https://cpanel.netbar.org/assets/js/xml.php
http://159.65.130.146:80/index?a=
http://91.92.254.14:80/index?a=
https://www.safe.rocks?a=
https://catcher.requestcatcher.com/
http://89.23.107.155/
https://entraide-internationale.fr/IMG/xml.php?a=
http://8.137.112.245:8001/uploads/user/update.php?a=
http://35.201.216.249:80/index?a=
https://66.42.68.120?
https://duorhytm.fun/
https://secure-cama.com/checkindex?a=
https://telemetry.psecure.pro/index?a=

#Additional C2s via twitter.com/drb_ra:
http://146.0.228.66:1080/assets/js/xml.php
http://146.0.228.66:1080/css/chat.jsp
http://146.0.228.66:8111/css/chat.jsp
http://152.32.128.64
https://api.d-n-s.name:80/$
https://dcgems.net/plugins/authentication/auth.php?a=
https://www.miltonhouse.nl/assets/js/xml.php
http://www.areekaweb.com:8080/js/chat.php
http://www.ehangmun.com/board/selectbox/xml.php
line-api.com/wp-mails.php

#Additional C2s via twitter.com/JusticeRage
154.223.17.218
45.227.255[.]213:30303
clickcom.click