misp-warninglists/lists/lots-project/list.json

191 lines
4.0 KiB
JSON

{
"description": "List of popular legitimate domains from LOTS (Living Off Trusted Sites) Project used to conduct phishing, C&C, exfiltration or downloading tools to evade detection",
"list": [
".000webhostapp.com",
".amazonaws.com",
".appspot.com",
".atlassian.net",
".axshare.com",
".azureedge.net",
".azurefd.net",
".azurestaticapps.net",
".azurewebsites.net",
".backblazeb2.com",
".blob.core.windows.net",
".blogspot.com",
".box.com",
".canva.com",
".clickfunnels.com",
".cloudapp.azure.com",
".cloudapp.net",
".cloudfront.net",
".cloudwaysapps.com",
".codesandbox.io",
".csb.app",
".digitaloceanspaces.com",
".docusign.com",
".doubleclick.net",
".dropmark.com",
".duckdns.org",
".easywp.com",
".firebaseapp.com",
".fleek.co",
".format.com",
".fyi.to",
".github.io",
".glitch.me",
".godaddysites.com",
".gofile.io",
".googleusercontent.com",
".herokuapp.com",
".hostingerapp.com",
".instagram.com",
".linodeobjects.com",
".mybluehost.me",
".mybluemix.net",
".myportfolio.com",
".mystrikingly.com",
".netlify.app",
".ngrok.io",
".nimbusweb.me",
".notion.site",
".on.aws",
".ondigitalocean.app",
".oraclecloud.com",
".pagecloud.com",
".pages.dev",
".plesk.page",
".repl.co",
".requestbin.net",
".rf.gd",
".sendspace.com",
".sharepoint.com",
".slab.com",
".surveycake.com",
".translate.goog",
".trycloudflare.com",
".tumblr.com",
".twitter.com",
".typeform.com",
".uplooder.net",
".wasabisys.com",
".web.app",
".web.core.windows.net",
".webflow.io",
".weebly.com",
".wixsite.com",
".wordpress.com",
".workers.dev",
".xiti.com",
".zendesk.com",
"12ft.io",
"1drv.com",
"1drv.ms",
"4sync.com",
"anonfiles.com",
"api.telegram.org",
"app.milanote.com",
"appdomain.cloud",
"archive.org",
"archive.ph",
"attachment.outlook.live.net",
"attachments.office.net",
"beautiful.ai",
"bit.ly",
"bitbucket.io",
"bitbucket.org",
"cdn.discordapp.com",
"cdn.fbsbx.com",
"clbin.com",
"codepen.io",
"ct.sendgrid.net",
"cutt.ly",
"discord.com",
"doc.clickup.com",
"docs.google.com",
"docsend.com",
"dogechain.info",
"drive.google.com",
"dropbox.com",
"evernote.com",
"express.adobe.com",
"facebook.com",
"feedproxy.google.com",
"filebin.net",
"filecloudonline.com",
"filetransfer.io",
"firebasestorage.googleapis.com",
"forms.office.com",
"genius.com",
"gitee.com",
"github.com",
"gitlab.com",
"googleweblight.com",
"graph.microsoft.com",
"i.imgur.com",
"icloud.com",
"ideone.com",
"inmotionhosting.com",
"ix.io",
"lnkd.in",
"localhost.run",
"mediafire.com",
"mega.nz",
"my.visme.co",
"nethunt.com",
"notion.so",
"nt.embluemail.com",
"onedrive.live.com",
"onenoteonlinesync.onenote.com",
"parg.co",
"paste.ee",
"pastebin.com",
"pastebin.pl",
"pastetext.net",
"pastie.org",
"pcloud.com",
"raw.githubusercontent.com",
"rb.gy",
"rebrand.ly",
"reddit.com",
"rentry.co",
"s.id",
"siasky.net",
"sites.google.com",
"slack-files.com",
"slack.com",
"spark.adobe.com",
"sprunge.us",
"stonly.com",
"storage.googleapis.com",
"sway.office.com",
"t.co",
"t.m1.email.samsung.com",
"telegra.ph",
"teletype.in",
"termbin.com",
"textbin.net",
"tinyurl.com",
"track.adform.net",
"transfer.sh",
"trello.com",
"ufile.io",
"viewer.joomag.com",
"wetransfer.com",
"workflowy.com",
"wtools.io",
"youtube.com",
"zerobin.net"
],
"matching_attributes": [
"domain",
"domain|ip",
"hostname",
"hostname|port",
"url"
],
"name": "List of LOTS (Living Off Trusted Sites) Project Domains",
"type": "hostname",
"version": 20241104
}