apt_chamelgang.txt

# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/

115.144.122.8:5555
45.91.24.73:8996
http://42.99.116.14
http://45.99.116.14
api.microsofed.com
app.centralgoogle.com
app.tstartel.org
appupdate.ibmlotus.net
auth.newtrendmicro.com
cdn-chrome.com
centralgoogle.com
cn.mcafee-service.us.com
collector.centralgoogle.com
content.centralgoogle.com
content.newtrendmicro.com
contents.newtrendmicro.com
derbox.centralgoogle.com
docs.microsoft-support.net
download.softupdate-online.top
downloads.softupdate-online.top
en.mcafee-service.us.com
funding-exchange.org
helpdisk.ibmlotus.net
ibmlotus.net
internet.softupdate-online.top
jumper.funding-exchange.org
kaspernsky.com
login.cdn-chrome.com
mail.ibmlotus.net
mail.tstartel.org
market.newtrendmicro.com
mcafee-service.us.com
mcafee-upgrade.com
microsofed.com
microsoft-support.net
newtrendmicro.com
online.softupdate-online.top
os.microsoft-support.net
search.ibmlotus.net
snn1.mhysl.org
snn2.mhysl.org
snn3.mhysl.org
softupdate-online.top
ssl.mcafee-upgrade.com
static.mhysl.org
test.mcafee-upgrade.com
tstartel.org
tw.mcafee-upgrade.com
update.kaspernsky.com
update.softupdate-online.top
upgrade.ibmlotus.net
upgrade.newtrendmicro.com
us.mcafee-upgrade.com
webmail.tstartel.org

# Reference: https://stairwell.com/news/chamelgang-and-chameldoh-a-dns-over-https-implant/
# Reference: https://otx.alienvault.com/pulse/64907e470e46bba8d3b68d52

ns1.marocfamily.com
ns1.marocfamilym.com
ns1.marocfamilyx.com
ns1.spezialsex.com
ns2.marocfamily.com
ns2.spezialsex.com
ns30.mayashopping.net
ns31.mayashopping.net
update.microsoft-support.net

# Generic

/vuln6581362514513155613jboss