diff --git a/DGA/2D91C0784F4E90F43B8D5D1BF7D4F238/2021-10-15-DGALIST-2D91C0784F4E90F43B8D5D1BF7D4F238.txt b/DGA/2D91C0784F4E90F43B8D5D1BF7D4F238/2021-10-15-DGALIST-2D91C0784F4E90F43B8D5D1BF7D4F238.txt
diff --git a/DGA/41B9A610F8B5CFDE7E4153E8B6305187/2021-11-16-DGALIST-41B9A610F8B5CFDE7E4153E8B6305187.txt b/DGA/41B9A610F8B5CFDE7E4153E8B6305187/2021-11-16-DGALIST-41B9A610F8B5CFDE7E4153E8B6305187.txt
@@ -0,0 +1,200 @@
+0nn53h3qu.com
+0nn53h3qu.ru
+1s4wgktku.com
+1s4wgktku.ru
+1szalrftd.com
+1szalrftd.ru
+1uselaej4.com
+1uselaej4.ru
+1wohqz3or.com
+1wohqz3or.ru
+201s2kzoi.com
+201s2kzoi.ru
+2n6noboel.com
+2n6noboel.ru
+2o88chg21.com
+2o88chg21.ru
+44urm2roz.com
+44urm2roz.ru
+4slj8m3a5.com
+4slj8m3a5.ru
+4unacrn54.com
+4unacrn54.ru
+4us8ijdn4.com
+4us8ijdn4.ru
+57u3ebrz8.com
+57u3ebrz8.ru
+5puckdda4.com
+5puckdda4.ru
+5tap9msv1.com
+5tap9msv1.ru
+691nzfweu.com
+691nzfweu.ru
+6d29gym2j.com
+6d29gym2j.ru
+6qgnc24b3.com
+6qgnc24b3.ru
+6sf3vk7mb.com
+6sf3vk7mb.ru
+6xy8cqt2v.com
+6xy8cqt2v.ru
+7lytmpq5d.com
+7lytmpq5d.ru
+7tbaci3uw.com
+7tbaci3uw.ru
+7v85ub74l.com
+7v85ub74l.ru
+7xzn0q961.com
+7xzn0q961.ru
+8dbs4r9s6.com
+8dbs4r9s6.ru
+8ocqqcx50.com
+8ocqqcx50.ru
+a9x6fcc71.com
+a9x6fcc71.ru
+ah8qac2jd.com
+ah8qac2jd.ru
+alvqan6ma.com
+alvqan6ma.ru
+anb2dfkeu.com
+anb2dfkeu.ru
+ay7md4aw4.com
+ay7md4aw4.ru
+b91kc52gg.com
+b91kc52gg.ru
+bad0bnj6e.com
+bad0bnj6e.ru
+bsoizu1nu.com
+bsoizu1nu.ru
+btbvnjdwu.com
+btbvnjdwu.ru
+bys3s65ry.com
+bys3s65ry.ru
+d8uj8hqce.com
+d8uj8hqce.ru
+dy4gsm0o6.com
+dy4gsm0o6.ru
+eb268jg2k.com
+eb268jg2k.ru
+ebp47rzts.com
+ebp47rzts.ru
+ec0wf7v0z.com
+ec0wf7v0z.ru
+epdvyiwda.com
+epdvyiwda.ru
+eujy3xcnk.com
+eujy3xcnk.ru
+ewliet2au.com
+ewliet2au.ru
+fcgu4mp61.com
+fcgu4mp61.ru
+fy3c780qw.com
+fy3c780qw.ru
+fzg82db9j.com
+fzg82db9j.ru
+g24n6lcdc.com
+g24n6lcdc.ru
+g2q6zbwlb.com
+g2q6zbwlb.ru
+g9xpcva91.com
+g9xpcva91.ru
+gez1mj6na.com
+gez1mj6na.ru
+gr9jiwmfx.com
+gr9jiwmfx.ru
+gs2qelzak.com
+gs2qelzak.ru
+h7hvch2um.com
+h7hvch2um.ru
+hggw2y4x4.com
+hggw2y4x4.ru
+hm1b5tc4k.com
+hm1b5tc4k.ru
+iaujaj3k1.com
+iaujaj3k1.ru
+io5f3eup3.com
+io5f3eup3.ru
+iyfdoke6c.com
+iyfdoke6c.ru
+j8hpuyy8h.com
+j8hpuyy8h.ru
+jsnaspt0w.com
+jsnaspt0w.ru
+jxirada4a.com
+jxirada4a.ru
+k4tv55fdz.com
+k4tv55fdz.ru
+kgzwohbvp.com
+kgzwohbvp.ru
+kwz90va72.com
+kwz90va72.ru
+maqgf9r1h.com
+maqgf9r1h.ru
+mgnav6dph.com
+mgnav6dph.ru
+mujnpomyb.com
+mujnpomyb.ru
+np3ixa24g.com
+np3ixa24g.ru
+nqtk6cvwq.com
+nqtk6cvwq.ru
+nrag6dgvr.com
+nrag6dgvr.ru
+nxq7816c0.com
+nxq7816c0.ru
+plurcoms1.com
+plurcoms1.ru
+q99kzhob7.com
+q99kzhob7.ru
+qa5gcrdg3.com
+qa5gcrdg3.ru
+qgyqm51b4.com
+qgyqm51b4.ru
+qrd9f341v.com
+qrd9f341v.ru
+rhb2ifw8s.com
+rhb2ifw8s.ru
+s57h4joul.com
+s57h4joul.ru
+s9ea4xnk8.com
+s9ea4xnk8.ru
+siz7clvkt.com
+siz7clvkt.ru
+tng099zzr.com
+tng099zzr.ru
+tqdumb4ds.com
+tqdumb4ds.ru
+tr67cn9ck.com
+tr67cn9ck.ru
+ts9er6pme.com
+ts9er6pme.ru
+u5pp5w81o.com
+u5pp5w81o.ru
+ufv9eludz.com
+ufv9eludz.ru
+uuzytsap0.com
+uuzytsap0.ru
+v1w8lw1o1.com
+v1w8lw1o1.ru
+v7105jxaj.com
+v7105jxaj.ru
+w0fndc9sc.com
+w0fndc9sc.ru
+wlhe3kl9t.com
+wlhe3kl9t.ru
+xavscq1av.com
+xavscq1av.ru
+xuz3ml6br.com
+xuz3ml6br.ru
+xxi2y9v9n.com
+xxi2y9v9n.ru
+yfxnbvrzv.com
+yfxnbvrzv.ru
+ynj2jaonr.com
+ynj2jaonr.ru
+yqva1gzi5.com
+yqva1gzi5.ru
+yz1yfyc6z.com
+yz1yfyc6z.ru
+z33azfcl9.com
+z33azfcl9.ru
diff --git a/DGA/760D800222E84C91A95A993CD7EDFF21/2021-11-16-DGALIST-760D800222E84C91A95A993CD7EDFF21.txt b/DGA/760D800222E84C91A95A993CD7EDFF21/2021-11-16-DGALIST-760D800222E84C91A95A993CD7EDFF21.txt
diff --git a/DGA/7B17D535E87720C8A7AEE913928456DF/2021-11-16-DGALIST-7B17D535E87720C8A7AEE913928456DF.txt b/DGA/7B17D535E87720C8A7AEE913928456DF/2021-11-16-DGALIST-7B17D535E87720C8A7AEE913928456DF.txt
@@ -0,0 +1,80 @@
+03d29eb719.pw
+064f708d91.pw
+07a161b88b.pw
+087e97d800.pw
+089c958e00.pw
+0cdc5165ff.pw
+0da133e5b2.pw
+111e8bc9e6.pw
+128249ab81.pw
+12c226568b.pw
+145dd35575.pw
+1b25eae0e1.pw
+1be212755b.pw
+1cdce2763b.pw
+213f94e9f5.pw
+331fa0e977.pw
+387684822f.pw
+3892364246.pw
+3932dd1a77.pw
+46e0bd953b.pw
+4856312bcd.pw
+4a2410130f.pw
+4bf8258066.pw
+55429f1db6.pw
+5c7b70ce48.pw
+65b38dc8d9.pw
+6871997c63.pw
+69219dae84.pw
+6a088b7dc4.pw
+6c6c07280f.pw
+6d0e4d12a4.pw
+6d58c91f94.pw
+7576dc1093.pw
+7799aa73ab.pw
+7adebfce97.pw
+7f1d432c07.pw
+7f2db2752f.pw
+817c4940b0.pw
+8523347757.pw
+8f65a721d9.pw
+91260ad41c.pw
+95c7964853.pw
+98e637a05c.pw
+9a136869e3.pw
+a5977d3156.pw
+a6c337d83a.pw
+a831a69e29.pw
+a8ebcd92ab.pw
+b0f179aae9.pw
+b220cf5629.pw
+b32659ba2a.pw
+b4337c0078.pw
+b55b9e5e83.pw
+b9103c8946.pw
+c325a0362a.pw
+c84aa197ef.pw
+cae43a8d9c.pw
+cc3d02ebfb.pw
+cce977f77d.pw
+d0a1b70906.pw
+d0dd48c3d9.pw
+d17ca0afd5.pw
+d2f0b41ed1.pw
+d51942f548.pw
+dbdeea0876.pw
+dcc36b74c4.pw
+e08e226273.pw
+e11c662c4d.pw
+e51286d65a.pw
+e76dba0e93.pw
+e7d413df23.pw
+e9701a3572.pw
+ebe995938b.pw
+ed7e7f28f0.pw
+ef2406c4ed.pw
+ef9c3b9df6.pw
+f07b2b3d41.pw
+f14a5841df.pw
+f23bbbfe4b.pw
+f3bd597c0a.pw
diff --git a/DGA/97C227D935DC521E1174465CC6B10E57/2021-11-16-DGALIST-97C227D935DC521E1174465CC6B10E57.txt b/DGA/97C227D935DC521E1174465CC6B10E57/2021-11-16-DGALIST-97C227D935DC521E1174465CC6B10E57.txt
@@ -0,0 +1,12 @@
+almwwoiq.cn
+cbmdnoyq.cn
+ckrbxrja.cn
+dijzsjyh.cn
+gcydqpyy.cn
+jjcteneg.cn
+qbgtrrif.cn
+utaxjdtd.cn
+wqgwtzhm.cn
+xqejzqeh.cn
+zbmayove.cn
+zegvzxyj.cn
diff --git a/DGA/Andromeda/2021-11-16-DGALIST-Andromeda.txt b/DGA/Andromeda/2021-11-16-DGALIST-Andromeda.txt
@@ -0,0 +1,198 @@
+v1.abtuzyr.su
+v1.adkiqxr.net
+v1.ajmdjgm.su
+v1.ajuiyho.net
+v1.aqbkutd.su
+v1.aqltjdn.su
+v1.asaycel.su
+v1.awknafe.net
+v1.awzhchr.net
+v1.azsifni.net
+v1.bkcjyel.net
+v1.blsqcom.su
+v1.borcrxy.su
+v1.bppxkia.net
+v1.byhjsgg.su
+v1.bzdzcfn.su
+v1.bzgozjj.net
+v1.bzofiku.su
+v1.cbidghg.net
+v1.cbprrwn.su
+v1.chfandc.net
+v1.ckoqcqn.net
+v1.cnetaoe.su
+v1.crafxjr.net
+v1.crixgdt.net
+v1.cyetpfr.net
+v1.czsbzuz.su
+v1.dankpup.net
+v1.ddcdqzg.net
+v1.ddiholg.net
+v1.dpjpaoz.net
+v1.dxzorrl.net
+v1.dztrhjr.net
+v1.eausapw.net
+v1.egzsgns.net
+v1.eocbrbc.net
+v1.eofczka.net
+v1.eukndis.su
+v1.ewzdrft.su
+v1.fgcjydd.su
+v1.fhfjloy.su
+v1.fhhrdnt.su
+v1.firhafy.su
+v1.frxrnud.net
+v1.fwkucwi.su
+v1.fxcpgju.net
+v1.gfqechl.su
+v1.ghmhwke.su
+v1.gqjgway.su
+v1.gsptuqg.su
+v1.gusmumu.su
+v1.gyrxttt.su
+v1.hrdnnjt.su
+v1.hrpuyux.su
+v1.hspggcg.net
+v1.hyutcsr.net
+v1.hyxfcet.su
+v1.iejsgoh.su
+v1.ihjeuup.net
+v1.iktkiwf.su
+v1.iomqefi.net
+v1.isxxqyt.net
+v1.itzlfzq.net
+v1.iufdhft.su
+v1.izuabbo.su
+v1.jebunqk.su
+v1.jghcbml.su
+v1.jotpiup.net
+v1.jpqgimz.su
+v1.jszjobg.net
+v1.kbizmwz.net
+v1.keuecba.su
+v1.keunslf.su
+v1.kgaiqdm.net
+v1.kmskuod.su
+v1.kqktptq.su
+v1.ksbcztc.net
+v1.kuruhpi.net
+v1.kxnqeba.net
+v1.kxqfhii.su
+v1.kyszccn.su
+v1.kzlxnfx.net
+v1.lgbjswe.su
+v1.lgdiqcq.net
+v1.libzahc.su
+v1.liqxhqu.net
+v1.ljwnkib.su
+v1.lkpuwsn.su
+v1.llmcuqr.net
+v1.llxgnku.su
+v1.lqslmae.net
+v1.lrplsox.net
+v1.lsttcgy.su
+v1.lxngwxg.net
+v1.lycoxyx.net
+v1.mctcylz.su
+v1.mfcifpc.su
+v1.mjunuzw.net
+v1.mmqdcnm.net
+v1.mnhuedt.su
+v1.mqmqdxy.net
+v1.msndokl.net
+v1.mzkpugu.su
+v1.nbryeiz.su
+v1.ndngolz.net
+v1.nerjyze.net
+v1.nkaebpn.su
+v1.nmsrbmg.su
+v1.oemwnkc.su
+v1.ohzodma.net
+v1.oilrjwn.net
+v1.oktjebr.net
+v1.olbduxa.net
+v1.orkteon.su
+v1.oxoqsgu.su
+v1.oycmnro.net
+v1.oykicdy.su
+v1.pdeerwn.net
+v1.pggetuc.net
+v1.pjuomno.su
+v1.pnpjgny.net
+v1.powdokf.su
+v1.psbkwxt.net
+v1.qejxyet.net
+v1.qfdbuqo.su
+v1.qffcfbt.net
+v1.qlupqsf.net
+v1.qnecfnx.su
+v1.qsqgysy.su
+v1.qsssctl.su
+v1.qtgtjeg.su
+v1.qxqsdwd.su
+v1.qyczyhr.net
+v1.qzxmhmc.su
+v1.rajugqq.net
+v1.rblkkpc.net
+v1.rdugpcb.net
+v1.rfkpdte.su
+v1.rilcrjj.su
+v1.rjdhyha.net
+v1.rleqily.su
+v1.rsymxsq.net
+v1.saipwux.net
+v1.segxwtb.net
+v1.shngami.su
+v1.smdzxcd.net
+v1.sqwshtn.su
+v1.ssuxbht.su
+v1.tcopdnx.net
+v1.tekguer.net
+v1.tewjnrz.net
+v1.tfpadgw.su
+v1.tkbsjya.su
+v1.txozmus.net
+v1.tyopceq.su
+v1.tzocdrt.su
+v1.ubnrcsf.su
+v1.ucfcjbc.su
+v1.ueqryhk.net
+v1.uflayrx.su
+v1.ugiuose.net
+v1.uitymbg.net
+v1.urofrpl.su
+v1.usrleir.su
+v1.utmsjsn.net
+v1.wgpdhqp.net
+v1.whzkikp.net
+v1.wimrguj.net
+v1.wjlelrc.su
+v1.wkiytow.su
+v1.wmhnthi.su
+v1.wuwzzlk.su
+v1.wwurqqk.su
+v1.wygqofr.net
+v1.xbxbijn.net
+v1.xeppfmj.su
+v1.xhfksqn.net
+v1.xjroiek.net
+v1.xjybdfl.net
+v1.xnsoaei.su
+v1.xpfgxgf.net
+v1.xqcsgnu.su
+v1.xrqkiea.su
+v1.xskgyoe.net
+v1.ygaonhh.net
+v1.yjqlbuo.net
+v1.ylrlftw.net
+v1.yowqyjw.su
+v1.yuqwltg.su
+v1.yzygkxs.net
+v1.zagnmyn.su
+v1.zgghjip.net
+v1.zhxeiaj.su
+v1.zhxufld.su
+v1.znfujhi.net
+v1.zsqfnlj.net
+v1.zwfjhuh.su
+v1.zzymubi.su
diff --git a/...LIST-D020E618C8109EB7F890ECEA60159D8C.txt → ...LIST-D020E618C8109EB7F890ECEA60159D8C.txt b/...LIST-D020E618C8109EB7F890ECEA60159D8C.txt → ...LIST-D020E618C8109EB7F890ECEA60159D8C.txt
diff --git a/...LIST-F38BD82554B1FAE6782F41F75CE05521.txt → DGA/Khalesi/2021-11-16-DGALIST-Khalesi.txt b/...LIST-F38BD82554B1FAE6782F41F75CE05521.txt → DGA/Khalesi/2021-11-16-DGALIST-Khalesi.txt
@@ -2095,202 +2095,3 @@ buy1.zzcikkf.net
 buy1.zzcsctw.com
 buy1.zzjfmny.ru
 buy1.zzqlyal.net
-v1.abtuzyr.su
-v1.adkiqxr.net
-v1.ajmdjgm.su
-v1.ajuiyho.net
-v1.aqbkutd.su
-v1.aqltjdn.su
-v1.asaycel.su
-v1.awknafe.net
-v1.awzhchr.net
-v1.azsifni.net
-v1.bkcjyel.net
-v1.blsqcom.su
-v1.borcrxy.su
-v1.bppxkia.net
-v1.byhjsgg.su
-v1.bzdzcfn.su
-v1.bzgozjj.net
-v1.bzofiku.su
-v1.cbidghg.net
-v1.cbprrwn.su
-v1.chfandc.net
-v1.ckoqcqn.net
-v1.cndnagb.biz
-v1.cnetaoe.su
-v1.crafxjr.net
-v1.crixgdt.net
-v1.cyetpfr.net
-v1.czsbzuz.su
-v1.dankpup.net
-v1.ddcdqzg.net
-v1.ddiholg.net
-v1.dpjpaoz.net
-v1.dxzorrl.net
-v1.dztrhjr.net
-v1.eausapw.net
-v1.egzsgns.net
-v1.eocbrbc.net
-v1.eofczka.net
-v1.eukndis.su
-v1.ewzdrft.su
-v1.fgcjydd.su
-v1.fhfjloy.su
-v1.fhhrdnt.su
-v1.firhafy.su
-v1.frxrnud.net
-v1.fwkucwi.su
-v1.fxcpgju.net
-v1.gfqechl.su
-v1.ghmhwke.su
-v1.gqjgway.su
-v1.gsptuqg.su
-v1.gusmumu.su
-v1.gyrxttt.su
-v1.hrdnnjt.su
-v1.hrpuyux.su
-v1.hspggcg.net
-v1.hyutcsr.net
-v1.hyxfcet.su
-v1.iejsgoh.su
-v1.ihjeuup.net
-v1.iktkiwf.su
-v1.iomqefi.net
-v1.isxxqyt.net
-v1.itzlfzq.net
-v1.iufdhft.su
-v1.izuabbo.su
-v1.jebunqk.su
-v1.jghcbml.su
-v1.jotpiup.net
-v1.jpqgimz.su
-v1.jszjobg.net
-v1.kbizmwz.net
-v1.keuecba.su
-v1.keunslf.su
-v1.kgaiqdm.net
-v1.kmskuod.su
-v1.kqktptq.su
-v1.ksbcztc.net
-v1.kuruhpi.net
-v1.kxnqeba.net
-v1.kxqfhii.su
-v1.kyszccn.su
-v1.kzlxnfx.net
-v1.lgbjswe.su
-v1.lgdiqcq.net
-v1.libzahc.su
-v1.liqxhqu.net
-v1.ljwnkib.su
-v1.lkpuwsn.su
-v1.llmcuqr.net
-v1.llxgnku.su
-v1.lqslmae.net
-v1.lrplsox.net
-v1.lsttcgy.su
-v1.lxngwxg.net
-v1.lycoxyx.net
-v1.mctcylz.su
-v1.mfcifpc.su
-v1.mjunuzw.net
-v1.mmqdcnm.net
-v1.mnhuedt.su
-v1.mqmqdxy.net
-v1.msndokl.net
-v1.mzkpugu.su
-v1.nbryeiz.su
-v1.ndngolz.net
-v1.nerjyze.net
-v1.nkaebpn.su
-v1.nmsrbmg.su
-v1.oemwnkc.su
-v1.ohzodma.net
-v1.oilrjwn.net
-v1.oktjebr.net
-v1.olbduxa.net
-v1.orkteon.su
-v1.oxoqsgu.su
-v1.oycmnro.net
-v1.oykicdy.su
-v1.pdeerwn.net
-v1.pggetuc.net
-v1.pjuomno.su
-v1.pnpjgny.net
-v1.powdokf.su
-v1.psbkwxt.net
-v1.qejxyet.net
-v1.qfdbuqo.su
-v1.qffcfbt.net
-v1.qlupqsf.net
-v1.qnecfnx.su
-v1.qsqgysy.su
-v1.qsssctl.su
-v1.qtgtjeg.su
-v1.qxqsdwd.su
-v1.qyczyhr.net
-v1.qzxmhmc.su
-v1.rajugqq.net
-v1.rblkkpc.net
-v1.rdugpcb.net
-v1.rfkpdte.su
-v1.rilcrjj.su
-v1.rjdhyha.net
-v1.rleqily.su
-v1.rsymxsq.net
-v1.saipwux.net
-v1.segxwtb.net
-v1.shngami.su
-v1.smdzxcd.net
-v1.sqwshtn.su
-v1.ssuxbht.su
-v1.tcopdnx.net
-v1.tekguer.net
-v1.tewjnrz.net
-v1.tfpadgw.su
-v1.tkbsjya.su
-v1.txozmus.net
-v1.tyopceq.su
-v1.tzocdrt.su
-v1.ubnrcsf.su
-v1.ucfcjbc.su
-v1.ueqryhk.net
-v1.uflayrx.su
-v1.ugiuose.net
-v1.uitymbg.net
-v1.urofrpl.su
-v1.usrleir.su
-v1.utmsjsn.net
-v1.wgpdhqp.net
-v1.whzkikp.net
-v1.wimrguj.net
-v1.wjlelrc.su
-v1.wkiytow.su
-v1.wmhnthi.su
-v1.wuwzzlk.su
-v1.wwurqqk.su
-v1.wygqofr.net
-v1.xbxbijn.net
-v1.xeppfmj.su
-v1.xhfksqn.net
-v1.xjroiek.net
-v1.xjybdfl.net
-v1.xnsoaei.su
-v1.xpfgxgf.net
-v1.xqcsgnu.su
-v1.xrqkiea.su
-v1.xskgyoe.net
-v1.ygaonhh.net
-v1.yjqlbuo.net
-v1.ylrlftw.net
-v1.yowqyjw.su
-v1.yuqwltg.su
-v1.yzygkxs.net
-v1.zagnmyn.su
-v1.zgghjip.net
-v1.zhxeiaj.su
-v1.zhxufld.su
-v1.znfujhi.net
-v1.zsqfnlj.net
-v1.zwfjhuh.su
-v1.zzymubi.su
diff --git a/...LIST-57A3D376E6495D594ED5F8E811824C4B.txt → DGA/Mylobot/2021-11-16-DGALIST-Mylobot.txt b/...LIST-57A3D376E6495D594ED5F8E811824C4B.txt → DGA/Mylobot/2021-11-16-DGALIST-Mylobot.txt
diff --git a/ioc_extender/ET_APT33.json b/ioc_extender/ET_APT33.json
@@ -150,6 +150,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "dev.hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "dev.hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",
@@ -270,6 +276,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",
@@ -408,6 +420,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "mail.hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "mail.hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",
@@ -528,6 +546,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "n3tc4t.hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "n3tc4t.hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",
@@ -642,6 +666,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "proxymaterials.hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "proxymaterials.hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",
@@ -798,6 +828,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "www.dev.hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "www.dev.hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",
@@ -906,6 +942,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "www.hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "www.hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",
@@ -1014,6 +1056,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "www.proxymaterials.hopto.com",
+      "links": "fe342ada644cf9a63266124642a9fbea4e86c1a9",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "www.proxymaterials.hopto.com",
       "links": "ff0f9ccaa878af8ab00dddb66a71875a97fe0cc2",

diff --git a/ioc_extender/ET_Gamaredon.json b/ioc_extender/ET_Gamaredon.json
diff --git a/ioc_extender/ET_Lemon_Duck.json b/ioc_extender/ET_Lemon_Duck.json
@@ -342,6 +342,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "billing-incomplete.com",
+      "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "blinds.vc",
       "links": "40a5aa896dbd1dfc41d2726f095eeae6ecda74d4",

diff --git a/ioc_extender/ET_Matanbuchus.json b/ioc_extender/ET_Matanbuchus.json
diff --git a/ioc_extender/HP_IcedID.json b/ioc_extender/HP_IcedID.json
@@ -120,6 +120,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "HP Threat Research: IcedID",
+      "links": "counteredilin.top",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "HP Threat Research: IcedID",
       "links": "creaslipfo.top",
@@ -666,6 +672,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "bansoffgo.rest",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "befederehop.fun",
       "links": "195.123.233.249",
@@ -876,6 +888,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "counteredilin.top",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "creaslipfo.top",
       "links": "185.186.245.27",
@@ -1230,6 +1248,18 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "financeexactly.site",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
+    {
+      "host": "firzittoser.site",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "flipperdesar.digital",
       "links": "23.227.206.161",
@@ -1842,6 +1872,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "lokiwaderty.space",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "lovewistdir.top",
       "links": "79.110.52.108",
@@ -2382,6 +2418,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "roadswendy.top",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "rodolfmedia.top",
       "links": "79.110.52.108",
@@ -2808,6 +2850,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "vikollaser.space",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "virenistonaling.top",
       "links": "185.186.245.199",
@@ -2970,6 +3018,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "zixermacher.surf",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "zokawero.fun",
       "links": "79.141.171.29",

diff --git a/ioc_extender/HP_TA551.json b/ioc_extender/HP_TA551.json
@@ -60,6 +60,18 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "HP Threat Research: TA551",
+      "links": "thriveparrad.com",
+      "type": "z",
+      "ln": 2
+    },
+    {
+      "host": "HP Threat Research: TA551",
+      "links": "topproperty1998b.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "antiquefund1998b.com",
       "links": "194.62.42.113",
@@ -96,6 +108,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "digivape1.com",
+      "links": "09e4df9b8328342aafc76e048b1c59eb7798e988",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "digivape1.com",
       "links": "e0ba564746d7ca05b074df110d9c43296a344d01",
@@ -108,6 +126,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "digivape2.com",
+      "links": "09e4df9b8328342aafc76e048b1c59eb7798e988",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "digivape2.com",
       "links": "e0ba564746d7ca05b074df110d9c43296a344d01",
@@ -120,6 +144,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "digivape3.com",
+      "links": "09e4df9b8328342aafc76e048b1c59eb7798e988",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "digivape3.com",
       "links": "e0ba564746d7ca05b074df110d9c43296a344d01",
@@ -132,6 +162,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "digivape4.com",
+      "links": "09e4df9b8328342aafc76e048b1c59eb7798e988",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "elvirsac05.itnappqyorrgj.live",
       "links": "45.95.11.111",
@@ -180,12 +216,30 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "santiagoposts.com",
+      "links": "194.62.42.45",
+      "type": "pdns",
+      "ln": 2
+    },
+    {
+      "host": "thriveparrad.com",
+      "links": "194.62.42.45",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "tm-porno.ru",
       "links": "194.62.42.19",
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "topproperty1998b.com",
+      "links": "194.62.42.45",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "tp-adult.ru",
       "links": "194.62.42.19",
@@ -198,6 +252,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "www.digivape1.com",
+      "links": "09e4df9b8328342aafc76e048b1c59eb7798e988",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "www.digivape1.com",
       "links": "e0ba564746d7ca05b074df110d9c43296a344d01",
@@ -210,6 +270,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "www.digivape2.com",
+      "links": "09e4df9b8328342aafc76e048b1c59eb7798e988",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "www.digivape2.com",
       "links": "e0ba564746d7ca05b074df110d9c43296a344d01",
@@ -221,6 +287,12 @@
       "links": "fa482fea3da001e6e0ebefc98b8d8730f7498f24",
       "type": "certs",
       "ln": 2
+    },
+    {
+      "host": "www.digivape4.com",
+      "links": "09e4df9b8328342aafc76e048b1c59eb7798e988",
+      "type": "certs",
+      "ln": 2
     }
   ]
 }
diff --git a/ioc_extender/TF_BazarBackdoor.json b/ioc_extender/TF_BazarBackdoor.json
@@ -234,6 +234,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "santiagoposts.com",
+      "links": "194.62.42.45",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "thriveparrad.com",
       "links": "194.62.42.45",

diff --git a/ioc_extender/TF_Chrysaor.json b/ioc_extender/TF_Chrysaor.json
@@ -456,6 +456,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "billing-incomplete.com",
+      "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "boaalerts.com",
       "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",

diff --git a/ioc_extender/TF_Cobalt_Strike.json b/ioc_extender/TF_Cobalt_Strike.json
@@ -486,6 +486,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "crtdnl.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Cobalt Strike",
       "links": "cubigif.com",
@@ -516,6 +522,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "demtp.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Cobalt Strike",
       "links": "dirupun.com",
@@ -624,6 +636,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "gomershuz.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Cobalt Strike",
       "links": "googlecnd.com",
@@ -642,6 +660,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "halartymana.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Cobalt Strike",
       "links": "healthfirsthospitals.com",
@@ -1020,6 +1044,18 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "soccergl.com",
+      "type": "z",
+      "ln": 2
+    },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "sochuk.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Cobalt Strike",
       "links": "softnewspaper.com",
@@ -1176,6 +1212,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "xahebuz.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Cobalt Strike",
       "links": "xegogiv.com",
@@ -1272,6 +1314,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Cobalt Strike",
+      "links": "zuhufoy.com",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Cobalt Strike",
       "links": "zuveye.com",
@@ -1440,6 +1488,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "asdstatistic.com",
+      "links": "152.89.247.208",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "asdstatistic.com",
       "links": "335b0d41d4463209fecb9933958b61707594199f",
@@ -1578,6 +1632,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "banksgmb.com",
+      "links": "162.244.82.77",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "baofenh.com",
       "links": "107.181.161.198",
@@ -1632,6 +1692,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "billing-incomplete.com",
+      "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "binanceico.com",
       "links": "0dc95187933afbb5a002e7bde78be6821c02eb3e",
@@ -1908,6 +1974,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "crtdnl.com",
+      "links": "783d28bdfc896ff55a0e267865891ccea58b438f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "cryptostation.exchange",
       "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",
@@ -1926,6 +1998,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "cz-cloud.xyz",
+      "links": "152.89.247.208",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "d2.backupmasterservice.com",
       "links": "3.214.68.117",
@@ -1998,6 +2076,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "demtp.com",
+      "links": "66.70.246.7",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "deniz-baligi.com",
       "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",
@@ -2682,6 +2766,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "ip7.ip-66-70-246.net",
+      "links": "66.70.246.7",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "ipko-bussines.com",
       "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",
@@ -3336,6 +3426,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "navnteam.site",
+      "links": "172.93.201.63",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "nefida.com",
       "links": "23.106.223.105",
@@ -3474,6 +3570,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "ns1.crtdnl.com",
+      "links": "783d28bdfc896ff55a0e267865891ccea58b438f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "ns1.gabriel.host",
       "links": "162.244.82.249",
@@ -3498,12 +3600,30 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "ns2.crtdnl.com",
+      "links": "783d28bdfc896ff55a0e267865891ccea58b438f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "ns2.jesage.com",
       "links": "172.93.201.138",
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "ns3.crtdnl.com",
+      "links": "783d28bdfc896ff55a0e267865891ccea58b438f",
+      "type": "certs",
+      "ln": 2
+    },
+    {
+      "host": "ns4.crtdnl.com",
+      "links": "783d28bdfc896ff55a0e267865891ccea58b438f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "oldboytakecar.net",
       "links": "176.118.164.143",
@@ -3786,6 +3906,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "ripe-back-s31.bioother.com",
+      "links": "162.244.82.77",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "rs229777.rs.hosteurope.de",
       "links": "37.61.205.212",

diff --git a/ioc_extender/TF_Dridex.json b/ioc_extender/TF_Dridex.json
@@ -294,6 +294,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "billing-incomplete.com",
+      "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "boaalerts.com",
       "links": "004a44ff4929e5fd91538276fe45fb57c11bb06f",

diff --git a/ioc_extender/TF_Ficker_Stealer.json b/ioc_extender/TF_Ficker_Stealer.json
@@ -53,6 +53,12 @@
       "links": "62.113.117.9",
       "type": "pdns",
       "ln": 2
+    },
+    {
+      "host": "v849834.hosted-by-vdsina.ru",
+      "links": "62.113.117.9",
+      "type": "pdns",
+      "ln": 2
     }
   ]
 }
diff --git a/ioc_extender/TF_Formbook.json b/ioc_extender/TF_Formbook.json
@@ -918,6 +918,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "cpanel.nursingassignmentdue.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "cpanel.pool.express",
       "links": "199.192.23.253",
@@ -1020,6 +1026,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "cpcalendars.nursingassignmentdue.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "cpcalendars.pool.express",
       "links": "199.192.23.253",
@@ -1122,6 +1134,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "cpcontacts.nursingassignmentdue.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "cpcontacts.pool.express",
       "links": "199.192.23.253",
@@ -1176,6 +1194,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "cunerier.com",
+      "links": "66.29.133.181",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "curap.online",
       "links": "63.250.34.114",
@@ -1278,6 +1302,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "eleven.finance",
+      "links": "13.56.221.4",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "elitestatsanalysis.com",
       "links": "162.0.213.60",
@@ -1344,6 +1374,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "gogreenup.nl",
+      "links": "13.56.221.4",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "haxb33.xyz",
       "links": "162.0.233.6",
@@ -1392,6 +1428,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "iptu.cariocariodigital.org",
+      "links": "162.0.233.137",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "jadoomagic.in",
       "links": "162.0.238.245",
@@ -1476,6 +1518,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "log-ama-zon.com",
+      "links": "162.0.230.164",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "lownak.com",
       "links": "192.64.115.15",
@@ -2016,6 +2064,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "nursingassignmentdue.nursingassignmentacers.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "nursingessaygurus.com",
       "links": "162.0.213.60",
@@ -2088,6 +2142,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "probinns.com",
+      "links": "66.29.133.181",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "promedrep.com",
       "links": "199.192.24.12",
@@ -2274,6 +2334,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "solanup.com",
+      "links": "13.56.221.4",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "solevux.com",
       "links": "162.0.221.213",
@@ -2526,6 +2592,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "webdisk.nursingassignmentdue.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "webdisk.pool.express",
       "links": "199.192.23.253",
@@ -2640,6 +2712,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "webmail.nursingassignmentdue.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "webmail.pool.express",
       "links": "199.192.23.253",
@@ -2688,6 +2766,18 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "whm.nursingassignmentdue.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
+    {
+      "host": "wiktorwisniewski.dev",
+      "links": "13.56.221.4",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "wpad.beauty",
       "links": "162.0.223.226",
@@ -3186,6 +3276,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "www.iptu.cariocariodigital.org",
+      "links": "162.0.233.137",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "www.jam-nins.com",
       "links": "162.0.216.198",
@@ -3318,6 +3414,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "www.nursingassignmentdue.nursingassignmentacers.com",
+      "links": "162.0.213.60",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "www.nursingessaygurus.nursingassignmentacers.com",
       "links": "162.0.213.60",

diff --git a/ioc_extender/TF_Gozi.json b/ioc_extender/TF_Gozi.json
@@ -324,6 +324,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "whiskey-vpiski.ru",
+      "links": "743a3b269bed3112ada96de119bc6972d1317736",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "worunekulo.club",
       "links": "78f7946fee67a734fb1b74cf64e34c192ad64ca6",

diff --git a/ioc_extender/TF_ISFB.json b/ioc_extender/TF_ISFB.json
diff --git a/ioc_extender/TF_IcedID.json b/ioc_extender/TF_IcedID.json
@@ -462,6 +462,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: IcedID",
+      "links": "counteredilin.top",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: IcedID",
       "links": "creaslipfo.top",
@@ -2262,6 +2268,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "awesillo.live",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "awesillo.live",
       "links": "185.70.184.43",
@@ -2322,6 +2334,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "bansoffgo.rest",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "barcafokliresd.top",
       "links": "2429a8db017d7e2de4e0f1013c0f99e45e018df6",
@@ -2700,6 +2718,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "counteredilin.top",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "cpanel.aopemucoa.com",
       "links": "178.62.242.234",
@@ -3324,6 +3348,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "erformedilin.top",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "erformedilin.top",
       "links": "185.70.184.43",
@@ -3552,6 +3582,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "financeexactly.site",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "firesolivag.top",
       "links": "46.21.153.39",
@@ -3564,6 +3600,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "firzittoser.site",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "fislatriller.best",
       "links": "188.166.88.45",
@@ -3624,6 +3666,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "follytresh.co",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "follytresh.co",
       "links": "185.70.184.43",
@@ -3792,6 +3840,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "gistratiofilin.top",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "gistratiofilin.top",
       "links": "5.34.181.44",
@@ -3972,6 +4026,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "hangetilin.top",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "hangetilin.top",
       "links": "5.34.181.44",
@@ -4338,6 +4398,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "intonthsnstr.rest",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "intonthsnstr.rest",
       "links": "185.70.184.43",
@@ -4578,6 +4644,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "kummamemybaby.rest",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "kummamemybaby.rest",
       "links": "5.34.181.44",
@@ -4626,6 +4698,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "lakogrefop.rest",
+      "links": "45.153.241.21",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "lakogrefop.rest",
       "links": "5.34.181.44",
@@ -4728,6 +4806,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "lokiwaderty.space",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "lokkinkolins.cyou",
       "links": "178.128.146.23",
@@ -6006,6 +6090,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "roadswendy.top",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "rodolfmedia.top",
       "links": "23.106.124.168",
@@ -6930,6 +7020,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "vikollaser.space",
+      "links": "160.20.147.29",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "vinchanger.top",
       "links": "74885b091ee785faabae2b3b404fb75c92572eb3",
@@ -7386,6 +7482,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "zixermacher.surf",
+      "links": "195.123.234.34",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "zmekiloder.site",
       "links": "139.60.161.33",

diff --git a/ioc_extender/TF_IcedID_Downloader.json b/ioc_extender/TF_IcedID_Downloader.json
@@ -258,6 +258,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "dilingiromkan.ink",
+      "links": "67.205.174.210",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "dlihuhihbtvf.info",
       "links": "2429a8db017d7e2de4e0f1013c0f99e45e018df6",
@@ -420,6 +426,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "pisipilkan.ink",
+      "links": "67.205.174.210",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "pjr82milford.xyz",
       "links": "2429a8db017d7e2de4e0f1013c0f99e45e018df6",

diff --git a/ioc_extender/TF_NjRAT.json b/ioc_extender/TF_NjRAT.json
@@ -24,6 +24,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: NjRAT",
+      "links": "kiritofsagds.ddns.net",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "azad.live",
       "links": "3a330610d3889b7eb55f43e7698bea1f8e13a6b1",
@@ -35,6 +41,18 @@
       "links": "3a330610d3889b7eb55f43e7698bea1f8e13a6b1",
       "type": "certs",
       "ln": 2
+    },
+    {
+      "host": "kiritofsagds.ddns.net",
+      "links": "181.191.218.128",
+      "type": "pdns",
+      "ln": 2
+    },
+    {
+      "host": "revcnn-128.connecttelecom.rio.br",
+      "links": "181.191.218.128",
+      "type": "pdns",
+      "ln": 2
     }
   ]
 }
diff --git a/ioc_extender/TF_QakBot.json b/ioc_extender/TF_QakBot.json
diff --git a/ioc_extender/TF_RedLine_Stealer.json b/ioc_extender/TF_RedLine_Stealer.json
@@ -84,6 +84,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: RedLine Stealer",
+      "links": "tatreriash.xyz",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: RedLine Stealer",
       "links": "topstart.site",
@@ -264,6 +270,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "dns.patatras.info",
+      "links": "94.140.112.47",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "dogspise.site",
       "links": "f92a80414b514bca9d37969c5315e73f87d4784a",
@@ -648,6 +660,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "nueva-actualizados-mi-soporte.ellenpompeo.info",
+      "links": "94.140.112.47",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "of.dogspise.site",
       "links": "f92a80414b514bca9d37969c5315e73f87d4784a",
@@ -906,6 +924,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "tatreriash.xyz",
+      "links": "94.140.112.47",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "tf.topstart.site",
       "links": "09b12ada43368507714bbb8948f63b2ad9f70b69",

diff --git a/ioc_extender/TF_Remcos.json b/ioc_extender/TF_Remcos.json
@@ -120,6 +120,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "ThreatFox: Remcos",
+      "links": "satsundai.club",
+      "type": "z",
+      "ln": 2
+    },
     {
       "host": "ThreatFox: Remcos",
       "links": "swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu",
@@ -150,6 +156,12 @@
       "type": "z",
       "ln": 2
     },
+    {
+      "host": "airvpn.izrm.net",
+      "links": "184.75.221.171",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "ams-tedesus.com",
       "links": "212.193.30.133",
@@ -294,6 +306,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "noname79.direct.quickconnect.to",
+      "links": "79.134.225.37",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "ogidi.ddns.net",
       "links": "185.244.30.240",
@@ -318,6 +336,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "podzeye.duckdns.org",
+      "links": "79.134.225.37",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "rem16.camdvr.org",
       "links": "37.120.138.222",
@@ -414,6 +438,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "satsundai.club",
+      "links": "79.134.225.37",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "server105.nyc.us.na.ikev2.vpnable.net",
       "links": "37.120.138.222",
@@ -450,18 +480,36 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "thwarrior.synology.me",
+      "links": "184.75.221.171",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "tlngoose.synology.me",
       "links": "194.187.251.155",
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "trapboijiggy.dvrlists.com",
+      "links": "184.75.221.171",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "trapboijiggy.dvrlists.com",
       "links": "194.187.251.155",
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "twistednerd.dvrlists.com",
+      "links": "184.75.221.171",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "twistednerd.dvrlists.com",
       "links": "194.187.251.155",

diff --git a/ioc_extender/TF_ServHelper.json b/ioc_extender/TF_ServHelper.json
@@ -2136,6 +2136,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "saidijfjv9as.xyz",
+      "links": "194.180.174.95",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "saidijfjv9as.xyz",
       "links": "194a174f65563208b8ea965d6b0b94cbcabaef5a",
@@ -3444,6 +3450,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "www.saidijfjv9as.xyz",
+      "links": "194.180.174.95",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "www.saidijfjv9as.xyz",
       "links": "194a174f65563208b8ea965d6b0b94cbcabaef5a",

diff --git a/ioc_extender/TF_SmokeLoader.json b/ioc_extender/TF_SmokeLoader.json
diff --git a/ioc_extender/TF_magecart.json b/ioc_extender/TF_magecart.json
@@ -666,6 +666,12 @@
       "type": "certs",
       "ln": 2
     },
+    {
+      "host": "clawarekiuraratrom.store",
+      "links": "4d8e2becdfb0a3309e46e243b1f98b46ae049d36",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "cloudflare-ssl.com",
       "links": "45.142.213.55",
@@ -786,6 +792,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "gacorcuy.com",
+      "links": "4d8e2becdfb0a3309e46e243b1f98b46ae049d36",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "gcdn.space",
       "links": "8.209.69.3",
@@ -816,6 +828,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "google-activate.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "google-activate.com",
       "links": "47.254.184.114",
@@ -834,6 +852,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "google-activated.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "google-activated.com",
       "links": "47.254.184.114",
@@ -972,6 +996,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "google-sagepay.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "google-sagepay.com",
       "links": "47.254.184.114",
@@ -1368,6 +1398,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "lady-misss.site",
+      "links": "9c73f26d08c80392fcf32de60e43cfc5586b26f8",
+      "type": "certs",
+      "ln": 2
+    },
     {
       "host": "livechatlnc.com",
       "links": "178.20.44.93",
@@ -1446,6 +1482,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "merchant-analytics.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "merchant-analytics.com",
       "links": "47.254.184.114",
@@ -1476,6 +1518,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "mx.merchant-analytics.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "mx.merchant-analytics.com",
       "links": "47.254.184.114",
@@ -1986,6 +2034,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "www.google-activate.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "www.google-activate.com",
       "links": "47.254.184.114",
@@ -2004,6 +2058,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "www.google-activated.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "www.google-activated.com",
       "links": "47.254.184.114",
@@ -2142,6 +2202,12 @@
       "type": "pdns",
       "ln": 2
     },
+    {
+      "host": "www.merchant-analytics.com",
+      "links": "47.254.178.32",
+      "type": "pdns",
+      "ln": 2
+    },
     {
       "host": "www.merchant-analytics.com",
       "links": "47.254.184.114",

diff --git a/mozi_tracker/2021-11-16-MOZI-IPLIST.txt b/mozi_tracker/2021-11-16-MOZI-IPLIST.txt