# Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: calisto

# Reference: https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/

drive-share.live
protect-link.online
protection-office.live
proton-viewer.com

# Reference: https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign/

cache-docs.com
cloud-docs.com
docs-cache.com
docs-drive.online
docs-info.com
documents-cloud.com
documents-cloud.online
documents-pdf.online
drive-docs.com
file-milgov.systems
hypertextteches.com
office-protection.online
pdf-cloud.online
pdf-docs.online
pdf-shared.online
protectionmail.online
proton-docs.com
proton-view.online

# Reference: https://twitter.com/h2jazi/status/1538940189015429122
# Reference: https://www.virustotal.com/gui/file/7b95747eeea196c1485d089fa47a06bacb07d06399603d3a4fa153c21ce0a9ba/detection

cache-pdf.com

# Reference: https://otx.alienvault.com/pulse/6272996039678903e0b73dd5

cache-dns.com
docs-shared.com
documents-forwarding.com
documents-preview.com
protection-link.online
webresources.live

# Reference: https://twitter.com/r0ny_123/status/1549751626004500481

cache-pdf.online
documents-cloud.online
pdf-cache.online
pdf-forwarding.online
storage-service.online
