{
  "description": "List of popular legitimate domains from LOTS (Living Off Trusted Sites) Project used to conduct phishing, C&C, exfiltration or downloading tools to evade detection",
  "list": [
    ".000webhostapp.com",
    ".amazonaws.com",
    ".appspot.com",
    ".atlassian.net",
    ".axshare.com",
    ".azureedge.net",
    ".azurefd.net",
    ".azurestaticapps.net",
    ".azurewebsites.net",
    ".backblazeb2.com",
    ".blob.core.windows.net",
    ".blogspot.com",
    ".box.com",
    ".canva.com",
    ".clickfunnels.com",
    ".cloudapp.azure.com",
    ".cloudapp.net",
    ".cloudfront.net",
    ".cloudwaysapps.com",
    ".codesandbox.io",
    ".csb.app",
    ".digitaloceanspaces.com",
    ".docusign.com",
    ".doubleclick.net",
    ".dropmark.com",
    ".duckdns.org",
    ".easywp.com",
    ".firebaseapp.com",
    ".fleek.co",
    ".format.com",
    ".fyi.to",
    ".github.io",
    ".glitch.me",
    ".godaddysites.com",
    ".gofile.io",
    ".googleusercontent.com",
    ".herokuapp.com",
    ".hostingerapp.com",
    ".instagram.com",
    ".linodeobjects.com",
    ".mybluehost.me",
    ".mybluemix.net",
    ".myportfolio.com",
    ".mystrikingly.com",
    ".netlify.app",
    ".ngrok.io",
    ".nimbusweb.me",
    ".notion.site",
    ".on.aws",
    ".ondigitalocean.app",
    ".oraclecloud.com",
    ".pagecloud.com",
    ".pages.dev",
    ".plesk.page",
    ".repl.co",
    ".requestbin.net",
    ".rf.gd",
    ".sendspace.com",
    ".sharepoint.com",
    ".slab.com",
    ".surveycake.com",
    ".translate.goog",
    ".trycloudflare.com",
    ".tumblr.com",
    ".twitter.com",
    ".typeform.com",
    ".uplooder.net",
    ".wasabisys.com",
    ".web.app",
    ".web.core.windows.net",
    ".webflow.io",
    ".weebly.com",
    ".wixsite.com",
    ".wordpress.com",
    ".workers.dev",
    ".xiti.com",
    ".zendesk.com",
    "12ft.io",
    "1drv.com",
    "1drv.ms",
    "4sync.com",
    "anonfiles.com",
    "api.telegram.org",
    "app.milanote.com",
    "appdomain.cloud",
    "archive.org",
    "archive.ph",
    "attachment.outlook.live.net",
    "attachments.office.net",
    "beautiful.ai",
    "bit.ly",
    "bitbucket.io",
    "bitbucket.org",
    "cdn.discordapp.com",
    "cdn.fbsbx.com",
    "clbin.com",
    "codepen.io",
    "ct.sendgrid.net",
    "cutt.ly",
    "discord.com",
    "doc.clickup.com",
    "docs.google.com",
    "docsend.com",
    "dogechain.info",
    "drive.google.com",
    "dropbox.com",
    "evernote.com",
    "express.adobe.com",
    "facebook.com",
    "feedproxy.google.com",
    "filebin.net",
    "filecloudonline.com",
    "filetransfer.io",
    "firebasestorage.googleapis.com",
    "forms.office.com",
    "genius.com",
    "gitee.com",
    "github.com",
    "gitlab.com",
    "googleweblight.com",
    "graph.microsoft.com",
    "i.imgur.com",
    "icloud.com",
    "ideone.com",
    "inmotionhosting.com",
    "ix.io",
    "lnkd.in",
    "localhost.run",
    "mediafire.com",
    "mega.nz",
    "my.visme.co",
    "nethunt.com",
    "notion.so",
    "nt.embluemail.com",
    "onedrive.live.com",
    "onenoteonlinesync.onenote.com",
    "parg.co",
    "paste.ee",
    "pastebin.com",
    "pastebin.pl",
    "pastetext.net",
    "pastie.org",
    "pcloud.com",
    "raw.githubusercontent.com",
    "rb.gy",
    "rebrand.ly",
    "reddit.com",
    "rentry.co",
    "s.id",
    "siasky.net",
    "sites.google.com",
    "slack-files.com",
    "slack.com",
    "spark.adobe.com",
    "sprunge.us",
    "stonly.com",
    "storage.googleapis.com",
    "sway.office.com",
    "t.co",
    "t.m1.email.samsung.com",
    "telegra.ph",
    "teletype.in",
    "termbin.com",
    "textbin.net",
    "tinyurl.com",
    "track.adform.net",
    "transfer.sh",
    "trello.com",
    "ufile.io",
    "viewer.joomag.com",
    "wetransfer.com",
    "workflowy.com",
    "wtools.io",
    "youtube.com",
    "zerobin.net"
  ],
  "matching_attributes": [
    "domain",
    "domain|ip",
    "hostname",
    "hostname|port",
    "url"
  ],
  "name": "List of LOTS (Living Off Trusted Sites) Project Domains",
  "type": "hostname",
  "version": 20241104
}