# Copyright (c) 2014-2023 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice
# Reference: https://www.mdsec.co.uk/2022/05/nighthawk-0-2-catch-us-if-you-can/
# Reference: https://otx.alienvault.com/pulse/637ded425913a7ae19e7113e

sephus.me

# Reference: https://twitter.com/1ZRR4H/status/1600569404705619988

clrf.net
corporate-document-exchange.com

# Reference: https://twitter.com/Gi7w0rm/status/1600977276417589248

3.229.134.140:443

# Reference: https://twitter.com/MichalKoczwara/status/1601278387141496832

offensive-operations.live
urbanhealthgoods.com

# Reference: https://twitter.com/1ZRR4H/status/1615791320982818830

eagle03group02.optumshadow.org
secure.mail-nationalmedtrans.com
secure.health-colony.com
ww1.login-nammcal.com

# Reference: https://twitter.com/MichalKoczwara/status/1615796586952462346

cs1group2.optumshadow.org
evildropper.optumshadow.org
healthsteward.org
squanchy.optumshadow.org
support.bison-health.com
