# Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://github.com/cobbr/Covenant
# Reference: https://twitter.com/1ZRR4H/status/1333606625551192064

45.83.176.85:7443

# Reference: https://twitter.com/bryceabdo/status/1352017243547250689
# Reference: https://www.virustotal.com/gui/file/1faee2229324a40a4d36e7bf0bcd2ceebe40915878d406efa4dd82b0ec1ee965/detection
# Reference: https://www.virustotal.com/gui/file/d776cdeb7432a2dafdc8d9f1255c278f8ae12051b8538e2a285f6255042f0a5d/detection

http://46.101.251.25

# Reference: https://twitter.com/TheDFIRReport/status/1374024318640742402

http://144.126.209.100
http://3.19.242.30

# Reference: https://twitter.com/TheDFIRReport/status/1372574766851231745

http://195.123.239.170
http://47.94.20.209

# Reference: https://twitter.com/TheDFIRReport/status/1375418278856822788

http://143.110.213.159
http://198.211.96.96
http://45.77.248.89
http://52.247.27.44

# Reference: https://twitter.com/TheDFIRReport/status/1377232960676577280

http://143.110.228.146
http://185.203.117.6

# Reference: https://twitter.com/TheDFIRReport/status/1379388421014122502
# Reference: https://beta.shodan.io/host/138.68.62.253

http://138.68.62.253
138.68.62.253:22
138.68.62.253:443
138.68.62.253:7443
138.68.62.253:8000

# Reference: https://twitter.com/TheDFIRReport/status/1379388421014122502
# Reference: https://beta.shodan.io/host/155.138.227.139

155.138.227.139:443
155.138.227.139:4443
155.138.227.139:5000
155.138.227.139:5432
155.138.227.139:8080

# Reference: https://twitter.com/TheDFIRReport/status/1379388421014122502
# Reference: https://beta.shodan.io/host/173.232.146.167

http://173.232.146.167
173.232.146.167:22
173.232.146.167:7443

# Reference: https://twitter.com/TheDFIRReport/status/1379388421014122502
# Reference: https://beta.shodan.io/host/185.186.244.84

http://185.186.244.84
185.186.244.84:22
185.186.244.84:7443

# Reference: https://twitter.com/TheDFIRReport/status/1379388421014122502
# Reference: https://beta.shodan.io/host/185.206.144.192

http://185.206.144.192
185.206.144.192:22
185.206.144.192:7443

# Reference: https://twitter.com/TheDFIRReport/status/1381636980040159234
# Reference: https://beta.shodan.io/host/165.232.131.109

http://165.232.131.109
165.232.131.109:7443
165.232.131.109:81

# Reference: https://twitter.com/TheDFIRReport/status/1381636980040159234
# Reference: https://beta.shodan.io/host/185.205.209.249

http://185.205.209.249
185.205.209.249:22
185.205.209.249:7443

# Reference: https://twitter.com/TheDFIRReport/status/1381636980040159234
# Reference: https://beta.shodan.io/host/45.32.29.78
http://45.32.29.78
45.32.29.78:22
45.32.29.78:7443
45.32.29.78:8443

# Reference: https://twitter.com/TheDFIRReport/status/1381636980040159234
# Reference: https://beta.shodan.io/host/47.243.14.171

http://47.243.14.171
47.243.14.171:443
47.243.14.171:7443

# Reference: https://twitter.com/TheDFIRReport/status/1384853172175392772
# Reference: https://beta.shodan.io/host/172.105.65.243

http://172.105.65.243
172.105.65.243:22
172.105.65.243:7443

# Reference: https://twitter.com/TheDFIRReport/status/1384853172175392772
# Reference: https://beta.shodan.io/host/45.147.228.146

45.147.228.146:7443

# Reference: https://twitter.com/TheDFIRReport/status/1384853172175392772
# Reference: https://beta.shodan.io/host/51.210.110.104

51.210.110.104:7443

# Reference: https://twitter.com/TheDFIRReport/status/1385567840732946436
# Reference: https://beta.shodan.io/host/139.59.231.248
# Reference: https://beta.shodan.io/host/192.46.234.174

http://192.46.234.174
139.59.231.248:22
139.59.231.248:3306
139.59.231.248:7443
192.46.234.174:22
192.46.234.174:7443

# Reference: https://twitter.com/TheDFIRReport/status/1387070281987108865
# Reference: https://beta.shodan.io/host/3.140.190.218

http://3.140.190.218
3.140.190.218:7443

# Reference: https://twitter.com/TheDFIRReport/status/1387070281987108865
# Reference: https://beta.shodan.io/host/35.211.206.132

http://35.211.206.132
35.211.206.132:22
35.211.206.132:443
35.211.206.132:7443

# Reference: https://twitter.com/TheDFIRReport/status/1389595672635183109
# Reference: https://beta.shodan.io/host/185.186.244.84

http://185.186.244.84
185.186.244.84:22
185.186.244.84:7443

# Reference: https://twitter.com/TheDFIRReport/status/1389595672635183109
# Reference: https://beta.shodan.io/host/185.206.144.192

http://185.206.144.192
185.206.144.192:22

# Reference: https://twitter.com/TheDFIRReport/status/1390652638513926144
# Reference: https://beta.shodan.io/host/195.161.62.228

http://195.161.62.228
195.161.62.228:22
195.161.62.228:7443
195.161.62.228:8834

# Reference: https://twitter.com/TheDFIRReport/status/1392089649984774146
# Reference: https://beta.shodan.io/host/195.123.247.143

http://195.123.247.143
195.123.247.143:7443
195.123.247.143:8834

# Reference: https://twitter.com/TheDFIRReport/status/1403321117692108800
# Reference: https://beta.shodan.io/host/52.175.148.20

52.175.148.20:22
52.175.148.20:3000
52.175.148.20:443
52.175.148.20:7443

# Reference: https://twitter.com/TheDFIRReport/status/1407322479664762890

162.55.184.250:7443
54.185.125.101:7443

# Reference: https://twitter.com/TheDFIRReport/status/1405151926640168964
# Reference: https://beta.shodan.io/host/206.189.0.12

http://206.189.0.12
206.189.0.12:22
206.189.0.12:443
206.189.0.12:7443

# Reference: https://twitter.com/TheDFIRReport/status/1405151926640168964
# Reference: https://beta.shodan.io/host/51.79.160.130

51.79.160.130:7443

# Reference: https://twitter.com/TheDFIRReport/status/1407752816362405895
# Reference: https://beta.shodan.io/host/202.169.39.5

202.169.39.5:22
202.169.39.5:587
202.169.39.5:7443
202.169.39.5:993

# Reference: https://twitter.com/TheDFIRReport/status/1407752816362405895
# Reference: https://beta.shodan.io/host/149.28.131.88

http://149.28.131.88
149.28.131.88:22
149.28.131.88:443
149.28.131.88:8000

# Generic

/covenantuser/
/covenantuser/login
