# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://ransomwaretracker.abuse.ch/tracker/sage/  (as seen on 2017-10-31)

mbfce24rgn65bx3g.kye1ap.net
mbfce24rgn65bx3g.l3by4d.com
mbfce24rgn65bx3g.17b3o.net
mbfce24rgn65bx3g.2igu316.com
mbfce24rgn65bx3g.je9mlz.com
mbfce24rgn65bx3g.eho23d.net
mbfce24rgn65bx3g.hp8ewo.net
mbfce24rgn65bx3g.0ny42p.com
mbfce24rgn65bx3g.is0hvt1.com

# Reference: https://blog.talosintelligence.com/2019/06/threat-roundup-0614-0621.html (# Win.Ransomware.Sage-6995951-1)

mbfce24rgn65bx3g.we0sgd.com
mbfce24rgn65bx3g.y8lkjg5.net

# Reference: http://id-ransomware.blogspot.com/2017/01/sage-2-ransomware.html (Russian)

mbfce24rgn65bx3g.op7su2.com
mbfce24rgn65bx3g.rzunt3u2.com
7gie6ffnkrjykggd.rzunt3u2.com
7gie6ffnkrjykggd.er29sl.in
7gie6ffnkrjykggd.onion
z5dq36kjy5swjtmr.hp8ewo.net
z5dq36kjy5swjtmr.0ny42p.com
fortycooola.top
newfoodas.top
smoeroota.top

# Reference: https://twitter.com/drProct0r/status/830532905336180736

meyaau.com

# Reference: https://www.fortinet.com/blog/threat-research/evasive-sage-2-2-ransomware-variant-targets-more-countries.html

indiasoujapa.info
johnmoplan.top
mondayyesha.info
sutranjdf.info
xxxkeyoplw.top
z5dq36kjy5swjtmr.onion

# Reference: https://twitter.com/peterkruse/status/870562376881508352

bidsintro.trade
gmailtrade.space
information4all.loan
ololoexport.bid
ololoinfo.win
xblinformation.loan
xblinformation.trade
ztsinfo.xyz

# Reference: https://twitter.com/c0d3inj3cT/status/920726596998148096

folxdogerm.info

# Reference: https://isc.sans.edu/diary/Sage%2B2.0%2BRansomware/21959

mbfce24rgn65bx3g.er29sl.in
