title: SwiftIOC high-confidence DNS indicators
id: 8e89ba4b-475a-5280-8c67-886c4dcda479
status: experimental
description: Detects DNS queries ending in a domain from SwiftIOC's curated high-confidence feed.
references:
- https://harsim.ca/SwiftIOC-Automated-Threat-Intelligence-Collector/
author: SwiftIOC
date: '2026-10-24'
tags:
- attack.command_and_control
logsource:
  category: dns
detection:
  domain_exact:
    query:
    - 189199.xyz
    - 1moko8um.encompass-graphics.co.uk
    - 1pbwy4ua.yellohotelsharmoni.com
    - 24siete.info
    - 3u8krmfu.energedia.com
    - 4m8axf47.worknernorgram.rest
    - 4xvc.com
    - 556990.xyz
    - 6z9bnriq.ecprofessionals.co
    - 7seasstore.com
    - 889992513.xyz
    - 94gs0ok1.dota.pw
    - 98win.tools
    - 99websitestudio.com
    - 9blb0qgz.emanuellejaques.com
    - a-head.fr
    - abrahamalvarezgonzalez.com
    - acecamps.net
    - aceexterior.com
    - aciencia-cap.com
    - adbimmo.cs-projets.be
    - administrationvisa.com
    - admission.qaed.pk
    - adplaret.com
    - adzyw.cn
    - afb-aspect.com
    - affordablemedicalhealthcare.com
    - afritekers.com
    - ailinshop.com
    - akupunktur-weiterstadt.com
    - alansarkw.com
    - alldatadaily.info
    - allianzexecutivo.com.br
    - amberbriefs.store
    - amberchronicle.store
    - ambercorner.store
    - amberdiaries.store
    - andrewresearchgroup.com
    - anfgroup.co.za
    - anthonyhamlock.cyber-demo-client-website2.com
    - anveraspain.com
    - appconsulting.fr
    - aqeellogistic.com
    - arclight.pipesnmetals.com
    - arrowsone.com
    - artsetindustriesinformatiques.fr
    - association-acage.fr
    - athenaengenharia.eng.br
    - auslanbee.com.au
    - azwebsoft.online
    - baiihua.com
    - baraksamoon.com
    - barkacsolokboltja.hu
    - barneyschurch.au
    - beatjournals.store
    - beautyavenue.us
    - bestpayoutcasinos.org
    - besttechnoschool.com
    - bezdickova.cz
    - bgrenergysolutions.com
    - bioindiaservices.com
    - bixcash.net
    - blackhillsutv.rentals
    - blog.edelzone.fr
    - blogstartups.com
    - bluegeneration.es
    - bolton-flooring.co.uk
    - bossleysportsclub.com.au
    - bragadeandrade.com.br
    - brownsenterprisesllc.com
    - buycocainethessaloniki.com
    - byhandhairstudio.com
    - c.adilawa99.org
    - c0013.bizhomepass.kr
    - canaillechicproduction.com
    - canakkaleayvaciktdiosb.org.tr
    - cdn.decadenza.me
    - cdn.remusdownloads.su
    - cdn.remusdownloads.to
    - chem-dryoforange.com
    - chemdrygreen.com
    - chemdryoflosangeles.com
    - chiamanino.it
    - city-dentist.de
    - cleandrygreen.com
    - client.remus.la
    - clinicasenise.com.br
    - cloudvault-app.com
    - comvale.com.br
    - cyberleakgta6.net
    - dannyeveritt.net
    - de.remusdownloads.su
    - deload.getpi.su
    - dewa898slot.co
    - dexband.quest
    - dicktigerfoundation.org
    - diepsam.vn
    - dimensionemosaico.it
    - doortrans.hu
    - dota.pw
    - drleonardofiuza.com.br
    - ecointernationalltd.com
    - ecommunicate.biz
    - ecprofessionals.co
    - education-lab.starbrain.jp
    - edypsomlbd.com
    - ehsan-perfume.com
    - ejscontabil.com.br
    - elchapodonpablo.duckdns.org
    - emakbapaklugimanasehat.my.id
    - emanuellejaques.com
    - encompass-graphics.co.uk
    - energedia.com
    - erzincanisitme.com
    - eudfitaly.org
    - event.springdepot.lat
    - extremenitrowrestling.com
    - fac.ucao-uuz.com
    - farhangsch.ir
    - festwirte.at
    - fhaedl.com
    - folasasegbon.org
    - framesi.com
    - gbhpljne.paars.poker
    - ghyasigroup.com
    - gispvn.vn
    - golfhotel-schweiz.com
    - gpwlegal.com
    - grarg.com
    - greencrowdsourcing.com
    - hafizbookstore.com
    - hirbodmotors.com
    - hiv-sar.ru
    - hochzeitsband-dj.de
    - hondapareindah.com
    - hp-clinics.com
    - hubbmediaentertainment.com
    - idd-industrieservice.de
    - iepsantarosapurisimaves.edu.pe
    - immexadvisory.com
    - immexcompany.com
    - immexsolutions.com
    - impaq.us
    - in-gesprek.com
    - isometric.cyber-demo-client-website2.com
    - isuzucorluservis.com
    - italian-university.com
    - iy.acunbet89.org
    - jemohgh.com
    - jheebdjw.com
    - juliaannlong.depaolisremodeling.com
    - justrpg.com
    - kakiseni.org
    - kargowa.ayz.pl
    - kaylamilleruxdesigner.com
    - kd.ac.th
    - kejda.net
    - kfzgutachterputzke.de
    - kidden.com.mx
    - kk.testgeek.de
    - knokheadstudio.com
    - kucabi.de
    - kudoassam.org
    - kurbad-st-leonhard.de
    - kusi75.ch
    - la.kker.dk
    - ladnejany.eu
    - landing.thtdev.xyz
    - landingpage.tatuagronegocios.com.br
    - lapinga.com.br
    - lawncaremansfield.com
    - learn.investohalal.com
    - legalwise.rw
    - lesmilanregistry.com
    - levoncargo.com.br
    - limo-deal.de
    - liverpoolenslaved.com
    - loja.acscientifica.com.br
    - loja.panan.com.br
    - loopsdigi.com
    - loseweightandlookyounger.com
    - lp.wooddesignpe.com.br
    - manzzkontolaktolakan.my.id
    - marbellamentalhealth.com
    - metasail.info
    - meteorprint.ca
    - minecraftsmp14.duckdns.org
    - misguayabas.es
    - moggydaytrainer.com
    - mpresso.co.th
    - mslightinggroup.com
    - mygumzy.com
    - mypersonalphotographerstudios.com
    - mytutions.com
    - n.acunbet89.org
    - n1492.ru
    - n2late.fr
    - netjournal.id
    - new.decorhome.kz
    - nubiaestetica.com
    - nypdprosecutorcorruption.com
    - og-allgemeinerhof.ch
    - oliscuquello.com
    - omannaturals.store
    - omnifluencer.com
    - onekanimo.com
    - orangecountychemdry.com
    - ortopediaqueralto.com
    - panel.vidar.to
    - permanentmakeup-andric.de
    - peterhopkin.co.uk
    - pharmafilters.com
    - phmultiservicios.cl
    - piracaia.lacasadecheiro.com.br
    - pkpots.com
    - platinum.csfsistemi.it
    - pratikkagittahta.com
    - precisionprinterservices.com
    - premiosarquitectura.org
    - prevoz-putnika.net
    - pro-vet.es
    - proyectosanborondon.es
    - ranganathcosmetologycenter.com
    - rcreformes.com
    - remus.la
    - remusapi.la
    - remusdownloads.su
    - remusdownloads.to
    - reportehla.xyz
    - residencialdama.com
    - rf.adilawa99.org
    - rodriguesembalagem.com.br
    - rosateeshop.com
    - rotundavillas.com
    - saskiadesign.nl
    - secrets.digistag.com
    - sequoia.aulasequoia.com
    - sfasagg.com
    - shavondezilva.com
    - shenzhen2050.com
    - shop.goforbranding.com
    - sigaconstrucoes.com.br
    - slideshowtomsk.ru
    - sm8gy4u6.ozabet.promo
    - smart.net-developer.co.uk
    - snowdonart.co.uk
    - sonarnegociosdigitais.com
    - srivaricotton.com
    - srv45056.seohost.com.pl
    - ssttower.com
    - starthappylife.com
    - statswarcraft.com
    - sulthansalmanjaya.com
    - suo.company
    - svo-zv.pro
    - tagesnachrichten24.de
    - talentclub.uk
    - theferrancegroup.ca
    - thelumberjackswife.com
    - tibor.es
    - toyota-club.by
    - trinityoftithing.com
    - triwell.cz
    - tttbr.com
    - turkishrebars.com
    - u7.ajo7.org
    - update.inteldrives.com
    - usa-salesforce.com
    - usedcarfriendship.online
    - v.getpi.su
    - vanadiumholding.com
    - volegov-pravo.ru
    - vzilnrw3.sleavepiker.com
    - wealthwise.co.uk
    - webshop.gereformeerdekerkoldebroek.nl
    - wishyourgifts.in
    - wp.klipr.io
    - www.111tv.it
    - www.11quu.com
    - www.150graziadeledda.it
    - www.abrahamalvarezgonzalez.com
    - www.adamellobrentameteo.it
    - www.adrenalinedesign.ca
    - www.allcoastinteriorlinings.com.au
    - www.allcopytx.com
    - www.alliancefr-bizerte.tn
    - www.alubox.org
    - www.alvesaraujo.com
    - www.ampaescolapalcam.com
    - www.bluegeneration.es
    - www.bolton-flooring.co.uk
    - www.bossleysportsclub.com.au
    - www.cag-promotion.fr
    - www.cloudespacios.com
    - www.danabagroup.com
    - www.fibraimpresa.it
    - www.gibertpaul.com
    - www.grarg.com
    - www.hubbmediaentertainment.com
    - www.isuzucorluservis.com
    - www.joliveira.com.br
    - www.judeglass.com
    - www.keithkloor.com
    - www.kurbad-st-leonhard.de
    - www.lesmilanregistry.com
    - www.mineniches.com
    - www.neonail.ro
    - www.neumaticosmarsili.com
    - www.nypdprosecutorcorruption.com
    - www.permanentart.cz
    - www.polonez.org.au
    - www.precisionprinterservices.com
    - www.premiosarquitectura.org
    - www.radiosantateresa.it
    - www.residencialdama.com
    - www.rotundavillas.com
    - www.shenzhen2050.com
    - www.sunagawa-shop.com
    - www.trinityoftithing.com
    - www.vvrs-info.be
    - www.zigpsychocybercowboys.com
    - xn--80affqomjaccdhnt.xn--p1ai
    - y3ppxpso.fazbet1.app
    - youblokle.com
    - zigpsychocybercowboys.com
  domain_subdomain:
    query|endswith:
    - .189199.xyz
    - .1moko8um.encompass-graphics.co.uk
    - .1pbwy4ua.yellohotelsharmoni.com
    - .24siete.info
    - .3u8krmfu.energedia.com
    - .4m8axf47.worknernorgram.rest
    - .4xvc.com
    - .556990.xyz
    - .6z9bnriq.ecprofessionals.co
    - .7seasstore.com
    - .889992513.xyz
    - .94gs0ok1.dota.pw
    - .98win.tools
    - .99websitestudio.com
    - .9blb0qgz.emanuellejaques.com
    - .a-head.fr
    - .abrahamalvarezgonzalez.com
    - .acecamps.net
    - .aceexterior.com
    - .aciencia-cap.com
    - .adbimmo.cs-projets.be
    - .administrationvisa.com
    - .admission.qaed.pk
    - .adplaret.com
    - .adzyw.cn
    - .afb-aspect.com
    - .affordablemedicalhealthcare.com
    - .afritekers.com
    - .ailinshop.com
    - .akupunktur-weiterstadt.com
    - .alansarkw.com
    - .alldatadaily.info
    - .allianzexecutivo.com.br
    - .amberbriefs.store
    - .amberchronicle.store
    - .ambercorner.store
    - .amberdiaries.store
    - .andrewresearchgroup.com
    - .anfgroup.co.za
    - .anthonyhamlock.cyber-demo-client-website2.com
    - .anveraspain.com
    - .appconsulting.fr
    - .aqeellogistic.com
    - .arclight.pipesnmetals.com
    - .arrowsone.com
    - .artsetindustriesinformatiques.fr
    - .association-acage.fr
    - .athenaengenharia.eng.br
    - .auslanbee.com.au
    - .azwebsoft.online
    - .baiihua.com
    - .baraksamoon.com
    - .barkacsolokboltja.hu
    - .barneyschurch.au
    - .beatjournals.store
    - .beautyavenue.us
    - .bestpayoutcasinos.org
    - .besttechnoschool.com
    - .bezdickova.cz
    - .bgrenergysolutions.com
    - .bioindiaservices.com
    - .bixcash.net
    - .blackhillsutv.rentals
    - .blog.edelzone.fr
    - .blogstartups.com
    - .bluegeneration.es
    - .bolton-flooring.co.uk
    - .bossleysportsclub.com.au
    - .bragadeandrade.com.br
    - .brownsenterprisesllc.com
    - .buycocainethessaloniki.com
    - .byhandhairstudio.com
    - .c.adilawa99.org
    - .c0013.bizhomepass.kr
    - .canaillechicproduction.com
    - .canakkaleayvaciktdiosb.org.tr
    - .cdn.decadenza.me
    - .cdn.remusdownloads.su
    - .cdn.remusdownloads.to
    - .chem-dryoforange.com
    - .chemdrygreen.com
    - .chemdryoflosangeles.com
    - .chiamanino.it
    - .city-dentist.de
    - .cleandrygreen.com
    - .client.remus.la
    - .clinicasenise.com.br
    - .cloudvault-app.com
    - .comvale.com.br
    - .cyberleakgta6.net
    - .dannyeveritt.net
    - .de.remusdownloads.su
    - .deload.getpi.su
    - .dewa898slot.co
    - .dexband.quest
    - .dicktigerfoundation.org
    - .diepsam.vn
    - .dimensionemosaico.it
    - .doortrans.hu
    - .dota.pw
    - .drleonardofiuza.com.br
    - .ecointernationalltd.com
    - .ecommunicate.biz
    - .ecprofessionals.co
    - .education-lab.starbrain.jp
    - .edypsomlbd.com
    - .ehsan-perfume.com
    - .ejscontabil.com.br
    - .elchapodonpablo.duckdns.org
    - .emakbapaklugimanasehat.my.id
    - .emanuellejaques.com
    - .encompass-graphics.co.uk
    - .energedia.com
    - .erzincanisitme.com
    - .eudfitaly.org
    - .event.springdepot.lat
    - .extremenitrowrestling.com
    - .fac.ucao-uuz.com
    - .farhangsch.ir
    - .festwirte.at
    - .fhaedl.com
    - .folasasegbon.org
    - .framesi.com
    - .gbhpljne.paars.poker
    - .ghyasigroup.com
    - .gispvn.vn
    - .golfhotel-schweiz.com
    - .gpwlegal.com
    - .grarg.com
    - .greencrowdsourcing.com
    - .hafizbookstore.com
    - .hirbodmotors.com
    - .hiv-sar.ru
    - .hochzeitsband-dj.de
    - .hondapareindah.com
    - .hp-clinics.com
    - .hubbmediaentertainment.com
    - .idd-industrieservice.de
    - .iepsantarosapurisimaves.edu.pe
    - .immexadvisory.com
    - .immexcompany.com
    - .immexsolutions.com
    - .impaq.us
    - .in-gesprek.com
    - .isometric.cyber-demo-client-website2.com
    - .isuzucorluservis.com
    - .italian-university.com
    - .iy.acunbet89.org
    - .jemohgh.com
    - .jheebdjw.com
    - .juliaannlong.depaolisremodeling.com
    - .justrpg.com
    - .kakiseni.org
    - .kargowa.ayz.pl
    - .kaylamilleruxdesigner.com
    - .kd.ac.th
    - .kejda.net
    - .kfzgutachterputzke.de
    - .kidden.com.mx
    - .kk.testgeek.de
    - .knokheadstudio.com
    - .kucabi.de
    - .kudoassam.org
    - .kurbad-st-leonhard.de
    - .kusi75.ch
    - .la.kker.dk
    - .ladnejany.eu
    - .landing.thtdev.xyz
    - .landingpage.tatuagronegocios.com.br
    - .lapinga.com.br
    - .lawncaremansfield.com
    - .learn.investohalal.com
    - .legalwise.rw
    - .lesmilanregistry.com
    - .levoncargo.com.br
    - .limo-deal.de
    - .liverpoolenslaved.com
    - .loja.acscientifica.com.br
    - .loja.panan.com.br
    - .loopsdigi.com
    - .loseweightandlookyounger.com
    - .lp.wooddesignpe.com.br
    - .manzzkontolaktolakan.my.id
    - .marbellamentalhealth.com
    - .metasail.info
    - .meteorprint.ca
    - .minecraftsmp14.duckdns.org
    - .misguayabas.es
    - .moggydaytrainer.com
    - .mpresso.co.th
    - .mslightinggroup.com
    - .mygumzy.com
    - .mypersonalphotographerstudios.com
    - .mytutions.com
    - .n.acunbet89.org
    - .n1492.ru
    - .n2late.fr
    - .netjournal.id
    - .new.decorhome.kz
    - .nubiaestetica.com
    - .nypdprosecutorcorruption.com
    - .og-allgemeinerhof.ch
    - .oliscuquello.com
    - .omannaturals.store
    - .omnifluencer.com
    - .onekanimo.com
    - .orangecountychemdry.com
    - .ortopediaqueralto.com
    - .panel.vidar.to
    - .permanentmakeup-andric.de
    - .peterhopkin.co.uk
    - .pharmafilters.com
    - .phmultiservicios.cl
    - .piracaia.lacasadecheiro.com.br
    - .pkpots.com
    - .platinum.csfsistemi.it
    - .pratikkagittahta.com
    - .precisionprinterservices.com
    - .premiosarquitectura.org
    - .prevoz-putnika.net
    - .pro-vet.es
    - .proyectosanborondon.es
    - .ranganathcosmetologycenter.com
    - .rcreformes.com
    - .remus.la
    - .remusapi.la
    - .remusdownloads.su
    - .remusdownloads.to
    - .reportehla.xyz
    - .residencialdama.com
    - .rf.adilawa99.org
    - .rodriguesembalagem.com.br
    - .rosateeshop.com
    - .rotundavillas.com
    - .saskiadesign.nl
    - .secrets.digistag.com
    - .sequoia.aulasequoia.com
    - .sfasagg.com
    - .shavondezilva.com
    - .shenzhen2050.com
    - .shop.goforbranding.com
    - .sigaconstrucoes.com.br
    - .slideshowtomsk.ru
    - .sm8gy4u6.ozabet.promo
    - .smart.net-developer.co.uk
    - .snowdonart.co.uk
    - .sonarnegociosdigitais.com
    - .srivaricotton.com
    - .srv45056.seohost.com.pl
    - .ssttower.com
    - .starthappylife.com
    - .statswarcraft.com
    - .sulthansalmanjaya.com
    - .suo.company
    - .svo-zv.pro
    - .tagesnachrichten24.de
    - .talentclub.uk
    - .theferrancegroup.ca
    - .thelumberjackswife.com
    - .tibor.es
    - .toyota-club.by
    - .trinityoftithing.com
    - .triwell.cz
    - .tttbr.com
    - .turkishrebars.com
    - .u7.ajo7.org
    - .update.inteldrives.com
    - .usa-salesforce.com
    - .usedcarfriendship.online
    - .v.getpi.su
    - .vanadiumholding.com
    - .volegov-pravo.ru
    - .vzilnrw3.sleavepiker.com
    - .wealthwise.co.uk
    - .webshop.gereformeerdekerkoldebroek.nl
    - .wishyourgifts.in
    - .wp.klipr.io
    - .www.111tv.it
    - .www.11quu.com
    - .www.150graziadeledda.it
    - .www.abrahamalvarezgonzalez.com
    - .www.adamellobrentameteo.it
    - .www.adrenalinedesign.ca
    - .www.allcoastinteriorlinings.com.au
    - .www.allcopytx.com
    - .www.alliancefr-bizerte.tn
    - .www.alubox.org
    - .www.alvesaraujo.com
    - .www.ampaescolapalcam.com
    - .www.bluegeneration.es
    - .www.bolton-flooring.co.uk
    - .www.bossleysportsclub.com.au
    - .www.cag-promotion.fr
    - .www.cloudespacios.com
    - .www.danabagroup.com
    - .www.fibraimpresa.it
    - .www.gibertpaul.com
    - .www.grarg.com
    - .www.hubbmediaentertainment.com
    - .www.isuzucorluservis.com
    - .www.joliveira.com.br
    - .www.judeglass.com
    - .www.keithkloor.com
    - .www.kurbad-st-leonhard.de
    - .www.lesmilanregistry.com
    - .www.mineniches.com
    - .www.neonail.ro
    - .www.neumaticosmarsili.com
    - .www.nypdprosecutorcorruption.com
    - .www.permanentart.cz
    - .www.polonez.org.au
    - .www.precisionprinterservices.com
    - .www.premiosarquitectura.org
    - .www.radiosantateresa.it
    - .www.residencialdama.com
    - .www.rotundavillas.com
    - .www.shenzhen2050.com
    - .www.sunagawa-shop.com
    - .www.trinityoftithing.com
    - .www.vvrs-info.be
    - .www.zigpsychocybercowboys.com
    - .xn--80affqomjaccdhnt.xn--p1ai
    - .y3ppxpso.fazbet1.app
    - .youblokle.com
    - .zigpsychocybercowboys.com
  condition: domain_exact or domain_subdomain
falsepositives:
- Legitimate infrastructure sharing an address or domain; validate with local context.
level: high