devilstongue.txt

# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: Candiru, DevilsTongue

# Reference: https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/ (# CVE-2021-31979, CVE-2021-33771, CVE-2021-21166, CVE-2021-30551, CVE-2021-33742)
# Reference: https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
# Reference: https://otx.alienvault.com/pulse/60f05cb87f7c642309de71ef

adtracker.link
amazon-cz.eu
amnestyreports.com
apple-updates.online
armenpress.net
backxercise.com
bitly.tel
blacklivesmatters.info
cdnmobile.io
cnn24-7.online
codeingasmylife.com
colorpallatess.com
cortanaupdates.com
cyprusnet.tk
drpbx-update.net
dw-arabic.com
eulenformacion.com
euro-news.online
faceb00k-live.com
fbcdnads.live
france-24.news
genderconference.org
googlplay.store
grayhornet.com
hilocake.info
indoprogress.co
instagrarn.co
johnshopkin.net
kenoratravels.com
konferenciya-zoom.com
kupony-rohlik.cz
lenovo-setup.tk
library-update.com
linkedin-jobs.com
llink.link
lwaeh-iteham-alasra.com
mbsmetoo.com
minstagram.net
msstore.io
nmcyclingexperience.com
noc-service-streamer.com
oiip.org
online-affiliate-mon.com
online-source-validate.com
osesgy-unmissions.org
pochtarossiy.info
rasef22.com
refugeeinternational.org
service-deamon.com
tehrantimes.org
total-slovenia-news.net
twitt-live.com
un-asia.co
url-tiny.co
useproof.cc
vesteldefnce.io
vfsglobal.fr
weathercheck.digital
whoint.co
wikipediaathome.net
winmslaf.xyz
womanstudies.co
yeni-safak.com
youtubee.life
zcombinator.co

# Reference: https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/
# Reference: https://otx.alienvault.com/pulse/6194c2377054cd0b3046ca6c

addthis.events
bit-ly.site
bitly.bz
bitly.tw
bitly.zone
bootstrapcdn.net
code-afsanalytics.com
cuturl.space
doubleclick.ac
engagebay.cc
fonts-gstatic.net
livesesion.bid
livesession.bid
medica-tradefair.co
moatads.co
piwiks.com
rebrandly.site
sherathis.com
shortlinkcut.link
site-improve.net
sitei-mprove.net
static-doubleclick.net
tinyurl.bz
tinyurl.ist
tinyurl.one
tinyurl.photos
tinyurl.plus
webfex.bz
webfx.cc
yektenet.com

# Reference: https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/

stat.email

# Reference: https://twitter.com/felixaime/status/1550443808709611522

7aqibatmosafer.com
aqaf.net
babiesfood.org
checkhotel.net
clicks.email
covid19sorgu.com
cuisinewithpaula.com
datanalytic.org
externalcloud.org
extremebirdwatching.com
fatura-sorgu.com
gelora.org
gerillaonline.net
gundeminfo.com
haqqin-news.com
justiceukraine.com
kazatutanagi.net
mailclick.info
mathsolve.info
myems-express.info
mylastnews.com
nusantaraqurban.com
only-music.net
oxu-xeber.com
padpay.org
pinkbulldoginu.com
pinkbulldoginu.net
pinkbulldoginu.org
proqnoz24.com
querylight.net
qurbanbandung.net
reporttoday.org
savealltrees.com
servers-mail.net
shippingnow.org
shopscreen.org
supportservicespro.com
syrianinfo.com
techmails.net
tennnisfield.com
updatenewsletters.com
usb-shops.com
uyapsorgulama.net
xeberim24.info
yeni-elan.com

# Reference: https://twitter.com/r0ny_123/status/1550461250928144384

getscreensupport.com
uavboss.com

# Reference: https://twitter.com/blackorbird/status/1550647971599233025

stylishblock.com

# Reference: https://twitter.com/sekoia_io/status/1601166853673431040

captivelogin.net
koronamiyim.com
olkem.net
opinionlimit.org
parkdev.net
seffafxeber.com
vergisorgula.com