← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
23.227.38.32 + luv[txt]vbs
WHITE msudosos 2026-05-01 Modified: 2026-05-30
6302
IOCs
HIGH VOLUME
This domain has a high-volume repository for malicious activity, currently hosting 94.2K communicating files, 200 Passive DNS entries, and 133 referring files. The presence of the luv[txt]vbs script, a known delivery mechanism for broader compromises exists. Technical Findings: Scale of Infiltration: I have successfully ingested and uploaded the 133 referring files and a significant sample of the 94.2K communicating files. Due to the massive scale of this repository, full ingestion is ongoing; however, the primary infection vector is confirmed to be targeting Windows [EXE] documents, as evidenced by high-frequency VirusTotal (VT) flagging.Stealth & Obfuscation Techniques: The domain contains a subset of documents disguised as "classroom education" materials. These files utilize a specific obfuscation technique where the first letter of the filename or content is omitted.
Indicators of Compromise (568 / 6302 total)
All IPv4 domain URL FileHash-SHA256 hostname FileHash-MD5 FileHash-SHA1 email CIDR
TYPEINDICATORDESCRIPTIONCREATED
URL http://www.google.com/url?client=internal-element-cse&cx=003414466004237966221:dgg7iftvryo&q=https://medium.com/%40aglerj/scouring-for-unsecured-cloud-buckets-d3fe1eb075cb&sa=U&ved=2ahUKEwjMqKbN75aUAxXuF2IAHdgLPIkQFnoECAIQAg&usg=AOvVaw39xs6Mw34LDhseyH_qJ3ts&fexp=121636677 — 2026-05-01
URL http://airairbnb.com/ — 2026-05-01
URL http://installturobotax.com/ — 2026-05-01
URL http://jordonmaxwellshow.com/ — 2026-05-01
URL http://seanmcommnumlty.com/ — 2026-05-01
URL http://ww1.airairbnb.com/ — 2026-05-01
URL http://ww1.seanmcommnumlty.com/ — 2026-05-01
URL http://ww1.thekentkitchencompany.co.uk/ — 2026-05-01
URL http://www.installturobotax.com/ — 2026-05-01
URL http://www.ndetflix.com/ — 2026-05-01
URL https://airairbnb.com/ — 2026-05-01
URL https://bigfisgames.com/ — 2026-05-01
URL https://installturobotax.com/ — 2026-05-01
URL https://seanmcommnumlty.com/ — 2026-05-01
URL https://ww1.airairbnb.com/ — 2026-05-01
URL https://ww1.cebupacificar.com/ — 2026-05-01
URL https://ww1.chinasemservice.com/ — 2026-05-01
URL https://ww1.seanmcommnumlty.com/ — 2026-05-01
URL https://www.bigfisgames.com/ — 2026-05-01
URL https://www.installturobotax.com/ — 2026-05-01
URL https://www.ndetflix.com/ — 2026-05-01
URL http://70.eu/ — 2026-05-01
URL http://adhesivesupplies.com/ — 2026-05-01
URL http://advertisingclips.com/ — 2026-05-01
URL http://all4nothin.net/announce.php — 2026-05-01
URL http://aprendebranding.com — 2026-05-01
URL http://carnevalsclub.de/ — 2026-05-01
URL http://elinksecure.com — 2026-05-01
URL http://emailspamtest.com/ — 2026-05-01
URL http://eyedow.com/ — 2026-05-01
URL http://hardreset.eu/ — 2026-05-01
URL http://rvkc.com/ — 2026-05-01
URL http://sterlingbooks.be/ — 2026-05-01
URL http://tally.com/ — 2026-05-01
URL http://webcomm.ch/ — 2026-05-01
URL http://www.carnevalsclub.de/ — 2026-05-01
URL http://www.webcomm.ch/ — 2026-05-01
URL http://xn--rauch-mbel-kcb.de/ — 2026-05-01
URL http://ww1.airairbnb.com — 2026-05-01
URL http://www.airairbnb.com/ — 2026-05-01
URL http://www.ww1.airairbnb.com/ — 2026-05-01
URL https://ww1.airairbnb.com — 2026-05-01
URL https://www.airairbnb.com/ — 2026-05-01
URL https://www.ww1.airairbnb.com/ — 2026-05-01
URL http://airairbnb.com/ — 2026-05-01
URL http://installturobotax.com/ — 2026-05-01
URL http://jordonmaxwellshow.com/ — 2026-05-01
URL http://seanmcommnumlty.com/ — 2026-05-01
URL http://ww1.airairbnb.com/ — 2026-05-01
URL http://ww1.seanmcommnumlty.com/ — 2026-05-01
URL http://ww1.thekentkitchencompany.co.uk/ — 2026-05-01
URL http://www.installturobotax.com/ — 2026-05-01
URL http://www.ndetflix.com/ — 2026-05-01
URL https://airairbnb.com/ — 2026-05-01
URL https://bigfisgames.com/ — 2026-05-01
URL https://installturobotax.com/ — 2026-05-01
URL https://seanmcommnumlty.com/ — 2026-05-01
URL https://ww1.airairbnb.com/ — 2026-05-01
URL https://ww1.cebupacificar.com/ — 2026-05-01
URL https://ww1.chinasemservice.com/ — 2026-05-01
URL https://ww1.seanmcommnumlty.com/ — 2026-05-01
URL https://www.bigfisgames.com/ — 2026-05-01
URL https://www.installturobotax.com/ — 2026-05-01
URL https://www.ndetflix.com/ — 2026-05-01
URL http://www.google.com/url?client=internal-element-cse&cx=003414466004237966221:dgg7iftvryo&q=https://medium.com/%40aglerj/scouring-for-unsecured-cloud-buckets-d3fe1eb075cb&sa=U&ved=2ahUKEwjMqKbN75aUAxXuF2IAHdgLPIkQFnoECAIQAg&usg=AOvVaw39xs6Mw34LDhseyH_qJ3ts&fexp=121636677 — 2026-05-01
URL http://aewrhprres.com/ — 2026-05-01
URL http://airairbnb.com — 2026-05-01
URL http://airairbnb.com/ — 2026-05-01
URL http://apacheopenoffice.org/ — 2026-05-01
URL http://artistxerocreations.com — 2026-05-01
URL http://artistxerocreations.com/slil/richolo — 2026-05-01
URL http://atusaa.com/ — 2026-05-01
URL http://bigfisgames.com/ — 2026-05-01
URL http://hubinnternational.com — 2026-05-01
URL http://installturobotax.com/ — 2026-05-01
URL http://jordonmaxwellshow.com/ — 2026-05-01
URL http://linkedinj.com/ — 2026-05-01
URL http://linkedint.com/ — 2026-05-01
URL http://myetherevvalliet.com — 2026-05-01
URL http://seanmcommnumlty.com/ — 2026-05-01
URL http://sensiemerson.com/ — 2026-05-01
URL http://tge-me.com/ojycj — 2026-05-01
URL http://wanfangmaiers.com/admin/controller/extension/theme/My_Gov/Otp2.php — 2026-05-01
URL http://wanfangmaiers.com/admin/controller/extension/theme/My_Gov/full_info.php — 2026-05-01
URL http://wanfangmaiers.com/admin/controller/extension/theme/My_Gov/index_check.php — 2026-05-01
URL http://ww1.aanparshnh.com/ — 2026-05-01
URL http://ww1.aewrhprres.com/ — 2026-05-01
URL http://ww1.airairbnb.com — 2026-05-01
URL http://ww1.airairbnb.com/ — 2026-05-01
URL http://ww1.azurewebsistes.net/ — 2026-05-01
URL http://ww1.bahiswon24.com/ — 2026-05-01
URL http://ww1.capitalone360savingsaccoutlitigation.com/ — 2026-05-01
URL http://ww1.carclearancetc.co.uk/ — 2026-05-01
URL http://ww1.dailyquotes4free.com/ — 2026-05-01
URL http://ww1.filmsnews21.com/ — 2026-05-01
URL http://ww1.gametrackofficial.com/ — 2026-05-01
URL http://ww1.mdsmanuals.com/ — 2026-05-01
URL http://ww1.mijracing.co.uk/ — 2026-05-01
URL http://ww1.scoire.com/ — 2026-05-01
URL http://ww1.seanmcommnumlty.com/ — 2026-05-01
URL http://ww1.ssleaner.com/ — 2026-05-01
URL http://ww1.tenembeeevents.co.uk/ — 2026-05-01
URL http://ww1.thekentkitchencompany.co.uk/ — 2026-05-01
URL http://ww1.vrtytyu.com/ — 2026-05-01
URL http://ww1.windos93.net/ — 2026-05-01
URL http://www.adadsonline.com/ — 2026-05-01
URL http://www.apacheopenoffice.org/ — 2026-05-01
URL http://www.bigfisgames.com/ — 2026-05-01
URL http://www.idmediciad.com/ — 2026-05-01
URL http://www.installturobotax.com/ — 2026-05-01
URL http://www.jordonmaxwellshow.com/ — 2026-05-01
URL http://www.ndetflix.com/ — 2026-05-01
URL http://www.sensiemerson.com/ — 2026-05-01
URL http://www.westmerciaapas.co.uk/ — 2026-05-01
URL https://aewrhprres.com/ — 2026-05-01
URL https://airairbnb.com — 2026-05-01
URL https://airairbnb.com/ — 2026-05-01
URL https://apacheopenoffice.org/ — 2026-05-01
URL https://artistxerocreations.com — 2026-05-01
URL https://bigfisgames.com/ — 2026-05-01
URL https://hubinnternational.com — 2026-05-01
URL https://idmediciad.com/ — 2026-05-01
URL https://installturobotax.com/ — 2026-05-01
URL https://jordonmaxwellshow.com/ — 2026-05-01
URL https://myetherevvalliet.com — 2026-05-01
URL https://seanmcommnumlty.com/ — 2026-05-01
URL https://selectiondulocker.com/ — 2026-05-01
URL https://steamcommuntiuy.com/profiles/76561198751499792 — 2026-05-01
URL https://ww1.airairbnb.com — 2026-05-01
URL https://ww1.airairbnb.com/ — 2026-05-01
URL https://ww1.azurewebsistes.net/ — 2026-05-01
URL https://ww1.bahiswon24.com/ — 2026-05-01
URL https://ww1.boitchesgirls.com/ — 2026-05-01
URL https://ww1.capitalone360savingsaccoutlitigation.com/ — 2026-05-01
URL https://ww1.cebupacificar.com/ — 2026-05-01
URL https://ww1.chinasemservice.com/ — 2026-05-01
URL https://ww1.dailyquotes4free.com/ — 2026-05-01
URL https://ww1.didacticaeducativa.com/ — 2026-05-01
URL https://ww1.furiousfar.com/ — 2026-05-01
URL https://ww1.gametrackofficial.com/ — 2026-05-01
URL https://ww1.harris-teeter.com/ — 2026-05-01
URL https://ww1.landstonedrivewaysandlandscapes.co.uk/ — 2026-05-01
URL https://ww1.mdsmanuals.com/ — 2026-05-01
URL https://ww1.mybusinesslibertymutual.com/ — 2026-05-01
URL https://ww1.offalolyingston.com/ — 2026-05-01
URL https://ww1.playhom.com/ — 2026-05-01
URL https://ww1.seanmcommnumlty.com/ — 2026-05-01
URL https://ww1.stylevana.uk/ — 2026-05-01
URL https://ww1.vrtytyu.com/ — 2026-05-01
URL https://ww1.xhtree2.com/ — 2026-05-01
URL https://www.apacheopenoffice.org/ — 2026-05-01
URL https://www.bigfisgames.com/ — 2026-05-01
URL https://www.idmediciad.com/ — 2026-05-01
URL https://www.installturobotax.com/ — 2026-05-01
URL https://www.jordonmaxwellshow.com/ — 2026-05-01
URL https://www.ndetflix.com/ — 2026-05-01
URL https://www.sensiemerson.com/ — 2026-05-01
URL http://aewrhprres.com/ — 2026-05-01
URL http://airairbnb.com — 2026-05-01
URL http://airairbnb.com/ — 2026-05-01
URL http://apacheopenoffice.org/ — 2026-05-01
URL http://artistxerocreations.com — 2026-05-01
URL http://artistxerocreations.com/slil/richolo — 2026-05-01
URL http://atusaa.com/ — 2026-05-01
URL http://bigfisgames.com/ — 2026-05-01
URL http://hubinnternational.com — 2026-05-01
URL http://installturobotax.com/ — 2026-05-01
URL http://jordonmaxwellshow.com/ — 2026-05-01
URL http://linkedinj.com/ — 2026-05-01
URL http://linkedint.com/ — 2026-05-01
URL http://myetherevvalliet.com — 2026-05-01
URL http://seanmcommnumlty.com/ — 2026-05-01
URL http://sensiemerson.com/ — 2026-05-01
URL http://tge-me.com/ojycj — 2026-05-01
URL http://wanfangmaiers.com/admin/controller/extension/theme/My_Gov/Otp2.php — 2026-05-01
URL http://wanfangmaiers.com/admin/controller/extension/theme/My_Gov/full_info.php — 2026-05-01
URL http://wanfangmaiers.com/admin/controller/extension/theme/My_Gov/index_check.php — 2026-05-01
URL http://ww1.aanparshnh.com/ — 2026-05-01
URL http://ww1.aewrhprres.com/ — 2026-05-01
URL http://ww1.airairbnb.com — 2026-05-01
URL http://ww1.airairbnb.com/ — 2026-05-01
URL http://ww1.azurewebsistes.net/ — 2026-05-01
URL http://ww1.bahiswon24.com/ — 2026-05-01
URL http://ww1.capitalone360savingsaccoutlitigation.com/ — 2026-05-01
URL http://ww1.carclearancetc.co.uk/ — 2026-05-01
URL http://ww1.dailyquotes4free.com/ — 2026-05-01
URL http://ww1.filmsnews21.com/ — 2026-05-01
URL http://ww1.gametrackofficial.com/ — 2026-05-01
URL http://ww1.mdsmanuals.com/ — 2026-05-01
URL http://ww1.mijracing.co.uk/ — 2026-05-01
URL http://ww1.scoire.com/ — 2026-05-01
URL http://ww1.seanmcommnumlty.com/ — 2026-05-01
URL http://ww1.ssleaner.com/ — 2026-05-01
URL http://ww1.tenembeeevents.co.uk/ — 2026-05-01
URL http://ww1.thekentkitchencompany.co.uk/ — 2026-05-01
URL http://ww1.vrtytyu.com/ — 2026-05-01
URL http://ww1.windos93.net/ — 2026-05-01
URL http://www.adadsonline.com/ — 2026-05-01
URL http://www.apacheopenoffice.org/ — 2026-05-01
URL http://www.bigfisgames.com/ — 2026-05-01
URL http://www.idmediciad.com/ — 2026-05-01
URL http://www.installturobotax.com/ — 2026-05-01
URL http://www.jordonmaxwellshow.com/ — 2026-05-01
URL http://www.ndetflix.com/ — 2026-05-01
URL http://www.sensiemerson.com/ — 2026-05-01
URL http://www.westmerciaapas.co.uk/ — 2026-05-01
URL https://aewrhprres.com/ — 2026-05-01
URL https://airairbnb.com — 2026-05-01
URL https://airairbnb.com/ — 2026-05-01
URL https://apacheopenoffice.org/ — 2026-05-01
URL https://artistxerocreations.com — 2026-05-01
URL https://bigfisgames.com/ — 2026-05-01
URL https://hubinnternational.com — 2026-05-01
URL https://idmediciad.com/ — 2026-05-01
URL https://installturobotax.com/ — 2026-05-01
URL https://jordonmaxwellshow.com/ — 2026-05-01
URL https://myetherevvalliet.com — 2026-05-01
URL https://seanmcommnumlty.com/ — 2026-05-01
URL https://selectiondulocker.com/ — 2026-05-01
URL https://steamcommuntiuy.com/profiles/76561198751499792 — 2026-05-01
URL https://ww1.airairbnb.com — 2026-05-01
URL https://ww1.airairbnb.com/ — 2026-05-01
URL https://ww1.azurewebsistes.net/ — 2026-05-01
URL https://ww1.bahiswon24.com/ — 2026-05-01
URL https://ww1.boitchesgirls.com/ — 2026-05-01
URL https://ww1.capitalone360savingsaccoutlitigation.com/ — 2026-05-01
URL https://ww1.cebupacificar.com/ — 2026-05-01
URL https://ww1.chinasemservice.com/ — 2026-05-01
URL https://ww1.dailyquotes4free.com/ — 2026-05-01
URL https://ww1.didacticaeducativa.com/ — 2026-05-01
URL https://ww1.furiousfar.com/ — 2026-05-01
URL https://ww1.gametrackofficial.com/ — 2026-05-01
URL https://ww1.harris-teeter.com/ — 2026-05-01
URL https://ww1.landstonedrivewaysandlandscapes.co.uk/ — 2026-05-01
URL https://ww1.mdsmanuals.com/ — 2026-05-01
URL https://ww1.mybusinesslibertymutual.com/ — 2026-05-01
URL https://ww1.offalolyingston.com/ — 2026-05-01
URL https://ww1.playhom.com/ — 2026-05-01
URL https://ww1.seanmcommnumlty.com/ — 2026-05-01
URL https://ww1.stylevana.uk/ — 2026-05-01
URL https://ww1.vrtytyu.com/ — 2026-05-01
URL https://ww1.xhtree2.com/ — 2026-05-01
URL https://www.apacheopenoffice.org/ — 2026-05-01
URL https://www.bigfisgames.com/ — 2026-05-01
URL https://www.idmediciad.com/ — 2026-05-01
URL https://www.installturobotax.com/ — 2026-05-01
URL https://www.jordonmaxwellshow.com/ — 2026-05-01
URL https://www.ndetflix.com/ — 2026-05-01
URL https://www.sensiemerson.com/ — 2026-05-01
URL http://aamanhswhs.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://aewrhprres.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ahprhhsmnr.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://apemasmshh.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://apmhephmnn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://asqnannrwn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://awwmhpnaqn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://eanesaeana.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://eesmwweanr.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ehwrqwrrqs.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://esmasmqqhs.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ewnwnrhnmh.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://haearrsqhn.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hesasheqhn.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmamsmwhar.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmhheneeqh.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmmpnpehqs.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmparqsaqa.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hnepeqpera.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hwnppemeea.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mewahwhsna.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mhhweqaama.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mhphemmpns.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mmheeahhss.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mraqapeqsa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://msarphnewh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mwhnpqrmrn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mwqaspaqrh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://nqenrpwpeh.us/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://nwmsqrapmh.us/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://phrnmapqqa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pnaqheqnsa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ppeseaqmms.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pprehqnmmn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pqshhpemrn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://prpwhsmpwh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwqpewwahh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwramqmsms.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwshrrpmrh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qapmmrqrwa.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qasqhaqwrn.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qmamrhhrwh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qmhqeesawh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnnqaasrrh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnrnwnwaas.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnrqqrrwra.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsansspsar.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsmapshhqh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsqpspspqn.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://remrpqpseh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rmpeaqrwwh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rmsapnwmsr.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rnwmmwqrsh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rqahepwann.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rqrawrqsqs.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rsqwqsewms.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rwshappwma.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://sammppesmh.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://smeawmehns.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://snhpmwqera.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://snphrmwehh.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://spawwehsrs.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://sqhnmhrann.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://srhpphwmms.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ssnsphrnws.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://swmwrnhsar.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://weaeprawra.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://weepsaneha.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://whmqahwees.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wmspppenas.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wnshehamhh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wpqqhhspps.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://aamanhswhs.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://aewrhprres.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ahprhhsmnr.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://apemasmshh.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://apmhephmnn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://asqnannrwn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://awwmhpnaqn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://eanesaeana.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://eesmwweanr.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ehwrqwrrqs.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://esmasmqqhs.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ewnwnrhnmh.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://haearrsqhn.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hesasheqhn.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmamsmwhar.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmhheneeqh.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmmpnpehqs.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmparqsaqa.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hnepeqpera.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hwnppemeea.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mewahwhsna.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mhhweqaama.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mhphemmpns.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mmheeahhss.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mraqapeqsa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://msarphnewh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mwhnpqrmrn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mwqaspaqrh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://nqenrpwpeh.us/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://nwmsqrapmh.us/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://phrnmapqqa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pnaqheqnsa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ppeseaqmms.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pprehqnmmn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pqshhpemrn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://prpwhsmpwh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwqpewwahh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwramqmsms.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwshrrpmrh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qapmmrqrwa.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qasqhaqwrn.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qmamrhhrwh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qmhqeesawh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnnqaasrrh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnrnwnwaas.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnrqqrrwra.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsansspsar.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsmapshhqh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsqpspspqn.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://remrpqpseh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rmpeaqrwwh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rmsapnwmsr.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rnwmmwqrsh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rqahepwann.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rqrawrqsqs.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rsqwqsewms.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rwshappwma.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://sammppesmh.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://smeawmehns.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://snhpmwqera.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://snphrmwehh.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://spawwehsrs.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://sqhnmhrann.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://srhpphwmms.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ssnsphrnws.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://swmwrnhsar.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://weaeprawra.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://weepsaneha.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://whmqahwees.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wmspppenas.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wnshehamhh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wpqqhhspps.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://aamanhswhs.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://aewrhprres.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ahprhhsmnr.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://apemasmshh.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://apmhephmnn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://asqnannrwn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://awwmhpnaqn.com/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://eanesaeana.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://eesmwweanr.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ehwrqwrrqs.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://esmasmqqhs.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ewnwnrhnmh.ws/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://haearrsqhn.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hesasheqhn.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmamsmwhar.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmhheneeqh.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmmpnpehqs.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hmparqsaqa.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hnepeqpera.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://hwnppemeea.net/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mewahwhsna.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mhhweqaama.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mhphemmpns.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mmheeahhss.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mraqapeqsa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://msarphnewh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mwhnpqrmrn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://mwqaspaqrh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://nqenrpwpeh.us/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://nwmsqrapmh.us/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://phrnmapqqa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pnaqheqnsa.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ppeseaqmms.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pprehqnmmn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pqshhpemrn.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://prpwhsmpwh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwqpewwahh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwramqmsms.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://pwshrrpmrh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qapmmrqrwa.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qasqhaqwrn.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qmamrhhrwh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qmhqeesawh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnnqaasrrh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnrnwnwaas.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qnrqqrrwra.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsansspsar.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsmapshhqh.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://qsqpspspqn.info/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://remrpqpseh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rmpeaqrwwh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rmsapnwmsr.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rnwmmwqrsh.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rqahepwann.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rqrawrqsqs.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rsqwqsewms.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://rwshappwma.org/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://sammppesmh.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://smeawmehns.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://snhpmwqera.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://snphrmwehh.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://spawwehsrs.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://sqhnmhrann.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://srhpphwmms.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://ssnsphrnws.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://swmwrnhsar.biz/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://weaeprawra.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://weepsaneha.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://whmqahwees.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wmspppenas.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wnshehamhh.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://wpqqhhspps.in/imgs/krewa/nqxa.php?id=2481btni&s5=3159&lip=192.168.122.67&win=fWinS — 2026-05-01
URL http://2.0.0.0 — 2026-05-01
URL http://electricity.co.ke — 2026-05-01
URL http://haysoft.org — 2026-05-01
URL http://rsc.io/quote — 2026-05-01
URL http://rsc.io/quote$' — 2026-05-01
URL http://soapinterop.org/xsd — 2026-05-01
URL http://www.chawg.org — 2026-05-01
URL http://www.developershome.com/7-zip/ — 2026-05-01
URL http://www.oruddho.com — 2026-05-01
URL http://www.prizeeinternational.com — 2026-05-01
URL http://www.teisininkas.lt/ivairus/7-zip: — 2026-05-01
URL http://ns.attribution.com/ads/1.0/ — 2026-05-01
URL http://www.mitsubishi-tv.com/ — 2026-05-01
URL http://131.107.255.255 — 2026-05-01
URL http://authrootstl.cab?9653cd009836544a — 2026-05-01
URL http://disallowedcertstl.cab?0a82c1676432a265 — 2026-05-01
URL http://disallowedcertstl.cab?e8e6eecb108e2cf0 — 2026-05-01
URL http://example.com/a — 2026-05-01
URL http://example.com/b — 2026-05-01
URL http://example.com/depends/on/generics@v1.0.0 — 2026-05-01
URL http://example.com/m — 2026-05-01
URL http://example.com/missingpkg — 2026-05-01
URL http://example.com/missingpkg/deprecated — 2026-05-01
URL http://example.com/usemissingpre — 2026-05-01
URL http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9653cd009836544a — 2026-05-01
URL http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0a82c1676432a265 — 2026-05-01
URL http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e8e6eecb108e2cf0 — 2026-05-01
URL http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?48a2e1f6dfda74ff — 2026-05-01
URL http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?f06c4e10bbb50bc8 — 2026-05-01
URL http://download.windowsupdate.com/d/msdownload/update/others/2015/05/17930914_a3b333eff1f0428f5a2c87724c542504821cdbd8.cab — 2026-05-01
URL http://example.com/ — 2026-05-01
URL http://example.com/' — 2026-05-01
URL http://hi.baidu.com/saqirilatuu/item/9438213716f316ebe7bb7a8d — 2026-05-01
URL http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D — 2026-05-01
URL http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D — 2026-05-01
URL http://s1.symcb.com/pca3-g5.crl — 2026-05-01
URL http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D — 2026-05-01
URL http://schemas.xmlsoap.org/soap/encoding/ — 2026-05-01
URL http://schemas.xmlsoap.org/soap/envelope/ — 2026-05-01
URL http://schemas.xmlsoap.org/soap/http — 2026-05-01
URL http://schemas.xmlsoap.org/wsdl/ — 2026-05-01
URL http://schemas.xmlsoap.org/wsdl/soap/ — 2026-05-01
URL http://softfurlan.altervista.org — 2026-05-01
URL http://sv.symcb.com/sv.crl — 2026-05-01
URL http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEADzAwdvBip42MYbURaknTY%3D — 2026-05-01
URL http://tjl73.altervista.org/ — 2026-05-01
URL http://www.hot.ee/somberg/7zip.html — 2026-05-01
URL http://www.w3.org/2001/XMLSchema — 2026-05-01
URL http://www.w3.org/2001/XMLSchema-instance — 2026-05-01
URL https://github.com/mattn/webapi-vim — 2026-05-01
URL https://github.com/php/php-sdk-binary-tools.git — 2026-05-01
URL https://golang.org/issue/45979: — 2026-05-01
URL https://is.gd/ — 2026-05-01
URL https://is.gd/' — 2026-05-01
URL https://play.rust-lang.org/ — 2026-05-01
URL https://play.rust-lang.org/' — 2026-05-01
URL https://www.softcatala.org — 2026-05-01
URL http://patch.example.com/direct — 2026-05-01
URL http://patch.example.com/indirect — 2026-05-01
URL http://pinrulesstl.cab?48a2e1f6dfda74ff — 2026-05-01
URL http://pinrulesstl.cab?f06c4e10bbb50bc8 — 2026-05-01
URL http://vcs-test.golang.org/git/no-tags.git — 2026-05-01
URL http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y — 2026-05-01
URL http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0 — 2026-05-01
URL http://crl.thawte.com/ThawteTimestampingCA.crl0 — 2026-05-01
URL http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0 — 2026-05-01
URL http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0 — 2026-05-01
URL http://www.globalsign.net/repository/03 — 2026-05-01
URL http://www.nvidia.com/content/drivers/redirect.asp?language=%s&page=%sopenSOFTWARE — 2026-05-01
URL http://www.nvidia.com/object/3D_TV_play.htmlwww.nvidia.com/get3D.www.nvidia.com/register%hs — 2026-05-01
URL https://bugs.chromium.org/p/chromium/issues/entry?template=Safety — 2026-05-01
URL https://dc.services.visualstudio.com/Jhttps://rt.services.visualstudio.com/Fhttps://profiler.monitor — 2026-05-01
URL https://dc.services.visualstudio.com/api/profiles/ — 2026-05-01
URL https://dc.services.visualstudio.com/f — 2026-05-01
URL https://github.com/Microsoft/ApplicationInsights-dotnet — 2026-05-01
URL https://github.com/microsoft/ApplicationInsights-dotnet/issues/1152 — 2026-05-01
URL https://monitor.azure.com//.default — 2026-05-01
URL https://profiler.monitor.azure.com/l — 2026-05-01
URL https://rt.services.visualstudio.com/l — 2026-05-01
URL https://sectigo.com/CPS0 — 2026-05-01
URL https://snapshot.monitor.azure.com/ — 2026-05-01
URL https://support.google.com/chrome/answer/6098869 — 2026-05-01
URL https://www.bitvise.com/0 — 2026-05-01
URL http://23.227.32.0 — 2026-05-01
URL http://23.227.63.255 — 2026-05-01
URL http://e7.c.lencr.org/101.crl — 2026-05-01
URL http://e7.i.lencr.org/ — 2026-05-01
URL https://rdap.arin.net/registry/ip/23.227.32.0 — 2026-05-01
URL https://whois.arin.net/rest/net/NET-23-227-32-0-1 — 2026-05-01
URL https://rdap.arin.net/registry/entity/SHOPI-1 — 2026-05-01
URL https://whois.arin.net/rest/org/SHOPI-1 — 2026-05-01
URL http://23.227.32.0 — 2026-05-01
URL http://23.227.63.255 — 2026-05-01
URL https://rdap.arin.net/registry/ip/23.227.32.0 — 2026-05-01
URL https://rdap.arin.net/registry/entity/SHOPI-1 — 2026-05-01
URL https://rdap.arin.net/registry/entity/SHOPI-ARIN — 2026-05-01
URL https://rdap.arin.net/registry/entity/SHOPI2-ARIN — 2026-05-01
URL http://23.227.32.0 — 2026-05-01
URL http://23.227.63.255 — 2026-05-01
URL https://rdap.arin.net/registry/ip/23.227.32.0 — 2026-05-01
URL https://rdap.arin.net/registry/entity/SHOPI-1 — 2026-05-01
URL https://rdap.arin.net/registry/entity/SHOPI-ARIN — 2026-05-01
URL https://rdap.arin.net/registry/entity/SHOPI2-ARIN — 2026-05-01
References (5)
↗ This missing-letter technique is likely a stealth tactic designed to bypass traditional heuristic detection and signature-based antivirus (AV) scans. These indicators are consistent with high-integrity sources and threat actors I have previously documented and reported. ↗ "Network port scanning and reconnaissance - according to source Guardpot - 10 months ago This IP was involved in 632 events across 1 distinct attack types. Attacks: dns-query (632). First seen: 2025-06-17 00:47 UTC, Last seen: 2025-06-17 00:48 UTC." ↗ ↗ Code Insights VT, Of note, a lot of the malicious PDFs I have detected through sandboxing do not flag and all have code insights. Incidental finding that is curious. ↗ The code insights look like this "The analyzed document exhibits no internal execution chains, embedded scripts, or exploits, but heavily utilizes numerous external URIs. Visual and textual analysis indicates the file functions as an SEO poisoning or doorway document. The PDF consists almost entirely of a dense, nonsensical list of hyperlinked keywords referencing various brands, user manuals, and textbooks, all operating under a garbled, unrelated title. Although the file is structurally harmless and lack