +0.0.0.0 app.givefreely.com +0.0.0.0 app.mobnv.com +0.0.0.0 app.numici.com +0.0.0.0 app.snoopza.com +0.0.0.0 app.xdspy.app +0.0.0.0 app.xyspy.com +0.0.0.0 app2.snoopza.com +0.0.0.0 appfrancisco.store +0.0.0.0 appjiagu.com +0.0.0.0 applepps.com +0.0.0.0 application.opence.fr +0.0.0.0 approve.aegisweb3.com +0.0.0.0 apprtc.appspot.com +0.0.0.0 apps-ios.net +0.0.0.0 appspy-net.firebaseio.com +0.0.0.0 appspy.net +0.0.0.0 aps12.spyhuman.com +0.0.0.0 aps13.spyhuman.com +0.0.0.0 aps14.spyhuman.com +0.0.0.0 aps15.spyhuman.com +0.0.0.0 aps16.spyhuman.com +0.0.0.0 aps16042016.spyhuman.com +0.0.0.0 aps17.spyhuman.com +0.0.0.0 aps18data.securebackuponline.net +0.0.0.0 aps18file.securebackuponline.net +0.0.0.0 aps2.spyhuman.com +0.0.0.0 aps22.spyhuman.com +0.0.0.0 aralaper.com +0.0.0.0 aramexegypt.com +0.0.0.0 arcpi.nextialive.roimaster.site +0.0.0.0 arduous.work +0.0.0.0 arindocation.com +0.0.0.0 arr.kcpro.tk +0.0.0.0 artateulseonitor.com +0.0.0.0 asgard-f8c53.firebaseio.com +0.0.0.0 asrararabiya.co +0.0.0.0 asrararablya.com +0.0.0.0 asrarrarabiya.com +0.0.0.0 ass.absolutesoftsystem.in +0.0.0.0 asset.bk128.com +0.0.0.0 asset.xiz4me.com +0.0.0.0 at.gogameportal.club +0.0.0.0 atb.bearclod.com +0.0.0.0 atheere.com +0.0.0.0 ats.flyermobi.com +0.0.0.0 ats.ikmytech.com +0.0.0.0 attorney-client-privileged.com +0.0.0.0 attorney-client.org +0.0.0.0 attorneyclientprivileged.com +0.0.0.0 audit-pvv.com +0.0.0.0 auth.forwardtoken.website +0.0.0.0 auto-forward.com +0.0.0.0 autocoupon.net +0.0.0.0 autoforward-8433d.firebaseio.com +0.0.0.0 av2wg.rt14v.com +0.0.0.0 awamisolution.com +0.0.0.0 awsapi.io +0.0.0.0 b.appjiagu.com +0.0.0.0 b.freespy1.ml +0.0.0.0 b.freespy1.tk +0.0.0.0 b.hdmodecam.live +0.0.0.0 b1.etrality.com +0.0.0.0 b2.etrality.com +0.0.0.0 b3.etrality.com +0.0.0.0 b55y.net +0.0.0.0 b7.photoeffect.xyz +0.0.0.0 b8c.mveditor.xyz +0.0.0.0 ba.beautycam.xyz +0.0.0.0 ba3.photoeffect.xyz +0.0.0.0 back.brunoespiao.com.br +0.0.0.0 backup-a71f4.firebaseio.com +0.0.0.0 badr-regex.fastytb.com +0.0.0.0 bafrfrede.get1tn0w.free247downloads.com +0.0.0.0 bagscaner.com +0.0.0.0 bahrainsms.co +0.0.0.0 bank-alahly.com +0.0.0.0 bark-android-media.s3.amazonaws.com +0.0.0.0 batterychargingeffect.club +0.0.0.0 batterylivewallpaperhd.club +0.0.0.0 bbc-africa.com +0.0.0.0 bbcsworld.com +0.0.0.0 bbrp.co +0.0.0.0 be.startdownload.mobi +0.0.0.0 beachhackerspace.com +0.0.0.0 beck-ede.com +0.0.0.0 berf4o.xyz +0.0.0.0 best-spy-apps.com +0.0.0.0 bestflights-deals.com +0.0.0.0 beta-api.logger.mobi +0.0.0.0 beta.kid-control.com +0.0.0.0 beta.logger.mobi +0.0.0.0 beta.smstracker.com +0.0.0.0 betly.me +0.0.0.0 bff.ecoindex.fr +0.0.0.0 bi.thd.cc +0.0.0.0 bi.tly.gr.com +0.0.0.0 bi.tly.link +0.0.0.0 bigdata800.com +0.0.0.0 bin5y4muil.execute-api.us-east-1.amazonaws.com +0.0.0.0 bincdi.6kvses.com +0.0.0.0 bincdi.birxpk.com +0.0.0.0 birxpk.com +0.0.0.0 bit-li.com +0.0.0.0 bit-li.ws +0.0.0.0 bit-ly.link +0.0.0.0 bit-ly.org +0.0.0.0 bitlinkin.xyz +0.0.0.0 bitlly.live +0.0.0.0 bitlyrs.com +0.0.0.0 bitt.fi +0.0.0.0 bity.ws +0.0.0.0 bityl.me +0.0.0.0 bivitis.bearclod.com +0.0.0.0 bk128.com +0.0.0.0 bl.publicapi.semrush.com +0.0.0.0 blackdragon.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 blackdragon03.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 blacktrail.xyz +0.0.0.0 blfnf9y.com +0.0.0.0 blompascator.com +0.0.0.0 blurspy.com +0.0.0.0 bmw.gr.com +0.0.0.0 bnc.lt +0.0.0.0 bookjob.club +0.0.0.0 boostvocab.com +0.0.0.0 botfortickets.site +0.0.0.0 brilliant-flame-585.appspot.com +0.0.0.0 brilliant-flame-585.firebaseio.com +0.0.0.0 brlyp4pg.com +0.0.0.0 browsercheck.services +0.0.0.0 brt.bearclod.com +0.0.0.0 brul.bearclod.com +0.0.0.0 brunoespiao.com +0.0.0.0 brunoespiao.com.br +0.0.0.0 brunoespiao2.s3.amazonaws.com +0.0.0.0 bulbazaur.com +0.0.0.0 bulk.fun +0.0.0.0 bumabara.bid +0.0.0.0 burgerprince.us +0.0.0.0 burivingsim.com +0.0.0.0 bus-metrolis.com +0.0.0.0 businesnews.net +0.0.0.0 c-phone.ru +0.0.0.0 c.appjiagu.com +0.0.0.0 c.betly.me +0.0.0.0 c.freespy1.ml +0.0.0.0 c.freespy1.tk +0.0.0.0 c.webengage.com +0.0.0.0 c1.etrality.com +0.0.0.0 c1.panspy.com +0.0.0.0 c2.etrality.com +0.0.0.0 c3.etrality.com +0.0.0.0 c4.etrality.com +0.0.0.0 cabinet.ecohouse-eg.com +0.0.0.0 cabinet.gps-monitor.uz +0.0.0.0 cabinet.kfnm.ru +0.0.0.0 cabinet.thecybernanny.com +0.0.0.0 cabinet.vegosm.ru +0.0.0.0 cabinet.vkur.se +0.0.0.0 cabinet.vkur1.se +0.0.0.0 cailrecorder.com +0.0.0.0 callerids.club +0.0.0.0 callrecordpro.club +0.0.0.0 callwhozdine.com +0.0.0.0 camerdentifier.com +0.0.0.0 campaignmanager.fun.moobig.com +0.0.0.0 canary.wakweli.com +0.0.0.0 candidserver.com +0.0.0.0 canopoument.com +0.0.0.0 canyouc.xyz +0.0.0.0 carmesin.me +0.0.0.0 carracer.club +0.0.0.0 carrefourmisr.com +0.0.0.0 catwatchful-e03b8-2.firebaseio.com +0.0.0.0 catwatchful-e03b8.firebaseio.com +0.0.0.0 catwatchful.com +0.0.0.0 cb.wzrkt.com +0.0.0.0 cbapi.rewardsbunny.com +0.0.0.0 cbbc01.xyz +0.0.0.0 cbphe.com +0.0.0.0 cbpheback.com +0.0.0.0 ccallerx.com +0.0.0.0 cdn.branch.io +0.0.0.0 cdn.optimizely.com +0.0.0.0 cdn.owebanalytics.com +0.0.0.0 cef.kcpro.tk +0.0.0.0 celebrnewz.xyz +0.0.0.0 cell-phones-tracker.net +0.0.0.0 cell-tracker-green.firebaseio.com +0.0.0.0 cell-tracker-updated.firebaseio.com +0.0.0.0 cellconn.net +0.0.0.0 cellmonitoring.co +0.0.0.0 cellphone-remote-tracker.com +0.0.0.0 cellphoneservices.info +0.0.0.0 celltracker.mobi +0.0.0.0 celltrackernew.firebaseio.com +0.0.0.0 celular007.s3.amazonaws.com +0.0.0.0 cerberusapp.com +0.0.0.0 cfg.inappertising.org +0.0.0.0 cfs.kcpro.ga +0.0.0.0 charles.huqindustries.co.uk +0.0.0.0 charmander.xyz +0.0.0.0 chat-support.support +0.0.0.0 chat-transa.com +0.0.0.0 chatwithme.store +0.0.0.0 checkheart.club +0.0.0.0 checkinonlinehere.com +0.0.0.0 chipp.pw +0.0.0.0 chromehistory.herokuapp.com +0.0.0.0 chulahfi.xyz +0.0.0.0 ciaolvc.com +0.0.0.0 cibeg.online +0.0.0.0 citroen.gr.com +0.0.0.0 ck-running-apps-700f1.firebaseio.com +0.0.0.0 ckforward.one +0.0.0.0 claptfindzmphone.com +0.0.0.0 clevguard.net +0.0.0.0 client.mobilefonex.com +0.0.0.0 client.spyhide.com +0.0.0.0 client.spyhide.ir +0.0.0.0 clientreport.info +0.0.0.0 clipbuddy.club +0.0.0.0 clockupdate.com +0.0.0.0 cloud.nathompsstra.com +0.0.0.0 cloud.ttspy.com +0.0.0.0 cloudsecurityservice.net +0.0.0.0 cloudstatistics.net +0.0.0.0 cloudtimesync.com +0.0.0.0 cloudwatchtower.com +0.0.0.0 clues.link +0.0.0.0 clues4.com +0.0.0.0 cluestr.com +0.0.0.0 cmvkvncsse.xyz +0.0.0.0 cnapi.trackview.net +0.0.0.0 cnn-africa.co +0.0.0.0 cnn.gr.com +0.0.0.0 co.akisinn.info +0.0.0.0 co.dewrain.life +0.0.0.0 co.vaicore.site +0.0.0.0 co.vaicore.xyz +0.0.0.0 cocachar.com +0.0.0.0 coinsearch.cash +0.0.0.0 color.joarteauxelb.com +0.0.0.0 colorizerset.club +0.0.0.0 comclap.club +0.0.0.0 community.sidenoteapp.com +0.0.0.0 comphotolab.club +0.0.0.0 comqubla.club +0.0.0.0 config.unityads.unity3d.com +0.0.0.0 config.unityads.unitychina.cn +0.0.0.0 connectivitycheck.live +0.0.0.0 connectivitycheck.online +0.0.0.0 connectivitychecker.com +0.0.0.0 consilio.lawyer +0.0.0.0 consiliolaw.com +0.0.0.0 console.presto.oystr.com.br +0.0.0.0 continue-to-get-content-now.com +0.0.0.0 control-phone-a05a3.firebaseio.com +0.0.0.0 control.teragence.net +0.0.0.0 controlcenterios.club +0.0.0.0 cophico.pw +0.0.0.0 copy9.com +0.0.0.0 copy9db.com +0.0.0.0 core.knowee.ai +0.0.0.0 corn-cob.com +0.0.0.0 coupongiftsnstashop.com +0.0.0.0 coupons.comagno.com +0.0.0.0 covid19-ca.link +0.0.0.0 covid19masks.shop +0.0.0.0 cp.mspyonline.com +0.0.0.0 cp.thewispy.com +0.0.0.0 cpcalendars.spymasterpro.com +0.0.0.0 cpcontacts.spymasterpro.com +0.0.0.0 crashonline.site +0.0.0.0 csa.naaronegya.com +0.0.0.0 cut.red +0.0.0.0 cutcutpro.club +0.0.0.0 cvectorart.club +0.0.0.0 cwkjravqsj.xyz +0.0.0.0 cyber.country +0.0.0.0 cyberbit.com +0.0.0.0 d-app-apk.com +0.0.0.0 d.appjiagu.com +0.0.0.0 d.corn-cob.com +0.0.0.0 d.d-app-apk.com +0.0.0.0 d.freespy1.ml +0.0.0.0 d.freespy1.tk +0.0.0.0 d.tispy.net +0.0.0.0 d1.panspy.com +0.0.0.0 d1gslyvqtipqvi.cloudfront.net +0.0.0.0 d24lo6rmha82nf.cloudfront.net +0.0.0.0 d2nipadu1fr4ne.cloudfront.net +0.0.0.0 d3.mveditor.xyz +0.0.0.0 d3cameraplan.com +0.0.0.0 d3clybje3sun07.cloudfront.net +0.0.0.0 d3ftgl1xpkr9bu.cloudfront.net +0.0.0.0 d3g4zswpacwtfb.cloudfront.net +0.0.0.0 dalbam.vip +0.0.0.0 damanhealth.online +0.0.0.0 danas.bid +0.0.0.0 darknetinfo.com +0.0.0.0 dashboard.linkpublishers.com +0.0.0.0 dat.funheroic.com +0.0.0.0 data-api.famisafe.com +0.0.0.0 data-api.phonedata.me +0.0.0.0 data-api.similarsites.com +0.0.0.0 data-api.spyzie.com +0.0.0.0 data-webwatcherdata-alb-1451089636.us-west-2.elb.amazonaws.com +0.0.0.0 data.api.spyzie.wondershare.cn +0.0.0.0 data.mistat.india.xiaomi.com +0.0.0.0 data.mistat.intl.xiaomi.com +0.0.0.0 data.mistat.rus.xiaomi.com +0.0.0.0 data.popup-blocker.org +0.0.0.0 data.qa.webwatcherdata.com +0.0.0.0 data.reptilicus.net +0.0.0.0 data.webwatcherdata.com +0.0.0.0 data.youtube-adblock.pro +0.0.0.0 data240.mrec24.com +0.0.0.0 data241.mrec24.com +0.0.0.0 dataillusionist.com +0.0.0.0 datingappswmt.com +0.0.0.0 dc.wondershare.cc +0.0.0.0 dcylog.com +0.0.0.0 dd.adecosystems.com +0.0.0.0 ddiutilities.com +0.0.0.0 decide.mixpanel.com +0.0.0.0 dehcoveanager.com +0.0.0.0 dev.chat.roimaster.site +0.0.0.0 dev.hoverwatch.com +0.0.0.0 dev.nodle.io +0.0.0.0 dev.snoopza.com +0.0.0.0 dev2.refog.com +0.0.0.0 devassist-api.onrender.com +0.0.0.0 device-ac480.appspot.com +0.0.0.0 device-ac480.firebaseio.com +0.0.0.0 devices.starbolt.io +0.0.0.0 dgmxn.c8xwor.com +0.0.0.0 dhfvbsihjf.com +0.0.0.0 discover-api.flashintel.ai +0.0.0.0 disp2.mrec24.com +0.0.0.0 dispatcher.mrecorder.com +0.0.0.0 distedc.com +0.0.0.0 djp.bz +0.0.0.0 dmp.starbolt.io +0.0.0.0 dmw.bz +0.0.0.0 dmw.cc +0.0.0.0 dns1.sdkbalance.com +0.0.0.0 dns2.sdkbalance.com +0.0.0.0 dns3.sdkbalance.com +0.0.0.0 down.tracksz.co +0.0.0.0 downapk.spytoapp.com +0.0.0.0 downdating.club +0.0.0.0 download-file.top +0.0.0.0 download.webwatcherdata.com +0.0.0.0 download4you.xyz +0.0.0.0 downloads.refog.com +0.0.0.0 dragonair.xyz +0.0.0.0 driveriders.club +0.0.0.0 drivingexpiriencesimulator.club +0.0.0.0 droimon20.ru +0.0.0.0 dsfhskln.com +0.0.0.0 dto.kcpro.ga +0.0.0.0 dwn.vys.me +0.0.0.0 dz7.wethnc067.xyz +0.0.0.0 e-spy.app +0.0.0.0 e-spy.org +0.0.0.0 e.appjiagu.com +0.0.0.0 e.crashlytics.com +0.0.0.0 e.freespy1.ml +0.0.0.0 e2c64.firebaseio.com +0.0.0.0 eagerfox.xyz +0.0.0.0 eaglespy.com.br +0.0.0.0 easybassbooster.club +0.0.0.0 easycalea.com +0.0.0.0 easydoc.info +0.0.0.0 easyloggerbeta.azurewebsites.net +0.0.0.0 easyphonetrack.com +0.0.0.0 easyvshow.com +0.0.0.0 ebill.cosmote.center +0.0.0.0 ecom.flexispy.com +0.0.0.0 editsbackground.club +0.0.0.0 edlnc255s2q.s3.amazonaws.com +0.0.0.0 efsyn.online +0.0.0.0 egyqaz.com +0.0.0.0 einformatiks.com +0.0.0.0 ejn.kcpro.ga +0.0.0.0 eksndtpf.org +0.0.0.0 elcore-api.azurewebsites.net +0.0.0.0 em.awsapi.io +0.0.0.0 emcpanel.com +0.0.0.0 emiratesfoundation.net +0.0.0.0 emraiyz.xyz +0.0.0.0 engine.ninja +0.0.0.0 enigmase.xyz +0.0.0.0 enikos.news +0.0.0.0 eok8wd5v.net +0.0.0.0 erbfzk.com +0.0.0.0 ereportaz.news +0.0.0.0 ern.kcpro.ga +0.0.0.0 ersokbkj.com +0.0.0.0 es.mobiplus.me +0.0.0.0 espressonews.gr.com +0.0.0.0 etcotater.com +0.0.0.0 etisalategypt.tech +0.0.0.0 etisalatgreen.com +0.0.0.0 etpweb.answerai.pro +0.0.0.0 eu1-spiky.wzrkt.com +0.0.0.0 eu1.alb.wzrkt.com +0.0.0.0 eu1.wzrkt.com +0.0.0.0 evt17.com +0.0.0.0 ewish.cards +0.0.0.0 explorer.sikayetvar.com +0.0.0.0 expresscreditcash.com +0.0.0.0 extapp.globalsou.com +0.0.0.0 extension.1dasou.com +0.0.0.0 extension.ground.news +0.0.0.0 extremeexploits.com +0.0.0.0 extremeexploits.org +0.0.0.0 eyezyapp.thd.cc +0.0.0.0 f.appjiagu.com +0.0.0.0 f.freespy1.ml +0.0.0.0 f.freespy1.tk +0.0.0.0 f0.photoeffect.xyz +0.0.0.0 f6.beautycam.xyz +0.0.0.0 f8a.beautycam.xyz +0.0.0.0 fa.gifcam.xyz +0.0.0.0 facenalyer.com +0.0.0.0 famisafe-b6807.firebaseio.com +0.0.0.0 faspulhearratmoni.com +0.0.0.0 fastdownload.me +0.0.0.0 fastuploads.xyz +0.0.0.0 fb-accounts.com +0.0.0.0 fb.gifcam.xyz +0.0.0.0 fdfjhks.com +0.0.0.0 feartranslator.com +0.0.0.0 ferrari.gr.com +0.0.0.0 fetch.mangoerp.com +0.0.0.0 ffitnesstrainer.club +0.0.0.0 ffnbafc.xyz +0.0.0.0 ffoxnewz.com +0.0.0.0 fgcxweasqw.oss-eu-central-1.aliyuncs.com +0.0.0.0 fiddaz.club +0.0.0.0 fif0.top +0.0.0.0 files.geozilla.com +0.0.0.0 fimes.gr.com +0.0.0.0 fincconttact.com +0.0.0.0 find-my-phone-prod.herokuapp.com +0.0.0.0 findmyphone.mangobird.com +0.0.0.0 finfisher.com +0.0.0.0 fingdefend.com +0.0.0.0 fingerprihanger.com +0.0.0.0 firebase-settings.crashlytics.com +0.0.0.0 fireup.xyz +0.0.0.0 fisherman.engine.ninja +0.0.0.0 fitnessdias.club +0.0.0.0 fitnessgymup.club +0.0.0.0 fitnesspoint.club +0.0.0.0 fitnessstrategy.xyz +0.0.0.0 fl.gifcam.xyz +0.0.0.0 flexipagez.com +0.0.0.0 flickry.xyz +0.0.0.0 flower.snoopza.com +0.0.0.0 fluency.ryboucoathom.com +0.0.0.0 flushdata.1topspy.com +0.0.0.0 flushdata.copy9db.com +0.0.0.0 flushdata.hellospy.com +0.0.0.0 flushdata2.hellospy.com +0.0.0.0 flushdata3.hellospy.com +0.0.0.0 flushdata4.hellospy.com +0.0.0.0 flushdata5.hellospy.com +0.0.0.0 flushdbd.maxxspy.com +0.0.0.0 flyermobi.com +0.0.0.0 fnbdeiegpslocoiatntcrkaer.com +0.0.0.0 fonemonitor.vip +0.0.0.0 foodin.site +0.0.0.0 foreverspy.com +0.0.0.0 forwardeshoptt.com +0.0.0.0 forzahmobile.com +0.0.0.0 fr.chillaxgames.mobi +0.0.0.0 fraudpreventionsys.com +0.0.0.0 frecalwolwid.com +0.0.0.0 free247downloads.com +0.0.0.0 freecoupon21.com +0.0.0.0 freemobilespy.net +0.0.0.0 freespy.cf +0.0.0.0 freespyapp.com +0.0.0.0 ftp.info-taxi.info +0.0.0.0 ftphotom.com +0.0.0.0 full.naturalpercent.life +0.0.0.0 fxkwboard.com +0.0.0.0 g.appjiagu.com +0.0.0.0 g.freespy1.ml +0.0.0.0 g.freespy1.tk +0.0.0.0 g1790.rt14v.com +0.0.0.0 gamma-international.de +0.0.0.0 gateway.unityads.unity3d.com +0.0.0.0 gbcf.odskguo.xyz +0.0.0.0 gd-1301476296.cos.na-toronto.myqcloud.com +0.0.0.0 geo2ipapi.org +0.0.0.0 geozilla.autosmartins.com +0.0.0.0 geozillafamily-c92d0.firebaseio.com +0.0.0.0 geozillafamily.firebaseio.com +0.0.0.0 get-your-access-now.com +0.0.0.0 get.snoopza.com +0.0.0.0 getelements.xyz +0.0.0.0 getmspy.net +0.0.0.0 getsignalapps.com +0.0.0.0 getsignalapps.live +0.0.0.0 getspylix.io +0.0.0.0 getupdatesnow.xyz +0.0.0.0 giftmio.com +0.0.0.0 gleancorp.com +0.0.0.0 globalloginpage.com +0.0.0.0 go.creativemobilemarketing.com +0.0.0.0 go.fastfinderworld.com +0.0.0.0 go.grandprizewinners.com +0.0.0.0 go.interlinkinternet.com +0.0.0.0 go.kid-control.com +0.0.0.0 go.protectyoursearch.com +0.0.0.0 go.trackitalltheway.com +0.0.0.0 go.trackiteazy.com +0.0.0.0 go.watchwiser.com +0.0.0.0 go.whatabookmark.com +0.0.0.0 go2.kid-control.com +0.0.0.0 goldenscent.net +0.0.0.0 goldenscint.com +0.0.0.0 goldescent.com +0.0.0.0 googleplay-store.com +0.0.0.0 gosokm.com +0.0.0.0 gotossl.ml +0.0.0.0 gpi3.life360.com +0.0.0.0 gpi4.dev.life360.com +0.0.0.0 gpi4.life360.com +0.0.0.0 gpsme1.kid-control.com +0.0.0.0 gpsphonuetrackerfamilylocator.com +0.0.0.0 gravyanalytics.com +0.0.0.0 grd77.cn +0.0.0.0 greenwich-for-chrome.replit.app +0.0.0.0 groovefitness.xyz +0.0.0.0 guardian-tt.me +0.0.0.0 guardnews.live +0.0.0.0 guestspy.com +0.0.0.0 h.appjiagu.com +0.0.0.0 h.freespy1.ml +0.0.0.0 h.freespy1.tk +0.0.0.0 hail-reporting.tutelatechnologies.com +0.0.0.0 hanstrackr.com +0.0.0.0 hawkeye-us.us-west-1.log.aliyuncs.com +0.0.0.0 heartrateandmealtracker.com +0.0.0.0 heartrateproxhealthmonitor.com +0.0.0.0 heartratteandpulsetracker.com +0.0.0.0 heartrhythm.club +0.0.0.0 heaven.army +0.0.0.0 heiiasjournai.com +0.0.0.0 hellasjournal.company +0.0.0.0 hellasjournal.website +0.0.0.0 hellospy.com +0.0.0.0 hellottec.art +0.0.0.0 help.domainoutlet.site +0.0.0.0 hempower.shop +0.0.0.0 hfstat.bearclod.com +0.0.0.0 histre.com +0.0.0.0 hkn01.bearclod.com +0.0.0.0 hn.algolia.com +0.0.0.0 home.everaccountable.com +0.0.0.0 hoolives.com +0.0.0.0 hopnope.xyz +0.0.0.0 horoscopefortune.club +0.0.0.0 hotofecro.com +0.0.0.0 hover.watch +0.0.0.0 hoverwatch.com +0.0.0.0 hrvxkxq.xyz +0.0.0.0 htapi.getapiv8.com +0.0.0.0 huntcontactz.com +0.0.0.0 hw.cab +0.0.0.0 hwa.cab +0.0.0.0 hwm.cab +0.0.0.0 hws.icu +0.0.0.0 hww.cab +0.0.0.0 hxg.kcpro.ga +0.0.0.0 hydro-ca.link +0.0.0.0 hz-service.thd.cc +0.0.0.0 hz7.thd.cc +0.0.0.0 hzdy.birxpk.com +0.0.0.0 i.cocospy.com +0.0.0.0 i.fonemonitor.co +0.0.0.0 i.freespy1.ml +0.0.0.0 i.freespy1.tk +0.0.0.0 i.hoverwatch.com +0.0.0.0 i.lf360.co +0.0.0.0 i.minspy.com +0.0.0.0 i.neatspy.com +0.0.0.0 i.safespy.com +0.0.0.0 i.spyic.com +0.0.0.0 i.spyier.com +0.0.0.0 i.spyine.com +0.0.0.0 i.spyzie.io +0.0.0.0 i.teensafe.net +0.0.0.0 i1.hoverwatch.com +0.0.0.0 i10.clientreport.info +0.0.0.0 i11.clientreport.info +0.0.0.0 i12.clientreport.info +0.0.0.0 i13.clientreport.info +0.0.0.0 i151125.infourl.net +0.0.0.0 i6.clientreport.info +0.0.0.0 i7.clientreport.info +0.0.0.0 i8.clientreport.info +0.0.0.0 i9.clientreport.info +0.0.0.0 iblompass.com +0.0.0.0 icloudappe.com +0.0.0.0 icloudcacher.com +0.0.0.0 icloudeu.com +0.0.0.0 icloudflair.com +0.0.0.0 iconylc.com +0.0.0.0 icoonectedtrack.com +0.0.0.0 icptime.com +0.0.0.0 icrcworld.com +0.0.0.0 ideas-telcel.com.mx +0.0.0.0 idevs.co +0.0.0.0 idme.org +0.0.0.0 iibt.xyz +0.0.0.0 ikea-egypt.net +0.0.0.0 ikeymonitor.com +0.0.0.0 ikeymonitor.fr +0.0.0.0 ikm.awsapi.io +0.0.0.0 il0baz.com +0.0.0.0 ilnk.xyz +0.0.0.0 im.brunoespiao.com.br +0.0.0.0 im.theonespy.com +0.0.0.0 image.loadingmessage.info +0.0.0.0 imageview.xyz +0.0.0.0 img01.findgravy.com +0.0.0.0 img02.findgravy.com +0.0.0.0 img03.findgravy.com +0.0.0.0 img04.findgravy.com +0.0.0.0 imobispy.com +0.0.0.0 imonitor-da8b2.firebaseio.com +0.0.0.0 imonitorke.com +0.0.0.0 imonitorsoft.cn +0.0.0.0 imonitorsoft.com +0.0.0.0 in-politics.com +0.0.0.0 in.cb.wzrkt.com +0.0.0.0 in.cuebiq.com +0.0.0.0 in.wzrkt.com +0.0.0.0 in1-spiky.wzrkt.com +0.0.0.0 in1.alb.wzrkt.com +0.0.0.0 in1.wzrkt.com +0.0.0.0 inapturst.top +0.0.0.0 indelibleblue.net +0.0.0.0 indelibleblueinc.net +0.0.0.0 info-taxi.info +0.0.0.0 infosms-a.site +0.0.0.0 ingestion-api.kiwi.sand.cuebiq.ai +0.0.0.0 init.supersonicads.com +0.0.0.0 inservices.digital +0.0.0.0 insider.gr.com +0.0.0.0 insights.getblockify.com +0.0.0.0 instagam.click +0.0.0.0 instagam.in +0.0.0.0 instagam.photos +0.0.0.0 instantspeechtranslation.club +0.0.0.0 instegram.co +0.0.0.0 int.akisinn.info +0.0.0.0 int.akisinn.me +0.0.0.0 int.akisinn.site +0.0.0.0 int.dewrain.life +0.0.0.0 int.dewrain.site +0.0.0.0 int.dewrain.world +0.0.0.0 int.vaicore.site +0.0.0.0 int.vaicore.store +0.0.0.0 int.vaicore.xyz +0.0.0.0 int.vlancaa.fun +0.0.0.0 int.vlancaa.site +0.0.0.0 intelgenttran.com +0.0.0.0 intellens-api.aigos.io +0.0.0.0 internetcartography.com +0.0.0.0 internetcartography.net +0.0.0.0 internetcartography.org +0.0.0.0 inv.logger.mobi +0.0.0.0 invoker.icu +0.0.0.0 ioi.life +0.0.0.0 ios-apps.store +0.0.0.0 ios-gw.spynger.net +0.0.0.0 ios.kid-control.com +0.0.0.0 iosmnbg.com +0.0.0.0 iot.geozilla.com +0.0.0.0 ircleocatinder.com +0.0.0.0 islsrickers.com +0.0.0.0 istiqlaihaber.com +0.0.0.0 itcgr.live +0.0.0.0 itly.link +0.0.0.0 itranstxtvoicepht.com +0.0.0.0 itter.me +0.0.0.0 iusacell-movil.com.mx +0.0.0.0 iveilembercker.com +0.0.0.0 ivlewepapallrbkragonucd.com +0.0.0.0 ixhtb.s9gxw8.com +0.0.0.0 izapk.xyz +0.0.0.0 izspy-1313.firebaseio.com +0.0.0.0 j.freespy1.ml +0.0.0.0 j.freespy1.tk +0.0.0.0 jailbreak-gateway.thd.cc +0.0.0.0 jduzuyd.com +0.0.0.0 jjspy.com +0.0.0.0 jjspy.ml +0.0.0.0 jk8681oy.oss-eu-central-1.aliyuncs.com +0.0.0.0 jobs.illaewinstralinc.com +0.0.0.0 join.crazymob.co +0.0.0.0 join.officeframe.work +0.0.0.0 joincharitytree.com +0.0.0.0 jquery-updater.xyz +0.0.0.0 js.intercomcdn.com +0.0.0.0 jsdfbhsa.com +0.0.0.0 jydfoafcaf.xyz +0.0.0.0 k.freespy1.ml +0.0.0.0 k.freespy1.tk +0.0.0.0 kaspersky-safe-kids.firebaseio.com +0.0.0.0 kathimerini.news +0.0.0.0 kenyasms.org +0.0.0.0 key-logger-90fff.firebaseio.com +0.0.0.0 keyboardthemes.club +0.0.0.0 kfcwsa.com +0.0.0.0 kgr0aixa.xyz +0.0.0.0 kidsguard-6c6a9.firebaseio.com +0.0.0.0 kidslox.firebaseio.com +0.0.0.0 kidslox.page.link +0.0.0.0 kidsshield.net +0.0.0.0 kinder.engine.ninja +0.0.0.0 kinesis.ap-southeast-1.amazonaws.com +0.0.0.0 klg.a-spy.com +0.0.0.0 koenigseggg.com +0.0.0.0 kohaicorp.com +0.0.0.0 kokum.ru +0.0.0.0 koora-egypt.com +0.0.0.0 koreavopi.kro.kr +0.0.0.0 kormoran.bid +0.0.0.0 kpsbproxy.kiddoware.com +0.0.0.0 kranos.gr.com +0.0.0.0 krkmyvlmdg.xyz +0.0.0.0 kuuvv.com +0.0.0.0 kvprojectop.com +0.0.0.0 kvshdi.birxpk.com +0.0.0.0 kypler.com +0.0.0.0 l.freespy1.ml +0.0.0.0 l.freespy1.tk +0.0.0.0 l.hdmodecam.live +0.0.0.0 l.servidor.in +0.0.0.0 laalaslirayeblection.com +0.0.0.0 labrador.ua +0.0.0.0 laced-brass-honeysuckle.glitch.me +0.0.0.0 ladysizi.top +0.0.0.0 lamborghini-s.shop +0.0.0.0 landingpg.xyz +0.0.0.0 landingpge.xyz +0.0.0.0 laodaoo.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 lasouncherio.com +0.0.0.0 laucass.forumactif.org +0.0.0.0 lb.theonespy.com +0.0.0.0 lbjg7.com +0.0.0.0 leanwithme.xyz +0.0.0.0 lending-online.club +0.0.0.0 lepamcker.com +0.0.0.0 letmespy.com +0.0.0.0 leunoon.com +0.0.0.0 lexpress.me +0.0.0.0 lg.luckyforworlds.com +0.0.0.0 lg.requestads.com +0.0.0.0 lg.smardroid.com +0.0.0.0 lgdzbch.com +0.0.0.0 liahkhe.xyz +0.0.0.0 lif0.top +0.0.0.0 life360-com-l360safetycenter.firebaseio.com +0.0.0.0 life360-dev.tile-api.com +0.0.0.0 life360-location-dev.tile-api.com +0.0.0.0 life360.atlassian.net +0.0.0.0 life360feedback.typeform.com +0.0.0.0 lifecircle-223805.firebaseio.com +0.0.0.0 lifeel-scan.com +0.0.0.0 lifestyleshops.net +0.0.0.0 limk.one +0.0.0.0 link-m.xyz +0.0.0.0 link-protection.com +0.0.0.0 linkit.digital +0.0.0.0 linktothisa.xyz +0.0.0.0 lionflix.club +0.0.0.0 liponals.store +0.0.0.0 lippi-doc-portal-frontend.cn-hangzhou.log.aliyuncs.com +0.0.0.0 lisslpagestat.panel.kantartns.lt +0.0.0.0 littoralventures.com +0.0.0.0 live-live.vip +0.0.0.0 livetalk.top +0.0.0.0 livetalk.vip +0.0.0.0 livingwithbadkidny.xyz +0.0.0.0 llinkedin.net +0.0.0.0 lljmbbk.com +0.0.0.0 lmbbnrhiuj.xyz +0.0.0.0 lnkedin.org +0.0.0.0 localegem.net +0.0.0.0 locatinfind.com +0.0.0.0 location.family.microsoft.com +0.0.0.0 locatorprivacy.com +0.0.0.0 locatorqiafindlocation.com +0.0.0.0 locatorshar.com +0.0.0.0 lockaaocker.com +0.0.0.0 lockul.com +0.0.0.0 locxfindxlocx.com +0.0.0.0 log.adywind.com +0.0.0.0 log.felo.ai +0.0.0.0 log.mobpowertech.com +0.0.0.0 login.quanly24h.net +0.0.0.0 login.webwatcher.com +0.0.0.0 loginwebmailcenter.com +0.0.0.0 logs.supersonic.com +0.0.0.0 logx.optimizely.com +0.0.0.0 lojackforlaptops.co +0.0.0.0 loverman.net +0.0.0.0 loversfinder.xyz +0.0.0.0 lowlight.xyz +0.0.0.0 lp.shoopadoo.com +0.0.0.0 lsepeanitor.com +0.0.0.0 ludamec.com +0.0.0.0 ludospeakeasy.club +0.0.0.0 ludospeakv2.club +0.0.0.0 luxoreditor.club +0.0.0.0 lwvurdsjk.org +0.0.0.0 lxghjoxzns.com +0.0.0.0 lylink.online +0.0.0.0 m-media.thd.cc +0.0.0.0 m.a-spy.com +0.0.0.0 m.asgardtech.ru +0.0.0.0 m.freespy1.ml +0.0.0.0 m.freespy1.tk +0.0.0.0 m.lifecircle.app +0.0.0.0 m11.slimedit.live +0.0.0.0 m12.slimedit.live +0.0.0.0 m13.slimedit.live +0.0.0.0 maglook.eu +0.0.0.0 mail1.nsogroup.com +0.0.0.0 main.protico.io +0.0.0.0 makeitshort.xyz +0.0.0.0 mangasiso.top +0.0.0.0 manoraonline.net +0.0.0.0 marketinfo.tips +0.0.0.0 marketing.tllms.com +0.0.0.0 martpolocator.com +0.0.0.0 matchos.price.com +0.0.0.0 maxxspy.com +0.0.0.0 mcloud-api.thd.cc +0.0.0.0 md-news-direct.com +0.0.0.0 mda.kcpro.ga +0.0.0.0 measurelib.com +0.0.0.0 measurementsys.com +0.0.0.0 media-sync-a.copy9.com +0.0.0.0 media-sync-a.exactspy.com +0.0.0.0 media-sync-a.fonetracker.com +0.0.0.0 media-sync-a.ispyoo.com +0.0.0.0 media-sync-a.thetruthspy.com +0.0.0.0 media-sync-a100.fonetracker.com +0.0.0.0 media-sync-a100.thetruthspy.com +0.0.0.0 media-sync-a600.fonetracker.com +0.0.0.0 media-sync-a621.fonetracker.com +0.0.0.0 media-sync-a696.fonetracker.com +0.0.0.0 media-sync-a710.fonetracker.com +0.0.0.0 media-sync-a740.thetruthspy.com +0.0.0.0 media-sync-a743.thetruthspy.com +0.0.0.0 media-sync-a746.thetruthspy.com +0.0.0.0 media-sync-a747.thetruthspy.com +0.0.0.0 media-sync-a748.thetruthspy.com +0.0.0.0 media-sync-a749.thetruthspy.com +0.0.0.0 media-sync-a780.fonetracker.com +0.0.0.0 media-sync-a785.fonetracker.com +0.0.0.0 media-sync-a7xx.thetruthspy.com +0.0.0.0 media-sync-a810.thetruthspy.com +0.0.0.0 media-sync-a820.thetruthspy.com +0.0.0.0 media-sync-a825.thetruthspy.com +0.0.0.0 media-sync-a830.thetruthspy.com +0.0.0.0 media-sync-a835.thetruthspy.com +0.0.0.0 media-sync-a895.thetruthspy.com +0.0.0.0 media-sync-a8xx.thetruthspy.com +0.0.0.0 media-sync-a910.thetruthspy.com +0.0.0.0 media-sync-a915.thetruthspy.com +0.0.0.0 media-sync-a920.thetruthspy.com +0.0.0.0 media-sync-a925.thetruthspy.com +0.0.0.0 media-sync-a930.thetruthspy.com +0.0.0.0 media-sync-a935.thetruthspy.com +0.0.0.0 media-sync-a940.thetruthspy.com +0.0.0.0 media-sync-a941.thetruthspy.com +0.0.0.0 media-sync-a942.thetruthspy.com +0.0.0.0 media-sync-a943.thetruthspy.com +0.0.0.0 media-sync-a944.thetruthspy.com +0.0.0.0 media-sync-a945.thetruthspy.com +0.0.0.0 media-sync-a946.thetruthspy.com +0.0.0.0 media-sync-a947.thetruthspy.com +0.0.0.0 media-sync.systemserviceprovider.com +0.0.0.0 media.thetruthspy.com +0.0.0.0 meetingonlinechat.club +0.0.0.0 message-tracker-98822.firebaseio.com +0.0.0.0 messages01.smstracker.com +0.0.0.0 messages02.smstracker.com +0.0.0.0 mflx.biz +0.0.0.0 mg-spyzie.oss-us-west-1.aliyuncs.com +0.0.0.0 mg.sdkbalance.com +0.0.0.0 mgo.kcpro.ga +0.0.0.0 mi.thd.cc +0.0.0.0 microsoft-updateserver.com +0.0.0.0 microsoftprotection.net +0.0.0.0 microtracker-1ca43.firebaseio.com +0.0.0.0 mifcbook.link +0.0.0.0 mimestyle.xyz +0.0.0.0 mimeversion.top +0.0.0.0 mimi18s.top +0.0.0.0 mimibox.top +0.0.0.0 mimicwt.net +0.0.0.0 mimimsg.net +0.0.0.0 miniiosapps.xyz +0.0.0.0 mintrack.vip +0.0.0.0 mirrorscreencasttvv.com +0.0.0.0 misran.org +0.0.0.0 mitube1.link +0.0.0.0 mlinks.ws +0.0.0.0 mlite-app.livekit.cloud +0.0.0.0 mlite-app.thd.cc +0.0.0.0 mlite-socket.thd.cc +0.0.0.0 mliteapp.alter757.info +0.0.0.0 mmbox.top +0.0.0.0 mnesytrlatr.com +0.0.0.0 mnfbodivbv.com +0.0.0.0 mob.eurotrans.kz +0.0.0.0 mobi22.com +0.0.0.0 mobiispy.com +0.0.0.0 mobil-kem.com +0.0.0.0 mobile-collector.newrelic.com +0.0.0.0 mobile-crash.newrelic.com +0.0.0.0 mobile-gw.thd.cc +0.0.0.0 mobile-sdk-api.intercom.io +0.0.0.0 mobile-tracker-data.com +0.0.0.0 mobile-tracker-free.com +0.0.0.0 mobile.ams2.measurelib.com +0.0.0.0 mobile.fra2.measurelib.com +0.0.0.0 mobile.measurelib.com +0.0.0.0 mobileaggregator.family.microsoft.com +0.0.0.0 mobilenannylogs.com +0.0.0.0 mobilerecorder-1277.firebaseio.com +0.0.0.0 mobiletool.ru +0.0.0.0 mobleingsder.com +0.0.0.0 mobnetlink1.com +0.0.0.0 mobnetlink2.com +0.0.0.0 mobnetlink3.com +0.0.0.0 momomsg.top +0.0.0.0 monitor-android.android-monitor.ru +0.0.0.0 monitor-ultra.com +0.0.0.0 mozillaupdate.xyz +0.0.0.0 mrec24.com +0.0.0.0 mrswd.wo87sf.com +0.0.0.0 msafe.xyz +0.0.0.0 msas.ws +0.0.0.0 mspy.alter757.info +0.0.0.0 mspyonline.com +0.0.0.0 mspytrackercom.alter757.info +0.0.0.0 mt2-sdp4.mt-2.co +0.0.0.0 mt5vsuf1.net +0.0.0.0 mtechn.zendesk.com +0.0.0.0 mtf.re +0.0.0.0 mtm1nwmx-api.findgravy.com +0.0.0.0 mtoolapp.biz +0.0.0.0 mtoolapp.net +0.0.0.0 mtracker.fortess.net +0.0.0.0 multilingualbackend.azurewebsites.net +0.0.0.0 muslimasauda.com +0.0.0.0 mxout.net +0.0.0.0 mxspy.com +0.0.0.0 my-player.vip +0.0.0.0 my-spy-a9c92.firebaseio.com +0.0.0.0 my.a-spy.com +0.0.0.0 my.aispyer.com +0.0.0.0 my.copy9.com +0.0.0.0 my.ispyoo.com +0.0.0.0 my.jjspy.com +0.0.0.0 my.kidsecured.com +0.0.0.0 my.mobiletool.ru +0.0.0.0 my.mobispy.net +0.0.0.0 my.mrec24.com +0.0.0.0 my.mspyonline.com +0.0.0.0 my.mtoolapp.net +0.0.0.0 my.nexspy.com +0.0.0.0 my.phonsee.com +0.0.0.0 my.securechildren.online +0.0.0.0 my.snoopza.com +0.0.0.0 my.spylix.com +0.0.0.0 my.spynger.net +0.0.0.0 my.spyzie.com +0.0.0.0 my.thespyapp.com +0.0.0.0 my.thetruthspy.com +0.0.0.0 my2.snoopza.com +0.0.0.0 myaddress.today +0.0.0.0 myappmobile-537f7.firebaseio.com +0.0.0.0 mychattranslator.club +0.0.0.0 mycloud-cs10.wisemo.com +0.0.0.0 mycloud-cs17.wisemo.com +0.0.0.0 mycloud-cs17a.wisemo.com +0.0.0.0 mycloud-cs5a.wisemo.com +0.0.0.0 mycloud-cs9.wisemo.com +0.0.0.0 mycloud.wisemo.com +0.0.0.0 mycloud1.wisemo.com +0.0.0.0 mycoffeeshop.shop +0.0.0.0 mydwnd.com +0.0.0.0 myfcbk.net +0.0.0.0 mylocatorplus.club +0.0.0.0 mytrips.quest +0.0.0.0 myutbe.net +0.0.0.0 mywebsitevpstest.xyz +0.0.0.0 mz-vodacom.info +0.0.0.0 mzpgfh.uhabq9.com +0.0.0.0 n.appspool.net +0.0.0.0 n.freespy1.ml +0.0.0.0 n.freespy1.tk +0.0.0.0 n.servidor.in +0.0.0.0 n.systemlog.me +0.0.0.0 n1.flyermobi.com +0.0.0.0 n47n.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 n6sm2m.celltracker.io +0.0.0.0 nabd.site +0.0.0.0 nabde.app +0.0.0.0 nassosblog.gr.com +0.0.0.0 natfrancisco.xyz +0.0.0.0 nation-news.com +0.0.0.0 nav.telematicsdirect.com +0.0.0.0 ndagri.com +0.0.0.0 neatspy.vip +0.0.0.0 nemaeovies.com +0.0.0.0 nemospy.com +0.0.0.0 nemshi-news.xyz +0.0.0.0 nemshi.net +0.0.0.0 net.cleverjp.com +0.0.0.0 net.etrality.com +0.0.0.0 net.hahamobi.com +0.0.0.0 net.salmonads.com +0.0.0.0 netspy-7b8ec.firebaseio.com +0.0.0.0 networkcartography.com +0.0.0.0 networkcartography.net +0.0.0.0 networkcartography.org +0.0.0.0 networkenterprise.net +0.0.0.0 new.androidlost.com +0.0.0.0 newdulcina.com +0.0.0.0 newsbeast.gr.com +0.0.0.0 newslive2.xyz +0.0.0.0 newtarrifs.net +0.0.0.0 newyorkingsite.com +0.0.0.0 newzeto.xyz +0.0.0.0 newzgroup.xyz +0.0.0.0 nextialive.roimaster.site +0.0.0.0 nfrmg1y.xyz +0.0.0.0 ngc77.com +0.0.0.0 niceonase.com +0.0.0.0 niceonesa.net +0.0.0.0 nikjol.xyz +0.0.0.0 nimbus.bitdefender.net +0.0.0.0 nineth03.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 nissan.gr.com +0.0.0.0 node-api.theonespy.com +0.0.0.0 node1.theonespy.com +0.0.0.0 node2.theonespy.com +0.0.0.0 node3.theonespy.com +0.0.0.0 node4.theonespy.com +0.0.0.0 node5.theonespy.com +0.0.0.0 nodejs.spyhuman.com +0.0.0.0 notifications-sec.com +0.0.0.0 notifications.wa-info.com +0.0.0.0 noujx.s9gxw8.com +0.0.0.0 novasdk.oss-cn-beijing.aliyuncs.com +0.0.0.0 novosti.bid +0.0.0.0 nsogroup.com +0.0.0.0 nsoqa.com +0.0.0.0 nwluoodzct.xyz +0.0.0.0 nwzhmwux-api.findgravy.com +0.0.0.0 o.freespy1.ml +0.0.0.0 o.freespy1.tk +0.0.0.0 observer.back4app.io +0.0.0.0 ocheyhv.xyz +0.0.0.0 office.hw.cab +0.0.0.0 offroaderssurvive.club +0.0.0.0 ogymoggy.firebaseio.com +0.0.0.0 oilgy.xyz +0.0.0.0 okjojihgv.com +0.0.0.0 olexegy.com +0.0.0.0 olimob.net +0.0.0.0 olurdaolurdediler.shop +0.0.0.0 olxeg.com +0.0.0.0 omanreal.net +0.0.0.0 omeega.xyz +0.0.0.0 onarchbylap.com +0.0.0.0 oncamera.top +0.0.0.0 oncamera.vip +0.0.0.0 oncast.top +0.0.0.0 onelink.me +0.0.0.0 onelnk.com +0.0.0.0 onespy-in-196211.firebaseio.com +0.0.0.0 onlinefundb.com +0.0.0.0 onlineservices.gr.com +0.0.0.0 ooredoodeals.com +0.0.0.0 opensourcecontext.com +0.0.0.0 oppfrede.get1tn0w.free247downloads.com +0.0.0.0 oppleman.org +0.0.0.0 orangegypt.co +0.0.0.0 orchomenos.news +0.0.0.0 order.80876dd5.shop +0.0.0.0 oroscopemestry.com +0.0.0.0 ortn13der.xyz +0.0.0.0 oscontext.com +0.0.0.0 osloufr1x.get1tn0w.free247downloads.com +0.0.0.0 oso.kcpro.ga +0.0.0.0 ospocatracker.com +0.0.0.0 otaupdatesios.com +0.0.0.0 outcome-ssp.supersonicads.com +0.0.0.0 outline.abunddhighett.com +0.0.0.0 outline.truecaller.com +0.0.0.0 p.baoyueai.com +0.0.0.0 p.freespy1.ml +0.0.0.0 p.freespy1.tk +0.0.0.0 p.webengage.com +0.0.0.0 package.mrec24.com +0.0.0.0 package2.mrec24.com +0.0.0.0 panel.spy24.net +0.0.0.0 panel24.org +0.0.0.0 panspy-1.oss-us-west-1.aliyuncs.com +0.0.0.0 panspy.com +0.0.0.0 panspy.me +0.0.0.0 paok-24.com +0.0.0.0 parent.netnanny.com +0.0.0.0 parental-control-d4a98-default-rtdb.asia-southeast1.firebasedatabase.app +0.0.0.0 parser.cufinder.io +0.0.0.0 pastepast.net +0.0.0.0 pathanalyzer.com +0.0.0.0 pathanalyzerpro.com +0.0.0.0 pc.backupsoft.eu +0.0.0.0 pc.brunoespiao.com.br +0.0.0.0 pc.foxspy.com.br +0.0.0.0 pc.freespyapp.com +0.0.0.0 pc.selfspy.com +0.0.0.0 pc.spykontrol.com +0.0.0.0 pc.spyone.pl +0.0.0.0 pc.viptelefonprogrami.com +0.0.0.0 pc1.brunoespiao.com.br +0.0.0.0 pc6zu1ek.get1tn0w.free247downloads.com +0.0.0.0 pc6zu1ek.info8fvhgl3.urlpush.net +0.0.0.0 pctattletale.com +0.0.0.0 pctattletalev2.s3.amazonaws.com +0.0.0.0 pdfviewer.app +0.0.0.0 pemuti.com +0.0.0.0 perargero.com +0.0.0.0 pfsense02-01.is-61194.teragence.net +0.0.0.0 pgv4.com +0.0.0.0 pharaohsadventure.club +0.0.0.0 phone-backup-service.firebaseio.com +0.0.0.0 phoneboster.com +0.0.0.0 phonecallerscreen.com +0.0.0.0 phonecontrolapp-e2c64.firebaseio.com +0.0.0.0 phonecontrolblockspamcalls.com +0.0.0.0 phonedata.me +0.0.0.0 phonesheriff.com +0.0.0.0 phonespector-b2f13.firebaseio.com +0.0.0.0 phonespector.com +0.0.0.0 phonespying.com +0.0.0.0 phonetrack.com +0.0.0.0 phonetracker.com +0.0.0.0 phonetracker95gpsonly.firebaseio.com +0.0.0.0 phonetracking-dd226.firebaseio.com +0.0.0.0 phonetracking.net +0.0.0.0 phonfinbyclap.com +0.0.0.0 photoeditorbest.club +0.0.0.0 pi.info-taxi.info +0.0.0.0 pickuchu.com +0.0.0.0 piction.club +0.0.0.0 pie.wirelessregistry.com +0.0.0.0 pikchoeditor.com +0.0.0.0 pipe.thd.cc +0.0.0.0 pixelprose.fr +0.0.0.0 play-store-3bb64.firebaseio.com +0.0.0.0 playestore.net +0.0.0.0 playgoog1e.com +0.0.0.0 plug2025.bm-com.com +0.0.0.0 pluginapi.chajianapi.com +0.0.0.0 ply.bearclod.com +0.0.0.0 pn8sm7rjuc.execute-api.us-east-1.amazonaws.com +0.0.0.0 pocopoc.xyz +0.0.0.0 poiuwhejgr.com +0.0.0.0 policy.getdownloadtime.com +0.0.0.0 politika.bid +0.0.0.0 politique-koaci.info +0.0.0.0 ponyvideochat.com +0.0.0.0 portal.flexispy.com +0.0.0.0 portal.unipass.top +0.0.0.0 positivefitness.club +0.0.0.0 pql.kcpro.ga +0.0.0.0 precise.fit +0.0.0.0 preservtyg.com +0.0.0.0 pricetiger.org +0.0.0.0 prmopromo.com +0.0.0.0 pro.logger.mobi +0.0.0.0 production.getpriceapp.com +0.0.0.0 profile.localytics.com +0.0.0.0 prog-money.android-monitor.ru +0.0.0.0 prog-money.com +0.0.0.0 project-323448153542050953.firebaseio.com +0.0.0.0 project-7991479181228723357.firebaseio.com +0.0.0.0 projectormp.com +0.0.0.0 pronews.gr.com +0.0.0.0 proocallerr.com +0.0.0.0 protocol-a.copy9.com +0.0.0.0 protocol-a.exactspy.com +0.0.0.0 protocol-a.fonetracker.com +0.0.0.0 protocol-a.guestspy.com +0.0.0.0 protocol-a.ispyoo.com +0.0.0.0 protocol-a.mxspy.com +0.0.0.0 protocol-a.thetruthspy.com +0.0.0.0 protocol-a100.fonetracker.com +0.0.0.0 protocol-a100.phoneparental.com +0.0.0.0 protocol-a100.thetruthspy.com +0.0.0.0 protocol-a5.guestspy.com +0.0.0.0 protocol-a58.guestspy.com +0.0.0.0 protocol-a59.guestspy.com +0.0.0.0 protocol-a6.thetruthspy.com +0.0.0.0 protocol-a60.guestspy.com +0.0.0.0 protocol-a600.fonetracker.com +0.0.0.0 protocol-a610.copy9.com +0.0.0.0 protocol-a610.thetruthspy.com +0.0.0.0 protocol-a611.copy9.com +0.0.0.0 protocol-a611.thetruthspy.com +0.0.0.0 protocol-a612.copy9.com +0.0.0.0 protocol-a614.copy9.com +0.0.0.0 protocol-a615.copy9.com +0.0.0.0 protocol-a616.copy9.com +0.0.0.0 protocol-a617.copy9.com +0.0.0.0 protocol-a618.copy9.com +0.0.0.0 protocol-a620.copy9.com +0.0.0.0 protocol-a621.copy9.com +0.0.0.0 protocol-a65.guestspy.com +0.0.0.0 protocol-a69.copy9.com +0.0.0.0 protocol-a696.copy9.com +0.0.0.0 protocol-a70.guestspy.com +0.0.0.0 protocol-a710.copy9.com +0.0.0.0 protocol-a712.fonetracker.com +0.0.0.0 protocol-a72.thetruthspy.com +0.0.0.0 protocol-a720.thetruthspy.com +0.0.0.0 protocol-a721.thetruthspy.com +0.0.0.0 protocol-a722.thetruthspy.com +0.0.0.0 protocol-a723.thetruthspy.com +0.0.0.0 protocol-a724.thetruthspy.com +0.0.0.0 protocol-a725.thetruthspy.com +0.0.0.0 protocol-a726.thetruthspy.com +0.0.0.0 protocol-a727.thetruthspy.com +0.0.0.0 protocol-a728.thetruthspy.com +0.0.0.0 protocol-a729.thetruthspy.com +0.0.0.0 protocol-a730.thetruthspy.com +0.0.0.0 protocol-a731.thetruthspy.com +0.0.0.0 protocol-a732.thetruthspy.com +0.0.0.0 protocol-a733.thetruthspy.com +0.0.0.0 protocol-a734.thetruthspy.com +0.0.0.0 protocol-a735.thetruthspy.com +0.0.0.0 protocol-a736.thetruthspy.com +0.0.0.0 protocol-a737.thetruthspy.com +0.0.0.0 protocol-a738.thetruthspy.com +0.0.0.0 protocol-a739.thetruthspy.com +0.0.0.0 protocol-a740.thetruthspy.com +0.0.0.0 protocol-a741.thetruthspy.com +0.0.0.0 protocol-a742.thetruthspy.com +0.0.0.0 protocol-a743.thetruthspy.com +0.0.0.0 protocol-a744.thetruthspy.com +0.0.0.0 protocol-a745.mxspy.com +0.0.0.0 protocol-a745.thetruthspy.com +0.0.0.0 protocol-a746.thetruthspy.com +0.0.0.0 protocol-a747.thetruthspy.com +0.0.0.0 protocol-a748.thetruthspy.com +0.0.0.0 protocol-a749.thetruthspy.com +0.0.0.0 protocol-a780.copy9.com +0.0.0.0 protocol-a780.fonetracker.com +0.0.0.0 protocol-a780.ispyoo.com +0.0.0.0 protocol-a780.mxspy.com +0.0.0.0 protocol-a785.copy9.com +0.0.0.0 protocol-a785.fonetracker.com +0.0.0.0 protocol-a810.ispyoo.com +0.0.0.0 protocol-a810.mxspy.com +0.0.0.0 protocol-a810.thetruthspy.com +0.0.0.0 protocol-a811.ispyoo.com +0.0.0.0 protocol-a811.mxspy.com +0.0.0.0 protocol-a880.ispyoo.com +0.0.0.0 protocol-a89.ispyoo.com +0.0.0.0 protocol-a89.mxspy.com +0.0.0.0 protocol-a910.thetruthspy.com +0.0.0.0 protocol-a915.thetruthspy.com +0.0.0.0 protocol-a920.thetruthspy.com +0.0.0.0 protocol-a925.thetruthspy.com +0.0.0.0 protocol-a930.thetruthspy.com +0.0.0.0 protocol-a935.thetruthspy.com +0.0.0.0 protocol-a940.thetruthspy.com +0.0.0.0 protocol-a941.thetruthspy.com +0.0.0.0 protocol-a942.thetruthspy.com +0.0.0.0 protocol-a943.thetruthspy.com +0.0.0.0 protocol-a944.thetruthspy.com +0.0.0.0 protocol-a945.thetruthspy.com +0.0.0.0 protocol-a946.thetruthspy.com +0.0.0.0 protocol-a947.thetruthspy.com +0.0.0.0 protocol-monitor.thetruthspy.com +0.0.0.0 protocol-viewer-a.copy9.com +0.0.0.0 protocol.copy9.com +0.0.0.0 protocol.guestspy.com +0.0.0.0 protocol.inospy.com +0.0.0.0 protocol.ispyoo.com +0.0.0.0 protocol.mxspy.com +0.0.0.0 protocol.systemserviceprovider.com +0.0.0.0 protocol.thetruthspy.com +0.0.0.0 protothema.live +0.0.0.0 proupload.xyz +0.0.0.0 proxy.reptilicus.net +0.0.0.0 proxy48.oss-eu-central-1.aliyuncs.com +0.0.0.0 ps1link.xyz +0.0.0.0 ps2link.xyz +0.0.0.0 ps97mailer.logger.mobi +0.0.0.0 pulsesolutions-net-easy-logger.firebaseio.com +0.0.0.0 push.mobilefonex.com +0.0.0.0 pushapi.localytics.com +0.0.0.0 pwhois.net +0.0.0.0 pwhois.org +0.0.0.0 pwtgnp.pw +0.0.0.0 q12z.net +0.0.0.0 q95294fs.beget.tech +0.0.0.0 qaintqa.com +0.0.0.0 qibdirctiowa.com +0.0.0.0 qiberiblaon.com +0.0.0.0 qibla-quran.com +0.0.0.0 qibla-ultima.com +0.0.0.0 qiblassirection.com +0.0.0.0 qrcodesscan.com +0.0.0.0 qrreaderpro.com +0.0.0.0 qtwjhuj.com +0.0.0.0 quadreamtech.com +0.0.0.0 quanly24h.net +0.0.0.0 quickupdates.xyz +0.0.0.0 quietquell.com +0.0.0.0 quinoa-personal-identify-prod.sense360eng.com +0.0.0.0 qwert.xyz +0.0.0.0 qwxzyl.com +0.0.0.0 r.findmychilds.org +0.0.0.0 r.findmykids.org +0.0.0.0 racerscardriver.club +0.0.0.0 rank.trellian.com +0.0.0.0 rc-api.lifecircle.app +0.0.0.0 rcomlogin.com +0.0.0.0 rctphvxwnjhx.pw +0.0.0.0 realtime-spy-mobile.com +0.0.0.0 rec.hw.cab +0.0.0.0 redcrossworld.com +0.0.0.0 redeitt.com +0.0.0.0 redirect-ede.com +0.0.0.0 redvios.com +0.0.0.0 refinery.shopsavvy.com +0.0.0.0 relay1.trackview.net +0.0.0.0 remotecommands.com +0.0.0.0 remotesecurity-629f2.firebaseio.com +0.0.0.0 remotesecurityots.firebaseio.com +0.0.0.0 remoto.foxspy.com.br +0.0.0.0 repo.mspyonline.com +0.0.0.0 report.huqindustries.co.uk +0.0.0.0 reporting-util.tutelatechnologies.com +0.0.0.0 reporting.tutelatechnologies.com +0.0.0.0 reports.crashlytics.com +0.0.0.0 reptilicus.net +0.0.0.0 revolution-ede.com +0.0.0.0 rfjdhxbz.com +0.0.0.0 rfrancisco.store +0.0.0.0 rinimae.oss-ap-southeast-5.aliyuncs.com +0.0.0.0 rockalab.com +0.0.0.0 rooitor.com +0.0.0.0 rp.apollospy.com +0.0.0.0 rp.dedrone.com.ua +0.0.0.0 rp.labrador.ua +0.0.0.0 rp.liquidblue.com.ua +0.0.0.0 rportranslator.com +0.0.0.0 rrspy.com +0.0.0.0 rtc.ttspy.com +0.0.0.0 rulapptoplan.com +0.0.0.0 runaki-support.appspot.com +0.0.0.0 rythemsjoy.club +0.0.0.0 rzhpe6vyf9.execute-api.eu-west-2.amazonaws.com +0.0.0.0 s.appjiagu.com +0.0.0.0 s.kid-control.com +0.0.0.0 s.net2share.com +0.0.0.0 s.servidor.in +0.0.0.0 s1.panspy.com +0.0.0.0 s1.spylive360.com +0.0.0.0 s10.kid-control.com +0.0.0.0 s2.spylive360.com +0.0.0.0 s3.spylive360.com +0.0.0.0 s3.thd.cc +0.0.0.0 s4.kid-control.com +0.0.0.0 s5.kid-control.com +0.0.0.0 s6.kid-control.com +0.0.0.0 s7.kid-control.com +0.0.0.0 s8.kid-control.com +0.0.0.0 s9.kid-control.com +0.0.0.0 s9gxw8.com +0.0.0.0 sa.api.india.miui.com +0.0.0.0 sa.api.intl.miui.com +0.0.0.0 sa.api.rus.miui.com +0.0.0.0 sabafon.info +0.0.0.0 safe-link.mobi +0.0.0.0 safe.videoadblockerplus.com +0.0.0.0 safedriving.family.microsoft.com +0.0.0.0 safelock.club +0.0.0.0 safelyredirecting.com +0.0.0.0 safelyredirecting.digital +0.0.0.0 safespy.vip +0.0.0.0 safeyourdata.xyz +0.0.0.0 sahar.oss-us-east-1.aliyuncs.com +0.0.0.0 sandbox97.childsafetytrackerapp.com +0.0.0.0 sandbox97.logger.mobi +0.0.0.0 sandbox97.seniorsafetyapp.com +0.0.0.0 sanely.cc +0.0.0.0 sap4mobile-89685.firebaseio.com +0.0.0.0 sap4mobile.com +0.0.0.0 sapient-flight-837.firebaseio.com +0.0.0.0 scandocnotes.com +0.0.0.0 scar.unityads.unity3d.com +0.0.0.0 scfstats.alixblog.com +0.0.0.0 screentimelabs.appspot.com +0.0.0.0 sdk-as.complementics.com +0.0.0.0 sdk.dofunapps.com +0.0.0.0 sdk.predic.io +0.0.0.0 sdk.sdkbalance.com +0.0.0.0 sdk.starbolt.io +0.0.0.0 seahome.top +0.0.0.0 search.matchy.ru +0.0.0.0 sec-flare.com +0.0.0.0 secondclone-2d312.firebaseio.com +0.0.0.0 secontranslatpr.com +0.0.0.0 securebackuponline.net +0.0.0.0 security.laikalabs.ai +0.0.0.0 securityservice-center.com +0.0.0.0 senior-safety-189010.firebaseio.com +0.0.0.0 senseye.spymasterpro.com +0.0.0.0 sentry-01.thd.cc +0.0.0.0 sentry-02.thd.cc +0.0.0.0 sentry-03.thd.cc +0.0.0.0 sentry-04.thd.cc +0.0.0.0 sentry-05.thd.cc +0.0.0.0 sentry-06.thd.cc +0.0.0.0 sentry-07.thd.cc +0.0.0.0 sentry-product-new.bbrp.co +0.0.0.0 sentrypc.net +0.0.0.0 sepenet.gr.com +0.0.0.0 sephoragroup.com +0.0.0.0 ser-chat.com +0.0.0.0 server.androidmonitor.com +0.0.0.0 server.freeandroidspy.com +0.0.0.0 servers-mobile.info +0.0.0.0 service.n.weiguanai.cn +0.0.0.0 service.weiguanai.cn +0.0.0.0 services.spytoapp.com +0.0.0.0 servicesloggermobi.azurewebsites.net +0.0.0.0 serviceupdaterequest.com +0.0.0.0 servidor.in +0.0.0.0 setting.rayjump.com +0.0.0.0 settings.crashlytics.com +0.0.0.0 setup.nemospy.com +0.0.0.0 setupmail-a.icloudappe.com +0.0.0.0 setupmail-a720.icloudappe.com +0.0.0.0 setupmail-a722.icloudappe.com +0.0.0.0 setupmail-a724.icloudappe.com +0.0.0.0 setupmail-a725.icloudappe.com +0.0.0.0 setupmail-a726.icloudappe.com +0.0.0.0 setupmail-a727.icloudappe.com +0.0.0.0 setupmail-a729.icloudappe.com +0.0.0.0 setupmail-a732.icloudappe.com +0.0.0.0 setupmail-a733.icloudappe.com +0.0.0.0 setupmail-a734.icloudappe.com +0.0.0.0 setupmail-a735.icloudappe.com +0.0.0.0 setupmail-a737.icloudappe.com +0.0.0.0 setupmail-a738.icloudappe.com +0.0.0.0 setupmail-a740.icloudappe.com +0.0.0.0 setupmail-a741.icloudappe.com +0.0.0.0 setupmail-a742.icloudappe.com +0.0.0.0 setupmail-a743.icloudappe.com +0.0.0.0 setupmail-a744.icloudappe.com +0.0.0.0 setupmail-a745.icloudappe.com +0.0.0.0 setupmail-a746.icloudappe.com +0.0.0.0 setupmail-a747.icloudappe.com +0.0.0.0 setupmail-a748.icloudappe.com +0.0.0.0 setupmail-a910.icloudappe.com +0.0.0.0 setupmail-a915.icloudappe.com +0.0.0.0 setupmail-a920.icloudappe.com +0.0.0.0 setupmail.icloudappe.com +0.0.0.0 sextape225.me +0.0.0.0 sg1-spiky.wzrkt.com +0.0.0.0 sg1.cb.wzrkt.com +0.0.0.0 sg1.wzrkt.com +0.0.0.0 shadow-logs.com +0.0.0.0 shadow-spy.com +0.0.0.0 shadowappbundle-default-rtdb.firebaseio.com +0.0.0.0 shadowlogspanel.firebaseio.com +0.0.0.0 shorten.fi +0.0.0.0 shortenurls.me +0.0.0.0 shortmee.one +0.0.0.0 shortwidgets.com +0.0.0.0 shortxyz.com +0.0.0.0 signal-live.vip +0.0.0.0 signaltalk.top +0.0.0.0 simetricode.uk +0.0.0.0 sinai-new.com +0.0.0.0 sitepref.xyz +0.0.0.0 sjkfsdkg.com +0.0.0.0 sk1-spiky.wzrkt.com +0.0.0.0 sk1-staging-1.wzrkt.com +0.0.0.0 sk1-staging-10.wzrkt.com +0.0.0.0 sk1-staging-2.wzrkt.com +0.0.0.0 sk1-staging-3.wzrkt.com +0.0.0.0 sk1-staging-4.wzrkt.com +0.0.0.0 sk1-staging-5.wzrkt.com +0.0.0.0 sk1-staging-6.wzrkt.com +0.0.0.0 sk1-staging-7.wzrkt.com +0.0.0.0 sk1-staging-8.wzrkt.com +0.0.0.0 sk1-staging-9.wzrkt.com +0.0.0.0 sk1.wzrkt.com +0.0.0.0 skycoachgg.club +0.0.0.0 sl360-7ba65.firebaseio.com +0.0.0.0 slimesimulator.club +0.0.0.0 smalllcalllrecorder.com +0.0.0.0 smart.link +0.0.0.0 smartadblocker.com +0.0.0.0 smartback-12d60.appspot.com +0.0.0.0 smartback-12d60.firebaseio.com +0.0.0.0 sms.webadv.co +0.0.0.0 smsandcalltracker.firebaseio.com +0.0.0.0 smser.net +0.0.0.0 smsuns.com +0.0.0.0 snapfire.xyz +0.0.0.0 snaplens-pt.com +0.0.0.0 sniper.pet +0.0.0.0 snoopza.com +0.0.0.0 sock.godforgiveuss.live +0.0.0.0 sock.hhhhrkanandda.xyz +0.0.0.0 sock.nmnmnmfsamsfan.xyz +0.0.0.0 socktest.ankatras.xyz +0.0.0.0 solargoup.xyz +0.0.0.0 solargroup.xyz +0.0.0.0 solvely.ai +0.0.0.0 sonar.actv8technologies.com +0.0.0.0 soulscanneryh.com +0.0.0.0 sp.kuuvv.com +0.0.0.0 sp18022019.firebaseio.com +0.0.0.0 sparrow.wondershare.com +0.0.0.0 spc-runtimes.s3.amazonaws.com +0.0.0.0 spectronet.pw +0.0.0.0 speedspot.speedspot.netdna-cdn.com +0.0.0.0 speedy.sbs +0.0.0.0 speedygonzales.xyz +0.0.0.0 speedymax.shop +0.0.0.0 sport4ever.club +0.0.0.0 sports-mdg.xyz +0.0.0.0 sportsnewz.site +0.0.0.0 spy-datacenter.com +0.0.0.0 spy24.net +0.0.0.0 spy2mobile-bb441.firebaseio.com +0.0.0.0 spy2mobile.com +0.0.0.0 spyadvice.com +0.0.0.0 spyapp-8916f.firebaseio.com +0.0.0.0 spyapp.top +0.0.0.0 spyaudiorecorder.firebaseio.com +0.0.0.0 spyera.postaffiliatepro.com +0.0.0.0 spyhide.com +0.0.0.0 spyhide.ir +0.0.0.0 spyhuman-97943.firebaseio.com +0.0.0.0 spyhuman.com +0.0.0.0 spylive360.com +0.0.0.0 spylogs.com +0.0.0.0 spymaster-e535b.firebaseio.com +0.0.0.0 spynote.us +0.0.0.0 spysetup.com +0.0.0.0 spyt.co +0.0.0.0 spytomobile.com +0.0.0.0 spytrac-app1.s3.amazonaws.com +0.0.0.0 spyzee.com +0.0.0.0 spyzie-a.firebaseio.com +0.0.0.0 spyzie.com +0.0.0.0 squishyp.com +0.0.0.0 sse.chyldmonitor.com +0.0.0.0 sslasmr.com +0.0.0.0 sslportservices.com +0.0.0.0 stable.icecyber.org +0.0.0.0 staging-all-tracker.appspot.com +0.0.0.0 staging.smstracker.com +0.0.0.0 static-graph.com +0.0.0.0 static.complementics.com +0.0.0.0 static.privacytrck.com +0.0.0.0 static.trckingbyte.com +0.0.0.0 static.trckpath.com +0.0.0.0 stats.buildwithkt.dev +0.0.0.0 stats.essayget.com +0.0.0.0 stats.inappertising.org +0.0.0.0 stonisi.news +0.0.0.0 store.dianmpsoathom.com +0.0.0.0 stream.meetextension.com +0.0.0.0 stream.redcoolmedia.net +0.0.0.0 streetprocarsracingss.com +0.0.0.0 streetracingg.club +0.0.0.0 strunhvgpk.com +0.0.0.0 studio11-7e288.firebaseio.com +0.0.0.0 super-voice.vip +0.0.0.0 supersonicads.com +0.0.0.0 support.mtoolapp.biz +0.0.0.0 support.phoneparental.com +0.0.0.0 supportset.net +0.0.0.0 survey-notify-event.sense360eng.com +0.0.0.0 suzuki.gr.com +0.0.0.0 svetovid.bid +0.0.0.0 symoty.com +0.0.0.0 sync-a.copy9.com +0.0.0.0 sync-a.exactspy.com +0.0.0.0 sync-a.fonetracker.com +0.0.0.0 sync-a.ispyoo.com +0.0.0.0 sync-a.mxspy.com +0.0.0.0 sync-a.thetruthspy.com +0.0.0.0 sync-a100.fonetracker.com +0.0.0.0 sync-a600.fonetracker.com +0.0.0.0 sync-a712.fonetracker.com +0.0.0.0 sync-a780.mxspy.com +0.0.0.0 sync-a7xx.thetruthspy.com +0.0.0.0 sync-a8xx.thetruthspy.com +0.0.0.0 sync-a925.thetruthspy.com +0.0.0.0 sync-a930.thetruthspy.com +0.0.0.0 sync-a935.thetruthspy.com +0.0.0.0 sync-a940.thetruthspy.com +0.0.0.0 sync-a941.thetruthspy.com +0.0.0.0 sync-a942.thetruthspy.com +0.0.0.0 sync.bk128.com +0.0.0.0 sync.xiz4me.com +0.0.0.0 syncservices.one +0.0.0.0 synctimestamp.com +0.0.0.0 syncupdate.site +0.0.0.0 t-bit.me +0.0.0.0 t.appsflyer.com +0.0.0.0 t.pie.org +0.0.0.0 t1.twmills.xyz +0.0.0.0 t1k22.c8xwor.com +0.0.0.0 t2.twmills.xyz +0.0.0.0 t3.twmills.xyz +0.0.0.0 taaborfrede.get1tn0w.free247downloads.com +0.0.0.0 tagdps.ru +0.0.0.0 tags.illaryboucnc.com +0.0.0.0 talklog.tools +0.0.0.0 tchsrvce.com +0.0.0.0 tele-gram.vip +0.0.0.0 telecomegy-ads.com +0.0.0.0 telenorconn.com +0.0.0.0 tesla-s.shop +0.0.0.0 teslal.shop +0.0.0.0 teslal.xyz +0.0.0.0 teslali.com +0.0.0.0 test-client.mobilefonex.com +0.0.0.0 test.androidlost.com +0.0.0.0 test.onetouchsecurities.com +0.0.0.0 test.refog.com +0.0.0.0 test.udadblocker.com +0.0.0.0 testapi.foozor.com +0.0.0.0 tfk7r22klf8vtd8g90jq8qno1tpqhmpe.apps.googleusercontent.com +0.0.0.0 tgrthgsrgwrthwrtgwr.xyz +0.0.0.0 tgscontakcs.com +0.0.0.0 thainews.asia +0.0.0.0 thd.cc +0.0.0.0 theodoi24h.com +0.0.0.0 thepopulator.tutelatechnologies.com +0.0.0.0 thepromise.standsapp.org +0.0.0.0 thetruth-db94a.firebaseio.com +0.0.0.0 thevendry.com +0.0.0.0 thiefguardbd.com +0.0.0.0 ti.domainforlite.com +0.0.0.0 tickeakhatsp.com +0.0.0.0 timestampsync.com +0.0.0.0 timeupdate.xyz +0.0.0.0 timeupdateservice.com +0.0.0.0 tiny.gr.com +0.0.0.0 tinylinks.live +0.0.0.0 tinyulrs.com +0.0.0.0 tinyurl.cloud +0.0.0.0 tiol.xyz +0.0.0.0 tips.ghetaldhighe.com +0.0.0.0 tispy.net +0.0.0.0 tly.gr.com +0.0.0.0 tly.link +0.0.0.0 tocast.vip +0.0.0.0 tok.vaicore.xyz +0.0.0.0 top-best.com +0.0.0.0 topcontactco.com +0.0.0.0 topzaloha.cz +0.0.0.0 tovima.live +0.0.0.0 tqiblacompas.com +0.0.0.0 tr.appmia.com +0.0.0.0 traccar-client-app.firebaseio.com +0.0.0.0 traccar.org +0.0.0.0 track-your-fedex-package.org +0.0.0.0 track.odskguo.xyz +0.0.0.0 trackier.vip +0.0.0.0 trackine.vip +0.0.0.0 tracking-smartphone.firebaseio.com +0.0.0.0 tracking.hexilo.com +0.0.0.0 tracking.india.miui.com +0.0.0.0 tracking.intl.miui.com +0.0.0.0 tracking.mliteapp.com +0.0.0.0 tracking.mspyonline.com +0.0.0.0 tracking.rus.miui.com +0.0.0.0 trackingsmartphone.com +0.0.0.0 trackji.com +0.0.0.0 trackmy.mobi +0.0.0.0 trackmyphones-pro.firebaseio.com +0.0.0.0 trackmyphones.com +0.0.0.0 trackpro.vip +0.0.0.0 tracksp-7743c.firebaseio.com +0.0.0.0 tracksp.in +0.0.0.0 trackview.net +0.0.0.0 transatitonneap.com +0.0.0.0 translations.matetranslate.com +0.0.0.0 trcalluecodr.com +0.0.0.0 trecv.xyz +0.0.0.0 trecvf.xyz +0.0.0.0 trfvbnji7.com +0.0.0.0 trkc.online +0.0.0.0 trkps.com +0.0.0.0 truck-rouddrive.com +0.0.0.0 true-truck-86810.appspot.com +0.0.0.0 true-truck-86810.firebaseio.com +0.0.0.0 truewebmedia.com +0.0.0.0 trustcor.co +0.0.0.0 tsrt.xyz +0.0.0.0 ttjj.ga +0.0.0.0 ttjj.ml +0.0.0.0 ttjj.tk +0.0.0.0 ttspy.com +0.0.0.0 ttspy.net +0.0.0.0 ttspy.top +0.0.0.0 turkeynewsupdates.com +0.0.0.0 turkishairines.info +0.0.0.0 tw.itter.me +0.0.0.0 twi-tter.vip +0.0.0.0 twtter.net +0.0.0.0 tyfrancisco.store +0.0.0.0 tyfrancisco.xyz +0.0.0.0 u1.panspy.com +0.0.0.0 ua.brunoespiao.com.br +0.0.0.0 ua.evaspy.com +0.0.0.0 ua.tispy.net +0.0.0.0 uaenews.online +0.0.0.0 uataz.quickolabs.com +0.0.0.0 ub.evaspy.com +0.0.0.0 ube.gr.com +0.0.0.0 uberegypt.cn.com +0.0.0.0 ublocker-chrome.com +0.0.0.0 uc.evaspy.com +0.0.0.0 ud.evaspy.com +0.0.0.0 udata.elephantdata.net +0.0.0.0 ue.brunoespiao.com.br +0.0.0.0 ue.evaspy.com +0.0.0.0 ue.maglook.eu +0.0.0.0 uf.brunoespiao.com.br +0.0.0.0 uf.evaspy.com +0.0.0.0 uf.maglook.eu +0.0.0.0 uf1.brunoespiao.com.br +0.0.0.0 ufz.doesxyz.com +0.0.0.0 ug.evaspy.com +0.0.0.0 ug1c5v.birxpk.com +0.0.0.0 uh.evaspy.com +0.0.0.0 uhtpuerdfbnm.com +0.0.0.0 ui.evaspy.com +0.0.0.0 uj.evaspy.com +0.0.0.0 uk.evaspy.com +0.0.0.0 ul.evaspy.com +0.0.0.0 um.evaspy.com +0.0.0.0 un.evaspy.com +0.0.0.0 uncherdroid.com +0.0.0.0 unisafe-a342f.firebaseio.com +0.0.0.0 unityads.unity3d.com +0.0.0.0 univision.click +0.0.0.0 unonoticias.net +0.0.0.0 uo.evaspy.com +0.0.0.0 up.evaspy.com +0.0.0.0 update-service-7e59f.firebaseio.com +0.0.0.0 update.crashlytics.com +0.0.0.0 updates4you.xyz +0.0.0.0 updateservice.center +0.0.0.0 updateservicecenter.com +0.0.0.0 updatetime.zone +0.0.0.0 updatingnews.xyz +0.0.0.0 updete.xyz +0.0.0.0 upload-tutelawest.s3-accelerate.amazonaws.com +0.0.0.0 upload.weiguanai.cn +0.0.0.0 uq.evaspy.com +0.0.0.0 ur.brunoespiao.com.br +0.0.0.0 ur.evaspy.com +0.0.0.0 ur.spyone.pl +0.0.0.0 urirank.com +0.0.0.0 url-promo.club +0.0.0.0 url-tiny.app +0.0.0.0 urlpush.net +0.0.0.0 urtyhfds.com +0.0.0.0 us-central1-api-project-285519687053.cloudfunctions.net +0.0.0.0 us-central1-catwatchful-e03b8.cloudfunctions.net +0.0.0.0 us-central1-production-242307.cloudfunctions.net +0.0.0.0 us.umobix.com +0.0.0.0 us01.salmonads.com +0.0.0.0 us1-spiky.wzrkt.com +0.0.0.0 us1.cb.wzrkt.com +0.0.0.0 us1.wzrkt.com +0.0.0.0 usafe-ca594.firebaseio.com +0.0.0.0 usafe.ru +0.0.0.0 user.ownspy.es +0.0.0.0 user.trackview.net +0.0.0.0 user2.trackview.net +0.0.0.0 userauthen.pw +0.0.0.0 users.awosoft.com +0.0.0.0 users.easemon.com +0.0.0.0 users.thephonem.com +0.0.0.0 uservicescheck.com +0.0.0.0 uservicesforyou.com +0.0.0.0 utube.digital +0.0.0.0 uu.domainforlite.com +0.0.0.0 uyghur-news.com +0.0.0.0 uyghur-soft-market.com +0.0.0.0 uyghurhaber.com +0.0.0.0 v-talk.top +0.0.0.0 v-talk.vip +0.0.0.0 v.mobzones.com +0.0.0.0 v4vw4ytvo4.execute-api.us-east-2.amazonaws.com +0.0.0.0 v9czaci.xyz +0.0.0.0 vaccine-appointment.link +0.0.0.0 vaicore.xyz +0.0.0.0 vbchs.com +0.0.0.0 vbchs.org +0.0.0.0 vbhacker.space +0.0.0.0 vbhackerspace.com +0.0.0.0 vbhackerspace.org +0.0.0.0 vd.toobox.online +0.0.0.0 ve.toobox.online +0.0.0.0 vegfrede.get1tn0w.free247downloads.com +0.0.0.0 verifyurl.me +0.0.0.0 video-recorder-c0419.firebaseio.com +0.0.0.0 video-url.tutelatechnologies.com +0.0.0.0 videos.ultrawidevideo.com +0.0.0.0 videosound.vip +0.0.0.0 viewer.snoopza.com +0.0.0.0 viptelefonprogrami.com +0.0.0.0 viptrack.pro +0.0.0.0 vipyoga.today +0.0.0.0 virsis.net +0.0.0.0 viva.gr.com +0.0.0.0 vkur.se +0.0.0.0 vkur1.se +0.0.0.0 vl.denrok.space +0.0.0.0 vodafoneegypt.tech +0.0.0.0 vodafonegypt.com +0.0.0.0 voicecontrol.top +0.0.0.0 voicesupport.vip +0.0.0.0 vortnomade.net +0.0.0.0 vostrom.ventures +0.0.0.0 vpnzfep.com +0.0.0.0 vt.toobox.online +0.0.0.0 vtalk.vip +0.0.0.0 vys.me +0.0.0.0 w-video.vip +0.0.0.0 w9x7itu.xyz +0.0.0.0 wa-info.com +0.0.0.0 wa.zcnewy.com +0.0.0.0 wallvoluminousfourk.club +0.0.0.0 wap.trend-tech.net +0.0.0.0 wavekli.xyz +0.0.0.0 waws-prod-blu-247-e7b3.eastus.cloudapp.azure.com +0.0.0.0 waws-prod-blu-247.sip.azurewebsites.windows.net +0.0.0.0 wcf.seven1029.com +0.0.0.0 we-site.net +0.0.0.0 weathear.live +0.0.0.0 weatherclub.club +0.0.0.0 weathernewz.xyz +0.0.0.0 weathersite.online +0.0.0.0 web.ab-salute.com +0.0.0.0 web.chyldmonitor.com +0.0.0.0 web.whatssapp.co +0.0.0.0 webadv.co +0.0.0.0 webaffise.com +0.0.0.0 webmaildirect.com +0.0.0.0 webrtc.thd.cc +0.0.0.0 webscan.cyber-risk.upguard.com +0.0.0.0 webservice.accountable2you.com +0.0.0.0 webservicesdb.mobiispy.com +0.0.0.0 webviewbridge.unityads.unity3d.com +0.0.0.0 webwatcher-child-app.firebaseio.com +0.0.0.0 webwatcherdata.com +0.0.0.0 webwatchernow.com +0.0.0.0 wethnc067.xyz +0.0.0.0 wfupppx.com +0.0.0.0 wha.tsapp.me +0.0.0.0 whatsapp-app.com +0.0.0.0 whatsmesticker.club +0.0.0.0 whatspp.wa-info.com +0.0.0.0 whatssapp.co +0.0.0.0 where-is-my-children.firebase.io +0.0.0.0 where-is-my-children.firebaseio.com +0.0.0.0 whoisanalyzer.com +0.0.0.0 whoisanalyzerpro.com +0.0.0.0 whynotworkonit.top +0.0.0.0 windowsphoneclean.com +0.0.0.0 wmdcommander.appspot.com +0.0.0.0 worldnws.xyz +0.0.0.0 wpc.A3CD.edgecastcdn.net +0.0.0.0 wppspy.tech +0.0.0.0 ws.findgravy.com +0.0.0.0 ws.nextialive.roimaster.site +0.0.0.0 ws.ttspy.com +0.0.0.0 wss.findmychilds.org +0.0.0.0 wss.findmykids.org +0.0.0.0 wtc1111.com +0.0.0.0 wtc2222.com +0.0.0.0 wtc3333.com +0.0.0.0 wts-app.info +0.0.0.0 wvv.kcpro.ga +0.0.0.0 www.alinbox.co +0.0.0.0 www.android-monitor.ru +0.0.0.0 www.androidlost.com +0.0.0.0 www.apk7.biz +0.0.0.0 www.apkcar.com +0.0.0.0 www.apkhl.pw +0.0.0.0 www.apkpure.bz +0.0.0.0 www.app-spy.com +0.0.0.0 www.appmarket.co +0.0.0.0 www.bark.us +0.0.0.0 www.blexb.com +0.0.0.0 www.brunoespiao.com.br +0.0.0.0 www.cangquyun.com +0.0.0.0 www.cellmonitoring.co +0.0.0.0 www.cerberusapp.com +0.0.0.0 www.e-spy.org +0.0.0.0 www.einformatiks.com +0.0.0.0 www.enhancedimageviewer.com +0.0.0.0 www.everestnote.com +0.0.0.0 www.familyorbit.com +0.0.0.0 www.familyorbit.net +0.0.0.0 www.flyermobi.com +0.0.0.0 www.imonitorsoft.cn +0.0.0.0 www.imonitorsoft.com +0.0.0.0 www.ioi.life +0.0.0.0 www.jueoxdr.com +0.0.0.0 www.liveupdate.cc +0.0.0.0 www.maglook.eu +0.0.0.0 www.mnfbodivbv.com +0.0.0.0 www.msafe.xyz +0.0.0.0 www.mspy.com +0.0.0.0 www.mspyonline.com +0.0.0.0 www.mtoolapp.net +0.0.0.0 www.myandroid.org +0.0.0.0 www.mydwnd.com +0.0.0.0 www.mzeibiyr.com +0.0.0.0 www.offerslove.com +0.0.0.0 www.okjojihgv.com +0.0.0.0 www.onworks.net +0.0.0.0 www.pgv4.com +0.0.0.0 www.platstack.com +0.0.0.0 www.questionai.com +0.0.0.0 www.recentnews.cc +0.0.0.0 www.reptilicus.net +0.0.0.0 www.runapps.org +0.0.0.0 www.sentrypc.download +0.0.0.0 www.sentrypc.net +0.0.0.0 www.sentrypconline.com +0.0.0.0 www.shadow-logs.com +0.0.0.0 www.shadyspy.com +0.0.0.0 www.shopper.com +0.0.0.0 www.spappmonitoring.com +0.0.0.0 www.spclogs.com +0.0.0.0 www.speedcheck.org +0.0.0.0 www.speedspot1.com +0.0.0.0 www.speedspot2.com +0.0.0.0 www.speedspot3.com +0.0.0.0 www.speedspot4.com +0.0.0.0 www.speedspot5.com +0.0.0.0 www.speedspot6.com +0.0.0.0 www.speedspot7.com +0.0.0.0 www.spy-datacenter.com +0.0.0.0 www.spy-phone-app.com +0.0.0.0 www.spyhide.com +0.0.0.0 www.spyhide.ir +0.0.0.0 www.spyzie.com +0.0.0.0 www.studentenkorting.nl +0.0.0.0 www.suppro.co +0.0.0.0 www.timpromos.com.br +0.0.0.0 www.trackmyphones.com +0.0.0.0 www.truckrental.cc +0.0.0.0 www.ttjj.tk +0.0.0.0 www.uptoplay.net +0.0.0.0 www.vys.me +0.0.0.0 www.webwatchernow.com +0.0.0.0 www.ywupscsff.com +0.0.0.0 wwwhisp.com +0.0.0.0 wx.weiguanai.cn +0.0.0.0 wzrkt.com +0.0.0.0 x.pgv4.com +0.0.0.0 x1panel.com +0.0.0.0 xapi.shastic.com +0.0.0.0 xf.actor +0.0.0.0 xiaoyuner.com +0.0.0.0 xiz4me.com +0.0.0.0 xmyevq.birxpk.com +0.0.0.0 xnore.com +0.0.0.0 xnspy.com +0.0.0.0 xnxx-hub.com +0.0.0.0 xpcpanel.com +0.0.0.0 xyvok.xyz +0.0.0.0 y0utube.com.mx +0.0.0.0 y0vvbm.xyz +0.0.0.0 yallakora-egy.com +0.0.0.0 ycxrl.com +0.0.0.0 ydc.kcpro.ga +0.0.0.0 ymex.apkcar.com +0.0.0.0 ymlog.apkcar.com +0.0.0.0 ymsdk.apkcar.com +0.0.0.0 yo.utube.digital +0.0.0.0 yo.utube.to +0.0.0.0 yoga4u.xyz +0.0.0.0 youarefired.xyz +0.0.0.0 your-access-here.com +0.0.0.0 yout.ube.gr.com +0.0.0.0 youtu-be.net +0.0.0.0 youtub.app +0.0.0.0 youtube.gr.live +0.0.0.0 youtube.voto +0.0.0.0 youtubesyncapi.com +0.0.0.0 youtubewatch.co +0.0.0.0 yq0z3d.xyz +0.0.0.0 yqchpwxvbg.execute-api.us-east-1.amazonaws.com +0.0.0.0 yuom7.net +0.0.0.0 z2a.digital +0.0.0.0 z2adigital.cloud +0.0.0.0 z2digital.cloud +0.0.0.0 za.startdownload.mobi +0.0.0.0 zdalnakontrola.pl +0.0.0.0 zerobt.net +0.0.0.0 zerobyte.top +0.0.0.0 zeusalmighty.club +0.0.0.0 zmq5ytc1-api.findgravy.com +0.0.0.0 zodiachand.club +0.0.0.0 zoemob.firebaseio.com +0.0.0.0 zoo.bearclod.com +0.0.0.0 zoofanimalm.com +0.0.0.0 zougla.gr.com +0.0.0.0 zougla.news +0.0.0.0 zqn.kcpro.ga +0.0.0.0 zsx.kcpro.ga +0.0.0.0 zumba.tampotrust.agency diff --git a/vigil/ioc/ips.txt b/vigil/ioc/ips.txt new file mode 100644 index 0000000..995db81 --- /dev/null +++ b/vigil/ioc/ips.txt @@ -0,0 +1,141 @@ +# Vigil IOC: Malicious IPs +# Format: ip|threat_name|category +103.147.225.210|PhoneSpy|c2 +103.242.134.243|201611_KeyBoy|c2 +103.40.102.233|201611_KeyBoy|c2 +103.55.24.196|201808_FamiliarFeeling|c2 +104.18.54.129|iKeyMonitor|c2 +104.18.55.129|iKeyMonitor|c2 +104.207.132.165|201801_SpyingOnABudget|c2 +104.236.73.120|Hoverwatch|c2 +104.238.191.204|201702_NilePhish|c2 +104.25.169.109|iKeyMonitor|c2 +104.25.170.109|iKeyMonitor|c2 +104.25.28.15|EasyLogger|c2 +104.25.29.15|EasyLogger|c2 +104.26.14.56|iKeyMonitor|c2 +104.26.15.56|iKeyMonitor|c2 +108.178.9.124|SentryPC|c2 +108.61.176.96|201702_NilePhish|c2 +109.169.40.172|201603_Shifting_Tactics|c2 +109.169.77.230|201603_Shifting_Tactics|c2 +112.10.117.47|201611_KeyBoy|c2 +115.126.39.107|201801_SpyingOnABudget|c2 +115.126.86.151|201808_FamiliarFeeling|c2 +116.193.154.69|201611_KeyBoy|c2 +119.8.35.235|FlexiSpy|c2 +138.201.32.118|Spy24|c2 +139.59.125.208|AndroidPolice|c2 +140.82.17.222|201909_MissingLink|c2 +144.202.59.23|201909_MissingLink|c2 +149.28.93.11|201909_MissingLink|c2 +149.56.26.44|Hoverwatch|c2 +157.7.84.81|201611_KeyBoy|c2 +158.69.24.236|Hoverwatch|c2 +162.144.212.52|Xnore|c2 +162.144.75.253|CatWatchful|c2 +162.209.103.68|201608_NSO_Group|c2 +167.114.114.207|AppSpy|c2 +167.71.189.163|TheWiSpy|c2 +172.67.194.85|iKeyMonitor|c2 +172.67.73.2|iKeyMonitor|c2 +172.67.81.216|EasyLogger|c2 +172.67.82.183|iKeyMonitor|c2 +175.126.146.147|PhoneSpy|c2 +176.123.26.42|201702_NilePhish|c2 +176.9.42.16|Reptilicus|c2 +178.33.203.110|AndroidMonitor|c2 +178.62.59.165|Snoopza|c2 +179.208.187.216|201512_PackRAT|c2 +184.154.69.210|RealtimeSpy|c2 +185.2.103.130|MonitorUltra|c2 +185.87.51.116|AndroidPolice|c2 +186.220.1.84|201512_PackRAT|c2 +186.220.11.67|201512_PackRAT|c2 +188.130.241.205|Hoverwatch|c2 +189.100.148.188|201512_PackRAT|c2 +190.20.180.181|201512_PackRAT|c2 +190.210.180.181|201512_PackRAT|c2 +192.169.243.65|201512_PackRAT|c2 +192.241.149.43|201611_KeyBoy|c2 +192.253.251.118|201603_Shifting_Tactics|c2 +193.105.134.27|201512_PackRAT|c2 +198.100.150.203|Hoverwatch|c2 +198.12.150.249|201512_PackRAT|c2 +198.44.190.85|201510_NGO_Burma|c2 +199.38.181.70|FreeAndroidSpy|c2 +201.33.21.62|eagleSPY|c2 +201.52.24.126|201512_PackRAT|c2 +203.189.232.207|201808_FamiliarFeeling|c2 +206.189.65.198|201909_MissingLink|c2 +210.61.12.153|201604_UP007_SLServer|c2 +212.7.195.171|201608_Group5|c2 +213.239.228.196|SpyHuman|c2 +217.182.176.52|FreeAndroidSpy|c2 +217.182.250.165|Snoopza|c2 +217.182.54.223|201905_EndlessMayfly|c2 +23.239.106.119|201707_InsiderInfo|c2 +27.126.176.169|201808_FamiliarFeeling|c2 +27.126.186.222|201808_FamiliarFeeling|c2 +37.120.162.163|AndroidPolice|c2 +43.240.14.37|201707_InsiderInfo|c2 +43.251.16.87|201909_MissingLink|c2 +45.114.224.147|CatWatchful|c2 +45.124.24.39|201707_InsiderInfo|c2 +45.125.12.147|201611_KeyBoy|c2 +45.127.97.222|201808_FamiliarFeeling|c2 +45.32.47.148|201611_KeyBoy|c2 +45.32.75.217|201909_MissingLink|c2 +45.32.91.137|201909_MissingLink|c2 +45.40.135.228|CallSMSTracker|c2 +45.63.0.49|201801_SpyingOnABudget|c2 +45.76.149.154|201909_MissingLink|c2 +45.76.53.26|201909_MissingLink|c2 +45.78.79.100|201909_MissingLink|c2 +45.79.149.154|ShadySpy|c2 +46.105.57.148|Snoopza|c2 +46.127.56.109|201603_Shifting_Tactics|c2 +46.246.89.246|201512_PackRAT|c2 +46.40.125.240|FreeAndroidSpy|c2 +47.252.23.40|AndroidPolice|c2 +47.88.63.70|ClevGuard|c2 +5.54.19.17|201603_Shifting_Tactics|c2 +50.28.38.175|EasyPhoneTrack|c2 +50.62.133.49|201512_PackRAT|c2 +50.63.202.57|201512_PackRAT|c2 +51.15.183.209|MobileTrackerFree|c2 +51.255.101.144|201905_EndlessMayfly|c2 +52.22.130.9|AndroidPolice|c2 +52.8.153.44|201608_NSO_Group|c2 +52.8.52.166|201608_NSO_Group|c2 +52.90.126.68|AndroidPolice|c2 +54.251.49.214|201608_NSO_Group|c2 +59.188.12.123|201604_UP007_SLServer|c2 +66.42.58.59|201909_MissingLink|c2 +67.227.193.142|pcTattletale|c2 +69.64.74.239|TheTruthSpy|c2 +69.64.81.166|TheTruthSpy|c2 +69.64.81.49|TheTruthSpy|c2 +69.64.81.98|TheTruthSpy|c2 +69.64.91.29|TheTruthSpy|c2 +78.129.252.159|201603_Shifting_Tactics|c2 +78.46.34.14|TalkLog|c2 +78.47.16.3|HelloSpy|c2 +80.241.216.14|MonitorUltra|c2 +80.255.12.237|201705_TaintedLeaks|c2 +82.80.202.200|201608_NSO_Group|c2 +82.80.202.204|201608_NSO_Group|c2 +85.13.206.195|TheOneSpy|c2 +85.13.218.229|TheOneSpy|c2 +87.117.229.109|201603_Shifting_Tactics|c2 +88.198.222.163|201608_Group5|c2 +89.32.40.238|201705_TaintedLeaks|c2 +89.33.190.8|VIPTrack|c2 +89.40.181.119|201705_TaintedLeaks|c2 +91.121.70.22|SpyMasterPro|c2 +91.196.212.201|LetMeSpy|c2 +91.196.212.202|LetMeSpy|c2 +95.154.195.159|201603_Shifting_Tactics|c2 +95.154.195.171|201603_Shifting_Tactics|c2 +95.169.2.57|201909_MissingLink|c2 +95.215.44.37|201605_Stealth_Falcon|c2 diff --git a/vigil/ioc/packages.txt b/vigil/ioc/packages.txt new file mode 100644 index 0000000..ae7df44 --- /dev/null +++ b/vigil/ioc/packages.txt @@ -0,0 +1,1197 @@ +# Vigil IOC: Malicious/stalkerware Android packages +# Format: package_name|threat_name|category +Aktualizacja.apps|Spyone|stalkerware +YWZiZDFjZTg2NTZlOGI4NDkyYWJjZDJjZDE5ZTM0Mjk.MzkwMmNhZGFiZGZhMjMyZjQzNTJkYmQ1ODg1ZjI1NzA|Observer|stalkerware +YWZiZDFjZTg2NTZlOGI4NDkyYWJjZDJjZDE5ZTM0Mjk.MzkwMmNhZGFiZGZhMjMyZjQzNTJkYmQ1ODg1ZjI1NzA|Unknown|stalkerware +a.tck.lvmchi|MobileTrackerFree|stalkerware +afs.hbmoczc|AndroidPolice|stalkerware +afs.hbmoczc|MonitorChecker|stalkerware +ahmyth.mine.king.ahmyth|Ahmyth|stalkerware +al.puik.cus|CallShowLite|spyware +and.GuardTrial|MobiStealth|stalkerware +and.LocatorTrial|MobiStealth|stalkerware +android.helper.system|celSpy|stalkerware +android.helper.system|mSpy|stalkerware +android.sys.process|celSpy|stalkerware +android.sys.process|mSpy|stalkerware +apex.hoolom.racecar.app|Apex Race Game|spyware +apk.keylogger|AndroSpy|stalkerware +apk.keylogger|RealtimeSpy|stalkerware +apk.kgl|AndroSpy|stalkerware +apk.kgl|RealtimeSpy|stalkerware +apk.kwoapsnde|AndroSpy|stalkerware +apk.kwoapsnde|RealtimeSpy|stalkerware +apk.screenshotrecorder|AndroSpy|stalkerware +apk.screenshotrecorder|RealtimeSpy|stalkerware +app.EasyLogger|EasyLogger|stalkerware +app.Easylogger|EasyLogger|stalkerware +app.Elogger|EasyLogger|stalkerware +app.childsafetytracker|EasyLogger|stalkerware +app.cybrook.trackvieo|TrackView|stalkerware +app.cybrook.trackviep|TrackView|stalkerware +app.cybrook.trackvieq|TrackView|stalkerware +app.cybrook.trackvier|TrackView|stalkerware +app.cybrook.trackvies|TrackView|stalkerware +app.cybrook.trackviet|TrackView|stalkerware +app.cybrook.trackvieu|TrackView|stalkerware +app.cybrook.trackviev|TrackView|stalkerware +app.cybrook.trackview|TrackView|stalkerware +app.cybrook.trackviex|TrackView|stalkerware +app.cybrook.trackviey|TrackView|stalkerware +app.cybrook.trackviez|TrackView|stalkerware +app.cybrook.trustserv|TrackView|stalkerware +app.lifecircle|TrackView|stalkerware +app.seniorsafety|EasyLogger|stalkerware +app.spy24.spy24installer|Spy24|stalkerware +app.spy24.systemwifi|Spy24|stalkerware +app.trackview.pro|TrackView|stalkerware +app.trackview|TrackView|stalkerware +br.com.appfornecedor.legal|MeuSpy|stalkerware +br.com.cloud.aplicativo|MeuSpy|stalkerware +br.com.cloud.backup|MeuSpy|stalkerware +br.com.daggers.gameap|MeuSpy|stalkerware +br.com.daggers.toshtec|MeuSpy|stalkerware +br.com.eaglespy|eagleSPY|stalkerware +br.com.galaxys.gameap|MeuSpy|stalkerware +br.com.gamelevel.cloudv3|MeuSpy|stalkerware +br.com.gamelevel.playstart|MeuSpy|stalkerware +br.com.maceda.android.antifurtow|AntiFurtoDroid|stalkerware +br.com.monsthers.gameap|MeuSpy|stalkerware +br.com.phonecell.cloud1|MeuSpy|stalkerware +br.com.phonecell.go5ge|MeuSpy|stalkerware +br.com.phonecell.maps|MeuSpy|stalkerware +br.com.phonecell.radio|MeuSpy|stalkerware +br.com.phonecell.services|MeuSpy|stalkerware +br.com.rastreadordenamorado|RastreadorDeNamorado|stalkerware +br.com.rastreadordenamorado|Unknown|stalkerware +br.com.sistema.aplicativo|MeuSpy|stalkerware +bv.vemzye|AndroidPolice|stalkerware +bv.vemzye|MonitorChecker|stalkerware +callerscreen.paper.ringshow|CallerPaper Show|spyware +city.russ.alltrackercorp|AllTracker|stalkerware +city.russ.alltrackerfamily|AllTracker|stalkerware +city.russ.alltrackerinstaller|AllTracker|stalkerware +cmf0.c3b5bm90zq.patch|Hoverwatch|stalkerware +cn.trackview.shentan|TrackView|stalkerware +com.AwamiSolution.smartkeylogger|Hiddad|stalkerware +com.AwamiSolution.smartkeylogger|SmartKeylogger|stalkerware +com.HalogenElement.Frame.TrainPhotoFrame|Train Photo Frame|spyware +com.Pixa.PhotoEditor.PicsArt.CollageMaker.Lightroom.PhotoLab.PixelLab.Pixlr|Pixa: Photo Editor & Collage Maker|spyware +com.USIB.Child.ChildControl|Mitbe|stalkerware +com.Videoeditortfs.pro|Video Editor 2021|spyware +com.abs.provideo_editor|Video Converter Master|spyware +com.accountable2you.ap1|Unknown|stalkerware +com.acetoon.studio.facephoto|Acetoon Photo Cartoon|spyware +com.addtextcoon.shapermoter|Photo Frame PIP Collage Maker|spyware +com.adonarusso.daily.horoscope|ZodiHoroscope - Fortune Finder|spyware +com.ads.optimization|Ad Optimization Meta|spyware +com.ads_manager_helper|Ads Manager Helper|spyware +com.adsagency.socialmng|Ad Manager For Social|spyware +com.afreesmstracker.app|AppSpy|stalkerware +com.agehohn.fpsgame.app|Agent John FPS Game|spyware +com.agpstracker.app|AppSpy|stalkerware +com.aif.tracksp|AiSpyer|stalkerware +com.aisistem.instalao|MeuSpy|stalkerware +com.aixlunro.uqfhkagb|AndroidPolice|stalkerware +com.aixlunro.uqfhkagb|KidLogger|stalkerware +com.aiyi.admin|Cocospy|stalkerware +com.ajygpxjy.bnthtjou|AndroidPolice|stalkerware +com.ajygpxjy.bnthtjou|Unknown|stalkerware +com.alienmanfc6.wheresmyandroid|WheresMyDroid|stalkerware +com.allsite.unlo|Unblocked Website|spyware +com.amazcam.apbest|Best Fun Cam|spyware +com.amazing.psychologyfacts|Psychology Facts|spyware +com.amon|AndroidPolice|stalkerware +com.amon|MonitorChecker|stalkerware +com.androdid.inteernet.aa21111227|MobileTrackerFree|stalkerware +com.android.core.mngi|Snoopza|stalkerware +com.android.core.mngj|Snoopza|stalkerware +com.android.core.mngk|Snoopza|stalkerware +com.android.core.mngl|Snoopza|stalkerware +com.android.core.mngn|Snoopza|stalkerware +com.android.core.mngo|Snoopza|stalkerware +com.android.core.mngp|Snoopza|stalkerware +com.android.core.mngq|Snoopza|stalkerware +com.android.core.mngr|Snoopza|stalkerware +com.android.core.mngs|Snoopza|stalkerware +com.android.core.mngt|Snoopza|stalkerware +com.android.core.mngu|Snoopza|stalkerware +com.android.core.mngv|Snoopza|stalkerware +com.android.core.mngw|Snoopza|stalkerware +com.android.core.mngx|Snoopza|stalkerware +com.android.core.mngy|Snoopza|stalkerware +com.android.core.mngz|Snoopza|stalkerware +com.android.core.mntah|Hoverwatch|stalkerware +com.android.core.mnta|Hoverwatch|stalkerware +com.android.core.mntb|Hoverwatch|stalkerware +com.android.core.mntd|Hoverwatch|stalkerware +com.android.core.mnte|Hoverwatch|stalkerware +com.android.core.mntf|Hoverwatch|stalkerware +com.android.core.mntg|Hoverwatch|stalkerware +com.android.core.mnth|Hoverwatch|stalkerware +com.android.core.mnti|Hoverwatch|stalkerware +com.android.core.mntj|Hoverwatch|stalkerware +com.android.core.mntk|Hoverwatch|stalkerware +com.android.core.mntl|Hoverwatch|stalkerware +com.android.core.mntm|Hoverwatch|stalkerware +com.android.core.mntn|Hoverwatch|stalkerware +com.android.core.mnto|Hoverwatch|stalkerware +com.android.core.mntp|Hoverwatch|stalkerware +com.android.core.mntq|Hoverwatch|stalkerware +com.android.core.mntr|Hoverwatch|stalkerware +com.android.core.mnts|Hoverwatch|stalkerware +com.android.core.mntt|Hoverwatch|stalkerware +com.android.core.mntu|Hoverwatch|stalkerware +com.android.core.mntv|Hoverwatch|stalkerware +com.android.core.mntw|Hoverwatch|stalkerware +com.android.core.mntx|Hoverwatch|stalkerware +com.android.core.mnty|Hoverwatch|stalkerware +com.android.core.mntz|Hoverwatch|stalkerware +com.android.core.mnt|Hoverwatch|stalkerware +com.android.core.monitor.debug|Hoverwatch|stalkerware +com.android.core.monitor.debug|Sync Service|stalkerware +com.android.core.monitor.null|Hoverwatch|stalkerware +com.android.core.monitornull|Hoverwatch|stalkerware +com.android.core.monitor|Hoverwatch|stalkerware +com.android.fystem.maps|AndroidPolice|stalkerware +com.android.fystem.maps|Kurulum|stalkerware +com.android.innovaspy|1TopSpy|stalkerware +com.android.innovaspy|HelloSpy|stalkerware +com.android.inputmethod.latinmy|AndroidPolice|stalkerware +com.android.inputmethod.latinmy|KidLogger|stalkerware +com.android.internet.a20200817|iKeyMonitor|stalkerware +com.android.internet.a20210916|iKeyMonitor|stalkerware +com.android.internet.a20220729|iKeyMonitor|stalkerware +com.android.internet.a20220829|iKeyMonitor|stalkerware +com.android.internet.a20220914|iKeyMonitor|stalkerware +com.android.keyboardhelper|celSpy|stalkerware +com.android.keyboardhelper|mSpy|stalkerware +com.android.omg|TheOneSpy|stalkerware +com.android.phone.dialer|FlexiSpy|stalkerware +com.android.preference.help.mole|BosSpy|stalkerware +com.android.preference.help.mole|Unknown|stalkerware +com.android.preference.voice|UPreferences|stalkerware +com.android.services|TheOneSpy|stalkerware +com.android.settings.app|OneMonitar|stalkerware +com.android.settings.app|OneSpy|stalkerware +com.android.system.app|OneMonitar|stalkerware +com.android.system.app|OneSpy|stalkerware +com.android.system.devicelogs|AppMia|stalkerware +com.android.system.devicelogs|com.android.devicelogs|stalkerware +com.android.system.maps|AndroidPolice|stalkerware +com.android.system.maps|Kurulum|stalkerware +com.android.system|System Service|stalkerware +com.android.wifi.tracker|Trackji|stalkerware +com.android.wifi.tracker|Unknown|stalkerware +com.androiddharmesh.editor|Cool Photo Editor|spyware +com.androiddharmesh.fashioncam|Cool Filter Editor|spyware +com.androidlost.smshandler|AndroidLost|stalkerware +com.androidlost|AndroidLost|stalkerware +com.anhhuy.adspagesmanager|Ads Pages Manager|spyware +com.anhhuy.ads|Ads & Page|spyware +com.ant.spymie.keylogger|Spymie|stalkerware +com.aphonetracker.app|AppSpy|stalkerware +com.app.audiorec|TrackMyPhones|stalkerware +com.app.call_rec_hidden|TrackMyPhones|stalkerware +com.app.com.app.com.app.aplintal|MeuSpy|stalkerware +com.app.good.constellationmaster|Constellation Master|spyware +com.app.insapp2|MeuSpy|stalkerware +com.app.keylogger|TrackMyPhones|stalkerware +com.app.recorder|TrackMyPhones|stalkerware +com.app.remote_control|TrackingSmartphone|stalkerware +com.app.remote_control|XZBO|stalkerware +com.app.spy_call_recorder|TrackMyPhones|stalkerware +com.app.videorec|TrackMyPhones|stalkerware +com.applock.easyuse.lock|AppLock-Lock Apps & Privacy Guard|spyware +com.apps.anti_theft|TrackMyPhones|stalkerware +com.apps.rct.CellTrackerActivity|TrackMyPhones|stalkerware +com.apspy.app|Copy9|stalkerware +com.apspy.app|TheTruthSpy|stalkerware +com.art.draw.SmoothPictureEditor|Smooth Picture Editor|spyware +com.artext.picshow|Text Camera|spyware +com.artoon.toonphoto|Artoon Photo Cartoon Creator|spyware +com.artpics.campro|Pics Art|spyware +com.as.clipboardmanager|AndroSpy|stalkerware +com.as.clipboardmanager|RealtimeSpy|stalkerware +com.as.facecapture|AndroSpy|stalkerware +com.as.facecapture|RealtimeSpy|stalkerware +com.as.gpstracker|AndroSpy|stalkerware +com.as.gpstracker|RealtimeSpy|stalkerware +com.as.keylogger2|AndroSpy|stalkerware +com.as.keylogger2|RealtimeSpy|stalkerware +com.as.keylogger|RealtimeSpy|stalkerware +com.as.klogger|AndroSpy|stalkerware +com.as.klogger|RealtimeSpy|stalkerware +com.as.screenrecorder|AndroSpy|stalkerware +com.as.screenrecorder|RealtimeSpy|stalkerware +com.as.urllogger|AndroSpy|stalkerware +com.as.urllogger|RealtimeSpy|stalkerware +com.ashtoon.tooncool.skordoi|Ashtoon Cartoon Editor|spyware +com.ass.antitheft|AbsoluTrack|stalkerware +com.ass.antitheft|RemoteSecurity|stalkerware +com.ass.ladieschildprotection|AbsoluTrack|stalkerware +com.ass.ladieschildprotection|RemoteSecurity|stalkerware +com.ass.remotesecurity|AbsoluTrack|stalkerware +com.ass.remotesecurity|RemoteSecurity|stalkerware +com.at.wwka|AndroidPolice|stalkerware +com.atharva.perfect.photoeffects|Perfect Photo Effects | Loop Photo Animator|spyware +com.ati.client|AndroidPolice|stalkerware +com.ati.client|Atic|stalkerware +com.ati.monitor|AndroidPolice|stalkerware +com.ati.monitor|Atic|stalkerware +com.ati.webwatcherconsole|AndroidPolice|stalkerware +com.ati.webwatcherconsole|Atic|stalkerware +com.atinc.slcompanion|AndroidPolice|stalkerware +com.atinc.slcompanion|Atic|stalkerware +com.atiw.wc|AndroidPolice|stalkerware +com.atiw.wc|Atic|stalkerware +com.atracker.app|AppSpy|stalkerware +com.autoforward.monitor|AutoForward|stalkerware +com.autoforward.monitor|HighsterMobile|stalkerware +com.avi.scbase|pcTattletale|stalkerware +com.awarenesstech.monitor|AndroidPolice|stalkerware +com.awarenesstech.monitor|Atic|stalkerware +com.awarenesstech.wwpapp|AndroidPolice|stalkerware +com.awarenesstechnologies.sideloadedws|AndroidPolice|stalkerware +com.awarenesstechnologies.sideloadedws|Atic|stalkerware +com.awti.slc|AndroidPolice|stalkerware +com.awti.slc|Atic|stalkerware +com.backup.tt|RealtimeSpy|stalkerware +com.backup.tt|ttspy|stalkerware +com.ballmaster.puzzle|Bomb Master 3D|spyware +com.beamuisclab.musicdownloader.song.mp3download.app|Free Music Downloader & Free Mp3 Downloader|spyware +com.beauty.selfcamera.perfect|Beauty Camera|spyware +com.beautycamera.plusfuny|Beauty Camera Plus|spyware +com.beautyeditor.bestphotoeditor|Photo Editor|spyware +com.beautymakeup.cameram|Beauty Makeup Camera|spyware +com.bestpuz.gams.artpics|Art Puzzle 2021|spyware +com.bettertomorrowapps.spyyourlovefree|CouplerTracker|stalkerware +com.biscoco.camfilter|Biscuit Coco Cam|spyware +com.bluee.gorme|Blue-shoot Game|spyware +com.blur.image.handle|Blur Photo|spyware +com.blut.shooting|Bluetouch Shooting Game|spyware +com.bnahrrbc.kwexsnhl|AndroidPolice|stalkerware +com.bnahrrbc.kwexsnhl|KidLogger|stalkerware +com.bobom.crashran.race|Ranger Crash Game|spyware +com.boo.bam.frvpn|Bamboo VPN|spyware +com.borderedit.cameraapp|Border Sticker Camera|spyware +com.brawsantoon.besteditor|Skintoon - Labs of Cartoon|spyware +com.brot.storage.work|Reptilicus|stalkerware +com.bul.b|AndroidPolice|stalkerware +com.bul.b|ControlPhone|stalkerware +com.bulgakov.bug|AndroidPolice|stalkerware +com.bulgakov.bug|ControlPhone|stalkerware +com.bulgakov.controlphone|AndroidPolice|stalkerware +com.businessplannerdesign|Business Planner Manage|spyware +com.bytepioneers.coupletracker|CouplerTracker|stalkerware +com.bzbqbkya.hgozttiu|AndroidPolice|stalkerware +com.bzbqbkya.hgozttiu|KidLogger|stalkerware +com.callhist.calltr|AndroidPolice|stalkerware +com.cam.io.cls|Classic filter camera|spyware +com.camepicin.libevent|PIP Camera 2022|spyware +com.camhart.netcountable|Unknown|stalkerware +com.candlesvpn.proxyss|Candles VPN|spyware +com.caniqiwa.perfectpuzzles|Perfect Puzzles|spyware +com.cartoons.photofacemaker|Photo editor PIP collage maker|spyware +com.caryshughes.toonprismaeffect|ToonPrisma - 3D Photo Effect|spyware +com.catrsy.jaluc|AndroidPolice|stalkerware +com.catrsy.jaluc|Gpspy|stalkerware +com.cellph.montrb|AndroidPolice|stalkerware +com.chaoqi.spyapp|AndroidPolice|stalkerware +com.chaoqi.spyapp|Unknown|stalkerware +com.charlottefabron.hdvideoplayer|HD Video Player with music|spyware +com.classic.beat.cam|BeautyCam|spyware +com.cldprotect|SpyHuman|stalkerware +com.client.requestlogs|ShadowSpy|stalkerware +com.cliffbradley.youtooncartooneffect|YouToon - AI Cartoon Effect|spyware +com.cocospy|Cocospy|stalkerware +com.colinread.playphooteditor|Play Phoot Editor & Collage|spyware +com.collageimage.photofilter|Photo Filter|spyware +com.connection.manager|Mrecorder|stalkerware +com.connection.manager|mobrec|stalkerware +com.contentwatch.ghoti.cp2.child|Unknown|stalkerware +com.coolcall.callshow|Color Call|spyware +com.coolcall.newspipcamera|Photo PIP Camera|spyware +com.craftstoon.cartoonphoto|Craftsart Cartoon Photo Tools|spyware +com.creatoonbest.faceedit|Creatoon Face Editor|spyware +com.creatorlena.vieds|Photo Video Editor:Lena Editor|spyware +com.crown.camera|Crown Camera|spyware +com.cryzp.leplluln|AndroidPolice|stalkerware +com.cryzp.leplluln|CellSpy|stalkerware +com.customcamare.ppcamera|Photo Pro 2021|spyware +com.cycle.start.mess|Reptilicus|stalkerware +com.d2p.ads_manager_plus|Ads Manager Plus|spyware +com.dahuadata.photomakerpip|Maker PIP Gallery|spyware +com.dashboardmanagemeta|Pages Dashboard|spyware +com.davykinsman.photoquipo.cartooneffect|Photoquipo Cartoon Pic Effect|spyware +com.day.flywallpaper|Flyingfish Wallpaper|spyware +com.dbzbpr.skt|AndroidPolice|stalkerware +com.dbzbpr.skt|Gpspy|stalkerware +com.ddhd.cameraadorn|CameraAdorn|spyware +com.ddhd.creatormould|CreatorMould|spyware +com.ddhd.photo.elegantimage|ElegantImage|spyware +com.ddiutilities.monitor|AutoForward|stalkerware +com.ddiutilities.monitor|HighsterMobile|stalkerware +com.deepwallpaper.hd.live|Deep Wallpaper-live,HD|spyware +com.dennisarmstrong.videolancervideomaker|Videolancer - Pro Video Maker|spyware +com.dev4playapps.whatsdeleted|TrackMyPhones|stalkerware +com.devspark.securityotp|SpySMS|stalkerware +com.devspark.securityotp|Unknown|stalkerware +com.dreammaker.phgridpip|PIP Collage Coco|spyware +com.dressing.charm.apps|Dress up Charming|spyware +com.droidwatcher|DroidWatcher|stalkerware +com.droidwatcher|Unknown|stalkerware +com.dromon|AndroidPolice|stalkerware +com.dromon|MonitorChecker|stalkerware +com.duiyun.cocospy.v2|Cocospy|stalkerware +com.duiyun.cocospy|Cocospy|stalkerware +com.duiyun.fonemonitor|Cocospy|stalkerware +com.duiyun.spyic|Cocospy|stalkerware +com.duiyun.spyine|Cocospy|stalkerware +com.duiyun.spyzie|Cocospy|stalkerware +com.dwyzb23xjiqpsn.zbqyuvfgtion|3 Patti King - India Rummy|spyware +com.dy.spyzie.v4|Cocospy|stalkerware +com.dypica.facepicture|Face Picture|spyware +com.dysfree.barcode.scanner|QR Barcode Scan|spyware +com.edgarmay.atecphotoeffect|Atec Sparkle Photo Editor 2022|spyware +com.editor.xinphoto|Enjoy Photo Editor|spyware +com.edmondatrentini.dingdingphotoeffect|Ding Ding Photo Effect Editor|spyware +com.elpatr.woac|AndroidPolice|stalkerware +com.elpatr.woac|Gpspy|stalkerware +com.epasufob.kybavfgt|Spyone|stalkerware +com.epbzrqcg.syzzkuqx|Spyone|stalkerware +com.epbzrqcg.syzzkuqx|Unknown|stalkerware +com.ernell.thht|AndroidPolice|stalkerware +com.ernell.thht|Gpspy|stalkerware +com.example.ghazi.sms|SpyAppGhazi|stalkerware +com.example.ghazi.sms|Unknown|stalkerware +com.example.hellospy|1TopSpy|stalkerware +com.example.hellospy|HelloSpy|stalkerware +com.example.lovespy.app|LoveSpy|stalkerware +com.example.lovespy.app|Unknown|stalkerware +com.example.openanotherapp|Spy24|stalkerware +com.example.reverseshell2|AndroRat|stalkerware +com.example.wosc.androidclient|CatWatchful|stalkerware +com.expto.akgarhwal.puzzlex|Art Photo Puzzle|spyware +com.eyezy.android|celSpy|stalkerware +com.eyezy.android|mSpy|stalkerware +com.eytewqrm.wvdkgmrl|Spyone|stalkerware +com.eytewqrm.wvdkgmrl|Unknown|stalkerware +com.fabiomancini.cartoonpainteffect|Cartoon Face Photo Editor|spyware +com.faceart.savetoon.cartoonedit|Savetoon Art - Face Cartoon|spyware +com.faceartoon.studioon|Facetoon Photo Art|spyware +com.fast.vpn.lifestyleb|Fast VPN Proxy|spyware +com.fb.ads.optimize|Ads Optimize|spyware +com.fb.metas.adsmanager|Ads Manager For Business|spyware +com.fbhpdsej.gnuebduy|AndroidPolice|stalkerware +com.fbhpdsej.gnuebduy|KidLogger|stalkerware +com.femimesusu.libapasopi|SpyApp|stalkerware +com.femimesusu.libapasopi|Unknown|stalkerware +com.fenced.ai|Fenced|stalkerware +com.fenced.ai|MobileSpyIo|stalkerware +com.fhekpqbq.otlzonjx|AndroidPolice|stalkerware +com.fhekpqbq.otlzonjx|TiSpy|stalkerware +com.fillartoon.toonphotos|Pica Artoon Face Editor|spyware +com.filmstrip.drawanima|Photo Layout Editor|spyware +com.filter.photoeditor|Instapic: Photo Editor Pro, Collage Maker|spyware +com.fimeruv.shapephotoeditor|Shape Photo Editor|spyware +com.fiwyl.sharephotomaker|Share Photo Maker|spyware +com.flnt.uck|Speedy Vpn Tunnel|spyware +com.floydhampton.moldishmansphotoeffect|Moldish - Men's Photo Editor|spyware +com.flyspeed.fish|FlyFish Speed|spyware +com.fone|Copy9|stalkerware +com.fone|TheTruthSpy|stalkerware +com.fonts.text.board|Stylist Fonts for Keyboard|spyware +com.fotspicass.makerpiccoa|PIP Editor Frame Photo|spyware +com.fp.backup|FlexiSpy|stalkerware +com.fqrs.qrscapp|Flash QRCode Scanner|spyware +com.free.unlimited.transcendvpn|Transcend VPN|spyware +com.free.vpn.masterproxy|Free VPN Master|spyware +com.freevpn.proxytubervpn|Tuber VPN - Free&Secure VPN Proxy Server|spyware +com.freevpn.proxytuber|Super Tuber VPN|spyware +com.fstl.vtnel|Fast Vpn Tunnel|spyware +com.fucol.puz|Photo Puzzle 2021|spyware +com.fun.herone.racegame|Lone Hero Racing|spyware +com.fysolasil.sharephotoeditor|Share Photo Editor|spyware +com.fzvsdrtb.qamlhxri|BrunoEspiao|stalkerware +com.fzvsdrtb.qamlhxri|Unknown|stalkerware +com.gadybatax.artsphotos|Arts Photos|spyware +com.gallery.provides|Art Filters:Photo to Painting|spyware +com.gamebooster.safegame|Game Booster|spyware +com.gcam.pvint|Vinto Cam|spyware +com.gcm_call_sms_tracker.updated|CallSMSTracker|stalkerware +com.gcm_call_sms_tracker.updated|TrackMyPhones|stalkerware +com.gcm_call_sms_tracker|TrackMyPhones|stalkerware +com.gcm_call_tracker|TrackMyPhones|stalkerware +com.gcm_celltracker|TrackMyPhones|stalkerware +com.genten.soulmatch|Emotion Checker|spyware +com.get.mtf|MobileTrackerFree|stalkerware +com.gh.ob|AndroidPolice|stalkerware +com.ghost.vpn.masterproxy|Ghost VPN Proxy|spyware +com.github.muneebwanee.dash|Dash|stalkerware +com.github.muneebwanee.dash|Unknown|stalkerware +com.gizmoquip.smstracker|CallSMSTracker|stalkerware +com.google.android.bacfup|AndroidPolice|stalkerware +com.google.android.bacfup|Kurulum|stalkerware +com.google.android.network|Buhsam|stalkerware +com.google.android.safe|AndroidPolice|stalkerware +com.google.android.safe|Kurulum|stalkerware +com.googleplay.settings|NetSpy|stalkerware +com.googlesettings.setting|1TopSpy|stalkerware +com.googlesettings.setting|HelloSpy|stalkerware +com.gpssettings.src.v65|Mobile Spy|stalkerware +com.gpstrian.phototrian|Train Photo|spyware +com.greatdata|AndroidPolice|stalkerware +com.greatdata|Gpspy|stalkerware +com.grigoriipeerevozchiikov.animephoto|Anime Photo|spyware +com.gss.whereismyphone|AbsoluTrack|stalkerware +com.gss.whereismyphone|RemoteSecurity|stalkerware +com.gtrid.edit.bingoemaker|Photo Editor Pic Collage|spyware +com.guest|System Service|stalkerware +com.guest|TheTruthSpy|stalkerware +com.gzomoyig.qwgawtaz|AndroidPolice|stalkerware +com.gzomoyig.qwgawtaz|KidLogger|stalkerware +com.hellospy.system|HelloSpy|stalkerware +com.hellospy.system|System Services|stalkerware +com.hellospy|1TopSpy|stalkerware +com.hellospy|HelloSpy|stalkerware +com.hiepro.hiynode|Hiyoo Hidenode pro|spyware +com.hiranursaygi.allinoneofficereader|All in one Doc Editor & Viewer|spyware +com.hn.dayblue|Fun Wallpaper|spyware +com.hotspot.vpn.freeproxy|Hotspot Free VPN|spyware +com.hp.vc|FreeAndroidSpy|stalkerware +com.hp.vd|FreeAndroidSpy|stalkerware +com.hqapps.ppp.wallpaper|Highquality Purple Wallpaper|spyware +com.hunbeiren.pipeditorimage|PIP Editor Image|spyware +com.hyadesinc.curiosus|Curiosus|stalkerware +com.hyadesinc.curiosus|Unknown|stalkerware +com.ibm.fb|AndroidMonitor|stalkerware +com.iceselfie.beautycamx|Ice Selfie Beauty Cam|spyware +com.iclaude.scheduledrecorder|Scheduled Recorder (spy recorder)|stalkerware +com.igyluazm.iytdhsky|AndroidPolice|stalkerware +com.igyluazm.iytdhsky|Unknown|stalkerware +com.image.move.puzzle|Image Move Puzzle|spyware +com.imonitor.ainfo|iMonitorSpy|stalkerware +com.instagram.app|Business from Instagram|spyware +com.interaction.wonderful|Wonderful Camera|spyware +com.ispyoo.traceyou|Copy9|stalkerware +com.ispyoo.traceyou|TheTruthSpy|stalkerware +com.ispyoo|System Service|stalkerware +com.ispyoo|TheTruthSpy|stalkerware +com.itqredn8dzrl|SpyLive360|stalkerware +com.ivorfrazier.orahororscope|Ora Horoscope - Fortune Finder|spyware +com.jgeuhcex.ejcxndak|Spyone|stalkerware +com.jgeuhcex.ejcxndak|Unknown|stalkerware +com.juzyuwqt.thxxnjvf|Spyone|stalkerware +com.jxpsnyy.kbvjdjx.dingdingphotoeffect|Ding Ding Photo Editor|spyware +com.jyotin.ct|MobileTrackerFree|stalkerware +com.kali.free.online.fast.translation|Instant Translator|spyware +com.kali_corporation.skethcamplus|Sketch CamPlus|spyware +com.kangaroo.vpnproxy|Kangaroo VPN|spyware +com.katarinalang.photocollage.room|Photoont - Photo Collage Edit|spyware +com.kfhdha.fkjfgjdi|EspiaoAndroid|stalkerware +com.kids.pro|ClevGuard|stalkerware +com.kids.whatsapp|ClevGuard|stalkerware +com.kidsmobmon|AndroidPolice|stalkerware +com.kotmob.palmistry|Palmistry Reading Free|spyware +com.kutsalkoyuncu.toonexphotoediotr|Toonex Photo Editor 2022|spyware +com.laucass.androsmscontrol|Spyone|stalkerware +com.laucass.phonecontrolenabler|Spyone|stalkerware +com.laucass.phonecontrolenabler|Unknown|stalkerware +com.laucass.phonecontroltarget|Spyone|stalkerware +com.laucass.phonecontroltarget|Unknown|stalkerware +com.leg.musclemaker.strong.man.getfit|Male fitness|spyware +com.leneroth.photocollagegridmaker|Pic Collage & Cartoon Editor|spyware +com.liannasoft.editorcam|4K Camera Hyper Photo Filters|spyware +com.liferun.freegame|Life Run|spyware +com.lightling.creatortoon.cartoon|Lighting Creator Toon|spyware +com.lightning.vpn.proxys|Lightning VPN|spyware +com.likefile.superfile|Files Clear|spyware +com.lilaihua.photoeditor|PhotoEditor|spyware +com.local_cell_tracker_updated|TrackMyPhones|stalkerware +com.local_cell_tracker|TrackMyPhones|stalkerware +com.lofacartoon.azwajstudio|Lofa - Studio Photo Cartoon|spyware +com.lrvciyti.unrxnfig|MobileTrackerFree|stalkerware +com.lsdroid.cerberus.client|Cerberus|stalkerware +com.lsdroid.cerberus.kids|Cerberus|stalkerware +com.lsdroid.cerberus.persona2|Cerberus|stalkerware +com.lsdroid.cerberus.persona|Cerberus|stalkerware +com.lsdroid.cerberuss|Cerberus|stalkerware +com.lsdroid.cerberus|Cerberus anti theft|stalkerware +com.lsdroid.cerberus|Cerberus|stalkerware +com.luckycatcher.freegame|Lucky Catcher - Catch Them All|spyware +com.lucpro.luckypro|Lucky Number Pro|spyware +com.lujeqari.videoremaker|Video Remaker|spyware +com.m.service.control|MobileTrackerFree|stalkerware +com.madtoon.aicartoon.kiroah|MadToon Face Cartoon|spyware +com.magic.world.daily.mhoroscope|Magic Horoscope|spyware +com.mango.findmyphone2|AndroidPolice|stalkerware +com.mango.findmyphone2|InMobi|stalkerware +com.mango.findmyphone3|AndroidPolice|stalkerware +com.mango.findmyphone|AndroidPolice|stalkerware +com.map.system|XNSpy|stalkerware +com.marcyl.wagbversion.gblatest.gbproversion.lite|GB WA Warna Latest Version|spyware +com.masto.kicter|Free Comic Photos|spyware +com.maxinetate.jessicabailey.fosterphotoeffect|Foster - Cartoon Photo Effect|spyware +com.maxxspy.system|1TopSpy|stalkerware +com.maxxspy.system|HelloSpy|stalkerware +com.maxxspy|1TopSpy|stalkerware +com.maxxspy|HelloSpy|stalkerware +com.merkee.neosnap.photo.editor.pro|NeoSnap Photo Editor|spyware +com.meta.adsformeta2|Business Ads for Meta|spyware +com.meta.adsformeta3|Business Meta Manager|spyware +com.meta.optimizer|Meta Optimizer - Ads Analysis|spyware +com.metasploit.stage|Metasploit|stalkerware +com.meteor.fast.connection|Meteor vpn|spyware +com.meuspy|MeuSpy|stalkerware +com.mexsier.nebwallpaper|Nebula Wallpaper|spyware +com.microsoft.familysafety|Unknown|stalkerware +com.milohoward.rosalindvega.theobarber.photoframeeffecteditor|Photo Editor - Frame Effect|spyware +com.minspy.v2|Cocospy|stalkerware +com.minspy.v3|Cocospy|stalkerware +com.mit.networkadapter|VIPTrack|stalkerware +com.mit.viptrackpro|VIPTrack|stalkerware +com.mkce.fsvc|Full Screen Video Editor|spyware +com.mnbeautif.lanchmn|Nice Photo|spyware +com.mnwkvijy.wzyxgrft|AndroidPolice|stalkerware +com.mnwkvijy.wzyxgrft|KidLogger|stalkerware +com.mob.service.control|MobileTrackerFree|stalkerware +com.mobiispy.system|1TopSpy|stalkerware +com.mobiispy.system|HelloSpy|stalkerware +com.mobiispy|1TopSpy|stalkerware +com.mobiispy|HelloSpy|stalkerware +com.mobile.asgard|GPSTrackerLoki|stalkerware +com.mobile.gps|MobileTrackerFree|stalkerware +com.mobile.loc|MobileTrackerFree|stalkerware +com.mobile.loki|GPSTrackerLoki|stalkerware +com.mobilefindfree|AppSpy|stalkerware +com.mobileservice.sync|Mrecorder|stalkerware +com.mobileservice.sync|mobrec|stalkerware +com.mobileservices2.synchronization|Mrecorder|stalkerware +com.mobileservices2.synchronization|mobrec|stalkerware +com.mobilespy.io|Fenced|stalkerware +com.mobilespy.io|MobileSpyIo|stalkerware +com.mobiletrackerfree.secondapp|MobileTrackerFree|stalkerware +com.mobiletrackerfree.www|MobileTrackerFree|stalkerware +com.mobiletracker|MobileTrackerFree|stalkerware +com.mobitra.todv|AndroidPolice|stalkerware +com.mobitra.todv|Gpspy|stalkerware +com.mobphn.monit|AndroidPolice|stalkerware +com.mobtr.danbel|AndroidPolice|stalkerware +com.mobtr.danbel|Gpspy|stalkerware +com.moker.sticker|Sticker Maker Pro|spyware +com.mold.figure.gym|Mold Figure Gym|spyware +com.monitor.phone.s0ft.phonemonitor|PhoneMonitor|stalkerware +com.monitor.phone.s0ft.phonemonitor|Unknown|stalkerware +com.monitorchecker|AndroidPolice|stalkerware +com.monitorchecker|MonitorChecker|stalkerware +com.monspap.alarm|EasyPhoneTrack|stalkerware +com.mood.camerapluss|Mood Camera|spyware +com.mophtr.td|AndroidPolice|stalkerware +com.mophtr.td|Gpspy|stalkerware +com.mosiaguda.astrohoroscope|Astro Horoscope Guide 2022|spyware +com.moxlndmp.uhzhgzjh|BrunoEspiao|stalkerware +com.moxlndmp.uhzhgzjh|Unknown|stalkerware +com.mrblue.setting|1TopSpy|stalkerware +com.mrblue.setting|HelloSpy|stalkerware +com.mrbluetooth.setting|1TopSpy|stalkerware +com.mrbluetooth.setting|HelloSpy|stalkerware +com.mrecorder.callrecorder|Mrecorder|stalkerware +com.mrecorder.callrecorder|mobrec|stalkerware +com.mrtred.setred|1TopSpy|stalkerware +com.mrtred.setred|HelloSpy|stalkerware +com.mspy.lite|mSpy|stalkerware +com.mtf.download|MobileTrackerFree / MonitorLoverman / MTrack / CellTracker / TrackMobil|stalkerware +com.mtf.download|MobileTrackerFree|stalkerware +com.mtf.d|MobileTrackerFree|stalkerware +com.mumu.music.mmp|MuMus Music Player|spyware +com.mxspy|System Service|stalkerware +com.mxspy|TheTruthSpy|stalkerware +com.my.spy.app|MySpyApps|stalkerware +com.my.spy.app|Unknown|stalkerware +com.myappspqwddeexo|SpyHuman|stalkerware +com.netowrk.service|MobileTrackerFree|stalkerware +com.newsandpic.cityphoto|Photo PIP 2022|spyware +com.nhevvtmt.thinkquo|BrunoEspiao|stalkerware +com.niceimg.editorsa|Camera PIP|spyware +com.nsmon.guard|NeoSpy|stalkerware +com.ntckdlhc.oifhnjwp|AndroidPolice|stalkerware +com.ntckdlhc.oifhnjwp|KidLogger|stalkerware +com.nuclearpower.vpnp|Nuclear VPN Proxy|spyware +com.okenyo.creatkartoon.studio|Okenyo Studio Creatoon|spyware +com.oknia.panacamera|Pana Camera|spyware +com.olfitness.android|Daily Fitness OL|spyware +com.onlansuyanto.editor.bading|Onlan Cartoon Editor|spyware +com.oransoda.player.soda|Soda Music Player|spyware +com.ots.antitheft|AbsoluTrack|stalkerware +com.ots.antitheft|RemoteSecurity|stalkerware +com.ots.ladieschildprotection|AbsoluTrack|stalkerware +com.ots.ladieschildprotection|RemoteSecurity|stalkerware +com.ots.remotesecurity|AbsoluTrack|stalkerware +com.ots.remotesecurity|RemoteSecurity|stalkerware +com.ots.womenchildsafety|AbsoluTrack|stalkerware +com.ots.womenchildsafety|RemoteSecurity|stalkerware +com.ownspy.android|OwnSpy|stalkerware +com.palmistry.ofdestiny|Palmistry of Destiny|spyware +com.panspy.android|PanSpy|stalkerware +com.papalai.popularemoji|Popular Emoji|spyware +com.pedomeste.steppedometer|Hot Sexy Girls|spyware +com.perfectphoto.lookablum|Perfect Photo Album|spyware +com.peweephotoon.halfcartoon|Pewee Photoon - Photo Cartoon|spyware +com.phabanner.cameraig|Photo PIP|spyware +com.phone.tracker.smsb|AndroidPolice|stalkerware +com.phonepad.sniper|Critical Strike Ops - FPS 3D shooting Game|spyware +com.phonepad.towerdefense|Tower Defense Zone - Batmen Rush|spyware +com.phonespector.app|AutoForward|stalkerware +com.phonespector.app|HighsterMobile|stalkerware +com.phonetrackerofficial1|SpyphoneMobileTracker|stalkerware +com.phonetrackerofficial|SpyphoneMobileTracker|stalkerware +com.photo.adjuster|Simple Photo Adjuster|spyware +com.photo.blureffect|Blur Effect Camera|spyware +com.photo.move|Photo Gaming Puzzle|spyware +com.photo.panoramacamera|Panorama Camera|spyware +com.photoeditor.pipcamera.photoeffects|Pip Camera 2022|spyware +com.photoeditor.proy|Photo editor Pro|spyware +com.photoeditor.sweetsummer|Sweet Summer Camera App|spyware +com.photoeditoreffect.mojung|Abrasive Photo Editor|spyware +com.photolupo.pipwall|Photo Editors|spyware +com.photoplaze.rainbow.color|Rainbow Photo Plaze|spyware +com.photosticker.camerayou|Photo Sticker&Camera:make you beauty|spyware +com.phtranlo.tifach|AndroidPolice|stalkerware +com.phtranlo.tifach|Gpspy|stalkerware +com.piccollage.imageeditors|Pic collage: photo editor&beauty image|spyware +com.piclibra.apiceditor|Camera PIP Editor|spyware +com.pip.photo.editor.camera.pipimage.maker|PIP Pic Camera Photo Editor|spyware +com.piphoto.pipsapp|PIP Photo|spyware +com.pipnames.gocamera|PIP Editor Collage|spyware +com.play.services|uMobix|stalkerware +com.playapp.arteffect.app|ToonArt|spyware +com.playrix.manormatter|Treasures of the Pharaoh|spyware +com.plugiedit.editandimg|PIP Pic Camera Photo Editor|spyware +com.popo.analyse|PhoneSpy|stalkerware +com.popo.analyse|Unknown|stalkerware +com.postergrid.resdecypic|Photo Collage Maker Pic|spyware +com.pped.topcam|Perfect Photo Editor|spyware +com.prettysmart.easyuse.powerlock|Smart AppLock|spyware +com.privacyapp.applocker.coolock|Cool Lock|spyware +com.probit.flare|Unknown|stalkerware +com.prophoto.editor|1TopSpy|stalkerware +com.prophoto.editor|HelloSpy|stalkerware +com.protect.download|MobileTrackerFree|stalkerware +com.protect|AndroidPolice|stalkerware +com.protect|KidLogger|stalkerware +com.psac.a.processservice|MobiSpy|stalkerware +com.pser.sysutils|AndroidPolice|stalkerware +com.pser.sysutils|CellSpy|stalkerware +com.pt.bark|bark|stalkerware +com.pulse.leftstrong.app|Pulse Music Player|spyware +com.pumpkinvpn.proxysafen|Pumpkin VPN|spyware +com.punk.data.transmission|Punk Vpn|spyware +com.purevpn.secure.intenetproxy|Pure-VPN:Fast Stable Secure internet Proxy|spyware +com.pvojpamt.tzzyqjyb|PhoneMonitor|stalkerware +com.quality.famous.deep|Deep Art Effects|spyware +com.qwertyuiop.asdfghjkl|OneSpy|stalkerware +com.qzogle.android.jacfut|AndroidPolice|stalkerware +com.qzogle.android.jacfut|Kurulum|stalkerware +com.qzogle.xndroid.jacfup|AndroidPolice|stalkerware +com.qzogle.xndroid.jacfup|Kurulum|stalkerware +com.qzogle.xndroid.jacfut|AndroidPolice|stalkerware +com.qzogle.xndroid.jacfut|Kurulum|stalkerware +com.rana_aditya.child|Spyzier|stalkerware +com.rana_aditya.child|Unknown|stalkerware +com.realdrive.dreamgame|Real Driving|spyware +com.realtime.spyapp|RealtimeSpy|stalkerware +com.realtime.spyapp|Unknown|stalkerware +com.rebekkadreyer.facecartooneffect.photoeditor|Papatoon Face Art Editor|spyware +com.remote.app|Unknown|stalkerware +com.remote.app|XploitSPY|stalkerware +com.renanespic.addpici|Camera Photo Editor|spyware +com.rephko.stha|AndroidPolice|stalkerware +com.rephko.stha|Gpspy|stalkerware +com.retina.phonesheriff|PhoneSheriff|stalkerware +com.retina21.ms41|PhoneSheriff|stalkerware +com.retina22.ms6|PhoneSheriff|stalkerware +com.retinasoft.ephonetracker|PhoneSheriff|stalkerware +com.retmagic.piplike|PIP Magic 2022|spyware +com.rextate.photovideomaker|Photo Video Creator with Music|spyware +com.ring.alarm.tone.flash|Pop Ringtone|spyware +com.rismas.tdaycam|Christmas Sticker Camera App|spyware +com.rnapp.fmfm|Ads Manager for Meta|spyware +com.roc.ketcon|Rocket Connect|spyware +com.rspl15.nanny.android|PhoneSheriff|stalkerware +com.rspl16.nanny.android|PhoneSheriff|stalkerware +com.rspl17.nanny.android|PhoneSheriff|stalkerware +com.rspl18.nanny.android|PhoneSheriff|stalkerware +com.rspl19.nanny.android|PhoneSheriff|stalkerware +com.rspl20.nanny.android|PhoneSheriff|stalkerware +com.rspl21.nanny.android|PhoneSheriff|stalkerware +com.rspl22.retinaspy|PhoneSheriff|stalkerware +com.runaki.synclogs|ShadowSpy|stalkerware +com.rushcar.hypergame|Rush Car 3D|spyware +com.rushhour.hyperovertake|Rush Hour 3D - Heavy Traffic|spyware +com.rynama.videoeditor|Video Editor|spyware +com.s2m.seas|AndroidPolice|stalkerware +com.s2m.seas|Gpspy|stalkerware +com.s2m|AndroidPolice|stalkerware +com.s2m|Gpspy|stalkerware +com.sa.app|SpyAdvice|stalkerware +com.safe.fast.connect|Safe Link|spyware +com.safesecureservice|Secure Service|stalkerware +com.safesecureservice|SpyHuman|stalkerware +com.saloomughal.spyapp|BlurSpy|stalkerware +com.sap4mobile|AndroidPolice|stalkerware +com.sap4mobile|Gpspy|stalkerware +com.saprontsevgertrud.cartoonillustrator|Cartoon Illustrator|spyware +com.satan.gifpipo|PIPO GIF|spyware +com.saxfamqvxj|SpyHuman|stalkerware +com.sc.cocospy.v2|Cocospy|stalkerware +com.sc.fonemonitor.v2|Cocospy|stalkerware +com.sc.fonemonitor|Cocospy|stalkerware +com.sc.minspy.v2|Cocospy|stalkerware +com.sc.neatspy.v2|Cocospy|stalkerware +com.sc.safespy.v2|Cocospy|stalkerware +com.sc.safespy.v3|Cocospy|stalkerware +com.sc.spyic.v2|Cocospy|stalkerware +com.sc.spyic.v3|Cocospy|stalkerware +com.sc.spyier.v2|Cocospy|stalkerware +com.sc.spyier.v2|Spyier|stalkerware +com.sc.spyine.v2|Cocospy|stalkerware +com.sc.spyzie.v2|Cocospy|stalkerware +com.sc.teensafe.v2|Cocospy|stalkerware +com.screentime|AndroidPolice|stalkerware +com.sec.android.internet.im.service.im20190118|iKeyMonitor|stalkerware +com.sec.android.internet.im.service.im20190419|iKeyMonitor|stalkerware +com.sec.android.internet.im.service.im20210815|iKeyMonitor|stalkerware +com.sec.android.internet.service.ik|Internet Service|stalkerware +com.sec.provider.mobile.android|MonitorUltra|stalkerware +com.sec.provider.mobile.android|Unknown|stalkerware +com.secsurf.fastvpn|Surf Vpn|spyware +com.seelad.mucxx.apo|Sealand Music Player|spyware +com.selgdg.febgdsra|AndroidPolice|stalkerware +com.selgdg.febgdsra|KidLogger|stalkerware +com.selgdg.mardsdaf|AndroidPolice|stalkerware +com.selgdg.mardsdaf|KidLogger|stalkerware +com.semantic.childcontrol|SpyMasterPro|stalkerware +com.sensitivity.swarmphoto|Swarm Photo|spyware +com.sepfsp.jasend|AndroidPolice|stalkerware +com.sepfsp.jasend|KidLogger|stalkerware +com.service.mug|SpyMug|stalkerware +com.services.phone|MobileTrackerFree|stalkerware +com.servotronicstech.perfectprocam|Perfect ProCam|spyware +com.sev.android.systemdev|AndroidPolice|stalkerware +com.sev.android.systemdev|CellSpy|stalkerware +com.shadow.client.android|ShadowSpy|stalkerware +com.shadyspy.monitor|ShadySpy|stalkerware +com.shadyspy.monitor|Unknown|stalkerware +com.sheilacoleman.fissioneffectdoeditor|Fission Effectdo Pic Editor|spyware +com.shinestar.camerax|ShineStar Camera|spyware +com.shirleypope.lightexposureedit|Light Exposure Photo Editor|spyware +com.sketchmaster.camplus|Cartoon Cam Pro|spyware +com.sl360|SpyLive360|stalkerware +com.slftz.xlzg|High HD Wallpapers 4K|spyware +com.slidingpuzzle.slidepuzzle|Amazing Photo Puzzle|spyware +com.smart.guardoffline|AbsoluTrack|stalkerware +com.smart.guardoffline|RemoteSecurity|stalkerware +com.smartback|AndroidPolice|stalkerware +com.smartback|Gpspy|stalkerware +com.smart|AndroidPolice|stalkerware +com.smart|Gpspy|stalkerware +com.sms.mms.message.ffei.free|Smart SMS Messages|spyware +com.smstra.xanris|AndroidPolice|stalkerware +com.smstra.xanris|Gpspy|stalkerware +com.snapcamera.beautyys|Snap Beauty Camera|spyware +com.snapch.monabcab|EasyPhoneTrack|stalkerware +com.snapchat.trmonap|EasyPhoneTrack|stalkerware +com.snapeditor.proproxy|Snap Editor Pro|spyware +com.snapface.sticker.camera|Snap Face Camera|spyware +com.snapsandwich.camera|Sandwich SnapBeauty Cam|spyware +com.sofapro.editortoon|Sofa Cartoon - Pro Editor|spyware +com.softalogy.thiefguard|AbsoluTrack|stalkerware +com.softalogy.thiefguard|RemoteSecurity|stalkerware +com.soh|TrackMyPhones|stalkerware +com.solupho.imdetail|PIP 2022|spyware +com.spappm_mondow.alarm|Backup|stalkerware +com.spappm_mondow.alarm|EasyPhoneTrack|stalkerware +com.spappm_mondow.alarm|SpyPhoneApp|stalkerware +com.spapptrakapp.alarm|SpyPhoneApp|stalkerware +com.spatrakappp.alarm|SpyPhoneApp|stalkerware +com.spedgame.dsrg|Drift Speed Racing Game|spyware +com.speed.booster.phonefree|Speed Booster|spyware +com.splicteout.photocolleger|SplitScreen PIP|spyware +com.spy2mobile.light|AndroidPolice|stalkerware +com.spy2mobile.light|Data Backup|stalkerware +com.spy2mobile|AndroidPolice|stalkerware +com.spy2mobile|Gpspy|stalkerware +com.spyapp247.system|SpyApp247|stalkerware +com.spyhumanrev|SpyHuman|stalkerware +com.spyic|Cocospy|stalkerware +com.spynote.software.stubspynote|Scream|stalkerware +com.spynote.software.stubspynote|SpyNote|stalkerware +com.spytoapp.system|SpyToApp|stalkerware +com.spytoapp.system|SystemTask!|stalkerware +com.spyzee|Copy9|stalkerware +com.spyzee|TheTruthSpy|stalkerware +com.sqlengphoto.photoeditorpicmix|PicMix Photo Editor|spyware +com.ssurebrec|Cerberus anti theft|stalkerware +com.ssurebrec|Cerberus|stalkerware +com.star.line.link|Star Line|spyware +com.stillcut.spiraeffect|PIP PHOTO|spyware +com.stmrsa.htxt|AndroidPolice|stalkerware +com.stmrsa.htxt|Gpspy|stalkerware +com.su.per.video|Pvideo|spyware +com.superior.speed.data|Superior Speed|spyware +com.surebrec|Cerberus|stalkerware +com.surfvpn.proxyfast|SurfVPN - Fast VPN Proxy|spyware +com.svpnproxy.free|S-VPN Proxy|spyware +com.svpnproxy.safeclient|S VPN - Fast & Safe VPN Client|spyware +com.sweet.lightlycamera|Lightly Camera|spyware +com.sweetcamera.filterface|Sweet Beauty Plus Camera|spyware +com.sweetsnap.camera.sticker|Beauty Sweet Camera|spyware +com.system.settings|Observer|stalkerware +com.system.settings|Unknown|stalkerware +com.system.task|XNSpy|stalkerware +com.system.user|uMobix|stalkerware +com.systemservice|Copy9|stalkerware +com.systemservice|TheTruthSpy|stalkerware +com.tag.viptrack|VIPTrack|stalkerware +com.tbn.fasts|Speedy Turbo|spyware +com.tbntxear.vfmkjxme|AndroidPolice|stalkerware +com.tbntxear.vfmkjxme|KidLogger|stalkerware +com.tccplos.spth|AndroidPolice|stalkerware +com.tccplos.spth|Gpspy|stalkerware +com.techno.photoposterframe|Fantastic camera|spyware +com.telephony.android|FlexiSpy|stalkerware +com.tentwheel.flyingphoto|Flying Photo|spyware +com.tevi.walpi|AndroidPolice|stalkerware +com.tevi.walpi|Gpspy|stalkerware +com.thaxygpc.xjsjobpn|BrunoEspiao|stalkerware +com.thecybernanny.andapp|Reptilicus|stalkerware +com.theme.cartoon.board.key|Cartoon Keyboard Theme|spyware +com.thetruth|Copy9|stalkerware +com.thetruth|TheTruthSpy|stalkerware +com.thewispy|TheWiSpy|stalkerware +com.thewispy|Unknown|stalkerware +com.threetranslator.wonderas|Translation Assistant|spyware +com.timeon.litclient|Unknown|stalkerware +com.tools.secretcamcorder|SecretCamRecorder|stalkerware +com.topspy.system|HelloSpy|stalkerware +com.topspy.system|System Services|stalkerware +com.topspy|1TopSpy|stalkerware +com.topspy|HelloSpy|stalkerware +com.torrent.fast.exchange|Torrent|spyware +com.touchvpn.free.proxy|Torch VPN Proxy|spyware +com.touchvpn.proxymaster|Touch VPN Master|spyware +com.tracker.sms.mobile|AndroidPolice|stalkerware +com.trackerapps.whatsaptracker|TrackMyPhones|stalkerware +com.tracking_smartphone|TrackingSmartphone|stalkerware +com.tracking_smartphone|XZBO|stalkerware +com.trackmyphone_pro|TrackMyPhones|stalkerware +com.trackmyphones.livefamilytracker|TrackMyPhones|stalkerware +com.trackmyphones.recoverphoneusingchatmessages|TrackMyPhones|stalkerware +com.trackmyphones.tmpusingchatmessages|TrackMyPhones|stalkerware +com.trackview|TrackView|stalkerware +com.trackzone.kids|AndroidPolice|stalkerware +com.traffictour.freegame|Traffic Tour 3D|spyware +com.trandmon.tool|AndroidPolice|stalkerware +com.trixgardner.photazophotoeffect|Photazo - PIP & Cartoon Effect|spyware +com.trphwhat.prob|AndroidPolice|stalkerware +com.truing.motopoolparty|MotoM3X-PoolParty|spyware +com.ts_settings|TrackingSmartphone|stalkerware +com.ts_settings|XZBO|stalkerware +com.ttsapp.catchcheating|TheTruthSpy|stalkerware +com.tuber.vpnproxy.internet|Tuber VPN Proxy|spyware +com.tubevpn.master.free|Tubo VPN Master|spyware +com.tuner.funnelwebview|uMobix|stalkerware +com.turbo.data.transmission|Secure Turbo|spyware +com.tutorial.instalao|MeuSpy|stalkerware +com.ubo.tnspeed|Turbo Net|spyware +com.udxlbuno.plwnnhop|AndroidPolice|stalkerware +com.udxlbuno.plwnnhop|Unknown|stalkerware +com.unlimited.net.request|Unlimited Net|spyware +com.uxgbipup.pdtvcgzc|AndroidPolice|stalkerware +com.uxgbipup.pdtvcgzc|KidLogger|stalkerware +com.uzoifhzk.qmqnpwaf|AndroidPolice|stalkerware +com.uzoifhzk.qmqnpwaf|KidLogger|stalkerware +com.v2.fast.free.rocketvpn|VPN Lite - Fast & Easy use VPN|spyware +com.vendertext.onphoto|Vender Add Text on Photo|spyware +com.viewcalls.rem|AndroidPolice|stalkerware +com.viewsms.remb|AndroidPolice|stalkerware +com.virgovpn.proxyy|Virgo VPN|spyware +com.virsys.tracker|1TopSpy|stalkerware +com.virsys.tracker|HelloSpy|stalkerware +com.vivavpnbooster.free|Viva VPN Booster|spyware +com.vivid.coltor|Vivid Cooleditor|spyware +com.voicechanger.soundseffect|Voice Changer|spyware +com.vpn.proxy.unlimited|Private VPN HD|spyware +com.vvt.android.syncmanager|FlexiSpy|stalkerware +com.w0f0|SpyLive360|stalkerware +com.w1f1|SpyLive360|stalkerware +com.wSpyEra|SpyEra|stalkerware +com.wallpaper4k.tools|4K Wallpaper|spyware +com.wanstep.likekeepstep|Keep Step|spyware +com.waxwell.saunders.pistaphotoeditor|Pista - Cartoon Photo Effect|spyware +com.waynecraig.magicalastrology|Magical Daily Astrology Reader|spyware +com.wb.production|Cocospy|stalkerware +com.whddhd.brilliantphoto|Brilliant Photo|spyware +com.whddhd.fancyphoto|FancyPhoto|spyware +com.whddhd.pixeditor|PixEditor|spyware +com.whtrack.monit|AndroidPolice|stalkerware +com.wifi0|SpyLive360|stalkerware +com.wifiset.service|HelloSpy|stalkerware +com.wifiset.service|Wi-Fi Settings|stalkerware +com.wifisettings.service|1TopSpy|stalkerware +com.wifisettings.service|HelloSpy|stalkerware +com.willowpena.fiestraphotoeditor|Piestra - Comic & Blend Effect|spyware +com.wilmaarnold.kutsalsaglik|Smart PDF Reader and Editor|spyware +com.wisemo.host.v10|WiseMo|stalkerware +com.wisemo.wsmguest.v18|Unknown|stalkerware +com.wisemo.wsmguest.v18|WiseMo|stalkerware +com.wlset.info|PhoneSpy|stalkerware +com.wlset.info|Unknown|stalkerware +com.woman.sport.Female.fitness.net|Female Fitness|spyware +com.workout.play.goal.fitness|Workout Pro|spyware +com.ws.scli|Cocospy|stalkerware +com.ws.sc|Cocospy|stalkerware +com.ws.sc|System Update Service|stalkerware +com.wtspy.apps|WtSpy|stalkerware +com.ww.companion|AndroidPolice|stalkerware +com.ww.companion|Atic|stalkerware +com.wwtspy|WtSpy|stalkerware +com.wwxd.toolkit|Toolkit|spyware +com.wzogle.zndroid.yacfup|AndroidPolice|stalkerware +com.wzogle.zndroid.yacfup|Kurulum|stalkerware +com.xcar.highwayrace.ds|Xcar Highway Race|spyware +com.xevaphoto.cartoonion|Xeva Photo Cartoon|spyware +com.xhunter.client|Unknown|stalkerware +com.xhunter.client|xHunter|stalkerware +com.xingx.gifimage|GIFs-Search Animated GIF & Stickers|spyware +com.xinx.apls|2021 MagicCamPlus|spyware +com.xinxin.anjoyartphoto|Enjoy Art Photo|spyware +com.xno.systemservice|Xnore|stalkerware +com.xnspy.dashboard|XNSpy|stalkerware +com.xonasounds.relaxing|Xona Relaxing Sounds|spyware +com.xooil.elzup|MAGIC PHOTO PUZZLE|spyware +com.young.photoeditor.cartooneditorapp|Cartoon Effects Photo Editor|spyware +com.yunlinan.photoeditorwall|Photo Editor Wall|spyware +com.yurpdpvxnybmlgh|SpyHuman|stalkerware +com.yvpnproxy.freemaster|Y VPN Master|spyware +com.zkftwsel.fqnoquuv|AndroidPolice|stalkerware +com.zkftwsel.fqnoquuv|KidLogger|stalkerware +com.zoomate.vpn.proxy.free|ZooMate VPN Proxy|spyware +core.framework|celSpy|stalkerware +core.framework|mSpy|stalkerware +core.update.framework|celSpy|stalkerware +core.update.framework|mSpy|stalkerware +crash.vila.touch.game|Vilatouch crash game|spyware +crash.vltcar.fungame.app|Vilatouch crash car|spyware +cybrook.trackview|TrackView|stalkerware +dell.scream.application|Scream|stalkerware +dell.scream.application|SpyNote|stalkerware +edu.virginia.cs.cs4720.ispy|ISpy|stalkerware +edu.virginia.cs.cs4720.ispy|Unknown|stalkerware +efexmsz.mzuooelftl|AndroidPolice|stalkerware +efexmsz.mzuooelftl|MonitorChecker / AndrMonitor / AndroidMon / Dromon|stalkerware +efexmsz.mzuooelftl|MonitorChecker|stalkerware +fka.ugsonrqogw|AndroidPolice|stalkerware +fod.loqpf|AndroidPolice|stalkerware +fod.loqpf|MonitorChecker|stalkerware +fpsgame.olshooter.threed.app|Online Shooter FPS|spyware +free.music.download.search.mp3.song.online.player|Free Music Downloader & Music Player|spyware +ftp.bomcarcing.crashcars|Crash Racing Game|spyware +ftp.camfilter.lovebeauty|Beauty Camera Filter|spyware +ftp.firattck.fpsgame|Action Flame FPS|spyware +ftp.piaoyi.racegames|Drift Sprint Racing Game|spyware +ftp.raceranger.gamepp|CityRanger Racing Game|spyware +funcam.fredonm.app|Thefun Camera|spyware +g.google.llc|MobileTrackerFree|stalkerware +game.deserthuting.app|Desert Hunting Game|spyware +game.trytospin.nipsotyrtll|Try to spin|spyware +googlesettings.setting|1TopSpy|stalkerware +googlesettings.setting|HelloSpy|stalkerware +ifk.ghumlh|AndroidPolice|stalkerware +ifk.ghumlh|MonitorChecker|stalkerware +iiw.orqjtwbkx|AndroidPolice|stalkerware +iiw.orqjtwbkx|MonitorChecker / AndrMonitor / AndroidMon / Dromon|stalkerware +iiw.orqjtwbkx|MonitorChecker|stalkerware +in.servidor.service|MeuSpy|stalkerware +in.spyapp.patanjali.android|PatanSpyApp|stalkerware +in.spyapp.patanjali.android|Unknown|stalkerware +inc.imonitor|iMonitorSpy|stalkerware +iqual.calculadora.pro|SpyMasterPro|stalkerware +ir.spy24.updater|Spy24|stalkerware +ir.spy24.wifi|Spy24|stalkerware +kenkbltcf.pwpwkvdwmjk|AndroidPolice|stalkerware +kenkbltcf.pwpwkvdwmjk|MonitorChecker|stalkerware +lookOut.Secure|MobiStealth|stalkerware +lunarzodiacg.besthoro|Lunar Zodiac Horoscope|spyware +m.mob.control|MobileTrackerFree|stalkerware +m.mob.service2020|MobileTrackerFree|stalkerware +m.mobile.control|SpyHuman|stalkerware +m.phone.control2020|MobileTrackerFree|stalkerware +m.protect.children|MobileTrackerFree|stalkerware +m.protect.parental|MobileTrackerFree|stalkerware +m.secu.children|MobileTrackerFree|stalkerware +m.security.parental|MobileTrackerFree|stalkerware +me.hawkshaw|AndroidSpyApp|stalkerware +me.hawkshaw|Unknown|stalkerware +med.mspy.mspy|celSpy|stalkerware +med.mspy.mspy|mSpy|stalkerware +media.callshow.vc.flash|Callshow Flash|spyware +media.grape.sdhnt.player|Grape Media Player|spyware +media.tean.music.appx|Tean Music Player|spyware +mg.locations.track5|OneLocator|stalkerware +mhu.bylbcwc|AndroidPolice|stalkerware +mhu.bylbcwc|MonitorChecker|stalkerware +mob.protect.children|MobileTrackerFree|stalkerware +mob.service.parental2020|MobileTrackerFree|stalkerware +mobile.controlparental2020|MobileTrackerFree|stalkerware +mobile.monitor.child2021|MobileTrackerFree|stalkerware +mobile.monitor.child2022|MobileTrackerFree|stalkerware +mobile.monitor.child2023|MobileTrackerFree|stalkerware +mobile.monitor.child2034|MobileTrackerFree|stalkerware +mobile.parental2021|MobileTrackerFree|stalkerware +mobile.protect.children2020|MobileTrackerFree|stalkerware +mobile.protect.children|MobileTrackerFree|stalkerware +muscle.loseweight.fitness.fatburning.exercise|Male Fitness 2020|spyware +net.androidcoreapp.androidbackup|Reptilicus|stalkerware +net.coolware.smart.camera.ultra|2022 Ultra Camera|spyware +net.cybrook.trackvieo|TrackView|stalkerware +net.cybrook.trackviep|TrackView|stalkerware +net.cybrook.trackvieq|TrackView|stalkerware +net.cybrook.trackvier|TrackView|stalkerware +net.cybrook.trackvies|TrackView|stalkerware +net.cybrook.trackviet|TrackView|stalkerware +net.cybrook.trackvieu|TrackView|stalkerware +net.cybrook.trackviev|TrackView|stalkerware +net.cybrook.trackview|Family Locator and Monitor - TrackView|stalkerware +net.cybrook.trackview|TrackView|stalkerware +net.cybrook.trackviex|TrackView|stalkerware +net.cybrook.trackviey|TrackView|stalkerware +net.cybrook.trackviez|TrackView|stalkerware +net.cybrook.trustserv|TrackView|stalkerware +net.delphiboardlayer.androidcoreapp|Reptilicus|stalkerware +net.droid.talk218|Ahmyth|stalkerware +net.droid.talk218|Unknown|stalkerware +net.fpsol.shooters|Code Name-Vulture FPS OL|spyware +net.homesafe|TrackView|stalkerware +net.kanvpn.fastspeed|Kangaroo Fast VPN|spyware +net.kidlogger.kidlogger|AndroidPolice|stalkerware +net.kidlogger.kidlogger|KidLogger|stalkerware +net.majorkernelpanic.spydroid|SpyDroid|stalkerware +net.majorkernelpanic.spydroid|Unknown|stalkerware +net.musicesapp.player|Muses Music Player|spyware +net.red.pi.fashion.camera|Red Camera|spyware +net.reptilicus.clientapp|Reptilicus|stalkerware +net.snaphdphotoeditorapp.ishscsnaphdphotoeditor|Snap: HD Photo Editor|spyware +net.someapp1.somecorp2|AndroidPolice|stalkerware +net.someapp1.somecorp2|KidLogger|stalkerware +net.spy24.wifi|Spy24|stalkerware +net.ssonn.boomrace|Lightning Drift Racing|spyware +net.sweetplus.camx|One-Sweet Camera|spyware +net.system_updater_abs341|Reptilicus|stalkerware +net.teecho.camche.camera|Baby Camera|spyware +net.teslineservice.kidl5|AndroidPolice|stalkerware +net.teslineservice.kidl5|KidLogger|stalkerware +net.trackview.pro|TrackView|stalkerware +net.trackview|TrackView|stalkerware +net.vkurhandler|Reptilicus|stalkerware +niko.ldali.batter|BatterySafe|spyware +ns.antapp.module|NeoSpy|stalkerware +one.enix.smsforward|SMForw|stalkerware +one.enix.smsforward|SMSForward|stalkerware +oo.ptkqyawh|AndroidPolice|stalkerware +oo.ptkqyawh|MonitorChecker|stalkerware +org.alltracker.security|AllTracker|stalkerware +org.connecting.updived.hygeist.interplays|MobileTool|stalkerware +org.crashmaster.funrace.aps|Crash Race Master|spyware +org.donfan.player.app|Donfan Music Player|spyware +org.findmykids.app|FindMyKids|stalkerware +org.findmykids.child|FindMyKids|stalkerware +org.findmykids.child|Unknown|stalkerware +org.mumu.hdpalyer.apps|Mulu Music Player|spyware +org.musinvshen.player|Musae Music Player|spyware +org.nzombie.hutgame|Night Hunter Game|spyware +org.poleward.burghs.hydrotherapy.homonymously|MobileTool|stalkerware +org.secure.smsgps|AutoForward|stalkerware +org.secure.smsgps|HighsterMobile|stalkerware +org.skysound.music.player|Teana Music Player|spyware +org.svpn.goatsheep|Goat Safe VPN|spyware +org.system.kernel|OwnSpy|stalkerware +org.traccar.client.hidden|Traca|stalkerware +org.traccar.client.hidden|Traccar|stalkerware +org.traccar.client|Traccar|stalkerware +org.urates.amirates.suffocate.chiliast|MobileTool|stalkerware +org.zipaimei.camfilter|SnapBeauty Cam Filter|spyware +phone.Secure|MobiStealth|stalkerware +pl.lidwin.letmespy2|LetMeSpy|stalkerware +pl.lidwin.letmespy3|LetMeSpy|stalkerware +pl.lidwin.letmespy4|LetMeSpy|stalkerware +pl.lidwin.letmespy5|LetMeSpy|stalkerware +pl.lidwin.letmespy|LetMeSpy|stalkerware +pl.lidwin.lms|LetMeSpy|stalkerware +pl.lidwin.remote1|LetMeSpy|stalkerware +pl.lidwin.remote2|LetMeSpy|stalkerware +pl.lidwin.remote|LetMeSpy|stalkerware +pl.radeal.lms4|LetMeSpy|stalkerware +pl.spyone.agent2|Spyone|stalkerware +player.mmm.mediapp.otrs|Mostfun Media Music|spyware +player.pinol.enoyend|OseaCamera|spyware +player.pmte.nfyti.media|Pomelo Music Player|spyware +player.seashel.loud.media|Sealod Music Player|spyware +player.shellvoice.app|SeaShell Music Player|spyware +proflash.flash.com|ProFlash|spyware +program.data.agus.dat|Kite camera|spyware +race.apex.accre.game|Apex Crash Race|spyware +ru.usafe.kid.unisafekids|Unisafe|stalkerware +ru.usafe.u_safe|Unisafe|stalkerware +ru.usafe.usafe|Unisafe|stalkerware +se.vkur.clientapp|Reptilicus|stalkerware +seC.fqjx.sqBB|OneMonitar|stalkerware +seC.fqjx.sqBB|OneSpy|stalkerware +security.mobile.parental|MobileTrackerFree|stalkerware +service.download.app|MobileTrackerFree|stalkerware +solo.impostormaster.kill|Impostor Master Solo Kill 2021|spyware +spdcar.gamedrag.racgame.app|Instant Drag Speed Racing|spyware +sped.racear.game.plusx|Extreme Speed Race|spyware +stealthLight.sys|MobiStealth|stalkerware +su.unisafe.unisafe|Unisafe|stalkerware +sy.slvzccd|AndroidPolice|stalkerware +sy.slvzccd|MonitorChecker|stalkerware +sys.framework|Update service|stalkerware +system.framework|celSpy|stalkerware +system.framework|mSpy|stalkerware +t.tools.app|TalkLog|stalkerware +tech.logsettings|TalkLog|stalkerware +technic.settings|TalkLog|stalkerware +tej.flashkeyloggerpro|FlashKeylogger|stalkerware +tej.flashkeyloggerpro|FlashKeylog|stalkerware +tej.flashkeylogger|FlashKeylogger|stalkerware +tej.flashkeylogges|FlashKeylogger|stalkerware +tej.flashkeylogges|FlashKeylog|stalkerware +tracker.mob.gps|MobileTrackerFree|stalkerware +tv.familynk|TrackView|stalkerware +tv.familynl|TrackView|stalkerware +update.service.android.installer|mSpy|stalkerware +update.service.android|mSpy|stalkerware +us.trackview|TrackView|stalkerware +vmf.uxytqgrl|AndroidPolice|stalkerware +vmf.uxytqgrl|MonitorChecker|stalkerware +vn.ehkfqgvn|AndroidPolice|stalkerware +vn.ehkfqgvn|MonitorChecker|stalkerware +whsmy.blod.sper|NoneCanDie|spyware +wifi.manager|Spy99|stalkerware +win.bestrace.threed.game|City Crash Racing Game|spyware +win.calshow.zzplus.app|Callpaper Show|spyware +win.hapsunday.mplayer|Sunday Media Player|spyware +win.hoomhom.fpsgame|Flame Shock FPS|spyware +win.modoen.time.camer|Modern Time Camera|spyware +win.smartgame.sortpuz.app|Rainbow Square- Sort Puzzle|spyware +win.tebag.camap|Tea Bag Camera|spyware +wosc.cwf2|CatWatchful|stalkerware +wosc.cwf|CatWatchful|stalkerware +xd.spy.app|Unknown|stalkerware +xd.spy.app|XDSpy|stalkerware +yc.sysupd.client|Reptilicus|stalkerware +yogaworkouts.dailyyoga.yogafitness|MobileTrackerFree|stalkerware +yr.tubjypbl|AndroidPolice|stalkerware +yr.tubjypbl|MonitorChecker|stalkerware diff --git a/vigil/lib/forensic_shield.sh b/vigil/lib/forensic_shield.sh new file mode 100755 index 0000000..f67c1e5 --- /dev/null +++ b/vigil/lib/forensic_shield.sh @@ -0,0 +1,236 @@ +#!/system/bin/sh +# Vigil — Forensic Shield (Anti-Cellebrite/UFED) +# Monitors USB, detects forensic extraction tools, triggers defensive response +# (c) Setec Labs +# +# Based on research from: levlesec/lockup, bakad3v/Android-AntiForensic-Tools +# +# Detection vectors: +# 1. USB device connection monitoring +# 2. Cellebrite binary hash detection in staging directories +# 3. Cellebrite signing certificate detection +# 4. Forensic tool process detection +# 5. ADB state monitoring + +VIGIL_DATA="/data/adb/vigil" +VIGIL_LOG="$VIGIL_DATA/vigil.log" +IOC_DIR="$VIGIL_DATA" +ALERT_DIR="$VIGIL_DATA/alerts" + +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [forensic] $1" >> "$VIGIL_LOG" +} + +alert() { + local severity="$1" + local message="$2" + local timestamp=$(date +%s) + echo "${severity}|${timestamp}|forensic_shield|${message}" >> "$ALERT_DIR/pending" + log "ALERT [$severity]: $message" +} + +# Known forensic tool staging directories +STAGING_DIRS="/data/local/tmp /data/local/tmp/cb /cblr /dev/shm /data/local/tmp/frida" + +# Known forensic tool process names +FORENSIC_PROCESSES="cellebrite\|ufed\|graykey\|grayshift\|magnet.forensic\|oxygen.forensic\|msab\|xry\|elcomsoft\|passware\|hashcat\|john\|volatility\|autopsy\|ftk\|encase\|axiom\|nuix\|paraben\|susteen\|mobiledit\|belkasoft" + +# Known exploit binary names used by forensic tools +EXPLOIT_NAMES="nandread\|dirtycow\|dirty_cow\|pingroot\|zergRush\|psneuter\|salmatak\|gingerbreak\|rageagainstthecage\|exploid\|zimperlich\|levitator\|mempodroid\|motochopper\|put_user\|towelroot\|framaroot\|kingroot" + +# ── STAGING DIRECTORY MONITOR ── +check_staging_dirs() { + local hits=0 + + for dir in $STAGING_DIRS; do + if [ -d "$dir" ]; then + # Check for any files + local files=$(find "$dir" -type f 2>/dev/null) + if [ -n "$files" ]; then + echo "$files" | while read -r filepath; do + local filename=$(basename "$filepath") + local filesize=$(stat -c '%s' "$filepath" 2>/dev/null || echo "0") + + # Check filename against exploit patterns + if echo "$filename" | grep -qiE "$EXPLOIT_NAMES"; then + alert "CRITICAL" "FORENSIC EXPLOIT BINARY: $filepath ($filename)" + hits=$((hits + 1)) + fi + + # Check file hash against Cellebrite hashes + if [ -f "$IOC_DIR/cellebrite_hashes.txt" ] && [ "$filesize" -gt 0 ]; then + local file_hash=$(sha256sum "$filepath" 2>/dev/null | cut -d' ' -f1) + if grep -qi "^${file_hash}" "$IOC_DIR/cellebrite_hashes.txt" 2>/dev/null; then + alert "CRITICAL" "CELLEBRITE BINARY DETECTED: $filepath (hash: ${file_hash:0:16}...)" + hits=$((hits + 1)) + fi + fi + + # Check for Frida-related files + if echo "$filename" | grep -qiE "frida|gadget|agent.*\.so|re\.frida"; then + alert "HIGH" "FRIDA INJECTION TOOL: $filepath" + hits=$((hits + 1)) + fi + done + fi + fi + done + + return $hits +} + +# ── PROCESS MONITOR ── +check_forensic_processes() { + local hits=0 + + ps -A -o PID,NAME 2>/dev/null | while read -r pid name; do + if echo "$name" | grep -qi "$FORENSIC_PROCESSES"; then + alert "CRITICAL" "FORENSIC TOOL PROCESS: $name (PID: $pid)" + hits=$((hits + 1)) + + # If auto-lockdown is enabled, trigger it immediately + if [ "${FORENSIC_AUTO_LOCKDOWN:-0}" = "1" ]; then + log "AUTO-LOCKDOWN triggered by forensic process: $name" + "$VIGIL_DATA/../modules/vigil/vigil/lib/key_wiper.sh" lockdown + fi + fi + done + + return $hits +} + +# ── USB STATE MONITOR ── +check_usb_state() { + local usb_state=$(cat /sys/class/android_usb/android0/state 2>/dev/null || getprop sys.usb.state 2>/dev/null) + local usb_config=$(getprop sys.usb.config 2>/dev/null) + + # If we're in lockdown and USB is connected, alert + if [ -f "$VIGIL_DATA/.lockdown" ]; then + if [ "$usb_state" = "CONFIGURED" ] || [ "$usb_state" = "CONNECTED" ]; then + alert "HIGH" "USB CONNECTED DURING LOCKDOWN (config: $usb_config)" + # Force charging-only mode + setprop sys.usb.config "charging" 2>/dev/null + fi + fi + + # Check if ADB got re-enabled unexpectedly + if [ "${FORENSIC_ADB_GUARD:-1}" = "1" ]; then + local adb_state=$(settings get global adb_enabled 2>/dev/null) + if [ -f "$VIGIL_DATA/.lockdown" ] && [ "$adb_state" = "1" ]; then + alert "HIGH" "ADB RE-ENABLED DURING LOCKDOWN — disabling" + settings put global adb_enabled 0 2>/dev/null + stop adbd 2>/dev/null + fi + fi +} + +# ── PACKAGE INSTALL MONITOR ── +# Check recently installed packages for forensic tool signatures +check_recent_installs() { + local hits=0 + local threshold=$(($(date +%s) - 300)) # Last 5 minutes + + # Check for recently installed packages with suspicious signing certs + pm list packages -i 2>/dev/null | while read -r line; do + local pkg=$(echo "$line" | sed 's/package:\([^ ]*\).*/\1/') + local installer=$(echo "$line" | grep -oP 'installer=\K[^ ]+') + + # Non-store installs are suspicious during forensic scenarios + if [ "$installer" != "com.android.vending" ] && [ "$installer" != "com.google.android.packageinstaller" ]; then + # Check if this is a known forensic tool package + if echo "$pkg" | grep -qiE "cellebrite\|ufed\|forensic\|graykey\|grayshift\|msab\|oxygen"; then + alert "CRITICAL" "FORENSIC TOOL PACKAGE INSTALLED: $pkg (installer: $installer)" + hits=$((hits + 1)) + fi + fi + done + + return $hits +} + +# ── CONTINUOUS MONITOR (run as daemon) ── +cmd_monitor() { + log "Forensic shield monitor starting..." + echo "Forensic Shield active — monitoring USB, processes, staging dirs" + + while true; do + check_usb_state + check_forensic_processes + check_staging_dirs + + # Quick process check every second if in lockdown, otherwise every 5 + if [ -f "$VIGIL_DATA/.lockdown" ]; then + sleep 1 + else + sleep 5 + fi + done +} + +# ── ONE-TIME SCAN ── +cmd_scan() { + log "Forensic shield scan..." + echo "Forensic Shield Scan" + echo "━━━━━━━━━━━━━━━━━━━━" + + local total=0 + + echo -n " Staging directories: " + check_staging_dirs + local s=$? + total=$((total + s)) + echo "$s findings" + + echo -n " Forensic processes: " + check_forensic_processes + local p=$? + total=$((total + p)) + echo "$p findings" + + echo -n " USB state: " + check_usb_state + echo "checked" + + echo -n " Recent installs: " + check_recent_installs + local i=$? + total=$((total + i)) + echo "$i findings" + + echo "━━━━━━━━━━━━━━━━━━━━" + if [ $total -gt 0 ]; then + echo "⚠ FORENSIC ACTIVITY DETECTED: $total findings" + else + echo "✓ No forensic tool activity detected" + fi + + return $total +} + +# ── STATUS ── +cmd_status() { + echo "Forensic Shield Status:" + echo " Enabled: ${FORENSIC_SHIELD_ENABLED:-1}" + echo " USB Guard: ${FORENSIC_USB_MONITOR:-1}" + echo " ADB Guard: ${FORENSIC_ADB_GUARD:-1}" + echo " Auto-Lock: ${FORENSIC_AUTO_LOCKDOWN:-0}" + echo " Lockdown: $([ -f "$VIGIL_DATA/.lockdown" ] && echo "ACTIVE" || echo "inactive")" + + local usb_state=$(getprop sys.usb.config 2>/dev/null) + local adb_state=$(settings get global adb_enabled 2>/dev/null) + echo " USB Config: $usb_state" + echo " ADB: $([ "$adb_state" = "1" ] && echo "ENABLED" || echo "disabled")" +} + +# ── DISPATCH ── +case "$1" in + monitor) cmd_monitor ;; + scan) cmd_scan ;; + status) cmd_status ;; + *) + echo "Forensic Shield — Anti-Extraction Defense" + echo "Usage: forensic_shield.sh {monitor|scan|status}" + ;; +esac diff --git a/vigil/lib/integrity.sh b/vigil/lib/integrity.sh new file mode 100755 index 0000000..f7245e6 --- /dev/null +++ b/vigil/lib/integrity.sh @@ -0,0 +1,228 @@ +#!/system/bin/sh +# Vigil — FrostGuard File Integrity Monitor +# Provides pseudo-locked-bootloader protection via file integrity + heuristics +# (c) Setec Labs + +VIGIL_DATA="/data/adb/vigil" +BASELINE_DIR="$VIGIL_DATA/baseline" +ALERT_DIR="$VIGIL_DATA/alerts" +VIGIL_LOG="$VIGIL_DATA/vigil.log" + +# Load config +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +CRITICAL_PATHS="${FROSTGUARD_CRITICAL_PATHS:-/system/bin /system/xbin /system/lib64 /system/framework /system/app /system/priv-app /vendor/bin}" + +log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [frostguard] $1" >> "$VIGIL_LOG" +} + +alert() { + local severity="$1" + local message="$2" + local timestamp=$(date +%s) + echo "${severity}|${timestamp}|frostguard|${message}" >> "$ALERT_DIR/pending" + log "ALERT [$severity]: $message" +} + +# Generate SHA256 hash of a file +hash_file() { + sha256sum "$1" 2>/dev/null | cut -d' ' -f1 +} + +# ── BASELINE: Create integrity baseline of critical system files ── +cmd_baseline() { + log "Creating file integrity baseline..." + mkdir -p "$BASELINE_DIR" + + local count=0 + for path in $CRITICAL_PATHS; do + if [ -d "$path" ]; then + find "$path" -type f 2>/dev/null | while read -r file; do + local hash=$(hash_file "$file") + local perms=$(stat -c '%a:%u:%g' "$file" 2>/dev/null || ls -ln "$file" | awk '{print $1":"$3":"$4}') + local size=$(stat -c '%s' "$file" 2>/dev/null || ls -ln "$file" | awk '{print $5}') + echo "${hash}|${perms}|${size}|${file}" + done + elif [ -f "$path" ]; then + local hash=$(hash_file "$path") + local perms=$(stat -c '%a:%u:%g' "$path" 2>/dev/null || ls -ln "$path" | awk '{print $1":"$3":"$4}') + local size=$(stat -c '%s' "$path" 2>/dev/null || ls -ln "$path" | awk '{print $5}') + echo "${hash}|${perms}|${size}|${path}" + fi + done > "$BASELINE_DIR/system.baseline" + + # Also baseline boot image hashes if accessible + for part in boot init_boot vendor_boot dtbo vbmeta; do + local block=$(find /dev/block -name "$part" 2>/dev/null | head -1) + if [ -n "$block" ] && [ -r "$block" ]; then + local bhash=$(sha256sum "$block" 2>/dev/null | cut -d' ' -f1) + echo "${bhash}|${part}" >> "$BASELINE_DIR/partitions.baseline" + fi + done + + count=$(wc -l < "$BASELINE_DIR/system.baseline" 2>/dev/null || echo 0) + log "Baseline created: $count files indexed" + echo "Baseline created: $count files indexed" +} + +# ── VERIFY: Check current state against baseline ── +cmd_verify() { + if [ ! -f "$BASELINE_DIR/system.baseline" ]; then + log "No baseline found — run 'vigil integrity baseline' first" + echo "ERROR: No baseline found" + return 1 + fi + + log "Verifying file integrity..." + local violations=0 + local checked=0 + local missing=0 + local modified=0 + local perm_changed=0 + local new_files=0 + + # Check each baselined file + while IFS='|' read -r expected_hash expected_perms expected_size filepath; do + checked=$((checked + 1)) + + if [ ! -f "$filepath" ]; then + alert "HIGH" "File MISSING: $filepath" + missing=$((missing + 1)) + violations=$((violations + 1)) + continue + fi + + local current_hash=$(hash_file "$filepath") + local current_perms=$(stat -c '%a:%u:%g' "$filepath" 2>/dev/null || ls -ln "$filepath" | awk '{print $1":"$3":"$4}') + local current_size=$(stat -c '%s' "$filepath" 2>/dev/null || ls -ln "$filepath" | awk '{print $5}') + + if [ "$current_hash" != "$expected_hash" ]; then + alert "CRITICAL" "File MODIFIED: $filepath (expected: ${expected_hash:0:16}... got: ${current_hash:0:16}...)" + modified=$((modified + 1)) + violations=$((violations + 1)) + fi + + if [ "$current_perms" != "$expected_perms" ]; then + alert "MEDIUM" "Permissions CHANGED: $filepath ($expected_perms -> $current_perms)" + perm_changed=$((perm_changed + 1)) + violations=$((violations + 1)) + fi + done < "$BASELINE_DIR/system.baseline" + + # Heuristic: check for NEW files in critical paths (could indicate implants) + for path in $CRITICAL_PATHS; do + if [ -d "$path" ]; then + find "$path" -type f -newer "$BASELINE_DIR/system.baseline" 2>/dev/null | while read -r newfile; do + if ! grep -q "|${newfile}$" "$BASELINE_DIR/system.baseline" 2>/dev/null; then + alert "HIGH" "NEW file detected: $newfile" + new_files=$((new_files + 1)) + violations=$((violations + 1)) + fi + done + fi + done + + # Check boot partitions + if [ -f "$BASELINE_DIR/partitions.baseline" ]; then + while IFS='|' read -r expected_hash part_name; do + local block=$(find /dev/block -name "$part_name" 2>/dev/null | head -1) + if [ -n "$block" ] && [ -r "$block" ]; then + local current_hash=$(sha256sum "$block" 2>/dev/null | cut -d' ' -f1) + if [ "$current_hash" != "$expected_hash" ]; then + alert "CRITICAL" "PARTITION MODIFIED: $part_name" + violations=$((violations + 1)) + fi + fi + done < "$BASELINE_DIR/partitions.baseline" + fi + + log "Integrity check complete: $checked files checked, $violations violations" + echo "FrostGuard Report:" + echo " Files checked: $checked" + echo " Modified: $modified" + echo " Missing: $missing" + echo " Permission changes: $perm_changed" + echo " New files: $new_files" + echo " Total violations: $violations" + + return $violations +} + +# ── VERIFY-CRITICAL: Fast check of most important files only ── +cmd_verify_critical() { + if [ ! -f "$BASELINE_DIR/system.baseline" ]; then + return 0 # No baseline yet, skip + fi + + # Only check key binaries and framework files + local violations=0 + for pattern in "/system/bin/app_process" "/system/bin/linker" "/system/framework/framework.jar" "/system/framework/services.jar" "/init"; do + local line=$(grep "|${pattern}$" "$BASELINE_DIR/system.baseline" 2>/dev/null) + if [ -n "$line" ]; then + local expected_hash=$(echo "$line" | cut -d'|' -f1) + local current_hash=$(hash_file "$pattern") + if [ -n "$current_hash" ] && [ "$current_hash" != "$expected_hash" ]; then + alert "CRITICAL" "Critical file MODIFIED: $pattern" + violations=$((violations + 1)) + fi + fi + done + + return $violations +} + +# ── HEURISTIC: Detect suspicious system modifications ── +cmd_heuristic() { + log "Running heuristic analysis..." + local suspicious=0 + + # Check for common implant locations + for dir in /data/local/tmp /data/local/tmp/cb /cblr /dev/shm; do + if [ -d "$dir" ] && [ "$(ls -A "$dir" 2>/dev/null)" ]; then + local fcount=$(find "$dir" -type f 2>/dev/null | wc -l) + if [ "$fcount" -gt 0 ]; then + alert "HIGH" "Suspicious files in staging directory: $dir ($fcount files)" + suspicious=$((suspicious + 1)) + fi + fi + done + + # Check for unexpected SUID binaries + find /system /vendor -perm -4000 -type f 2>/dev/null | while read -r suid; do + if ! grep -q "|${suid}$" "$BASELINE_DIR/system.baseline" 2>/dev/null; then + alert "HIGH" "Unexpected SUID binary: $suid" + suspicious=$((suspicious + 1)) + fi + done + + # Check for Frida, Xposed, or other injection frameworks + for proc_name in frida-server frida-agent xposed zygisk; do + if ps -A 2>/dev/null | grep -qi "$proc_name"; then + alert "MEDIUM" "Injection framework detected: $proc_name" + suspicious=$((suspicious + 1)) + fi + done + + # Check SELinux status + local selinux=$(getenforce 2>/dev/null) + if [ "$selinux" = "Permissive" ] || [ "$selinux" = "Disabled" ]; then + alert "HIGH" "SELinux is $selinux — system may be compromised" + suspicious=$((suspicious + 1)) + fi + + echo "Heuristic analysis: $suspicious suspicious findings" + return $suspicious +} + +# ── DISPATCH ── +case "$1" in + baseline) cmd_baseline ;; + verify) cmd_verify ;; + verify-critical) cmd_verify_critical ;; + heuristic) cmd_heuristic ;; + *) + echo "FrostGuard — File Integrity Monitor" + echo "Usage: integrity.sh {baseline|verify|verify-critical|heuristic}" + ;; +esac diff --git a/vigil/lib/key_wiper.sh b/vigil/lib/key_wiper.sh new file mode 100755 index 0000000..a2044a8 --- /dev/null +++ b/vigil/lib/key_wiper.sh @@ -0,0 +1,192 @@ +#!/system/bin/sh +# Vigil — Encryption Key Wiper / BFU Mode +# Wipes encryption keys from memory, forces device into BFU-equivalent state +# (c) Setec Labs +# +# THEORY OF OPERATION: +# Android devices in "After First Unlock" (AFU) state keep FBE/FDE keys in memory. +# Forensic tools exploit this to extract data without the user's PIN. +# This module wipes those keys, runs TRIM to prevent NAND recovery, kills logging, +# and effectively moves the phone to "Before First Unlock" (BFU) state — the same +# protection as a freshly powered-on phone. + +VIGIL_DATA="/data/adb/vigil" +VIGIL_LOG="$VIGIL_DATA/vigil.log" + +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +log() { + # Only log if we haven't killed logd yet + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [keywiper] $1" >> "$VIGIL_LOG" 2>/dev/null +} + +# ── LOCKDOWN: Full BFU-mode transition ── +cmd_lockdown() { + log "=== LOCKDOWN INITIATED ===" + + # Step 1: Disable ADB immediately + if [ "${KEYWIPER_DISABLE_ADB:-1}" = "1" ]; then + log "Disabling ADB..." + settings put global adb_enabled 0 2>/dev/null + setprop persist.sys.usb.config "charging" 2>/dev/null + setprop sys.usb.config "charging" 2>/dev/null + stop adbd 2>/dev/null + fi + + # Step 2: Clear clipboard and recent apps + if [ "${KEYWIPER_CLEAR_CLIPBOARD:-1}" = "1" ]; then + log "Clearing clipboard..." + am broadcast -a clipclear 2>/dev/null + service call clipboard 2 2>/dev/null + fi + + # Step 3: Lock device + log "Locking device..." + input keyevent 26 2>/dev/null # Power button press + + # Step 4: Evict FBE keys — this is the core operation + # Force credential-encrypted storage to lock + log "Evicting encryption keys..." + + # Evict CE (Credential Encrypted) keys for all users + for user_dir in /data/user/*; do + if [ -d "$user_dir" ]; then + local uid=$(basename "$user_dir") + # Use vold to evict CE keys + vdc cryptfs lockUserKey "$uid" 2>/dev/null + fi + done + + # Alternative: use keymaster/keystore to flush + # This forces the keystore daemon to drop cached keys + setprop vold.decrypt trigger_post_fs_data 2>/dev/null + + # Try to flush kernel key retention + # keyctl clear @s 2>/dev/null # Flush session keyring + # keyctl clear @u 2>/dev/null # Flush user keyring + + # Step 5: Drop filesystem caches (contains decrypted data) + log "Dropping filesystem caches..." + echo 3 > /proc/sys/vm/drop_caches 2>/dev/null + + # Step 6: Run TRIM to mark deleted blocks as free (prevents NAND recovery) + if [ "${KEYWIPER_TRIM_ON_LOCKDOWN:-1}" = "1" ]; then + log "Running TRIM on storage..." + sm fstrim 2>/dev/null & + fstrim /data 2>/dev/null & + fstrim /cache 2>/dev/null & + fi + + # Step 7: Disable logging + if [ "${KEYWIPER_KILL_LOGD:-1}" = "1" ]; then + log "Disabling system logging..." + setprop persist.logd.logpersistd "" 2>/dev/null + setprop persist.log.tag "S" 2>/dev/null # Suppress all logs + setprop logd.logpersistd.size 65536 2>/dev/null # Minimize buffer + # Don't fully stop logd — it causes instability. Just minimize it. + fi + + # Step 8: Disable developer settings + settings put global development_settings_enabled 0 2>/dev/null + + # Step 9: Block safe mode boot + settings put global safe_boot_disallowed 1 2>/dev/null + + # Step 10: Write lockdown marker + echo "$(date +%s)" > "$VIGIL_DATA/.lockdown" + + log "=== LOCKDOWN COMPLETE ===" + echo "LOCKDOWN ACTIVE — Device is in BFU-equivalent state" + echo "Encryption keys evicted, ADB disabled, logging minimized" + echo "Reboot required to restore normal operation" +} + +# ── QUICK LOCK: Fast key eviction without full lockdown ── +cmd_quick() { + log "Quick key eviction..." + + # Just evict keys and drop caches + for user_dir in /data/user/*; do + if [ -d "$user_dir" ]; then + local uid=$(basename "$user_dir") + vdc cryptfs lockUserKey "$uid" 2>/dev/null + fi + done + + echo 3 > /proc/sys/vm/drop_caches 2>/dev/null + input keyevent 26 2>/dev/null + + echo "Quick lock complete — keys evicted, device locked" +} + +# ── WIPE SESSION: Clear sensitive data from memory ── +cmd_wipe_session() { + log "Wiping session data..." + + # Clear app recents + am broadcast -a com.android.systemui.CLEAR_RECENT 2>/dev/null + + # Drop caches + echo 3 > /proc/sys/vm/drop_caches 2>/dev/null + + # Clear clipboard + service call clipboard 2 2>/dev/null + + # Clear notifications + service call notification 1 2>/dev/null + + # Run TRIM + fstrim /data 2>/dev/null & + + echo "Session data wiped" +} + +# ── STATUS ── +cmd_status() { + echo "Key Wiper Status:" + if [ -f "$VIGIL_DATA/.lockdown" ]; then + local lockdown_time=$(cat "$VIGIL_DATA/.lockdown") + echo " State: LOCKDOWN (since $(date -d @"$lockdown_time" 2>/dev/null || echo "$lockdown_time"))" + else + echo " State: Normal" + fi + + local adb_state=$(settings get global adb_enabled 2>/dev/null) + echo " ADB: $([ "$adb_state" = "1" ] && echo "ENABLED" || echo "disabled")" + + local dev_settings=$(settings get global development_settings_enabled 2>/dev/null) + echo " DevOpts: $([ "$dev_settings" = "1" ] && echo "ENABLED" || echo "disabled")" + + local selinux=$(getenforce 2>/dev/null || echo "unknown") + echo " SELinux: $selinux" +} + +# ── UNLOCK: Remove lockdown state (after reboot) ── +cmd_unlock() { + if [ -f "$VIGIL_DATA/.lockdown" ]; then + rm -f "$VIGIL_DATA/.lockdown" + log "Lockdown state cleared" + echo "Lockdown state cleared" + else + echo "Not in lockdown" + fi +} + +# ── DISPATCH ── +case "$1" in + lockdown) cmd_lockdown ;; + quick) cmd_quick ;; + wipe-session) cmd_wipe_session ;; + status) cmd_status ;; + unlock) cmd_unlock ;; + *) + echo "Key Wiper — BFU Mode Controller" + echo "Usage: key_wiper.sh {lockdown|quick|wipe-session|status|unlock}" + echo "" + echo " lockdown Full BFU lockdown (evict keys, disable ADB, TRIM, kill logs)" + echo " quick Fast key eviction + lock screen" + echo " wipe-session Clear session data (clipboard, caches, recents)" + echo " status Show current security state" + echo " unlock Remove lockdown marker (after reboot)" + ;; +esac diff --git a/vigil/lib/network_monitor.sh b/vigil/lib/network_monitor.sh new file mode 100755 index 0000000..6fc448b --- /dev/null +++ b/vigil/lib/network_monitor.sh @@ -0,0 +1,255 @@ +#!/system/bin/sh +# Vigil — Network Monitor / C2 Domain Blocker +# Blocks known C2, tracking, and surveillance domains via hosts + iptables +# (c) Setec Labs + +VIGIL_DATA="/data/adb/vigil" +VIGIL_LOG="$VIGIL_DATA/vigil.log" +IOC_DIR="$VIGIL_DATA" +ALERT_DIR="$VIGIL_DATA/alerts" +NET_LOG="$VIGIL_DATA/network.log" + +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +HOSTS_MARKER="# vigil-managed" +IPTABLES_CHAIN="VIGIL_BLOCK" + +log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [network] $1" >> "$VIGIL_LOG" +} + +alert() { + local severity="$1" + local message="$2" + local timestamp=$(date +%s) + echo "${severity}|${timestamp}|network|${message}" >> "$ALERT_DIR/pending" + log "ALERT [$severity]: $message" +} + +# ── HOSTS FILE: Install domain blocklist ── +cmd_install_hosts() { + log "Installing domain blocklist into hosts file..." + + local hosts_file="/system/etc/hosts" + local vigil_hosts="$IOC_DIR/hosts.txt" + + if [ ! -f "$vigil_hosts" ]; then + log "WARNING: hosts.txt not found" + echo "ERROR: No hosts blocklist found at $vigil_hosts" + return 1 + fi + + # Count domains to block + local domain_count=$(grep -c "^0.0.0.0" "$vigil_hosts" 2>/dev/null || echo 0) + + # Backup original hosts if not already backed up + if [ ! -f "$VIGIL_DATA/hosts.backup" ]; then + cp "$hosts_file" "$VIGIL_DATA/hosts.backup" 2>/dev/null + fi + + # Make /system writable (KernelSU overlay should handle this) + mount -o rw,remount /system 2>/dev/null + + # Remove old vigil entries + if grep -q "$HOSTS_MARKER" "$hosts_file" 2>/dev/null; then + sed -i "/$HOSTS_MARKER/d" "$hosts_file" + fi + + # Append new entries + echo "" >> "$hosts_file" + while read -r line; do + echo "$line $HOSTS_MARKER" >> "$hosts_file" + done < "$vigil_hosts" + + mount -o ro,remount /system 2>/dev/null + + log "Hosts blocklist installed: $domain_count domains" + echo "Domain blocklist active: $domain_count domains blocked" +} + +# ── HOSTS FILE: Remove blocklist ── +cmd_remove_hosts() { + log "Removing domain blocklist from hosts file..." + + local hosts_file="/system/etc/hosts" + + mount -o rw,remount /system 2>/dev/null + + if grep -q "$HOSTS_MARKER" "$hosts_file" 2>/dev/null; then + sed -i "/$HOSTS_MARKER/d" "$hosts_file" + log "Hosts blocklist removed" + echo "Domain blocklist removed" + else + echo "No vigil entries in hosts file" + fi + + mount -o ro,remount /system 2>/dev/null +} + +# ── IPTABLES: Block known malicious IPs ── +cmd_install_iptables() { + if [ "${NETWORK_IPTABLES_ENABLED:-1}" != "1" ]; then + echo "iptables blocking disabled in config" + return 0 + fi + + log "Installing iptables IP blocklist..." + + local ip_file="$IOC_DIR/ips.txt" + if [ ! -f "$ip_file" ]; then + log "WARNING: ips.txt not found" + echo "ERROR: No IP blocklist found" + return 1 + fi + + # Create chain if it doesn't exist + iptables -N "$IPTABLES_CHAIN" 2>/dev/null + ip6tables -N "$IPTABLES_CHAIN" 2>/dev/null + + # Flush existing rules in our chain + iptables -F "$IPTABLES_CHAIN" 2>/dev/null + ip6tables -F "$IPTABLES_CHAIN" 2>/dev/null + + # Add our chain to OUTPUT if not already there + iptables -C OUTPUT -j "$IPTABLES_CHAIN" 2>/dev/null || \ + iptables -I OUTPUT -j "$IPTABLES_CHAIN" 2>/dev/null + + ip6tables -C OUTPUT -j "$IPTABLES_CHAIN" 2>/dev/null || \ + ip6tables -I OUTPUT -j "$IPTABLES_CHAIN" 2>/dev/null + + # Block each IP with logging + local count=0 + while IFS='|' read -r ip threat_name category; do + [ -z "$ip" ] && continue + [ "${ip:0:1}" = "#" ] && continue + + # Determine if IPv4 or IPv6 + if echo "$ip" | grep -q ":"; then + ip6tables -A "$IPTABLES_CHAIN" -d "$ip" -j DROP 2>/dev/null && count=$((count + 1)) + else + iptables -A "$IPTABLES_CHAIN" -d "$ip" -j DROP 2>/dev/null && count=$((count + 1)) + fi + done < "$ip_file" + + log "iptables blocklist installed: $count IPs" + echo "IP blocklist active: $count IPs blocked" +} + +# ── IPTABLES: Remove blocklist ── +cmd_remove_iptables() { + log "Removing iptables blocklist..." + + iptables -D OUTPUT -j "$IPTABLES_CHAIN" 2>/dev/null + ip6tables -D OUTPUT -j "$IPTABLES_CHAIN" 2>/dev/null + iptables -F "$IPTABLES_CHAIN" 2>/dev/null + ip6tables -F "$IPTABLES_CHAIN" 2>/dev/null + iptables -X "$IPTABLES_CHAIN" 2>/dev/null + ip6tables -X "$IPTABLES_CHAIN" 2>/dev/null + + echo "IP blocklist removed" +} + +# ── CONNECTION MONITOR: Watch for suspicious network activity ── +cmd_monitor() { + log "Network monitor starting..." + echo "Network monitor active — watching for C2 connections" + + local domain_file="$IOC_DIR/domains.txt" + + while true; do + # Check active connections against known C2 IPs + if [ -f "$IOC_DIR/ips.txt" ]; then + # Get current connections + cat /proc/net/tcp /proc/net/tcp6 2>/dev/null | awk '{print $3}' | while read -r hex_addr; do + # Convert hex IP to dotted notation + local hex_ip=$(echo "$hex_addr" | cut -d: -f1) + if [ ${#hex_ip} -eq 8 ]; then + # IPv4 + local ip=$(printf "%d.%d.%d.%d" \ + "0x${hex_ip:6:2}" "0x${hex_ip:4:2}" \ + "0x${hex_ip:2:2}" "0x${hex_ip:0:2}" 2>/dev/null) + + if grep -q "^${ip}|" "$IOC_DIR/ips.txt" 2>/dev/null; then + local match=$(grep "^${ip}|" "$IOC_DIR/ips.txt" | head -1) + local threat=$(echo "$match" | cut -d'|' -f2) + alert "CRITICAL" "ACTIVE C2 CONNECTION: $ip ($threat)" + echo "$(date +%s)|C2_CONNECTION|$ip|$threat" >> "$NET_LOG" + fi + fi + done + fi + + # Check DNS cache / resolved domains if possible + # dumpsys connectivity can reveal recent DNS lookups on some ROMs + if [ -f "$domain_file" ]; then + dumpsys connectivity 2>/dev/null | grep -oE '[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | sort -u | while read -r domain; do + if grep -q "^${domain}|" "$domain_file" 2>/dev/null; then + local match=$(grep "^${domain}|" "$domain_file" | head -1) + local threat=$(echo "$match" | cut -d'|' -f2) + local category=$(echo "$match" | cut -d'|' -f3) + alert "HIGH" "SUSPICIOUS DOMAIN RESOLVED: $domain ($threat) [$category]" + echo "$(date +%s)|DNS_RESOLVE|$domain|$threat" >> "$NET_LOG" + fi + done + fi + + sleep 30 + done +} + +# ── STATUS ── +cmd_status() { + echo "Network Monitor Status:" + echo " Enabled: ${NETWORK_MONITOR_ENABLED:-1}" + echo " C2 Block: ${NETWORK_BLOCK_C2:-1}" + echo " Tracker Block: ${NETWORK_BLOCK_TRACKERS:-1}" + echo " iptables: ${NETWORK_IPTABLES_ENABLED:-1}" + + # Check if our hosts entries are active + local hosts_count=$(grep -c "$HOSTS_MARKER" /system/etc/hosts 2>/dev/null || echo 0) + echo " Hosts rules: $hosts_count domains" + + # Check iptables chain + local ipt_count=$(iptables -L "$IPTABLES_CHAIN" 2>/dev/null | grep -c "DROP" || echo 0) + echo " IP rules: $ipt_count IPs" + + if [ -f "$NET_LOG" ]; then + local detections=$(wc -l < "$NET_LOG") + echo " Detections: $detections logged" + fi +} + +# ── FULL INSTALL ── +cmd_install() { + cmd_install_hosts + cmd_install_iptables +} + +# ── FULL REMOVE ── +cmd_remove() { + cmd_remove_hosts + cmd_remove_iptables +} + +# ── DISPATCH ── +case "$1" in + install) cmd_install ;; + remove) cmd_remove ;; + install-hosts) cmd_install_hosts ;; + remove-hosts) cmd_remove_hosts ;; + install-iptables) cmd_install_iptables ;; + remove-iptables) cmd_remove_iptables ;; + monitor) cmd_monitor ;; + status) cmd_status ;; + *) + echo "Network Monitor — C2 & Tracker Blocker" + echo "Usage: network_monitor.sh {install|remove|monitor|status}" + echo "" + echo " install Install hosts + iptables blocklists" + echo " remove Remove all blocklists" + echo " install-hosts Install hosts-based domain blocking only" + echo " install-iptables Install iptables IP blocking only" + echo " monitor Live network connection monitoring" + echo " status Show network monitor status" + ;; +esac diff --git a/vigil/lib/scanner.sh b/vigil/lib/scanner.sh new file mode 100755 index 0000000..2a257f8 --- /dev/null +++ b/vigil/lib/scanner.sh @@ -0,0 +1,362 @@ +#!/system/bin/sh +# Vigil — Threat Scanner Engine +# Scans installed packages, processes, certificates, accessibility services +# against the IOC database +# (c) Setec Labs + +VIGIL_DATA="/data/adb/vigil" +VIGIL_LOG="$VIGIL_DATA/vigil.log" +IOC_DIR="$VIGIL_DATA" +ALERT_DIR="$VIGIL_DATA/alerts" + +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [scanner] $1" >> "$VIGIL_LOG" +} + +alert() { + local severity="$1" + local message="$2" + local timestamp=$(date +%s) + echo "${severity}|${timestamp}|scanner|${message}" >> "$ALERT_DIR/pending" + log "ALERT [$severity]: $message" +} + +load_exclusions() { + EXCLUDED_PACKAGES="" + if [ -f "$VIGIL_DATA/exclusions.conf" ]; then + EXCLUDED_PACKAGES=$(grep -v '^#' "$VIGIL_DATA/exclusions.conf" | grep -v '^$') + fi +} + +is_excluded() { + local pkg="$1" + echo "$EXCLUDED_PACKAGES" | grep -qx "$pkg" 2>/dev/null +} + +# ── PACKAGE SCAN: Check installed apps against IOC package list ── +scan_packages() { + log "Scanning installed packages..." + local hits=0 + local checked=0 + local ioc_file="$IOC_DIR/packages.txt" + + if [ ! -f "$ioc_file" ]; then + log "WARNING: packages.txt IOC file not found" + return 0 + fi + + # Get installed packages + local installed=$(pm list packages 2>/dev/null | sed 's/^package://') + + for pkg in $installed; do + checked=$((checked + 1)) + + # Skip exclusions + is_excluded "$pkg" && continue + + # Check against IOC database + local match=$(grep "^${pkg}|" "$ioc_file" 2>/dev/null | head -1) + if [ -n "$match" ]; then + local threat_name=$(echo "$match" | cut -d'|' -f2) + local category=$(echo "$match" | cut -d'|' -f3) + hits=$((hits + 1)) + + case "$category" in + pegasus|government) + alert "CRITICAL" "STATE-LEVEL SPYWARE: $pkg ($threat_name) [$category]" + ;; + spyware|stalkerware) + alert "HIGH" "STALKERWARE DETECTED: $pkg ($threat_name) [$category]" + ;; + trojan) + alert "HIGH" "TROJAN DETECTED: $pkg ($threat_name) [$category]" + ;; + tracker) + alert "MEDIUM" "TRACKER APP: $pkg ($threat_name) [$category]" + ;; + *) + alert "HIGH" "THREAT DETECTED: $pkg ($threat_name) [$category]" + ;; + esac + fi + done + + log "Package scan complete: $checked checked, $hits threats found" + echo " Packages: $checked scanned, $hits threats" + return $hits +} + +# ── CERTIFICATE SCAN: Check app signing certs against IOC cert list ── +scan_certificates() { + log "Scanning app certificates..." + local hits=0 + local checked=0 + local ioc_file="$IOC_DIR/certificates.txt" + + if [ ! -f "$ioc_file" ]; then + log "WARNING: certificates.txt IOC file not found" + return 0 + fi + + # Get certificate info for each package + pm list packages 2>/dev/null | sed 's/^package://' | while read -r pkg; do + # Extract signing certificate hash from package info + local cert_info=$(dumpsys package "$pkg" 2>/dev/null | grep -A1 "signatures=" | grep -oE '[0-9a-fA-F]{40}') + + for cert_hash in $cert_info; do + checked=$((checked + 1)) + local cert_upper=$(echo "$cert_hash" | tr 'a-f' 'A-F') + local cert_lower=$(echo "$cert_hash" | tr 'A-F' 'a-f') + + local match=$(grep -i "^${cert_lower}\|^${cert_upper}" "$ioc_file" 2>/dev/null | head -1) + if [ -n "$match" ]; then + local threat_name=$(echo "$match" | cut -d'|' -f2) + hits=$((hits + 1)) + alert "HIGH" "MALICIOUS CERTIFICATE on $pkg: $cert_hash ($threat_name)" + fi + done + done + + log "Certificate scan complete: $checked checked, $hits threats found" + echo " Certificates: $checked checked, $hits threats" + return $hits +} + +# ── PROCESS SCAN: Check running processes for suspicious activity ── +scan_processes() { + log "Scanning running processes..." + local hits=0 + + # Known suspicious process patterns + local suspicious_patterns="pegasus\|predator\|chrysaor\|hermit\|candiru\|sourgum\|quadream\|cytrox\|cellebrite\|ufed\|graykey\|magnet.forensic\|oxygen.forensic\|frida-server\|objection" + + # Check running processes + ps -A -o PID,NAME 2>/dev/null | while read -r pid name; do + if echo "$name" | grep -qi "$suspicious_patterns"; then + hits=$((hits + 1)) + alert "CRITICAL" "SUSPICIOUS PROCESS: $name (PID: $pid)" + fi + done + + # Check for hidden processes (processes that don't show in normal ps) + # Compare /proc entries with ps output + local ps_pids=$(ps -A -o PID 2>/dev/null | tail -n +2 | sort -n) + for pid_dir in /proc/[0-9]*; do + local pid=$(basename "$pid_dir") + if ! echo "$ps_pids" | grep -qx "$pid" 2>/dev/null; then + local cmdline=$(cat "/proc/$pid/cmdline" 2>/dev/null | tr '\0' ' ') + if [ -n "$cmdline" ]; then + alert "HIGH" "HIDDEN PROCESS: PID $pid ($cmdline)" + hits=$((hits + 1)) + fi + fi + done + + log "Process scan complete: $hits suspicious processes" + echo " Processes: $hits suspicious" + return $hits +} + +# ── ACCESSIBILITY SCAN: Check for stalkerware abusing accessibility ── +scan_accessibility() { + log "Scanning accessibility services..." + local hits=0 + local ioc_file="$IOC_DIR/packages.txt" + + # Get enabled accessibility services + local enabled=$(settings get secure enabled_accessibility_services 2>/dev/null) + + if [ -n "$enabled" ] && [ "$enabled" != "null" ]; then + # Split by colon + echo "$enabled" | tr ':' '\n' | while read -r service; do + local pkg=$(echo "$service" | cut -d'/' -f1) + + # Check if this package is in our IOC database + if [ -f "$ioc_file" ]; then + local match=$(grep "^${pkg}|" "$ioc_file" 2>/dev/null | head -1) + if [ -n "$match" ]; then + local threat_name=$(echo "$match" | cut -d'|' -f2) + hits=$((hits + 1)) + alert "CRITICAL" "STALKERWARE ACCESSIBILITY SERVICE: $service ($threat_name)" + fi + fi + + # Heuristic: check if accessibility service belongs to a non-system app + local is_system=$(pm dump "$pkg" 2>/dev/null | grep -c "SYSTEM") + if [ "$is_system" = "0" ]; then + # Non-system app with accessibility — suspicious + local app_name=$(pm dump "$pkg" 2>/dev/null | grep "applicationInfo" | head -1) + alert "MEDIUM" "Non-system accessibility service: $service" + hits=$((hits + 1)) + fi + done + fi + + log "Accessibility scan complete: $hits suspicious services" + echo " Accessibility: $hits suspicious" + return $hits +} + +# ── DEVICE ADMIN SCAN: Check for malicious device admins ── +scan_device_admin() { + log "Scanning device administrators..." + local hits=0 + local ioc_file="$IOC_DIR/packages.txt" + + # Get active device admins + dumpsys device_policy 2>/dev/null | grep "Active Admins" -A 100 | grep "ComponentInfo" | while read -r line; do + local component=$(echo "$line" | grep -oE '\{[^}]+\}' | tr -d '{}') + local pkg=$(echo "$component" | cut -d'/' -f1) + + if [ -f "$ioc_file" ]; then + local match=$(grep "^${pkg}|" "$ioc_file" 2>/dev/null | head -1) + if [ -n "$match" ]; then + local threat_name=$(echo "$match" | cut -d'|' -f2) + hits=$((hits + 1)) + alert "CRITICAL" "MALICIOUS DEVICE ADMIN: $component ($threat_name)" + fi + fi + done + + log "Device admin scan complete: $hits suspicious" + echo " Device admins: $hits suspicious" + return $hits +} + +# ── APK HASH SCAN: Check APK file hashes (slow, thorough) ── +scan_hashes() { + log "Scanning APK hashes (this may take a while)..." + local hits=0 + local checked=0 + local ioc_file="$IOC_DIR/hashes.txt" + + if [ ! -f "$ioc_file" ]; then + log "WARNING: hashes.txt IOC file not found" + return 0 + fi + + # Scan non-system APKs + pm list packages -f 2>/dev/null | sed 's/^package://' | while IFS='=' read -r apk_path pkg; do + # Skip system apps for speed (focus on user-installed) + case "$apk_path" in + /system/*|/vendor/*|/product/*) continue ;; + esac + + checked=$((checked + 1)) + local apk_hash=$(sha256sum "$apk_path" 2>/dev/null | cut -d' ' -f1) + + if [ -n "$apk_hash" ]; then + local match=$(grep "^${apk_hash}|" "$ioc_file" 2>/dev/null | head -1) + if [ -n "$match" ]; then + local threat_name=$(echo "$match" | cut -d'|' -f2) + hits=$((hits + 1)) + alert "CRITICAL" "MALICIOUS APK HASH: $pkg ($apk_path) matches $threat_name" + fi + fi + done + + log "Hash scan complete: $checked APKs checked, $hits threats found" + echo " APK hashes: $checked checked, $hits threats" + return $hits +} + +# ── FULL SCAN ── +cmd_full_scan() { + log "=== FULL THREAT SCAN STARTED ===" + load_exclusions + + local total_hits=0 + echo "" + echo "Vigil Threat Scan Report" + echo "━━━━━━━━━━━━━━━━━━━━━━━━" + echo "Time: $(date)" + echo "" + + [ "${SCANNER_CHECK_PACKAGES:-1}" = "1" ] && { + scan_packages + total_hits=$((total_hits + $?)) + } + + [ "${SCANNER_CHECK_CERTS:-1}" = "1" ] && { + scan_certificates + total_hits=$((total_hits + $?)) + } + + [ "${SCANNER_CHECK_PROCESSES:-1}" = "1" ] && { + scan_processes + total_hits=$((total_hits + $?)) + } + + [ "${SCANNER_CHECK_ACCESSIBILITY:-1}" = "1" ] && { + scan_accessibility + total_hits=$((total_hits + $?)) + } + + [ "${SCANNER_CHECK_DEVICE_ADMIN:-1}" = "1" ] && { + scan_device_admin + total_hits=$((total_hits + $?)) + } + + [ "${SCANNER_CHECK_HASHES:-1}" = "1" ] && { + scan_hashes + total_hits=$((total_hits + $?)) + } + + echo "" + echo "━━━━━━━━━━━━━━━━━━━━━━━━" + if [ $total_hits -gt 0 ]; then + echo "⚠ THREATS DETECTED: $total_hits" + echo "Run 'vigil alerts' for details" + else + echo "✓ No threats detected" + fi + echo "" + + log "=== FULL SCAN COMPLETE: $total_hits threats ===" + return $total_hits +} + +# ── QUICK SCAN (packages + processes only) ── +cmd_quick_scan() { + log "=== QUICK SCAN STARTED ===" + load_exclusions + + local total_hits=0 + echo "Vigil Quick Scan..." + + scan_packages + total_hits=$((total_hits + $?)) + + scan_processes + total_hits=$((total_hits + $?)) + + scan_accessibility + total_hits=$((total_hits + $?)) + + if [ $total_hits -gt 0 ]; then + echo "⚠ $total_hits threats detected — run 'vigil scan' for full scan" + else + echo "✓ Quick scan clean" + fi + + log "=== QUICK SCAN COMPLETE: $total_hits threats ===" + return $total_hits +} + +# ── DISPATCH ── +case "$1" in + full) cmd_full_scan ;; + quick) cmd_quick_scan ;; + packages) load_exclusions; scan_packages ;; + certificates) scan_certificates ;; + processes) scan_processes ;; + accessibility) scan_accessibility ;; + device-admin) scan_device_admin ;; + hashes) scan_hashes ;; + *) + echo "Vigil Threat Scanner" + echo "Usage: scanner.sh {full|quick|packages|certificates|processes|accessibility|device-admin|hashes}" + ;; +esac diff --git a/vigil/lib/sms_shield.sh b/vigil/lib/sms_shield.sh new file mode 100755 index 0000000..590c227 --- /dev/null +++ b/vigil/lib/sms_shield.sh @@ -0,0 +1,201 @@ +#!/system/bin/sh +# Vigil — SMS Shield / Silent SMS Interceptor +# Detects and handles Class-0 (Flash) and Type-0 (silent) SMS pings +# used for device tracking by intelligence agencies and stalkers +# (c) Setec Labs +# +# THEORY: +# - Class-0 SMS: "Flash SMS" displayed immediately, may not be saved +# - Type-0 SMS: Completely invisible, generates delivery receipt revealing location +# - Silent SMS: Used by law enforcement/intelligence to confirm SIM is active +# and triangulate location via cell tower +# +# Android hides Type-0 SMS since May 2010 patch, but they can be detected +# via logcat at the RIL/telephony layer with root access. + +VIGIL_DATA="/data/adb/vigil" +VIGIL_LOG="$VIGIL_DATA/vigil.log" +ALERT_DIR="$VIGIL_DATA/alerts" +SMS_LOG="$VIGIL_DATA/sms_shield.log" + +[ -f "$VIGIL_DATA/vigil.conf" ] && . "$VIGIL_DATA/vigil.conf" + +log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] [sms] $1" >> "$VIGIL_LOG" +} + +alert() { + local severity="$1" + local message="$2" + local timestamp=$(date +%s) + echo "${severity}|${timestamp}|sms_shield|${message}" >> "$ALERT_DIR/pending" + log "ALERT [$severity]: $message" +} + +# ── SILENT SMS DETECTOR (via logcat) ── +# Monitors RIL/telephony logs for Type-0 and Class-0 SMS indicators +cmd_monitor() { + log "SMS Shield monitor starting..." + echo "SMS Shield active — monitoring for silent/stealth SMS" + + # Clear logcat SMS buffer to start fresh + logcat -c 2>/dev/null + + # Monitor logcat for SMS-related events + # Key patterns that indicate silent SMS: + # - "SMS type 0" or "type0" in RIL layer + # - "class 0" in SMS dispatch + # - "WAP PUSH" binary SMS + # - "GsmInboundSmsHandler" processing events + # - "SmsMessage" with TP-PID indicating silent + # - "BroadcastSmsActivity" for flash SMS + + logcat -s \ + GsmInboundSmsHandler:* \ + SmsMessage:* \ + ImsSMSDispatcher:* \ + InboundSmsHandler:* \ + CdmaInboundSmsHandler:* \ + SmsDispatchersController:* \ + RIL:* \ + RILJ:* \ + TelephonyManager:* \ + 2>/dev/null | while read -r line; do + + # Detect Type-0 SMS (completely silent) + if echo "$line" | grep -qiE "type.?0.*sms|sms.*type.?0|TP-PID.*type.?0|pid=0.*dcs"; then + local timestamp=$(date '+%Y-%m-%d %H:%M:%S') + alert "CRITICAL" "TYPE-0 SILENT SMS DETECTED — possible location tracking" + echo "$timestamp|TYPE0|$line" >> "$SMS_LOG" + + if [ "${SMS_BLOCK_SILENT:-1}" = "1" ]; then + log "Attempting to suppress delivery receipt..." + # Try to block the delivery report by toggling airplane mode briefly + # This prevents the network from confirming the SIM is active + cmd svc wifi disable 2>/dev/null + settings put global airplane_mode_on 1 2>/dev/null + am broadcast -a android.intent.action.AIRPLANE_MODE --ez state true 2>/dev/null + sleep 2 + settings put global airplane_mode_on 0 2>/dev/null + am broadcast -a android.intent.action.AIRPLANE_MODE --ez state false 2>/dev/null + cmd svc wifi enable 2>/dev/null + log "Delivery receipt suppression attempted" + fi + fi + + # Detect Class-0 SMS (Flash SMS) + if echo "$line" | grep -qiE "class.?0|flash.*sms|sms.*flash|messageClass.*CLASS_0|displayMessageBody"; then + local timestamp=$(date '+%Y-%m-%d %H:%M:%S') + alert "HIGH" "CLASS-0 FLASH SMS DETECTED — possible tracking ping" + echo "$timestamp|CLASS0|$line" >> "$SMS_LOG" + fi + + # Detect WAP Push (can be used for silent configuration) + if echo "$line" | grep -qiE "wap.*push|wap_push|application/vnd.wap"; then + local timestamp=$(date '+%Y-%m-%d %H:%M:%S') + alert "MEDIUM" "WAP PUSH SMS detected — possible OTA configuration attack" + echo "$timestamp|WAP_PUSH|$line" >> "$SMS_LOG" + fi + + # Detect binary SMS (non-text, potentially data exfil or C2) + if echo "$line" | grep -qiE "binary.*sms|sms.*binary|data_sms_received|port.*sms"; then + local timestamp=$(date '+%Y-%m-%d %H:%M:%S') + alert "MEDIUM" "BINARY SMS detected on data port" + echo "$timestamp|BINARY|$line" >> "$SMS_LOG" + fi + + # Detect USSD commands (can be used for remote device control) + if echo "$line" | grep -qiE "ussd|MMI.*code|supplementary.*service"; then + local timestamp=$(date '+%Y-%m-%d %H:%M:%S') + alert "LOW" "USSD/MMI activity detected" + echo "$timestamp|USSD|$line" >> "$SMS_LOG" + fi + + done +} + +# ── SMS HISTORY ANALYSIS ── +# Analyze existing SMS database for suspicious patterns +cmd_analyze() { + log "Analyzing SMS patterns..." + echo "SMS Pattern Analysis" + echo "━━━━━━━━━━━━━━━━━━━━" + + # Check SMS database for suspicious entries + local sms_db="/data/data/com.android.providers.telephony/databases/mmssms.db" + local sms_db_alt="/data/user_de/0/com.android.providers.telephony/databases/mmssms.db" + + local db="" + [ -f "$sms_db" ] && db="$sms_db" + [ -f "$sms_db_alt" ] && db="$sms_db_alt" + + if [ -n "$db" ] && command -v sqlite3 >/dev/null 2>&1; then + # Count SMS by type + local total=$(sqlite3 "$db" "SELECT COUNT(*) FROM sms;" 2>/dev/null) + local empty_body=$(sqlite3 "$db" "SELECT COUNT(*) FROM sms WHERE body IS NULL OR body = '';" 2>/dev/null) + local short_codes=$(sqlite3 "$db" "SELECT COUNT(*) FROM sms WHERE LENGTH(address) <= 6;" 2>/dev/null) + + echo " Total SMS: ${total:-unknown}" + echo " Empty body SMS: ${empty_body:-unknown} (potential silent SMS)" + echo " Short code SMS: ${short_codes:-unknown}" + + # Look for suspicious patterns + if [ "${empty_body:-0}" -gt 0 ]; then + alert "MEDIUM" "Found $empty_body empty-body SMS messages — possible silent SMS history" + echo "" + echo " Empty SMS details:" + sqlite3 "$db" "SELECT address, date, type FROM sms WHERE body IS NULL OR body = '' ORDER BY date DESC LIMIT 10;" 2>/dev/null | while read -r row; do + echo " $row" + done + fi + else + echo " SMS database not accessible (sqlite3 may not be available)" + echo " Install sqlite3 or use 'vigil sms monitor' for real-time detection" + fi + + # Check our own detection log + if [ -f "$SMS_LOG" ]; then + local log_entries=$(wc -l < "$SMS_LOG") + echo "" + echo " Detection log: $log_entries entries" + echo " Recent detections:" + tail -5 "$SMS_LOG" | while read -r entry; do + echo " $entry" + done + fi + + echo "━━━━━━━━━━━━━━━━━━━━" +} + +# ── STATUS ── +cmd_status() { + echo "SMS Shield Status:" + echo " Enabled: ${SMS_SHIELD_ENABLED:-1}" + echo " Silent Detect: ${SMS_SILENT_DETECT:-1}" + echo " Block Silent: ${SMS_BLOCK_SILENT:-1}" + echo " Fake Response: ${SMS_FAKE_RESPONSE:-0}" + + if [ -f "$SMS_LOG" ]; then + local total=$(wc -l < "$SMS_LOG") + local type0=$(grep -c "TYPE0" "$SMS_LOG" 2>/dev/null || echo 0) + local class0=$(grep -c "CLASS0" "$SMS_LOG" 2>/dev/null || echo 0) + echo " Detections: $total total ($type0 Type-0, $class0 Class-0)" + else + echo " Detections: none yet" + fi +} + +# ── DISPATCH ── +case "$1" in + monitor) cmd_monitor ;; + analyze) cmd_analyze ;; + status) cmd_status ;; + *) + echo "SMS Shield — Silent SMS Interceptor" + echo "Usage: sms_shield.sh {monitor|analyze|status}" + echo "" + echo " monitor Real-time silent SMS detection via logcat" + echo " analyze Analyze SMS database for suspicious patterns" + echo " status Show SMS Shield status and detection history" + ;; +esac diff --git a/vigil/signatures/cellebrite.sig b/vigil/signatures/cellebrite.sig new file mode 100644 index 0000000..522f5b3 --- /dev/null +++ b/vigil/signatures/cellebrite.sig @@ -0,0 +1,136 @@ +# Vigil Forensic Tool Signatures - Cellebrite UFED +# Format: sig_type|value|description +# Generated: 2026-03-30 | Entries: 127 +# Source: lockup (KoreLogic Cellebrite UFED research) +# sig_type: sha256, filename, path, cert_sha256, cert_issuer +# +# Binary SHA256 hashes: Cellebrite UFED privilege escalation exploits +# These are deployed to /data/local/tmp during device extraction +# +sha256|df89c654afaad67ac7e85e5d34072b5463ea0849ef3e8462a13e299baa6aa6dc|Cellebrite UFED elevator/exploit binary +sha256|a944fd9e66d6b56bd031a3236b6ae8daee4b90e4689f167c22f7c0d02eaa3a98|Cellebrite UFED elevator/exploit binary +sha256|b5804223bdf91099de465a9cdc3d6bc8aec01f19a8856f6e9bdaec3a2a941035|Cellebrite UFED elevator/exploit binary +sha256|ab8130caac25334f2ae46781e4ef625020bd95b215a427785798c729d81fc410|Cellebrite UFED elevator/exploit binary +sha256|5e8dce4e63214099c35f342c6c5a548be30ed6341ec9f4655827f28473333b6b|Cellebrite UFED elevator/exploit binary +sha256|9da883c6999f2f333ab91631946984893fc51163e0c109e8683131b4775accdb|Cellebrite UFED elevator/exploit binary +sha256|49b7368bd28c936ac824bf6040101f57f2c42ce4e9e16877dab2f44922683213|Cellebrite UFED elevator/exploit binary +sha256|ca52579b3ded35fc8337ff9763634c4bf5407a97c85d0c03fb3de16b22d7638b|Cellebrite UFED elevator/exploit binary +sha256|37178f4d2711fc132b8ef19499c1517a70f73d29dc204116a85f5e6caa025034|Cellebrite UFED elevator/exploit binary +sha256|bbe87d1cd44869ee1ba8dbca4a671965765fcd5818f16efa434bbe972961de1c|Cellebrite UFED elevator/exploit binary +sha256|3541425a729454569dccdf713f84102a8b2efeeb77abd34a6c210dd4b9b61cf4|Cellebrite UFED elevator/exploit binary +sha256|6a14b252b01f7ddc21a20a4a9577cb76c82f459652845959040eae677c0df3ce|Cellebrite UFED elevator/exploit binary +sha256|47e7ddbadcb1ec5c228413e93baa029e06f24f44e77a83e817ba48770ffddd10|Cellebrite UFED elevator/exploit binary +sha256|08853c949bbc98b9e334ae52d6d344f219e225914abaf7e813c81307a8e3bcb5|Cellebrite UFED elevator/exploit binary +sha256|856ef82bb6f1e7d940be20a049a3566842a0c9b2c8635d646fdd487a00bd051a|Cellebrite UFED elevator/exploit binary +sha256|859192e3d697a8522a7f9c19088d125b723193ce27df348712701ee78aea286c|Cellebrite UFED elevator/exploit binary +sha256|c58a06ba1b0be01c564629f76f496fc3b7e2d971c807ab6fe06ade291fafb3cc|Cellebrite UFED elevator/exploit binary +sha256|872944fcf79fb92eb5f4134d87b6f6caabc5dec919070a1109ee820442942250|Cellebrite UFED elevator/exploit binary +sha256|ab9bc4c15b1589e45dcf9c604617eaa67034c388c8b8df3af7c71dc50b29bef5|Cellebrite UFED elevator/exploit binary +sha256|23d9ce4a7df20b28d0b5b24ac320a9643c1716987dd5f29110bff71f775dca8d|Cellebrite UFED elevator/exploit binary +sha256|d3aa3c7b75e986d2addf4364f90fb948addee91deade17765a383ec69f582806|Cellebrite UFED elevator/exploit binary +sha256|07e3923c52e1c73e6ba314e230605e2ddbb5033aab75495654c131ff8b1b32a6|Cellebrite UFED elevator/exploit binary +sha256|829dd6f9fc7b39d16b3f75428b3b8417e3b411a9dbb422030f4a2d0e93dbbe3f|Cellebrite UFED elevator/exploit binary +sha256|17afd50ea379a6669e59af03fa73af816f3947ab0bc979b41e8828916c63dc49|Cellebrite UFED elevator/exploit binary +sha256|39560ebb98e6973c88e4a92fb20e5b216616e4c7f607432329f26538aff77694|Cellebrite UFED elevator/exploit binary +sha256|96ea633fe332a30f65e80e1c48ca9a0158b6e02c33afcb4d05d9d96d62135aab|Cellebrite UFED elevator/exploit binary +sha256|962390deb44b84d5781c5f0868aaea7f55d374b2db161598bebe3dd90abc1564|Cellebrite UFED elevator/exploit binary +sha256|1226873d2fac892c3187b7a7da3a1c4b2a5c31d7ecdcd0c18f7ecba4197b05f0|Cellebrite UFED elevator/exploit binary +sha256|3c6dee8fcf4a47c70be5b2b1af6a84c7b54f4941b2a341f23547f1a1db64d034|Cellebrite UFED elevator/exploit binary +sha256|064af61a468a719291779c2aab1d8fd152e66d422b402ebf112c5d896f268a52|Cellebrite UFED elevator/exploit binary +sha256|6a4e49d86f471cd5be05af0737fcc8a7f58922c591c0d03c446bd0cf3bb0d8cb|Cellebrite UFED elevator/exploit binary +sha256|6bea0ed340e33aa457ca91a986ed266906e3639bccf7ee6cdf1597ba683d25cb|Cellebrite UFED elevator/exploit binary +sha256|e228cf22fa4934168fbde171e67729c8774df3813c1d31d9e5e206a19097ab87|Cellebrite UFED elevator/exploit binary +sha256|2a797d28f44e9865d0dc0a9b7393b62e468fde03a8e1982ddb32142f7570b23b|Cellebrite UFED elevator/exploit binary +sha256|f9ca7565b557f315a9a4fc0d77571206ba8471713160784b570bebc541a29fac|Cellebrite UFED elevator/exploit binary +sha256|cac5fdb8be75968291b42ab75dd654b3b21cf5dd1a5539490e6e8e015cb2a4ff|Cellebrite UFED elevator/exploit binary +sha256|5a14004e4c1a67acfd124ff21703b78ef3710c8e81677013234b4deb6af7da66|Cellebrite UFED elevator/exploit binary +sha256|97496d8bbfb71bff2ea121ae731da8e474d1cdd6aabdb2bf1d592afe3bd649de|Cellebrite UFED elevator/exploit binary +sha256|7b6343e560c51c0152af0479a8cd9e7c74b9464f16deaaf07a7263f3b876c6e2|Cellebrite UFED elevator/exploit binary +sha256|98e2efe999a859531af4940b4fcc63725f9b84f0c14645c32fd7def907e03030|Cellebrite UFED elevator/exploit binary +sha256|945a19f4a22daab9cdea1686971a0215f777d3b19f5ee45ffcf846b3a0638cd3|Cellebrite UFED elevator/exploit binary +sha256|7e898e7d0f04e798954f285d50feb44f9697b47a443bfac27a7bedee52942bf6|Cellebrite UFED elevator/exploit binary +sha256|5de2e8d08d246a7bb5c8ddd020853dbb5896cec4149527fa9256a786ebf3541d|Cellebrite UFED elevator/exploit binary +sha256|460ba81b6dc17efe179cf7d0617ff99dc66be3be4375348f1c97a88dfa4f39ea|Cellebrite UFED elevator/exploit binary +sha256|7546f3e3e6bfd3cc3b0d91f7883e39a1c9cd39be7a3a2c72cd76d9ca5378c540|Cellebrite UFED elevator/exploit binary +sha256|5c3d38ad5f26606ca19d277ee7392b039555449ac66cc96e9ad2c818857a3b31|Cellebrite UFED elevator/exploit binary +sha256|a4ea82cd91d99bf26ca19dfd4b1969c42b5551151f1d3bdb635ebb2567e5a741|Cellebrite UFED elevator/exploit binary +sha256|6c6909839af1076330fdfd64a82d2209030fcfd3f7819acbfccc7697d7d3b5ae|Cellebrite UFED elevator/exploit binary +sha256|46a202a88af8c7208d552904cd16d28580a24830011a536c431703848c5739fb|Cellebrite UFED elevator/exploit binary +sha256|a8212687308d7067af3d25664e84ace7f84fd939914a96a1c47e67c613c7b225|Cellebrite UFED elevator/exploit binary +sha256|a75788739e8f97fd9901496f2a69d5b6b24892992c106a1e8ee06faa25076c18|Cellebrite UFED elevator/exploit binary +sha256|7efdbc53f31c24bfe0046452e902be8fd7a500aae1a97d0d554ebe2bf8f2f9d8|Cellebrite UFED elevator/exploit binary +sha256|2db036febbbad09586eac6279a4de4852c353444c4cacb7f926605d174cc7e6e|Cellebrite UFED elevator/exploit binary +sha256|8e13aff69bc075116194f9d4e2dc7f2ef38ab502903649b4da8b9fc9ce2347e4|Cellebrite UFED elevator/exploit binary +sha256|6c66e32cc3c16dca941b9322e21463bb57c99cd7f3909e748fdfa671171cf66d|Cellebrite UFED elevator/exploit binary +sha256|3254e75112c3d219e1af7bbb7be73d2cea76e4786aa9678683bf8d77f1ffbde2|Cellebrite UFED elevator/exploit binary +sha256|0519d111df96968e376a0dc1fb4c37eef35829dd0f472953e71e19d05b15eb47|Cellebrite UFED elevator/exploit binary +sha256|ffc118fc66a09e5a421f2aa5a036c0b49fb178dc9a18d847592d68ddf21cbd1e|Cellebrite UFED elevator/exploit binary +sha256|93028ad412cfc3a792614596d5db155470840bb5614eb416d9e3265b959fc95c|Cellebrite UFED elevator/exploit binary +sha256|a2ea5e0d94abb55ade88a6ffe40a73f49329347c96d334c58426e1bc0c41e72b|Cellebrite UFED elevator/exploit binary +cert_sha256|df89c654afaad67ac7e85e5d34072b5463ea0849ef3e8462a13e299baa6aa6dc|Cellebrite UFED APK signing certificate +cert_sha256|a4ea82cd91d99bf26ca19dfd4b1969c42b5551151f1d3bdb635ebb2567e5a741|Cellebrite UFED APK signing certificate +cert_sha256|6a14b252b01f7ddc21a20a4a9577cb76c82f459652845959040eae677c0df3ce|Cellebrite UFED APK signing certificate +cert_sha256|f9ca7565b557f315a9a4fc0d77571206ba8471713160784b570bebc541a29fac|Cellebrite UFED APK signing certificate +cert_sha256|5a14004e4c1a67acfd124ff21703b78ef3710c8e81677013234b4deb6af7da66|Cellebrite UFED APK signing certificate +cert_sha256|49b7368bd28c936ac824bf6040101f57f2c42ce4e9e16877dab2f44922683213|Cellebrite UFED APK signing certificate +cert_sha256|97496d8bbfb71bff2ea121ae731da8e474d1cdd6aabdb2bf1d592afe3bd649de|Cellebrite UFED APK signing certificate +cert_sha256|93028ad412cfc3a792614596d5db155470840bb5614eb416d9e3265b959fc95c|Cellebrite UFED APK signing certificate +cert_sha256|856ef82bb6f1e7d940be20a049a3566842a0c9b2c8635d646fdd487a00bd051a|Cellebrite UFED APK signing certificate +cert_sha256|945a19f4a22daab9cdea1686971a0215f777d3b19f5ee45ffcf846b3a0638cd3|Cellebrite UFED APK signing certificate +cert_sha256|962390deb44b84d5781c5f0868aaea7f55d374b2db161598bebe3dd90abc1564|Cellebrite UFED APK signing certificate +filename|nandreadStatic_7180|Cellebrite UFED exploit/elevator binary +filename|pingroot_vultest|Cellebrite UFED exploit/elevator binary +filename|DisableHuaweiLogging_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|nandread64-pie-vold|Cellebrite UFED exploit/elevator binary +filename|autonomous_app.apk|Cellebrite UFED exploit/elevator binary +filename|exploits_2.1.5769.csv|Cellebrite UFED exploit/elevator binary +filename|forensics|Cellebrite UFED exploit/elevator binary +filename|nandreadStatic_1788|Cellebrite UFED exploit/elevator binary +filename|rootspot_verify_env|Cellebrite UFED exploit/elevator binary +filename|EnableHuaweiLogging_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|frida_script_obfuscated.js|Cellebrite UFED exploit/elevator binary +filename|manifest.webapp|Cellebrite UFED exploit/elevator binary +filename|c2a_disable_selinux_64.ko|Cellebrite UFED exploit/elevator binary +filename|EnableSharpRead_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|com.mr.meeseeks.apk|Cellebrite UFED exploit/elevator binary +filename|nandreadPie_7182|Cellebrite UFED exploit/elevator binary +filename|salamtak32|Cellebrite UFED exploit/elevator binary +filename|pingroot|Cellebrite UFED exploit/elevator binary +filename|zergRush_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|psneuter_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|shellcode_32_iptables.bin|Cellebrite UFED exploit/elevator binary +filename|dirtycow_32|Cellebrite UFED exploit/elevator binary +filename|nandreadPie_1788|Cellebrite UFED exploit/elevator binary +filename|shellcode_32_oatdump.bin|Cellebrite UFED exploit/elevator binary +filename|django_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|fourrunnerStatic_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|index.html|Cellebrite UFED exploit/elevator binary +filename|rosecure_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|patcher.exe|Cellebrite UFED exploit/elevator binary +filename|nandd|Cellebrite UFED exploit/elevator binary +filename|c2a_disable_selinux_32.ko|Cellebrite UFED exploit/elevator binary +filename|dirtycow|Cellebrite UFED exploit/elevator binary +filename|setuid_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|RecoveryImageMap.csv|Cellebrite UFED exploit/elevator binary +filename|salamtak64|Cellebrite UFED exploit/elevator binary +filename|gb_2.1.5767a|Cellebrite UFED exploit/elevator binary +filename|nandreadStatic_7182|Cellebrite UFED exploit/elevator binary +filename|nandread-pie_7182|Cellebrite UFED exploit/elevator binary +filename|shellcode.bin|Cellebrite UFED exploit/elevator binary +filename|nandread-pie-vold|Cellebrite UFED exploit/elevator binary +filename|daemonize|Cellebrite UFED exploit/elevator binary +filename|adbd.bin|Cellebrite UFED exploit/elevator binary +filename|nandreadPie_7181|Cellebrite UFED exploit/elevator binary +filename|rootspotter.apk|Cellebrite UFED exploit/elevator binary +path|/data/local/tmp|Cellebrite UFED staging directory +path|/data/local/tmp/cb|Cellebrite UFED staging directory +path|/data/app-asec/data/local/tmp|Cellebrite UFED staging directory +path|/cblr|Cellebrite UFED staging directory +cert_issuer|CN=Oleg Beloussov,OU=mobile secure,O=BeloussovOleg ltd.,L=Tel Aviv,ST=Israel,C=092|Cellebrite UFED APK certificate issuer DN +cert_issuer|C=IL|Cellebrite UFED APK certificate issuer DN +cert_issuer|CN=Cellebrite|Cellebrite UFED APK certificate issuer DN +cert_issuer|O=Cellebrite|Cellebrite UFED APK certificate issuer DN +cert_issuer|CN=mr meeseeks,OU=cell|Cellebrite UFED APK certificate issuer DN +cert_issuer|C=IL,L=Tel Aviv,O=Cellebrite,OU=Research,CN=Cellebrite Cellebrite|Cellebrite UFED APK certificate issuer DN +cert_issuer|CN=KYOCERA Corporation,OU=KYOCERA Corporation,O=KYOCERA Corporation,L=Fushimi,ST=Kyoto,C=JP|Cellebrite UFED APK certificate issuer DN +cert_issuer|CN=aaa,OU=aaa,O=aaa,L=aaaaa,ST=aaa,C=aaa|Cellebrite UFED APK certificate issuer DN