Scam Everything - Opioids, NetFlix, Phish, Covid Charities, and Government Refunds in one network neighborhood

There's a famous line in the movie Jerry McGuire where Tom Cruise's character says "Show me the Money!"  In online investigations, I prefer the line "Show me the Data!" This morning I was doing just that and found an interesting cluster of badness.

Dr. Elizabeth Gardner at UAB leads our Forensic Sciences program in the Department of Criminal Justice.  She and I have partnered on many projects in the past by mixing our expertise.  She's a forensic drug chemist, and I chase bad guys on the Internet.  8-).  Our current project follows up on some of the work we shared with the BBC Click episode "Can Technology Solve the Opioid Crisis?"

Last night we threw 586 Opioid and Fentanyl selling websites into our clustering-by-location program that Zack Knight (one of my student malware analysts) had developed for another project.  Our goal was to find clusters of drug-selling websites "in the same place" and then use other tools to explore what else is hosted in the same location.  The tool sorts first by country, then by ASN, and then by NetBlock.  There was a nice cluster that revealed itself, consisting of six websites all on the same Class C NetBlock:

Company: VERDINA Ltd., Autonomous System Number AS201133
111.90.156.117
thepleasantproducts[.]com
111.90.156.170
pharm-rx[.]to
111.90.156.173
globalheadshop[.]com
nembutalonlineshops[.]com
111.90.156.61
richmed-pharma[.]com
111.90.156.64
researchkem[.]com

Why were these sites in our database?  Well, they offer some overtly bad stuff for sale.  Here's an example:

thepleasantproducts[.]com

pharm-rx[.]to

nembutalonlineshops[.]com

You can clearly see why our Opioids project is interested in these sites!  But what we wanted to know was, given that there were six very clearly objectionable sites on the same Class C Subnet, might there be other sites there as well.  That's where the Zetalytics "ZoneCruncher" tool came into place.  We asked ZoneCruncher what other sites were recently resolved to this Netblock, fully expecting it to give us a list back of additional drug sales websites!  What we got back was much more interesting!

111.90.156.0/24 via ZoneCruncher from Zetalytics 

As soon as I saw the results, I knew exactly what scammers were behind these sites, as we were well familiar with the group from the work I've done with the excellent Business Email Compromise researchers at Artists Againt 419 (AA419)!  The "signature" of this group is their reliance on a set of nameservers running on domains "steeldns[.]com" "metaldns[.]com" and "argondns[.]com" hosted on the Malaysian hosting company Shinjiru MSC.  Verdina Ltd. is the owner of this particular netblock, which uses the Autonomous System Number AS201133.

Verdina has a few other Netblocks that we'll be exploring later, but this one has plenty of badness on its own!  Some of the most recent sites we have on this same Netblock include:

A fake Bank of Ireland site, indicating they would like to refund a suspicious transaction to your Visa card:

boi365refunds[.]com 

of course, first you have to login . . . 

An alert that your NETFLIX payment has been declined, which of course also requires a bit more information to "RESTART MEMBERSHIP" ...

netflx9-msg101[.]com 

netflx9-msg101[.]com / alldetails.html 

Many of the sites identified by ZoneCruncher have either already been remedied by security researchers working with registrars, are have not yet been deployed by the scammers.  The domain names themselves indicate the range of their creative scamming:

Covid Charity Scams 

=============================

e-media-covid19-relief[.]ibonline[.]digital

e-media-covid-19-relief-fund-donations[.]ibonline[.]digital

e-media-covid-19-relief-fund-donations-for-food-parcel[.]ibonline[.]digital

emedia-givedirectly-covid-19-reliefprogram[.]ibonline[.]digital givedirectly-covid19-emergency-fund[.]ibonline[.]digital www.1covid-19-d[.]com www.1covid9-cerb[.]com Netflix Phish ============================= n3tflix-billupdate1[.]com netfl1x-accupdate3[.]com netfloux474[.]com netflx1-sms98[.]com netflx9-msg101[.]com Paypal phish, Scotia Bank phish, RBC phish, ANZ phish ============================ paypai[.]restringido[.]org paypal[.]restringido[.]org rbcsecu1ces32[.]com scotia1ban2k1-info[.]com "Secure" Messaging portals ==================== msg-integrity[.]com report-payments[.]net threessl[.]com and so many more ... 112 different "scammy" domains were hosted on this single Class C just in the past ten days! UK Government Refund Scam

The most interesting of the current batch, however, was this one which was a means to update payment details in order to receive a refund from the UK Government via the website www[.]govuk-proceed-application[.]com, pictured below:

shall we begin the process?  

Give us all your personal data . . . 

Don't worry!  Everything is "secured with 256-BIT SSL Layer!" 

Give us all of your Banking Details!

 

And at the conclusion, you'll get a nice confirmation number!
(before a bit.ly link forwards you to the real UK Government)

Other Examples of Live Badness

Just a few more examples . . . all live as of this writing . . . 

volksign[.]bausp[.]com 

Gold Investing anyone? 

Paypal Phish

Bottom line?  Exploring the Network Neighborhood of a cluster of bad sites can lead to some very interesting findings!  I'm looking forward to learning more from Zetalytics!  They show 19,000+ more domains that were served by "ns1.metaldns.com" and so very many of them look scammy!

SEC Suspends CoronaVirus Stock Pump-n-Dump Scammers

Last month we shared information on the blog about spam-driven affiliate programs who were selling a variety of shady "anti-Coronavirus" products, including immunity oils, masks, disinfectants, and no-touch thermometers. (See: CAUCE Spamfighters Rally Against Corona Health Fraud Affiliate programs ).  Today I wanted to share an update regarding another type of spam and the SEC's actions related to stock market symbols being manipulated through "pump-n-dump" scams.

Over the past several weeks, the SEC announced the suspension of trading of several stock symbols due to illegal attempts to manipulate the value of those stocks, often by driving the stock value up ("pumping") by making untrue claims about how the company was involved in helping fight the Coronavirus, Covid19.  We'll just dive into two of the most recent ones here.

Turbo Global Partners, Inc ("TRBO")

On April 9, 2020, the SEC suspended trading of Turbo Global Partners, Inc ("TRBO"), a company based in Tampa, Florida.  The suspension is due to claims made by the company that it had entered into agreement with BeMotino, Inc to provide non-contact human temperature screening and facial recognition technology, and that it had the ability to ship the technology to customers within five days of receiving an order.  Press Releases on March 30th and April 3rd made these claims.

The small spike to .0074 cents per share on February 7th corresponded with the announcement that the company was doing a pilot to place indoor digital billboards in 100 pharmacies in Florida in 2020 with aggressive expansion predicted:

 Singerman continues, "BeMotion's Mobile Commerce Network 'MCN' and the DCN Vending & Marketplace 'DCN-V' is the solution we are bringing to the global market under our joint TURBO - BeMotion brand. Our initial effort will be integrating both MCN and DCN-V technologies into our independent pharmacy silo in 3 Phases of our 2020 Strategic and Tactical Plan:

"Phase 1: Integrating our Co-Brand Solutions into our 100-Pilot pharmacy locations in Florida to be deployed during Quarter 2, 2020.

"Phase 2: Deploying the DCN Vending into 1,000+ pharmacy locations in the U.S. deployed with the TURBO - BeMotion Co-Brand by 2021.

"Phase 3: Deploying the DCN Vending into 5,000+ pharmacy locations by 2023."

On March 14th someone buys nearly 120 million shares of the company for between .0016 and .0055 cents per share.  Then this press release is splashed around the Internet in penny stock forums and "investor tip" messages:

The company that was previously saying it was a marketing company selling indoor billboards is suddenly selling "non-contact human body scanning technology" that can scan "up to 320 people per minute" saying "Imagine Law Enforcement with our Technology version for vehicles being able to scan like RADAR a cluster of people or a homeless encampment in minutes for elevated temperatures." and that "THIS IS THE KEY TOOL ... THAT CAN HELP BREAK THE CHAIN OF VIRUS TRANSMISSION."

If we guess that the average purchase price for that stock was .003 cents per share, immediately after this press release, the stock booms to six times that value.  The investors who are "in on the deal" and bought 120 million shares on March 16th to March 18th and sold on April 4th and 5th would have paid around $360,000 and sold for right at $2 Million.  This is how Stock Pump n Dump works.

Where did that garish and false ad come from?  This copy was posted in an investment board run by "SHEEPWOLF" 

But was Sheepwolf heavily pushing this stock?  Let's look at his recent posts on the site:

Do you get the feeling that SHEEPWOLF really wants the value of $TRBO to increase?  Hmmm... I wonder why. Between March 27, 2020 and April 7, 2020, SHEEPWOLF posted EIGHTY-ONE MESSAGES about this stock!

There was a clear change in marketing via Press Releases that occurred beginning March 13th, according to OTC Markets:

https://www.otcmarkets.com/stock/TRBO/news

And that was just ONE of the recent SEC Suspensions. If you have more information about this case, please contact Justin Jeffries, Associate Regional Director for the SEC, at (404) 842-5750.

BioELife Corp f/k/a U.S. Lithium Corp ("LITH") 

On April 8, 2020, the SEC suspended trading of BioELife Corp f/k/a U.S. Lithium Corp ("LITH").  The SEC has "questions and concerns regarding the accuracy and adequacy of publicly available information concerning LITH, including public statements made by LITH in press releases issued on March 12, 2020 and March 16, 2020 and reinforced by third-party stock promoters, regarding a purported new Coronavirus (COVID-19) Prevention Products Line, together with potentially manipulative trading activity between October 2019 and present."

That is certainly an understatement!  Let's look at the recent press releases, indicating that BioELife had a sudden change in product direction, from selling CBD Pain treatments, to suddenly preventing the spread in CoronaVirus.

https://www.otcmarkets.com/stock/LITH/news

Some of those recent statements were things like this:

The initial purchase order from Group Buying Club- GPOCBD, covers all current BioELife products – lotions, tinctures, flower and gummies as well as the BioEDefense product line: Sanitizers, RespiPro Virus Killer Masks, and the R-Shield (a reusable nanofiber scarf designed for 50 wash cycles). GPOCBD is marketing CBD products directly to wholesalers, consumers and affiliates looking to supplement their sales of BioELife products which offer natural products to fight pain and infection, as well as help defend against the growing global concerns regarding bacteria and virus’s contamination.

That's funny. Respilon R Shield is a Czech mask created for fighting smog and marketed primarily through their Instagram page:  https://www.instagram.com/respilon_r_shield/.  They have converted Czech prisons into mask factories, because it seems the masks are in high demand.  Definitely a more "Lit" mask than most people are wearing these days.  But since they are still in KickStarter mode, I don't think there is much chance that US Lithium is involved with them. I don't believe they are at any way to fault for $LITH's bad marketing!

Here's an example of how these press releases are then turned into "BUZZ" by newsletters, such as this one from "Make Penny Stocks Great Again" one of many such services that provide "free" newsletters to people who are trying to make a quick buck daytrading.

Ooh!  CBD-fortified hand-sanitizer!  Where do I sign up?

If anyone has more information about the $LITH pump, "they should immediately contact Celeste A. Chase, Assistant Regional Director, at (212) 336-0049, or Jason R. Berkowitz, Assistant Regional Director, at (305) 982-6309." (from: https://www.sec.gov/litigation/suspensions/2020/34-88607.pdf )

Spotting the Scammers

There are some members of these "stock promotion" investor boards that try to warn others.  My favorite right now is "reverse_long" who shares information about stocks that are in "PAID PUMP N DUMP" scams ... I love the tagline he uses on his profile! "Shorting Paid Pump and Dumps to Make The World A Better Place"  (He also has a great Twitter feed:  @reverse_long)

And, sure enough, one of the 80 Paid Pump And Dump scams he has been warning his fellow investors about was $LITH: 

Which was also on his Twitter feed back on March 4th: 

Honestly, I believe if we wanted to find more of these, it would probably be as easy as doing this Google Search:

site:www.otcmarkets.com inurl:news inurl:stock COVID-19

Then I would take the resulting symbols and check them against these bogus stock promoter sites.  Let me assure you there are some DOOZIES in there!  But subscribing to many of these Stock Tip Newsletters might be another way to do so.

Other SEC Actions

(Quoting from the SEC Suspension Orders, linked to each company's name below: ) 

Feb 7, 2020 = $AEMD - Aethlon Medical - Concerns regarding the accuracy and adequacy of information in the marketplace since at least January 22, 2020 that appears to be disseminated by third party promoters that are purportedly not affiliated with AEMD about, among other things the viability of the company's products to treat the coronavirus.

Feb 24, 2020 = $ETBI - Eastgate Biotech Corp - Concerns about the adequacy and reliability of publicy available information concerning ETBI since at least January 30, 2020, among other things, statements about the company's purported international marketing rights to an approved coronavirus treatment to potentially combat the Wuhan Coronavirus.  

Mar 25, 2020 - $ZOOM - Zoom Technologies, Inc - This one seems to be because of the name confusion of their stock symbol and the "similarly-named NASDAQ-listed" video conferencing company.

Mar 25, 2020 - $PXYN - Praxsyn Corporation - Questions  regarding the accuracy and adequacy of information in the marketplace since at least February 27, 2020.  Statements about PXYN having and being able to obtain large quantities of N95 masks used to protect wearers from COVID-19. 

https://www.karmadata.com/Entity/Sponsor/praxsyn.com

One of the places $PXYN was being pumped was "Investors Hangout" ... "hotforpenny" was pumping the Corona run, but a review of messages shows that the company had been pumped before as a medical marijuana company in 2018:

HotforPenny also participates on "Sheepwolf's 1,000,000.00 Journey" that was referenced above.  He's currently pumping (excuse me, "discussing")  $GRYN, $SING, $BCCI, $BTFH, $AYTU, $BWVI, and $RJDG ... 

https://investorshangout.com/profile/latestposts/id/14192

April 3, 2020 - $NBDR - No Borders, Inc - Questions and concerns regarding the adequacy and accuracy of publicly available information concerning NBDR.  STatements about NBDR's products and business activities related to the COVID-19 pandemic, including NBDR's COVID-19 specimen collection kits, an agreement to bring COVID-19 test kits to the United States, and NBDR's activities related to the distribution of personal protective equipment. 

Example: 

https://investorshub.advfn.com/No-Borders-Inc-NBDR-3988/

April 3, 2020 - $SSTU - Sandy Steele Unlimited Inc - questions regarding the accuracy and adequacy of information in the marketplace since at least March, 2020. Those questions relate to apparent promotional activity, including e-mail stock promotions from unknown sources directed to investors, which claim that Sandy Steele is an operational garment manufacturer producing various clothing items and that it has the ability to produce protective masks that are in high demand due to the COVID-19 crisis.

InvestorsHub has over 700 messages related to this company, with many referring to the pump and dump.  See: https://investorshub.advfn.com/Sandy-Steele-SSTU-3697/ 

April 7, 2020 - $WMGR - Wellness Matrix Group, Inc - questions regarding the accuracy and adequacy of information in the marketplace since at least March 19, 2020. Those questions relate to statements WMGR made through affiliated websites and a company consultant about selling at-home COVID-19 testing kits that had been approved by the FDA.

NPR reported on this company's fraudulent behavior - See: SEC Suspends Trading of Company That Sold 'At-Home' COVID-19 Tests 

Ten months ago, they named a new VP of marketing (David Saltrelli) and a new president (Joshua Patterson) and a change in direction - developing "technologically advanced health care models in a Virtual Reality, Augmented Reality, and Creative Artificial Intelligence Platform." Kind of a jump from their origins as Fuhuiyuan International Holdings, which was mostly a real estate management company working with KWest Alberta in Canada.  When you issue 190,000,000 shares of stock to be valued at $0.0001 each and switch from real estate to Artificial Intelligence Health Care, something odd may be afoot.

April 7, 2020 - $PGEC - Prestige Capital Corp. -  concerns about the adequacy and accuracy of publicly available information concerning PGEC, including its financial condition and its operations, if any, in light of concerns about investors confusing this issuer with a similarly-named private company that is a manufacturer of N95 masks and the subject of increased media attention during the ongoing COVID-19 pandemic.

April 7, 2020 - $KCPC - Key Capital Corporation - questions regarding the accuracy and adequacy of information in the marketplace since at least March 5, 2020. Those questions relate to statements KCPC made about developing, and being able to make available to the mass market within three to six months, a vaccine to treat COVID-19 in press releases issued by the Company on March 5, 2020 and March 10, 2020.

Another company with a very interesting change in focus.  Recently this was a company who had announced a "Unique Digital Gold Standard Cryptocurrency" ... and now they have a vaccine for Corona?  

https://finance.yahoo.com/news/key-capital-seeks-partners-development-194915606.html

Quite a change from being the gold mining company behind the GoldCrypto ICO!

https://www.otcmarkets.com/stock/KCPC/news/GoldCrypto-Launching-Worlds-First-Hackproof-Cryptocurrency-Tokens?id=195885

Map It. Zap It. Covid-19 and Rural America #GoodCovidDomains

This post may seem off-topic for my regular cybercrime and cyber security readers, but these are unusual times. Regular readers know that part of what my team at the UAB Computer Forensics Research Lab has been working on is looking for scams and fraud related to Covid-19 / CoronaVirus.  Part of that process has been watching for malicious or scammy emails (see "CAUCE Spamfighters Rally Aainst Corona Health Fraud Affiliate Programs") and part has been monitoring the creation of new domain names which MIGHT be used for fraud or scams ( see "Covid-19 / CoronaVirus Domains: A looming threat?") In that latter article, I encouraged people to share #GoodCovidDomains or #BadCovidDomains that they found.

Today I wanted to highlight a #GoodCovidDomain that is used by a project launched by some amazing UAB researchers.

HelpBeatCovid19.org  :: MAP IT.  ZAP IT.

The project asks people to complete a simple survey to determine if they have COVID-19 symptoms.  Then it maps their responses to help identify areas where there may be an emerging cluster of COVID-19.

Dr. Sue Feldman directs the Health Informatics program at UAB, and is a fantastic leader in her space.  She's been an R.N. for 30 years in some of the coolest and most high pressure environments in the US (I was joking with her once about how silly television shows were where doctors and nurses fly out in helicopters to accident scenes ... she said "no, that's what I used to do in Los Angeles!), and she has PhDs in both Information Technology and Education!  We've worked together on some of her creative projects, such as teaching a cyber security tabletop simulation for future health care informaticists as part of one of her classes.

Dr. Sarah Parcak is one of UAB's most famous scientists, best known as "the Space Archaeologist" for her ground-breaking work in using satellite imagery to uncover buried remnants of ancient civilizations.  After being featured on BBC specials and winning the TED Prize and publishing an award-winning science book "Archaeology from Space" I was shocked to hear her say of this Covid-19 project "Its the coolest and most important thing I've ever done!" She brings her expertise in all things geo-spatial and Geographic Information Systems to a new focus area with this project. (@IndyFromSpace)

Their colleague Mohanraj Thirumalai worked for more than a decade as the Senior Web Developer at University of Illinois Chicago before getting a PhD in Management and Information Systems and moving to Alabama to be the Director of ICT at UAB/Lakeshore Research.  He's also an Assistant Professor in the School of Health Professions.

In a state like mine, Alabama, we have a great disparity in ease-of-access to medical care and as a citizen, I am concerned about whether that may be allowing Covid-19 to spread without detection in rural parts of our state.  When I look at this map, I ask myself "does this say that rural counties have a form of natural social distancing?  Or does this say that they are entirely lacking in basic medical infrastructure and testing capability?"

Alabama Public Health on ArcGIS

I used the Alabama Department of Public Health’s data to see what testing and infection rates looked like on a county-by-county basis in Alabama. In our ten most populous counties, we have 965 cases with 5,658 people tested (as of 10PM 3APR2020).

 In our thirty smallest counties, we have 133 cases with 858 people tested. Population-wise that isn’t as bad as it sounds. The combined population of our ten largest counties is 2.6 million people, while the thirty smallest counties have 534,000 people.

But it does point to scarcity of testing. Of those thirty smallest counties, most have had less than fifty people tested IN THE WHOLE COUNTY. (Bibb = 76, very likely in the prison there! Marion = 60, and Marengo = 65.) Ten counties have had LESS THAN TWENTY PEOPLE tested in their county.

Encourage your friends to go to HELPBEATCOVID19.org and report “how they are feeling” - whether sick or healthy! ESPECIALLY if you have contacts in our more rural parts of our state.

The project actually hopes to gather data from across the SouthEast, so despite my focus on Alabama, please do encourage anyone in "the SouthEast" to share information about this project with their friends.

As more data is gathered, UAB and their partners will be able to provide a more targeted response to Covid-19 in Alabama and across the SouthEast ... looking forward to seeing what emerges as we go from 10,000 participants to 100,000, to 200,000, to a million!

County statistics as of 03APR2020

County	Population	Infected	Tested	Dead	% Infected	% tested
Jefferson	658327	356	1920		.0541%	.2916%
Mobile	413590	103	652	5	.0249%	.1576%
Madison	342762	122	588	1	.0356%	.1715%
Montgomery	229293	61	448	1	.0266%	.1954%
Shelby	200983	112	535	4	.0557%	.2662%
Tuscaloosa	198694	41	556		.0206%	.2798%
Baldwin	190675	28	430	1	.0147%	.2255%
Lee	147808	99	190	3	.067%	.1285%
Morgan	120157	24	224		.02%	.1864%
Calhoun	117253	19	115		.0162%	.0981%
Etowah	104311	21	133	2	.0201%	.1275%
Houston	103298	12	118	1	.0116%	.1142%
Marshall	94413	17	134		.018%	.1419%
Lauderdale	92682	14	271	2	.0151%	.2924%
Limestone	87384	30	348		.0343%	.3982%
St. Clair	85167	23	134		.027%	.1573%
Talladega	81666	12	154		.0147%	.1886%
Elmore	80417	19	284		.0236%	.3532%
Cullman	80409	15	112	1	.0187%	.1393%
DeKalb	70977	10	109		.0141%	.1536%
Walker	66169	48	133		.0725%	.201%
Blount	57807	9	48		.0156%	.083%
Russell	57721	4	32		.0069%	.0554%
Autauga	55265	12	102		.0217%	.1846%
Colbert	54424	5	133		.0092%	.2444%
Jackson	53048	12	90	1	.0226%	.1697%
Coffee	51276	6	54		.0117%	.1053%
Dale	50348	1	51		.002%	.1013%
Chilton	43800	15	83		.0342%	.1895%
Dallas	42692	7	44		.0164%	.1031%
Tallapoosa	41157	20	46	1	.0486%	.1118%
Escambia	38070	2	50		.0053%	.1313%
Covington	37856	4	44		.0106%	.1162%
Chambers	34074	80	82	5	.2348%	.2407%
Lawrence	33777	4	91		.0118%	.2694%
Pike	33113	10	110		.0302%	.3322%
Franklin	31685	5	95		.0158%	.2998%
Marion	30538	16	60	2	.0524%	.1965%
Barbour	27232	1	21		.0037%	.0771%
Geneva	26969				.%	.%
Cherokee	26056	5	44		.0192%	.1689%
Clarke	25220	3	44		.0119%	.1745%
Winston	24153	3	39		.0124%	.1615%
Randolph	22720	10	25	1	.044%	.11%
Bibb	22662	4	76		.0177%	.3354%
Monroe	22629	5	36		.0221%	.1591%
Marengo	20389	8	65		.0392%	.3188%
Butler	20384	1	38		.0049%	.1864%
Macon	20383	5	27		.0245%	.1325%
Pickens	19331	11	29		.0569%	.15%
Henry	17285	2	20		.0116%	.1157%
Washington	17115	5	19	1	.0292%	.111%
Fayette	17005	1	38		.0059%	.2235%
Hale	15420	3	23		.0195%	.1492%
Cleburne	14885	7	19		.047%	.1276%
Lamar	14265	1	26		.007%	.1823%
Crenshaw	13981	1	46		.0072%	.329%
Choctaw	13585	4	15		.0294%	.1104%
Clay	13458	8	34		.0594%	.2526%
Sumter	13407	7	19		.0522%	.1417%
Conecuh	13009	1	21		.0077%	.1614%
Wilcox	11406	6	20		.0526%	.1753%
Coosa	11000	6	17		.0545%	.1545%
Lowndes	10846	2	15		.0184%	.1383%
Bullock	10605	2	10		.0189%	.0943%
Perry	10194				.%	.%
Greene	8848	5	12		.0565%	.1356%
					.%	.%
TOTALS	4817528	1515	9601	32	.0314%	.1993%

Covid-19 / CoronaVirus Domains: a looming threat?

I mentioned previously that CAUCE is watching for spammers who want to commit fraud or make a quick buck pumping out spam for fake products.  (See:  CAUCE Spamfighters Rally Against Corona Health Fraud Affiliate programs .)  One of the things that project has led to is trying to figure out what other forms of fraud and abuse may be going on with regards to newly registered domains that may be "suspicious."  One thing we learned long ago is that fraudsters love a good disaster!

The fine folks at DomainTools have been sharing a curated domain list but I thought it might be interesting to my readers to see the types of things being found.  Our methodology is to pull the daily list of all newly registered domains, filtering on a number of suspicious terms (more than DT's list).  While DomainTools has a great start, and indeed has more than 104,000 domains on their list, we wanted to come up with a theory of how to "cluster the badness."

In the "domainer" world, many people make a living by speculatively purchasing enormous numbers of domains, and either placing them for sale, or covering the domains with advertisements that generate revenue for them.  Each domain may only make a few cents per day, but if you have tens of thousands of them, you can earn a living.  Yesterday I was on a 100+ party conference call hosted by some FBI people when someone made the claim that "more than half" of the Covid domains that have been created are being used to spread malware and phishing.  We certainly don't agree with that assessment.  The vast majority of the domains we have reviewed are being used for simple "domain speculation" -- let's buy fifty domains and see if we get lucky!

While there are many forms of "shady activity" going on among these domains, there are also some BRILLIANT publicly minded projects being run by data scientists and health care workers.  The truth is that we don't have time to go into all of the domains and check each one by hand.  I asked a brilliant student in my lab, Zack Knight, to lend me a hand.  Zack took the opportunity to intern with the UAB Security Operations Center last summer and has an interest in automating analysis of risks, so he was a great choice to work on this project.  I gave Zack my "daily domains" and asked him to look up the IP address upon which one is hosted, and resolve it to an ASN and country code.  It is VERY LIKELY that newly registered covid-domains that are hosted on the same IP address may be related to one another.  Those that are in big batches of dozens or hundreds on the same IP are likely still in "domain speculator" hands, while those that are resolving to a single IP are more likely to be being used for some form of project -- good or malicious!

I'm sharing Two Days of newly registered domains below and would love for you to brainstorm with me on the best ways to spot goodness or badness among them.  PLEASE DO NOT VISIT THE DOMAINS without using some form of "safety" precautions.  (At a minimum, a Virtual Machine) as it is very likely that SOME of these domains are malicious!

If you find a domain that you think is a cool project, or a domain that you can demonstrate is malicious, feel free to comment below or tweet me about it (@garwarner). Use "#goodcoviddomains" or "#badcoviddomains" as a hashtag if you want to play along from home.

Example:  @garwarner #goodcoviddomains  yomamagotcorona[.]com - This domain tells "Yo Mama" jokes about Corona and invites people to donate to help fight Corona through WHO or NYC.gov

Example: @garwarner - #badcoviddomains corona-safety-masks[.]com - This domain sells medical masks from a company with no history of being a medical supplier



++++++++++++++++++++++++++++++++++++++
Domains Registered from 27MAR to 30MAR2020
++++++++++++++++++++++++++++++++++++++
Please see the list on my website: Corona-Domains from 27MAR to 30MAR
++++++++++++++++++++++++++++++++++++++
Domains Registered 31MAR2020
++++++++++++++++++++++++++++++++++++++
Please see the list on my website: Corona-Domains from 31MAR
++++++++++++++++++++++++++++++
Domains Registered on 01APR2020
++++++++++++++++++++++++++++++

198.185.159.145	ASN: 53831	Country: US	SQUARESPACE - Squarespace, Inc.
	Domain Names: 7
		86coronavirus[.]com
		covid19virussaftey[.]com
		covidhge[.]com
		covidmoney[.]net
		ma-covid-data[.]com
		sinaiimmunologycovid19[.]com
		virusrxusa[.]com
192.0.78.151	ASN: 2635	Country: US	AUTOMATTIC - Automattic, Inc
	Domain Names: 1
		adcoronavirus[.]com
184.168.221.39	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		aftercoronavirus[.]life
		corona-accomplishments[.]net
		coronaviruscareact[.]com
		taxhelp4coronavictims[.]com
		thecoronacats[.]com
		covid-19suppliers[.]net
		covid-20drones[.]com
		covid19employerlawsuit[.]com
		covid19femassistance[.]com
		covida19us[.]com
		covidloanexpress[.]com
		wecleancovid-19[.]com
Not registered	ASN:	Country:
	Domain Names: 167
		aftkscoronavirus[.]com
		corona-forex[.]com
		corona-immunity-tests[.]net
		corona-immunity[.]net
		corona-meds[.]net
		corona-z[.]net
		corona4cast[.]com
		coronaboss[.]com
		coronacashusa[.]com
		coronacureglobal[.]com
		coronadesinfect[.]com
		coronadestekol[.]com
		coronaerotica[.]com
		coronafilmfest[.]com
		coronainfluenza[.]net
		coronakahani[.]com
		coronameetsquarantine[.]com
		coronaorthopedic[.]com
		coronapositives[.]com
		coronareset[.]net
		coronaresin[.]com
		coronavirusaidbill[.]com
		coronavirusaidrelief[.]com
		coronavirusantibodytest[.]net
		coronavirusdeaths[.]net
		coronavirusinfluenza[.]net
		coronavirusmasks[.]biz
		coronavirusquarantine[.]net
		foxnewscoronaviruslawsuit[.]com
		freecoronavirusloans[.]com
		gpscoronavirus[.]com
		ikilledcorona[.]com
		kickthecoronavirusring[.]com
		kits-coronavirus[.]com
		neveragaincoronavirus[.]com
		neverforgetcoronavirus[.]net
		onestopcoronavirus[.]com
		onestopcoronavirusinfo[.]com
		post-corona[.]life
		reclamacionescoronavirus[.]net
		remedioscoronavirus[.]com
		suisse-corona[.]com
		testcoronaviruscovid[.]com
		testerapidocorona[.]com
		thecoronavirusfurlough[.]com
		vaccinecoronaviruscovid[.]com
		vacunacoronaviruscovid[.]com
		0covid19[.]com
		2o2ocovid-19[.]com
		alertacovid[.]com
		amparocovid19[.]com
		apicovid[.]com
		australiacovid19[.]com
		buycovidtests[.]com
		catchcovid[.]com
		cignacovid19answers[.]com
		covid-19-pneumonia-ai-dx[.]com
		covid-19memorialday[.]com
		covid-19memory[.]com
		covid-19personalfacemask[.]com
		covid-19relieffunding[.]com
		covid-19reliefregistry[.]com
		covid-19worldwar[.]com
		covid-1nine[.]com
		covid-a-thon[.]com
		covid-hla[.]net
		covid-immunity-tests[.]com
		covid-immunity-tests[.]net
		covid-immunity[.]com
		covid-immunity[.]net
		covid-one9[.]com
		covid-widget[.]com
		covid19-antibodies[.]com
		covid19-antibodies[.]net
		covid19-clinicaltrials[.]com
		covid19-clinicaltrials[.]net
		covid19cd[.]com
		covid19discussion[.]com
		covid19f[.]com
		covid19furlough[.]com
		covid19investment[.]com
		covid19loanexperts[.]com
		covid19masks[.]biz
		covid19memory[.]com
		covid19notifications[.]com
		covid19onestop[.]com
		covid19relieffinance[.]com
		covid19reliefregistry[.]com
		covid19rescue[.]net
		covid19restart[.]com
		covid19review[.]com
		covid19rt[.]com
		covid19testri[.]com
		covid19trap[.]com
		covid19worldwar[.]com
		covid19zapp[.]com
		covid1ninevaccine[.]com
		covidbusinessprograms[.]com
		covidcarelending[.]com
		covidcashcalc[.]com
		covidcenterbarby[.]com
		covideo[.]chat
		covidgr[.]com
		covidhealthkit[.]com
		covidinmemoriam[.]com
		covidioke[.]com
		covidkey[.]com
		covidliquors[.]com
		covidlog[.]net
		covidmin[.]com
		covidnearus[.]com
		covidnearus[.]net
		covidnews[.]media
		covidpaycheckprotection[.]com
		covidpaypayrollprotection[.]com
		covidpayrollrelief[.]com
		covidreliefsupport[.]com
		covidsbaapplication[.]com
		covidtestbrasil[.]com
		covidtestresults[.]com
		covidtestri[.]com
		covidum[.]com
		covidvs[.]com
		covidwidget[.]com
		covidzapp[.]com
		fightcovidnepal[.]com
		getcovid19kit[.]com
		gouvcanada-covid19[.]com
		hidingfromcovid19[.]com
		indizen-covid19[.]com
		italiacovid-19[.]com
		italiancovid-19[.]com
		kevzara-covid19[.]com
		kevzara-covid19[.]net
		kevzaracovid19treatment[.]com
		kevzaracovid19treatment[.]net
		mdcoviddefense[.]com
		murrietacovid19[.]com
		mycovid19alert[.]com
		neveragaincovid19[.]com
		onestopcovid19[.]com
		onestopcovid19[.]net
		pandemic-covid-19[.]net
		registercovid19[.]com
		testforcovidimmunity[.]com
		unite-against-covid[.]com
		united-against-covid[.]com
		usacovidtest[.]com
		viruscovid19news[.]com
		wmasscovid[.]com
		123novirus[.]com
		calmingthevirusmindset[.]com
		cleanskinantivirus[.]club
		conqueringoverwhelmingvirusesinvasionsdaily[.]club
		conqueringoverwhelmingvirusesinvasionsdaily[.]life
		ertantivirus[.]club
		fightallvirus[.]life
		novirus[.]pro
		redvsvirus[.]com
		vgvirusattack[.]com
		virus365[.]net
		viruscombatgear[.]com
		virusdatamap[.]com
		virusmedicalsupplies[.]com
		virusmedicalsupplies[.]net
		virusponge[.]com
		virusxxi[.]com
87.98.150.35	ASN: 16276	Country: FR	OVH
	Domain Names: 3
		alert-corona[.]com
		alertecorona[.]com
		alertecorona[.]net
91.184.0.100	ASN: 197902	Country: NL	HOSTNET
	Domain Names: 1
		anti-coronadoorhandle[.]com
197.242.92.146	ASN: 37153	Country: ZA	HETZNER
	Domain Names: 1
		anti-coronavirusproducts[.]com
81.169.145.88	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 1
		anticoronabeschichtung[.]com
50.63.202.47	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 7
		anticoronaglass[.]com
		coronacleanforces[.]com
		coronacomplish[.]com
		coronavirus-smart[.]com
		covid19communitycares[.]com
		covidsilver[.]com
		coronovirustestkit[.]com
23.227.38.65	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 18
		anticoronaviruscovid19[.]com
		corona-virus-normality[.]com
		coronapparel-collective[.]com
		coronastoper[.]net
		fkcoronaco[.]com
		survivingcoronatime[.]com
		anticovid[.]world
		covid-19deli[.]com
		covid-tee[.]com
		covideco[.]com
		covidgym[.]com
		covidteens[.]com
		gear4covid[.]com
		newyork-20covid-19[.]com
		preventcovid19australia[.]com
		suckitcovid19[.]com
		myantivirusmasks[.]com
		novirus[.]center
217.160.122.163	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		apothekecontracorona[.]com
200.58.111.34	ASN: 27823	Country: AR	Dattatec.com
	Domain Names: 1
		argentinalibredecoronavirus[.]com
184.168.221.52	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 13
		assistance4corona[.]com
		coronaandbeyond[.]com
		coronarviruswithalime[.]com
		coronavirusfloridalawyers[.]com
		covid-19erc[.]com
		covid19employernegligence[.]com
		covid19floridaattorneys[.]com
		covid19taxreliefnow[.]com
		covidfreebelgium[.]com
		outcomeofcovid19[.]com
		taxcreditcovid19[.]com
		usasurvivedcovid19[.]com
		jumviruscare[.]com
184.168.221.57	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 10
		ayudadecoronavirus[.]com
		coronacommandos[.]com
		coronavirusbailoutbillions[.]com
		covid19reliefcash[.]com
		coviddollars[.]com
		covidkentucky[.]com
		knockdowncovid19[.]com
		sbacovidcash[.]com
		unidoscontracovid[.]com
		mevirus[.]com
184.168.221.45	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		bdcorona[.]net
		donateforcoronavirus[.]net
		babycovid-19[.]com
		covid19-medicines[.]com
		covid19enseignements[.]com
		covid19fastcashloans[.]com
		covidsstudio[.]com
		covidvermont[.]com
		monitorcovid[.]com
		myworldwithcovid[.]com
		relief4covidvictims[.]com
		virusextinguisher[.]com
94.136.40.51	ASN: 20773	Country: DE	HOSTEUROPE-AS
	Domain Names: 15
		bebecorona[.]com
		coronabebe[.]com
		coronaviruslifetips[.]com
		covid-19flu-xpress[.]com
		covid-19workplace[.]com
		covid-19workplace[.]net
		covid19houseclean[.]com
		covid19houseclean[.]net
		covid19housecleaning[.]com
		covid19housecleaning[.]net
		covid19workplace-vaccinations[.]com
		covidflukiller[.]com
		covidlifetips[.]com
		end-covid-19[.]com
		fluviruskiller[.]com
50.63.202.43	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 13
		betterthanbeforecorona[.]com
		brokefromcorona[.]com
		coronakonnect[.]com
		coronasepiccomics[.]com
		coronavcation[.]com
		nyckickcoronavirusass[.]com
		realestatemarketandcoronavirus[.]com
		covid-19vaccine[.]life
		covidarmour[.]com
		globalcovid19memorial[.]com
		hugsusacovidfund[.]net
		realestatecovid19resources[.]com
		siparadigm-covid19[.]com
50.63.202.63	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 13
		betterthanbeforecorona[.]net
		corona-virus-ppe[.]com
		coronaccomplishmentz[.]com
		coronappp[.]net
		hechoscoronavirus[.]com
		qualify4coronadollars[.]com
		covid-19-api[.]com
		covid19-media[.]com
		covidz[.]life
		igscovid19[.]com
		mycovidcheck[.]com
		chinesevirusjustice[.]com
		virusapple[.]com
184.168.221.36	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		bidenoncoronavirus[.]com
		lamacchiarealtycoronavirus[.]com
		postcoronavirusparty[.]com
		austincovid19medsuppliescom[.]com
		covid-19helpcenter[.]com
		covid19-decals[.]com
		covid19costrecovery[.]com
		covidimmunitypassportonline[.]com
		coviding[.]life
		covidwiki[.]net
		facemasks-covid19[.]com
		femometercovid19[.]com
		sbacovidhelp[.]com
		timeofthevirus[.]com
145.14.145.248	ASN: 204915	Country: US	AWEX
	Domain Names: 1
		blockthecorona[.]com
162.241.253.111	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		brasilcorona[.]com
184.168.221.51	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		byecoronavirus[.]com
		coronavirussurvivor[.]life
		thecoronavirusrecovery[.]com
		covid-ninteenini[.]com
		covid19comfort[.]com
		covid19repair[.]com
		covid19taxhelpnow[.]com
		covid19wrapparty[.]com
		covidgreen[.]net
		covidsbacash[.]com
		generationcovid19[.]net
		getcovidloans[.]com
		isurvivedcovid19[.]pro
		wherescovid[.]com
184.168.221.33	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 9
		cash4corona[.]com
		coronacleanforce[.]com
		travelinthetimesofcorona[.]com
		wipecoronavirus[.]com
		covid19erc[.]com
		covid19forcemajeurelaw[.]com
		covidtelecare[.]com
		diyfacemasks-covid19[.]com
		savemyrealestatefromcovid19[.]com
184.168.221.43	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		cash4coronabiz[.]com
		coronaloyalties[.]com
		fkucorona[.]com
		covid-19-md[.]com
		covid-19isfinished[.]com
		covid-survivor[.]club
		covid19freesigns[.]com
		covid19necessities[.]com
		hugsusacovidfund[.]com
		sbacoviddisasterrelief[.]com
		uscovid19clean[.]com
		wecleannyccovid19[.]com
		shopnovirus[.]com
		uvkillsvirus[.]com
50.63.202.56	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 16
		cash4coronasurvivers[.]com
		coronadivorce[.]net
		coronavirus-nursing-home-lawsuit[.]com
		creativecoronacoliving[.]com
		thecoronaviruswellness[.]com
		covid19fedbailout[.]com
		covid19pointofcare[.]com
		covid19survivers[.]com
		covid19vaccine[.]guru
		covid19viruslawsuits[.]com
		covidcohab[.]com
		covidconnedticut[.]com
		covidwyoming[.]com
		diycovid19[.]com
		futureaftercovid[.]com
		virusuv[.]com
184.168.221.50	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 13
		cash4coronavictims[.]com
		coronabusinessfunding[.]com
		coronalaser[.]com
		coronavirus-analysis[.]com
		drugs4corona[.]com
		covid19californiaclassactionattorneys[.]com
		covid19newyorklawyers[.]com
		covidcohabs[.]com
		effectsofcovid19[.]com
		fileacovid19claim[.]com
		lifeincovidtimes[.]com
		thecovid-19recovery[.]com
		resistvirusnews[.]net
184.168.221.47	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 6
		certifiedcoronacleaners[.]com
		covid-19costume[.]com
		covid19lawyersonline[.]com
		diycovid19facemasks[.]com
		steamcovid[.]com
		coronovirusessentials[.]com
184.168.221.32	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 15
		certifiedfreeofcoronavirus[.]com
		corona-shields[.]com
		coronafastcashloans[.]com
		coronavirus-vaccine[.]guru
		abovecovid[.]com
		bravecovidwarrior[.]com
		covid-19doctor[.]net
		covid-19isdead[.]com
		covidkitchens[.]com
		covidtude[.]com
		mycovidid[.]com
		drvirusprotect[.]com
		drvirusprotection[.]com
		virusppedistributers[.]com
		wewillkickcornavirusass[.]com
50.63.202.40	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		chinascorona[.]com
		coronavictimrelief[.]com
		coronavirusvaccine[.]guru
		helpstopcoronavirus[.]net
		knockdowncoronavirus[.]com
		covid-19memorials[.]com
		covid19-nursing-home-lawsuit[.]com
		covid19theteachings[.]com
		covidnewhampshire[.]com
		covidteleconsultant[.]com
		virussud[.]com
66.96.162.140	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 1
		communitycoronahelp[.]com
104.24.102.92	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		contagiocoronavirus[.]com
216.239.32.21	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 11
		corona-19[.]life
		informationcorona[.]com
		periksacorona[.]com
		buyacarcovid[.]com
		covid[.]works
		covidantibodyproject[.]com
		covidantibodyproject[.]net
		covidapply[.]com
		monroecovid[.]com
		revealcovid[.]com
		tccovid[.]com
50.63.202.36	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		corona-accomplishments[.]com
		corona-complishments[.]net
		corona-virus-cruise-lawsuit[.]com
		coronafeats[.]net
		coronavirusdoctor[.]net
		coronavirusnewyorkattorneys[.]com
		covid19homesellerbenefit[.]com
		covid19pass[.]net
		covid19wearables[.]com
		covidnebraska[.]com
		rollycovid19[.]com
		virusmy[.]com
217.160.0.247	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		corona-ambulanz[.]com
217.160.107.59	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		corona-atemschutzmasken[.]com
50.63.202.34	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		corona-cleanforce[.]com
		coronaepiccomics[.]com
		coronafederalaid[.]com
		coronaslogan[.]com
		coronataxrefundnow[.]com
		coronavirushalloweencostume[.]com
		lifeincoronatime[.]com
		covid-19pins[.]com
		covidcocktailclub[.]com
		covidfirebarrier[.]com
		covidlegalinfo[.]com
		testcovidencasa[.]com
184.168.221.55	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		corona-complishments[.]com
		bayswatercovid19support[.]com
		covid-19debtadvice[.]com
		covid19conscious[.]com
		covid19faq[.]net
		covid19pointofcare[.]net
		covid19wearable[.]com
		covidcashrefund[.]com
		covidct[.]com
		covidenroll[.]com
		covidnorthcarolina[.]com
		ccp-virussanitation[.]com
104.24.125.70	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		corona-down[.]com
217.160.0.147	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		corona-geld[.]com
184.168.131.241	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 45
		corona-info[.]life
		coronacarekw[.]com
		coronadosage[.]com
		coronafundinghelpdesk[.]com
		coronavirusandhousingmarket[.]com
		coronavirusespanol[.]com
		coronavirusexperiment[.]com
		coronavirusimpactonmortgages[.]com
		coronavirusreliefopportunites[.]com
		facemasksforcoronavirus[.]net
		kwcoronachallenge[.]com
		paintforcoronavirus[.]com
		whosgotcorona[.]com
		5minutecovid-19test[.]com
		5minutecovid19test[.]com
		5minutecovidtest[.]com
		coffeeandcovid[.]com
		connectduringcovid[.]com
		covid-19rapidtestkit[.]today
		covid-funding[.]com
		covid19cashflow[.]com
		covid19donationcenter[.]com
		covid19livetv[.]com
		covid19pdxdata[.]com
		covid19realestateresources[.]com
		covid19realtorhelp[.]com
		covid19realtorresources[.]com
		covidfive[.]com
		covidreliefopportunities[.]com
		covidresp[.]com
		covidvirus19test[.]com
		cowlitzcovid19[.]com
		cowlitzcovid19[.]net
		fiveminutecovid-19test[.]com
		fiveminutecovid19test[.]com
		fiveminutecovidtest[.]com
		gainesvillecovidmasks[.]com
		home-covid19[.]com
		home-covid19[.]net
		kwcovid19resources[.]com
		protect-against-covid19[.]com
		strikedowncovid19[.]com
		togetherwefightcovid-19[.]com
		togetherwefightcovid19[.]com
		virusimmunization[.]com
178.238.33.249	ASN: 24971	Country: CZ	MASTER-AS Czech Republic / www.master.cz
	Domain Names: 1
		corona-informatie[.]com
184.168.221.54	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		corona-loyalty[.]com
		coronainfohub[.]com
		coronarest[.]com
		covid19teachersupply[.]com
		covidhands[.]com
		covidpassport[.]net
		covidsbahelptoday[.]com
		covidsurvivalpack[.]com
		knockdowncovid-19[.]com
		n95mask-covid[.]com
		nyc-covid19[.]com
		protect-against-covid[.]com
		teachingscovid19[.]com
		uksurvivedcovid19[.]com
31.170.160.61	ASN: 47583	Country: LT	AS-HOSTINGER
	Domain Names: 4
		corona-mask-shop[.]com
		coronaviruscorp[.]com
		coronavirussolutions[.]net
		thecovidnineteen[.]com
3.20.85.141	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 2
		corona-president[.]com
		loveinthetmesofcovid[.]com
62.116.130.8	ASN: 15456	Country: DE	INTERNETX-AS
	Domain Names: 1
		corona-prophylaxe[.]com
94.130.122.52	ASN: 24940	Country: DE	HETZNER-AS
	Domain Names: 2
		corona-protect24[.]com
		coronaprotect24[.]com
81.169.145.68	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 3
		corona-reinigung[.]com
		digital-durch-corona[.]com
		covid19flaechendesinfektion[.]com
116.203.213.72	ASN: 24940	Country: DE	HETZNER-AS
	Domain Names: 3
		corona-respirator[.]com
		corona-respiratory-protection[.]com
		coronarespiratoryprotection[.]com
50.63.202.53	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 13
		corona-scale[.]com
		emergencycoronacash[.]com
		houseofcorona[.]com
		nycwilllkickcoronavirusass[.]com
		covid-19pass[.]com
		covid19federalfunding[.]com
		covid19freebusiness[.]com
		covid19phsychologist[.]com
		covid19viruslegalteam[.]com
		covidhelptoday[.]com
		covidnailcare[.]com
		mycovidmonitor[.]com
		tampacovidlaw[.]com
81.169.145.78	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		corona-schutzbekleidung[.]com
		covidfreesurface[.]com
81.169.145.90	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		corona-schutzfolie[.]com
		we-after-corona[.]com
217.160.0.61	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		corona-sicher[.]com
217.160.0.27	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 2
		corona-sound[.]com
		coronavirus-sound[.]com
3.224.56.216	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 1
		corona-virus-holisitic-remedies[.]com
184.168.221.34	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		corona-virus-loans[.]com
		coronavirusinformationcenteroftexas[.]com
		coronavirussmallbusinessrelief[.]com
		dogsagainstcorona[.]com
		taxprep4coronavictims[.]com
		arcovid[.]com
		covid-19immune[.]net
		covid19debtadvice[.]com
		covidcrusader[.]com
		covidnewswire[.]com
		itrackcovid19[.]com
		kickcovid-19ass[.]com
		covirusol[.]com
		virusbegone[.]today
92.222.139.190	ASN: 16276	Country: FR	OVH
	Domain Names: 1
		corona-virus-news[.]net
217.198.116.188	ASN: 34222	Country: CZ	ZONER-AS
	Domain Names: 1
		corona-virus[.]city
50.63.202.55	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 18
		corona-virusgoodnews[.]com
		coronacashrefund[.]com
		coronaepiccomicbooks[.]com
		coronakitchens[.]com
		coronavaccinationcenter[.]com
		donateforcoronavirus[.]com
		nowcoronarelief[.]com
		covid[.]partners
		covid19-jobs[.]com
		covid19damageattorneys[.]com
		covid19fedbailoutloans[.]com
		covid19lawyersreviews[.]com
		covid19wisdom[.]com
		covidconnecticut[.]com
		covidmademedoit[.]com
		thecovid-19survivors[.]com
		chinabatvirus[.]com
		viruscomfort[.]com
184.168.221.41	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		corona-wills[.]com
		coronafirebarrier[.]com
		coronavirus2019testing[.]com
		covid19californialawsuits[.]com
		covid19lawsuitcenter[.]com
		covidsouthcarolina[.]com
		globalcovid19clean[.]com
		nycwecleancovid-19[.]com
		taxcreditcovid-19[.]com
		chinaviruspayback[.]com
		resistvirusnews[.]com
50.63.202.59	ASN: 38726	Country: VN	VTCDIGICOM-AS-VN VTC DIGICOM
	Domain Names: 11
		corona19pledge[.]com
		coronavida[.]world
		meds4corona[.]com
		covid-19couplescounseling[.]com
		covid19-vitals[.]com
		covid19employmentlawsuits[.]com
		covid19ftest[.]com
		covidnevada[.]com
		covidwisconsin[.]com
		jacksoncovid19[.]com
		portal3dcovid19[.]com
181.214.86.147	ASN: 52284	Country: PA	Panamaserver.com
	Domain Names: 31
		coronaactnow[.]com
		coronainues[.]com
		coronarirus[.]com
		coronatxk[.]com
		coronavirousnews[.]com
		coronavirsusa[.]com
		coronaviruenow[.]com
		coronavirusimusa[.]com
		coronavirusmnow[.]com
		coronavirusnewsnowmap[.]com
		coronavirusuas[.]com
		coronavirususanow[.]com
		churchcovid[.]com
		cignacovidanswers[.]com
		covid19harvesthoc[.]com
		covid19njjobs[.]com
		covidisualizer[.]com
		covidtravking[.]com
		covidtrqcking[.]com
		covidtrscking[.]com
		covidvisualer[.]com
		covidvisualise[.]com
		phlcovid19[.]com
		sandiegocovid19[.]com
		ushealthcovid[.]com
		caronavirussd[.]com
		coranvirusnewsnow[.]com
		corinvirus-sd[.]com
		coroavirususa[.]com
		corobavirusnewsnow[.]com
		thehypnovirus[.]com
184.168.221.48	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		coronabd[.]net
		covid19-smartsolutions[.]com
		covid19firebarrier[.]com
		covid19insuranceclaimsservices[.]com
		covid19txcare[.]com
		covidsbarelief[.]com
		laprescovid19[.]com
		menacovidrelief[.]fund
		sbacash4covid[.]com
		screeningcovid[.]com
		thecovid-19aftercare[.]com
		naturalvirusprotection[.]com
85.13.152.236	ASN: 34788	Country: DE	NMM-AS D - 02742 Friedersdorf Hauptstrasse 68
	Domain Names: 1
		coronabest[.]net
50.63.202.37	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 15
		coronabioweapon[.]com
		coronahandcure[.]com
		coronavi19[.]com
		kickcoronaass[.]com
		smartcorona[.]com
		covid-21drones[.]com
		covid19californiaattorneys[.]com
		covid19claim[.]net
		covid19floridaatorney[.]com
		covid19freecompany[.]com
		covid19rapidtestingnow[.]com
		coviddelaware[.]com
		covidresporator[.]com
		kickcovidass[.]com
		savemyhomefromcovid19[.]com
50.63.202.38	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		coronabizhelp[.]com
		coronadisinfections[.]com
		coronataxhelpnow[.]com
		taxprep4corona[.]com
		covid-19clearinghouse[.]com
		covid19classactionlawyer[.]com
		covidnorthdakota[.]com
		getcovid19relief[.]com
		housingmarketandcovid19[.]com
		nycwecleancovid19[.]com
		workaftercovid[.]net
91.195.240.94	ASN: 47846	Country: DE	SEDO-AS
	Domain Names: 6
		coronabizopp[.]com
		coronabizopps[.]com
		getcovid19aid[.]com
		antivirusdrug[.]com
		antivirusdrugs[.]com
		virustestinfo[.]com
64.98.145.30	ASN: 32491	Country: CA	TUCOWS-3 - Tucows.com Co.
	Domain Names: 6
		coronabona[.]com
		coronavirusimmunitypassport[.]com
		completecovidkit[.]com
		covid19immunitypassport[.]com
		covidfamilykit[.]com
		ultimatecovidkit[.]com
50.63.202.48	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 17
		coronabroke[.]com
		coronataxrefundanswers[.]com
		coronavirus-co19[.]com
		coronavirus-smartsolutions[.]com
		justcoronajobs[.]com
		sbacoronadollars[.]com
		breakthroughcovid[.]com
		covid19boise[.]com
		covid19californialawsuit[.]com
		covid19dri[.]com
		covid19federalhelp[.]com
		covid19floridaattorney[.]com
		covidtaxhelpnow[.]com
		covidtennessee[.]com
		nyckickcovidass[.]com
		prisonology-covid19[.]net
		viruswall[.]net
35.208.68.137	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 4
		coronacampaign[.]com
		coronavirus2019[.]life
		coronavirusswap[.]com
		covid19relieffund[.]net
198.49.23.144	ASN: 53831	Country: US	SQUARESPACE - Squarespace, Inc.
	Domain Names: 1
		coronacant[.]com
50.63.202.52	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 15
		coronacashtoday[.]com
		coronavirusfront[.]com
		diycoronafacemasks[.]com
		sbacoronamoney[.]com
		covid-19-archive[.]com
		covid-self-assessment[.]com
		covid19financialresources[.]com
		covid19viruslawyers[.]com
		covid2019wiki[.]com
		covidlearningcurve[.]com
		newyorksurvivedcovid19[.]com
		vaccination4covid-19[.]com
		beatvirusnews[.]net
		virusprotectionclub[.]net
		zero-virus[.]com
199.34.228.190	ASN: 27647	Country: US	WEEBLY - Weebly, Inc.
	Domain Names: 1
		coronacation2020[.]net
184.168.221.49	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 18
		coronaccomplish[.]com
		coronaccomplishment[.]com
		coronacomfy[.]com
		coronatwo[.]com
		covid19-coronavirus[.]net
		diycoronavirusfacemasks[.]com
		covid-19-masks[.]life
		covid-19oregon[.]com
		covid19californialawyer[.]com
		covid19cert[.]net
		covid19loanmessengers[.]com
		covid19sbasupport[.]com
		covid19widow[.]com
		covidatgims[.]com
		covidenespanol[.]com
		covidfreewithme[.]com
		viruscertify[.]com
		virusmap[.]life
198.71.232.3	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 23
		coronacide[.]biz
		coronavirus-labtest[.]com
		coronavirus-pandamic[.]com
		coronaviruslawyersatlanta[.]com
		coronaviruslawyerschicago[.]com
		coronaviruslawyersmiami[.]com
		coronaviruspandemicmarketing[.]com
		helpwithmycoronavirusloan[.]com
		igotcoronaed[.]com
		againstcovids19[.]com
		covid19cleaningcorp[.]com
		covid19detectiontest[.]com
		covid19homerapidtesting[.]com
		covidbestdeals[.]com
		covidcancerchic[.]com
		covidchange[.]com
		covids-19[.]com
		cutsforcovid[.]com
		diycovid19mask[.]com
		ihatecovids19[.]com
		la-covid[.]com
		neverlovecovid19[.]com
		testingkits-covid19[.]com
184.168.221.40	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 20
		coronacleaningforce[.]com
		coronafreemassage[.]com
		coronasepiccomicbooks[.]com
		coronastimulusguide[.]com
		coronavirusemployerlawsuits[.]com
		sbacoronarelief[.]com
		covid19hoax2020[.]com
		covid19onlinestore[.]com
		covid19reliefadvisor[.]com
		covid19s[.]life
		covid19sbahelptoday[.]com
		covidfamilyusa[.]com
		covidfog[.]com
		covidloans-now[.]com
		covidminnesota[.]com
		deathsbycovid19[.]com
		thecovid-19meetingplace[.]com
		antivirus-support-numbers[.]com
		escapevirusnews[.]com
		fearthisvirus[.]com
68.65.120.181	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		coronacoinofficial[.]com
50.63.202.41	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		coronacommando[.]com
		coronadollarsnow[.]com
		coronataxprep[.]com
		coronavirusfloridaattorney[.]com
		covid-19michigan[.]com
		covid19conscious[.]net
		covid19foodkit[.]com
		covid19freewater[.]com
		covidmaryland[.]com
		covidunemployed[.]com
		findcovidrelief[.]com
		escapevirusnews[.]net
50.63.202.50	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		coronacompliancenews[.]com
		coronavirusbankruptcymass[.]com
		covid19doctors[.]net
		covid19front[.]com
		covid19reliefcoffee[.]com
		covidsbarelief[.]net
		covidvictimadvisor[.]com
		isurvivedcovid19[.]life
		lamacchiacovidresource[.]com
		opensourcecovid19[.]world
		sbacovidadvisor[.]com
50.63.202.33	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		coronacomplianceusa[.]com
		taxhelp4coronasurvivers[.]com
		thecoronacalculator[.]com
		covid-19legalteam[.]com
		covid19brigade[.]com
		covid19damageattorney[.]com
		covid19rebuild[.]com
		covid19taxprep[.]com
		covidproofme[.]com
		covidvitals[.]com
		crushitinrecovidresources[.]com
		resultsofcovid19[.]com
		thecovid19brigade[.]net
		virusfreeliving[.]com
50.63.202.57	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 7
		coronacreme[.]com
		coronavirusloanassistance[.]com
		coronavirussolicitor[.]net
		covid19viruslawsuit[.]com
		covidss[.]com
		fightcovid19pandemic[.]com
		globalcovidclean[.]com
23.236.62.147	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 7
		coronacrisisuae[.]com
		coronakredit[.]net
		covidcollars[.]com
		drcccovid19[.]com
		gratitudecovid[.]com
		suite401-covid19[.]com
		virusbustercandles[.]com
184.168.221.35	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 6
		coronact[.]com
		coronavirusrealestatesolutions[.]com
		bravecovidwarriors[.]com
		covid19-mindset[.]com
		covid19medshop[.]com
		lifeafterthecovid19[.]com
81.169.145.158	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		coronacup[.]amsterdam
		schutz-corona[.]com
81.169.145.94	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 3
		coronacups[.]amsterdam
		coronashielding[.]com
		covid19flaechendesinfektion[.]net
81.169.145.77	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		coronacups[.]com
		gemeinsam-durch-corona[.]com
13.226.102.21	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		coronadamore[.]club
217.160.0.233	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		coronadarlehn[.]com
162.215.253.210	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		coronadataroom[.]com
184.168.221.59	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		coronademographics[.]com
		coronavirus-class[.]com
		mitzvotagainstcorona[.]com
		nowfindcoronarelief[.]com
		covid-19vitals[.]com
		covid19-control[.]com
		covid19-mentions-db[.]com
		covid19apres[.]com
		covid19litigationteams[.]com
		covid19testing[.]biz
		tuckercovid19[.]com
		byebyeviruses[.]com
199.34.228.59	ASN: 27647	Country: US	WEEBLY - Weebly, Inc.
	Domain Names: 1
		coronadoctoruam[.]com
213.186.33.5	ASN: 16276	Country: FR	OVH
	Domain Names: 8
		coronadrive-in[.]com
		covid-out[.]com
		covid19-immune[.]com
		covid19-out[.]com
		covidfreeafrica[.]biz
		covidorg[.]com
		waw-covid19[.]com
		wawcovid19[.]com
184.168.221.58	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		coronaecon[.]com
		coronavirusisfinished[.]com
		beyondcovid19podcast[.]com
		businessalliancecovid19[.]com
		covid19-insuranceclaims[.]com
		covid19-testkit[.]club
		covid19sbahelpnow[.]com
		covid19supplies1[.]com
		covidsbahelpnow[.]com
		covidsystem[.]com
		sbacovidadvisors[.]com
		thecovid19[.]today
		wherescovid19[.]com
		ccp-virusprotection[.]com
50.63.202.46	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		coronaegypttours[.]com
		coronakitlab[.]com
		coronataxadvice[.]com
		coronavirusbankruptcyny[.]com
		certifiedcovidcleaners[.]com
		covid-gear[.]com
		covid-survivor[.]world
		covid19collapse[.]com
		covid19freecompanies[.]com
		covid19insclaims[.]com
		covid19insuranceservices[.]com
		covid19nevadaattorneys[.]com
		covida19america[.]com
		galvestoncovid19[.]com
184.168.221.56	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		coronaepiccomicbook[.]com
		coronageneration[.]net
		drug4coronavirus[.]com
		legaladvicerelatedtocorona[.]com
		sbacoronadvice[.]com
		covid-19drones[.]com
		covid-19immunenotcontagious[.]com
		covid19employeelawsuits[.]com
		covidbroke[.]com
		covidpointofcare[.]com
		ligacontraelcovid[.]com
104.27.188.28	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		coronaequipments[.]com
184.168.221.61	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 9
		coronafeats[.]com
		coronapalooza2020[.]com
		craftnotcorona[.]com
		covid19supplys[.]com
		covidgeneration[.]net
		covidkonnect[.]com
		covidtestlocator[.]com
		covidwisdom[.]com
		avoidavirus[.]mobi
50.63.202.42	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 9
		coronaffect[.]com
		coronataxreliefdollars[.]com
		coronavirus-homekit[.]com
		covid-19boise[.]com
		covidcashtoday[.]com
		irshelpcovid19[.]com
		thecovid19opportunity[.]com
		currentvirus[.]com
		nowvirusrelief[.]com
192.195.77.66	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 2
		coronafi[.]com
		virusstophere[.]com
104.16.15.194	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		coronafightteam[.]com
217.160.0.229	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		coronaflirt[.]com
50.63.202.35	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 9
		coronafoodpack[.]com
		coronasepiccomicbook[.]com
		coronavirusnevadaattorneys[.]com
		purecoronarelief[.]com
		acovidconversation[.]com
		covid19businessrelieffund[.]com
		covid19healthcarelawyers[.]com
		covid19stories[.]life
		covid19survey[.]net
81.169.145.150	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		coronafreeplace[.]com
		dubistcorona[.]com
81.169.145.163	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 1
		coronafreesurface[.]com
184.168.221.46	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		coronafreevirus[.]net
		coronasplit[.]com
		covid19conclusion[.]com
		covid19loanmessenger[.]com
		covid19virusattorneys[.]com
		covidthriver[.]com
		theteachingscovid19[.]com
		wherewascovid[.]com
		apocalypticvirus[.]com
		virusdestroyers[.]com
		viruskitusa[.]com
104.18.59.23	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		coronagis[.]com
217.70.184.38	ASN: 29169	Country: FR	GANDI-AS Domain name registrar - http://www.gandi.net
	Domain Names: 4
		coronahaikus[.]com
		comocovid[.]com
		covidbycountry[.]com
		kanbancovid[.]com
35.214.213.29	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		coronahealth[.]center
35.186.238.101	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 3
		coronakidd[.]com
		coronakidds[.]com
		coronavirus19help[.]com
52.0.217.44	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 4
		coronaliveupdate[.]net
		killviruses[.]life
		viruskiller[.]life
		viruskillers[.]life
50.63.202.49	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 7
		coronalivingwill[.]com
		covids[.]today
		covidvital[.]com
		covidwearables[.]com
		signscovid-19[.]com
		taxcreditscovid-19[.]com
		virusbeaters[.]com
87.236.16.26	ASN: 198610	Country: RU	BEGET-AS
	Domain Names: 1
		coronaloyalty[.]com
3.86.168.228	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 1
		coronamaison[.]net
136.0.111.91	ASN: 40676	Country: US	AS40676 - Psychz Networks
	Domain Names: 1
		coronaminer[.]com
81.169.145.161	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		coronamug[.]com
		covidfreesurfaces[.]com
81.169.145.80	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		coronamugs[.]amsterdam
		gemeinsamdurchcorona[.]com
107.180.51.107	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		coronappp[.]com
81.169.145.160	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 2
		coronaprotectionshields[.]com
		whatsmycoronarisk[.]com
67.205.14.237	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		coronaquarantineclub[.]com
162.251.160.114	ASN: 53767	Country: US	ICASTCENTER - iCastCenter
	Domain Names: 1
		coronaradios[.]com
50.63.202.45	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		coronareliefcash[.]com
		coronavirusctrl[.]com
		findcoronarelief[.]com
		bopcovid-19[.]com
		covid-19is[.]com
		covid-hunter[.]com
		covid19bailoutloanagent[.]com
		covid19homebuyerbenefit[.]com
		covid19informaticsalliance[.]com
		covidalaska[.]com
		covidmassachusetts[.]com
		covidtaxcredit[.]com
		covidtestlocator[.]net
		theantidotecovid-19[.]com
162.241.219.128	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		coronarelieftigerforce[.]com
192.64.119.235	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		coronasafebusinesses[.]com
44.227.65.245	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 4
		coronasafetycenter[.]com
		is-coronavirus-still-spreading[.]com
		covidgilance[.]com
		medicovid19[.]com
5.157.87.204	ASN: 48635	Country: NL	ASTRALUS
	Domain Names: 3
		coronaschoon[.]com
		thisisnotaboutthevirus[.]com
		worldhumanvirus[.]com
81.169.145.162	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 1
		coronaschutzfolie[.]com
217.160.0.213	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		coronaschutzfuerkinder[.]com
67.217.34.72	ASN: 22458	Country: US	NETSOURCE - NetSource Communications, Inc.
	Domain Names: 1
		coronasdereinas[.]com
50.63.202.90	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		coronasingoff[.]com
142.93.210.73	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		coronastatusnp[.]com
162.255.119.161	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		coronasupportresource[.]com
50.63.202.54	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 15
		coronataxdollars[.]com
		coronavirusnewyorklawsuits[.]com
		coronawarfare[.]com
		covid-19certifiedimmune[.]com
		covid-19green[.]com
		covid-ing[.]com
		covid19bailoutloans[.]com
		covid19californiaclassactionlawyers[.]com
		covid19consulting[.]today
		covid19costume[.]com
		covidandcoffee[.]com
		covidwuhan[.]com
		helpwithcovid19depression[.]com
		worldwildecovid19[.]com
		kronavirus[.]com
184.168.221.42	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		coronataxexpert[.]com
		coronavirus19s[.]com
		coronavirus2020pandemic[.]com
		coronavirusclearance[.]com
		bybycovid[.]com
		covid19boardgame[.]com
		covid19green[.]net
		covid19isdead[.]com
		covidmontana[.]com
		hlbcovid19[.]com
		viruskitus[.]com
		virusmedian[.]net
50.63.202.39	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 6
		coronataxmoney[.]com
		coronavirusaidconsultants[.]com
		covid19business[.]net
		covids[.]world
		mycovidbaby[.]com
		virusthemusical[.]com
127.0.0.1	ASN: 0	Country: None	Not routed
	Domain Names: 2
		coronatel[.]com
		covidex[.]net
35.172.94.1	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 2
		coronatokyo[.]com
		pasifikacovid19[.]com
162.241.85.70	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		coronatollfreenumber[.]com
134.122.113.193	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		coronatownhallprayer[.]com
37.152.88.55	ASN: 57910	Country: ES	SCIP-AS Soluciones Corporativas IP (SCIP)
	Domain Names: 4
		coronatuvida[.]com
		despidocovid[.]com
		ejecucionhipotecariacovid[.]com
		perdidasinversioncovid[.]com
81.88.57.68	ASN: 39729	Country: IT	REGISTER-AS
	Domain Names: 5
		coronavenu[.]com
		coronavenue[.]com
		coronavenus[.]com
		amende-covid[.]com
		amende-covid19[.]com
91.195.240.126	ASN: 47846	Country: DE	SEDO-AS
	Domain Names: 3
		coronavicide[.]net
		loveinthetimesofcorona[.]net
		loveinthetimesofcovid[.]net
35.214.223.226	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		coronavid[.]net
151.236.216.5	ASN: 63949	Country: US	LINODE-AP Linode, LLC
	Domain Names: 1
		coronavirlab[.]net
13.248.155.104	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		coronavirus-il[.]com
37.140.192.112	ASN: 197695	Country: RU	AS-REG
	Domain Names: 2
		coronavirus-online24[.]com
		covid19-today[.]com
80.74.149.13	ASN: 21069	Country: CH	ASN-METANET Routing/peering issues: noc@metanet.ch
	Domain Names: 1
		coronavirus-openhardware[.]net
66.96.162.128	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 1
		coronavirus-rapid-test-kits[.]com
206.188.192.84	ASN: 55002	Country: US	DEFENSE-NET - Defense.Net, Inc
	Domain Names: 1
		coronavirus-stimulu-package[.]com
173.212.206.46	ASN: 51167	Country: DE	CONTABO
	Domain Names: 1
		coronavirus-syria[.]com
92.119.115.38	ASN: 204601	Country: NL	ON-LINE-DATA Server location - Netherlands, Dronten
	Domain Names: 1
		coronavirus-vaccine-covid19[.]com
50.63.202.44	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 10
		coronavirus-vaccine[.]life
		coronavirus19health[.]com
		coronavirusindead[.]com
		directcoronakiller[.]com
		avislovescovid[.]com
		covid-19vancouver[.]com
		covid19floridalawyers[.]com
		covidsouthdakota[.]com
		diyfacemaskscovid19[.]com
		notovirus[.]com
184.168.221.62	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 9
		coronavirusaidassistance[.]com
		taxrelief4corona[.]com
		viajandoenlostiempodelcorona[.]com
		covid-19battle[.]com
		covid19ethio[.]com
		covid19virtualcare[.]com
		impactcovid[.]com
		letsbeatthevirus[.]com
		virus-med[.]com
81.17.18.197	ASN: 51852	Country: CH	PLI-AS
	Domain Names: 4
		coronavirusanow[.]com
		contra-covid19[.]com
		conornavirus[.]com
		coronusvirususa[.]com
66.96.162.138	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 1
		coronavirusattorneyny[.]com
184.168.221.37	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 14
		coronavirusbankruptcylawyerca[.]com
		covid19californiaattorney[.]com
		covid19femahelp[.]com
		covid19litigationteam[.]com
		covid19rebates[.]com
		covid19summary[.]com
		covidaccountable[.]com
		covidconsole[.]com
		covidfreewater[.]com
		covidprotectme[.]com
		covidwestvirginia[.]com
		covidwuhansurvivor[.]com
		sbacovidadvice[.]com
		thecovid-19symptoms[.]com
50.63.202.60	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 9
		coronavirusbankruptcyri[.]com
		covid19helptoday[.]com
		covid19killer[.]biz
		covid19taxadvice[.]com
		covide19symtoms[.]com
		covidindiana[.]com
		relief4covid[.]com
		workaftercovid[.]com
		beatvirusnews[.]com
50.63.202.51	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 9
		coronavirusbusiness[.]net
		disinfectcoronas[.]com
		sbacoronahelp[.]com
		covid19dfwcare[.]com
		covid19psychologist[.]com
		covids[.]life
		mycovid-19risk[.]com
		healthcareworkervirusinjury[.]com
		viruscreme[.]com
162.241.2.39	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		coronaviruscasosmexico[.]com
50.63.202.32	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 13
		coronavirusclassactionattorney[.]com
		coronavirusdisease2019pandemic[.]com
		savemyhomefromcoronavirus[.]com
		the-corona-busters[.]com
		covid19hands[.]com
		covid19survivor2020[.]com
		covid19viruslegalteams[.]com
		covidcupcakes[.]com
		covidz[.]world
		i-trackcovid19[.]com
		virusbarriers[.]com
		virussuds[.]com
		virusverify[.]com
50.63.202.61	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 19
		coronaviruscleaningexperts[.]com
		selectcoronarelief[.]com
		uscoronavirusptsd[.]com
		wildcorona[.]com
		buycovid19mask[.]com
		certifiedfreeofcovid19[.]com
		covid-19immunetest[.]com
		covid-19isgone[.]com
		covid19-cruise-lawsuit[.]com
		covidassistancenow[.]com
		covidcashnow[.]com
		covidreliefnow[.]com
		covidresponse[.]team
		decalscovid-19[.]com
		nowcovid19relief[.]com
		phtcccovid19[.]com
		wecleannyccovid-19[.]com
		virusmedian[.]com
		virusprotectionclub[.]com
50.63.202.58	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 13
		coronaviruscoalition[.]com
		coronavirusmaps[.]world
		coronavirussurivor[.]com
		covid-19suppliers[.]com
		covid19classactionattorneys[.]com
		covid19deniedclaim[.]com
		covid19employerlawsuits[.]com
		covidnewmexico[.]com
		cuts4covid[.]com
		ourprojectcovid[.]com
		thecovid-19forum[.]com
		uscovid19memorial[.]com
		wtfcovid-19[.]com
160.153.133.162	ASN: 21501	Country: DE	MAINLAB-AS Autonomous System formerly Mainlab GmbH, Germany
	Domain Names: 1
		coronaviruscovid-19prevention[.]com
78.141.193.184	ASN: 20473	Country: US	AS-CHOOPA - Choopa, LLC
	Domain Names: 1
		coronaviruscy[.]com
67.225.165.30	ASN: 32244	Country: US	LIQUIDWEB - Liquid Web, L.L.C
	Domain Names: 1
		coronavirusdiaries[.]net
41.203.18.177	ASN: 37153	Country: ZA	HETZNER
	Domain Names: 1
		coronavirusdojo[.]com
184.168.221.60	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		coronavirusfloridaattorneys[.]com
		help4coronavictims[.]com
		laidoffcoronahelp[.]com
		covid-19attorney[.]net
		covid-19realtor[.]com
		covid-fix[.]com
		covid19workerslawsuits[.]com
		covidpointofcare[.]net
		covidslogan[.]com
		covidz[.]today
		mycovidskill[.]com
		recoverfromcovid19[.]com
184.168.221.53	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 10
		coronavirusforcemajeurelaw[.]com
		uscoronamask[.]com
		covid19bailoutloanagents[.]com
		covid19disasterloanassistance[.]com
		covid19employeelawsuitscom[.]com
		covid19helpnow[.]com
		covid19releaf[.]com
		covidboise[.]com
		covidfactory[.]com
		covidproofed[.]com
192.64.119.243	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		coronavirusholiday[.]com
184.168.221.63	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 12
		coronavirusisgone[.]com
		kickcoronastache[.]com
		rehabcoronavirus[.]com
		brokefromcovid[.]com
		covid-19marriagecounseling[.]com
		covid19claimhelp[.]com
		covid2020relief[.]com
		covidmalls[.]com
		covids[.]solutions
		covidtaxdollars[.]com
		lubbockcovid19[.]com
		prisonology-covid19[.]com
81.17.18.196	ASN: 51852	Country: CH	PLI-AS
	Domain Names: 2
		coronaviruslivenow[.]com
		covidivisualizer[.]com
198.57.189.35	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		coronavirusmag[.]com
217.76.156.252	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		coronavirusmakers-cr[.]com
173.236.226.161	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		coronavirusmeditation[.]club
91.195.240.103	ASN: 47846	Country: DE	SEDO-AS
	Domain Names: 4
		coronavirusmillionaire[.]com
		covid-19millionaire[.]com
		covid19millionaire[.]com
		wuhanvirusmillionaire[.]com
173.236.176.216	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		coronaviruspreparers[.]com
54.84.104.245	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 1
		coronaviruspropertyservices[.]com
38.113.1.97	ASN: 174	Country: US	COGENT-174 - Cogent Communications
	Domain Names: 2
		coronavirusradio[.]net
		covid19radio[.]net
50.76.127.155	ASN: 7922	Country: US	COMCAST-7922 - Comcast Cable Communications, LLC
	Domain Names: 1
		coronavirusscrubbers[.]com
192.64.119.202	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		coronavirustestschedule[.]com
50.63.202.72	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		coronavirustestsondemand[.]com
208.91.197.91	ASN: 40034	Country: VG	CONFLUENCE-NETWORK-INC - Confluence Networks Inc
	Domain Names: 3
		coronaviruzindia[.]com
		combatcovid[.]net
		covid19smbsurvey[.]com
81.17.18.194	ASN: 51852	Country: CH	PLI-AS
	Domain Names: 3
		coronaviusa[.]com
		covid19assistanceatmortgagefamily[.]com
		covid19vizualizer[.]com
67.225.222.21	ASN: 32244	Country: US	LIQUIDWEB - Liquid Web, L.L.C
	Domain Names: 1
		coronawaitress[.]com
150.95.255.38	ASN: 7506	Country: JP	INTERQ GMO Internet,Inc
	Domain Names: 5
		coronawari[.]com
		covid19-2021[.]com
		covid19-tokyo[.]com
		covid19-who[.]com
		covid19-who[.]net
82.194.68.40	ASN: 16371	Country: ES	ACENS_AS (Spain) Hosting, housing and VPN services
	Domain Names: 1
		coronayudas[.]com
31.11.33.88	ASN: 31034	Country: IT	ARUBA-ASN
	Domain Names: 4
		dannicoronavirus[.]com
		dannicovid19[.]com
		difesamedicicovid19[.]com
		risarcimentodannicovid19[.]com
195.149.114.22	ASN: 31044	Country: UA	NICUA-AS
	Domain Names: 1
		decoronameron[.]com
52.7.5.208	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 1
		djibouti-coronavirus[.]com
62.149.128.166	ASN: 31034	Country: IT	ARUBA-ASN
	Domain Names: 4
		drugscoronavirus[.]com
		19viruscovid[.]com
		curemycovid[.]com
		victimscovid19memorial[.]cloud
52.54.67.235	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 1
		epidemiccorona[.]com
195.110.124.133	ASN: 39729	Country: IT	REGISTER-AS
	Domain Names: 16
		fastestcoronavirus[.]com
		newtestcoronavirus[.]com
		safetytestcoronavirus[.]com
		safetyvaccinecoronavirus[.]com
		securevaccinecoronavirus[.]com
		aiutocovid[.]club
		covidexitstrategy[.]com
		covidiciannove[.]com
		incentivicovid19[.]com
		mistercovid[.]club
		mistercovid[.]com
		newtestcovid-19[.]com
		swabscovid-19[.]com
		swabscovid19[.]com
		waycovid[.]com
		fastestcorinavirus[.]com
107.161.23.204	ASN: 3842	Country: US	RAMNODE - RamNode LLC
	Domain Names: 3
		flatcorona[.]com
		covidtask[.]com
		fearisavirus[.]com
217.76.128.34	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 4
		formacioncoronavirus[.]com
		gripecoronavirus[.]net
		indemnizacionesafectadoscoronavirus[.]com
		indemnizacionesafectadoscovid19[.]com
151.101.1.195	ASN: 54113	Country: US	FASTLY - Fastly
	Domain Names: 2
		gocoronago[.]run
		covid19byday[.]com
217.76.142.203	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		gripecoronavirus[.]com
192.0.78.25	ASN: 2635	Country: US	AUTOMATTIC - Automattic, Inc
	Domain Names: 5
		infocoronavirusindustriamusical[.]net
		2072covid[.]net
		heartofcovid[.]com
		lagunawoodsvillagecovid19[.]com
		sjmocovid[.]com
45.39.158.166	ASN: 18779	Country: US	EGIHOSTING - EGIHosting
	Domain Names: 1
		infraredthermometercoronavirus[.]com
91.216.107.49	ASN: 16347	Country: FR	RMI-FITECH
	Domain Names: 1
		initiativecoronavirusisolation[.]com
176.126.172.102	ASN: 5588	Country: CZ	GTSCE GTS Central Europe / Antel Germany
	Domain Names: 1
		itscoronatime[.]wtf
94.152.13.55	ASN: 29522	Country: PL	KEI
	Domain Names: 1
		ivonacorona[.]com
103.241.24.98	ASN: 58820	Country: ID	IDNIC-PTAMI-AS-ID PT Apik Media Inovasi
	Domain Names: 1
		jeparalawancorona[.]com
184.168.221.44	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		kickcoronasstache[.]com
		covid-survey[.]com
		covid19brigade[.]net
		covid19freebusinesses[.]com
		covid19law[.]biz
		covid19percapita[.]com
		covid19smallbiz[.]com
		covidrhodeisland[.]com
		dollars4covidvictims[.]com
		shcovid[.]com
		testforcovid19now[.]com
134.209.157.211	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		kickoffcorona[.]com
62.149.128.160	ASN: 31034	Country: IT	ARUBA-ASN
	Domain Names: 1
		lockdowncoronavirus[.]com
81.169.145.74	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 1
		maparealdelcoronavirus[.]com
130.185.109.77	ASN: 51191	Country: DE	XIRRA
	Domain Names: 3
		mc-corona[.]com
		mc-covid-19[.]com
		mc-covid[.]com
185.104.28.238	ASN: 206281	Country: NL	AS-ZXCS
	Domain Names: 1
		moveagainstcorona[.]com
134.119.234.216	ASN: 8972	Country: DE	GD-EMEA-DC-SXB1
	Domain Names: 1
		mundschutz-corona[.]com
217.26.50.131	ASN: 29097	Country: CH	HOSTPOINT-AS
	Domain Names: 1
		mycoronatrades[.]com
217.160.0.127	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		oneforfreevscorona[.]com
35.236.68.234	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 1
		onlinecoronavirushelpline[.]com
74.208.236.120	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		onlinecoronavirusmap[.]com
104.28.18.106	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		ophthalmology-coronado[.]com
198.38.86.172	ASN: 23352	Country: US	SERVERCENTRAL - Server Central Network
	Domain Names: 1
		pakcorona[.]com
194.9.94.85	ASN: 39570	Country: SE	LOOPIA
	Domain Names: 1
		pandemiccorona2020[.]com
209.99.64.33	ASN: 40034	Country: VG	CONFLUENCE-NETWORK-INC - Confluence Networks Inc
	Domain Names: 2
		pimpmycorona[.]com
		postcoronavirussyndrome[.]com
35.208.99.44	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		planetcoronavirus[.]com
104.27.145.189	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		poker-corona[.]com
23.227.38.32	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 15
		preventcoronakit[.]com
		covid-bedarf[.]com
		covid95mask[.]com
		covidrebel[.]com
		cubrebocascovid[.]com
		customcovid[.]com
		postcovidfest[.]com
		storecovid[.]com
		supplycovid-19[.]com
		thecovid19essentials[.]com
		tobyspreadcovid19[.]com
		getvirusfree[.]com
		sabaoantivirus[.]com
		shopantivirusmasks[.]com
		virusgenix[.]com
104.27.148.126	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		rassdcorona[.]com
217.160.0.78	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		reclamacioncoronavirus[.]net
192.0.78.24	ASN: 2635	Country: US	AUTOMATTIC - Automattic, Inc
	Domain Names: 4
		rochestercoronavirusinfo[.]com
		soscorona[.]net
		covid-19sanitizers[.]com
		covidkw[.]com
217.160.0.123	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 2
		salvoconductocoronavirus[.]com
		salvoconductocovid19[.]com
185.30.32.176	ASN: 48324	Country: DE	PROTECTED
	Domain Names: 2
		schutz-gegen-corona[.]com
		covid-19-schutz[.]com
81.169.145.148	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 1
		schutzmittel-corona[.]com
173.236.170.8	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		storiesfromcorona[.]com
192.185.0.218	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 4
		swdenanticorona[.]net
		covidkn95[.]com
		ppecovid[.]com
		ricovidarchive[.]com
195.201.179.80	ASN: 24940	Country: DE	HETZNER-AS
	Domain Names: 1
		thecorona[.]world
104.27.134.218	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		thecoronadata[.]com
37.202.4.189	ASN: 15817	Country: DE	MITTWALD-AS Mittwald CM Service GmbH und Co. KG
	Domain Names: 1
		thecoronaoptimist[.]com
104.248.13.28	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		thecoronavirusinsider[.]com
160.153.73.162	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		thecovid-19coronavirus[.]com
74.220.199.14	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		thepeoplescoronadiary[.]com
104.24.124.39	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		thermometer-coronavirus[.]com
217.76.128.47	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		trendsincoronavirus[.]com
52.58.78.16	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		un-corona[.]com
104.31.89.14	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		withoutcoronavirus[.]com
13.249.127.18	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		xocoronavirus[.]com
217.76.128.35	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		alianzacovid19[.]com
104.27.160.44	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		amisurvivingcovid19[.]com
66.96.162.132	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 1
		angelscovid19[.]com
217.198.114.186	ASN: 34222	Country: CZ	ZONER-AS
	Domain Names: 1
		anticovidrespiration[.]com
217.160.0.66	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 2
		asacovid-19[.]com
		asacovid19[.]com
116.90.59.144	ASN: 55803	Country: AU	DIGITALPACIFIC-AU Digital Pacific Pty Ltd Australia
	Domain Names: 1
		aukiwi-covid19-help[.]center
72.249.57.170	ASN: 36024	Country: US	AS-TIERP-36024 - TierPoint, LLC
	Domain Names: 1
		autoevaluacioncovid19[.]com
192.185.57.77	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		azcovidproject[.]com
170.249.143.133	ASN: 30102	Country: US	BALDWIN - Baldwin County Commission
	Domain Names: 1
		baldwincovid[.]com
208.113.184.63	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		begonecovid19[.]com
74.208.236.41	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		bestcovidfacemask[.]com
66.96.162.146	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 23
		bookmycovid19test[.]com
		bookmycovid19testkit[.]com
		bookmytestcovid19[.]com
		euro2020-covid19[.]com
		fifa-covid19[.]com
		fifacovid19[.]com
		formula1-covid19[.]com
		formula1covid19[.]com
		mlb-covid19[.]com
		mlbcovid19[.]com
		nba-covid19[.]com
		nfl-covid19[.]com
		nflcovid19[.]com
		olympics-covid19[.]com
		olympicscovid19[.]com
		pgatour-covid19[.]com
		pgatourcovid19[.]com
		rolandgarros-covid19[.]com
		rolandgarroscovid19[.]com
		tomorrowland-covid19[.]com
		tomorrowlandcovid19[.]com
		uefa-covid19[.]com
		uefacovid19[.]com
81.16.28.165	ASN: 47583	Country: LT	AS-HOSTINGER
	Domain Names: 1
		cameroonhelpcovid19[.]com
50.63.202.62	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 11
		canadasurvivedcovid19[.]com
		covid-19bc[.]com
		coviddoctor[.]net
		covidfine[.]com
		covidmississippi[.]com
		covidpennsylvania[.]com
		sbarelief4covid[.]com
		taxcreditscovid19[.]com
		thecovid-19blog[.]com
		bybyvirus[.]com
		virusdoor[.]com
199.34.228.79	ASN: 27647	Country: US	WEEBLY - Weebly, Inc.
	Domain Names: 1
		ccfcovid19resources[.]com
104.16.13.194	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		cffcovidspecial[.]net
47.241.1.184	ASN: 45102	Country: CN	CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd.
	Domain Names: 1
		claimback-covid-19[.]com
66.96.132.100	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 4
		cleaningcovid-19orlando[.]com
		covid-19disinfectingorlando[.]com
		covid-19floridacleaning[.]com
		floridacovid-19[.]com
203.151.233.116	ASN: 4618	Country: TH	INET-TH-AS Internet Thailand Company Limited
	Domain Names: 1
		clearcovid19huahin[.]com
109.234.164.76	ASN: 50474	Country: FR	O2SWITCH
	Domain Names: 1
		coopcovid19[.]net
198.143.149.147	ASN: 32475	Country: US	SINGLEHOP-LLC - SingleHop, Inc.
	Domain Names: 1
		corpuscovidsupplies[.]com
188.40.223.86	ASN: 24940	Country: DE	HETZNER-AS
	Domain Names: 1
		covid-19-af[.]com
31.24.129.53	ASN: 29486	Country: DE	WEBHUSET-AS
	Domain Names: 1
		covid-19-atsea[.]com
185.151.30.148	ASN: 48254	Country: GB	OSS-URAL-AS
	Domain Names: 1
		covid-19-bolivia[.]com
95.173.102.23	ASN: 15657	Country: DE	SPEEDBONE-AS
	Domain Names: 1
		covid-19-infos[.]com
31.24.129.59	ASN: 29486	Country: DE	WEBHUSET-AS
	Domain Names: 2
		covid-19-onboard[.]com
		covid-19atsea[.]com
2.57.89.36	ASN: 47583	Country: LT	AS-HOSTINGER
	Domain Names: 1
		covid-19-support[.]com
188.93.150.34	ASN: 59980	Country: NL	MIJNDOMEIN
	Domain Names: 1
		covid-19-tax[.]com
176.31.149.194	ASN: 16276	Country: FR	OVH
	Domain Names: 3
		covid-19-virusdellapaura[.]com
		covid-19psicosivirale[.]com
		covid-19virusdellapaura[.]com
31.24.129.62	ASN: 29486	Country: DE	WEBHUSET-AS
	Domain Names: 1
		covid-19onboard[.]com
74.220.199.6	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		covid-19physdis[.]com
206.188.192.251	ASN: 55002	Country: US	DEFENSE-NET - Defense.Net, Inc
	Domain Names: 1
		covid-19unionrights[.]com
66.96.162.129	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 1
		covid-19viruslitigation[.]com
91.239.200.38	ASN: 43541	Country: CZ	VSHOSTING
	Domain Names: 1
		covid-bubbles[.]com
185.199.108.153	ASN: 54113	Country: US	FASTLY - Fastly
	Domain Names: 1
		covid-factsheet[.]com
208.91.197.27	ASN: 40034	Country: VG	CONFLUENCE-NETWORK-INC - Confluence Networks Inc
	Domain Names: 2
		covid-kids[.]net
		covid19loansupport[.]com
64.90.51.87	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		covid-line[.]com
66.165.248.146	ASN: 29802	Country: US	HVC-AS - HIVELOCITY VENTURES CORP
	Domain Names: 1
		covid-taskforce[.]com
27.254.67.75	ASN: 9891	Country: TH	CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited.
	Domain Names: 1
		covid-th[.]com
3.19.155.149	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 3
		covid-trump[.]com
		covidpresident[.]com
		love-in-the-time-of-covid19[.]com
165.160.15.20	ASN: 19574	Country: US	CSC - Corporation Service Company
	Domain Names: 4
		covid-unicredit[.]com
		covidunicredit[.]net
		unicredit-covid[.]com
		unicreditcovid[.]net
165.160.13.20	ASN: 19574	Country: US	CSC - Corporation Service Company
	Domain Names: 4
		covid-unicredit[.]net
		covidunicredit[.]com
		unicredit-covid[.]net
		unicreditcovid[.]com
35.196.196.42	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 2
		covid[.]sydney
		covidstatsus[.]com
87.98.239.5	ASN: 16276	Country: FR	OVH
	Domain Names: 1
		covid19-fighters[.]com
204.93.197.59	ASN: 23352	Country: US	SERVERCENTRAL - Server Central Network
	Domain Names: 1
		covid19-flulogger[.]com
217.26.48.101	ASN: 29097	Country: CH	HOSTPOINT-AS
	Domain Names: 1
		covid19-history[.]com
69.163.233.61	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 2
		covid19-lending[.]com
		covid19-unemployment[.]com
78.47.43.116	ASN: 24940	Country: DE	HETZNER-AS
	Domain Names: 1
		covid19-plano-contingencia[.]com
66.206.24.242	ASN: 29802	Country: US	HVC-AS - HIVELOCITY VENTURES CORP
	Domain Names: 1
		covid19-pro[.]com
104.18.37.3	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid19-sxm[.]com
92.222.139.156	ASN: 16276	Country: FR	OVH
	Domain Names: 1
		covid19-temoignages[.]com
66.235.200.145	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid19-updated[.]com
37.97.254.27	ASN: 20857	Country: NL	TRANSIP-AS Amsterdam, the Netherlands
	Domain Names: 2
		covid19-vrij[.]com
		meetcovid[.]com
217.116.0.182	ASN: 16371	Country: ES	ACENS_AS (Spain) Hosting, housing and VPN services
	Domain Names: 1
		covid19afectados[.]com
54.72.9.51	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 2
		covid19analyser[.]com
		covid19analyzer[.]com
31.24.129.48	ASN: 29486	Country: DE	WEBHUSET-AS
	Domain Names: 1
		covid19atsea[.]com
104.26.8.145	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid19bakersfield[.]com
66.96.160.157	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 2
		covid19buysupplies[.]com
		covidnorth[.]com
217.160.0.250	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		covid19carservice[.]com
50.63.202.88	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		covid19chek[.]com
104.28.27.106	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid19cm[.]com
166.62.28.95	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		covid19count[.]life
64.20.63.204	ASN: 19318	Country: US	NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC
	Domain Names: 1
		covid19crisishelp[.]com
13.249.102.102	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		covid19cuisines[.]com
145.131.10.247	ASN: 8315	Country: NL	AMSIO
	Domain Names: 1
		covid19cyber[.]com
34.193.204.92	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 2
		covid19emergencyfacemask[.]com
		masscovidtracker[.]com
185.114.108.15	ASN: 24961	Country: DE	MYLOC-AS
	Domain Names: 1
		covid19frequency[.]com
163.43.87.180	ASN: 9370	Country: JP	SAKURA-B SAKURA Internet Inc.
	Domain Names: 1
		covid19jc[.]com
34.90.76.137	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 1
		covid19last[.]com
104.27.130.73	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid19live[.]today
192.185.226.160	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		covid19live[.]world
45.56.114.98	ASN: 63949	Country: US	LINODE-AP Linode, LLC
	Domain Names: 1
		covid19lookup[.]com
108.167.172.191	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		covid19news[.]network
31.24.129.40	ASN: 29486	Country: DE	WEBHUSET-AS
	Domain Names: 1
		covid19onboard[.]com
35.214.51.171	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		covid19openforbusiness[.]com
103.67.235.120	ASN: 38719	Country: AU	DREAMSCAPE-AS-AP Dreamscape Networks Limited
	Domain Names: 3
		covid19rapidtestsydney[.]com
		rapidtestcovid19sydney[.]com
		rapidtestingcovid19[.]com
198.54.126.75	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		covid19responsfund[.]com
157.112.176.2	ASN: 9371	Country: JP	SAKURA-C SAKURA Internet Inc.
	Domain Names: 1
		covid19sci[.]com
52.5.34.110	ASN: 14618	Country: US	AMAZON-AES - Amazon.com, Inc.
	Domain Names: 1
		covid19secrets[.]com
62.149.128.74	ASN: 31034	Country: IT	ARUBA-ASN
	Domain Names: 1
		covid19serum[.]net
66.96.162.144	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 2
		covid19testprevention[.]com
		covidclaimsa[.]com
50.63.202.73	ASN: 38726	Country: VN	VTCDIGICOM-AS-VN VTC DIGICOM
	Domain Names: 1
		covid19testsondemand[.]com
98.124.199.50	ASN: 21740	Country: US	ENOMAS1 - eNom, Incorporated
	Domain Names: 1
		covid19teststudy[.]com
107.180.50.231	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		covid19tracker[.]today
13.249.102.119	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		covid19watch[.]net
217.160.0.3	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		covid19yahoraque[.]com
192.161.187.200	ASN: 8100	Country: US	ASN-QUADRANET-GLOBAL - QuadraNet, Inc
	Domain Names: 2
		covid20plus[.]com
		covidtasks[.]com
104.18.39.3	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid4d[.]club
104.18.51.68	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid4d[.]com
104.31.91.191	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covid4d[.]net
209.141.38.71	ASN: 53667	Country: US	PONYNET - FranTech Solutions
	Domain Names: 4
		covid4dummies[.]com
		covidsbafunding[.]com
		covidsbalending[.]com
		foxvirus[.]com
185.61.154.215	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 2
		covid939[.]com
		covidproject894[.]com
88.214.207.96	ASN: 46636	Country: US	NATCOWEB - NatCoWeb Corp.
	Domain Names: 1
		covidappeal[.]com
81.17.18.198	ASN: 51852	Country: CH	PLI-AS
	Domain Names: 4
		covidaxtnow[.]com
		covidreacking[.]com
		covidvidualizer[.]com
		pccoviduodate[.]com
66.96.162.147	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 1
		covidbabiesboom[.]com
40.86.86.144	ASN: 8075	Country: US	MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation
	Domain Names: 1
		covidbits[.]com
62.149.128.157	ASN: 31034	Country: IT	ARUBA-ASN
	Domain Names: 2
		covidblock[.]biz
		vaccinocovid[.]com
72.167.225.21	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		covidbuzz[.]com
3.20.70.240	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		covidcaregroup[.]com
5.39.10.93	ASN: 16276	Country: FR	OVH
	Domain Names: 1
		covidcause[.]com
184.168.221.75	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		covidchek[.]com
206.189.178.173	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		covidcoalition[.]net
157.245.130.6	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		covidcount[.]club
51.15.75.238	ASN: 12876	Country: FR	AS12876
	Domain Names: 1
		covidcyphers[.]com
217.160.0.26	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		coviddentistry[.]com
64.37.62.203	ASN: 33182	Country: US	DIMENOC - HostDime.com, Inc.
	Domain Names: 1
		covidenmexico[.]com
68.65.122.205	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		covidfreecheck[.]com
74.208.236.23	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		covidfreelove[.]com
98.137.244.37	ASN: 36647	Country: US	YAHOO-GQ1 - Yahoo
	Domain Names: 1
		covidgamers[.]net
3.19.116.243	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		covidglobalstats[.]com
74.208.215.125	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		covidgradesanitizer[.]com
13.127.151.145	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		covidheatmaps[.]com
81.88.48.71	ASN: 39729	Country: IT	REGISTER-AS
	Domain Names: 4
		covidiane-20[.]com
		covidiane-20[.]net
		covidiane20[.]com
		covidiane20[.]net
192.64.147.249	ASN: 19867	Country: US	VOODOO1 - Voodoo.com, Inc
	Domain Names: 1
		covidill[.]com
66.96.147.102	ASN: 29873	Country: US	BIZLAND-SD - The Endurance International Group, Inc.
	Domain Names: 1
		covidinfo[.]center
69.163.162.143	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		covidiot-count[.]com
74.208.43.66	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		covidiotsthemovie[.]com
62.233.121.61	ASN: 20860	Country: GB	IOMART-AS
	Domain Names: 2
		covidlifesurvey[.]com
		covidlifesurvey[.]net
184.168.221.38	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 4
		covidmaine[.]com
		covidvirusppe[.]com
		thecovid19brigade[.]com
		b2bvirussolutionscpm[.]com
103.42.108.46	ASN: 45638	Country: AU	SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD
	Domain Names: 1
		covidmedbot[.]com
198.50.252.64	ASN: 16276	Country: FR	OVH
	Domain Names: 2
		covidmedcheck[.]com
		hkcovid-19[.]com
94.254.58.36	ASN: 8473	Country: SE	BAHNHOF http://www.bahnhof.net/
	Domain Names: 1
		covidmeeting[.]com
185.243.183.13	ASN: 43260	Country: TR	DGN
	Domain Names: 1
		covidmetin2[.]com
78.142.210.2	ASN: 209853	Country: TR	AS209853
	Domain Names: 1
		covidmetric[.]com
81.169.145.95	ASN: 6724	Country: DE	STRATO STRATO AG
	Domain Names: 1
		covidnyl[.]com
108.179.243.219	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		covidol-3[.]com
74.208.236.233	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		covidosed[.]com
184.168.221.68	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		covidpoct[.]com
122.201.127.81	ASN: 38719	Country: AU	DREAMSCAPE-AS-AP Dreamscape Networks Limited
	Domain Names: 1
		covidproject965[.]com
81.17.18.195	ASN: 51852	Country: CH	PLI-AS
	Domain Names: 1
		covidracking[.]com
119.59.120.132	ASN: 56067	Country: TH	METRABYTE-TH 453 Ladplacout Jorakhaebua
	Domain Names: 1
		covidsakidthai[.]com
43.225.53.108	ASN: 394695	Country: US	PUBLIC-DOMAIN-REGISTRY - PDR
	Domain Names: 1
		covidsimpact[.]com
104.27.139.121	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		covidsro[.]com
184.164.141.130	ASN: 20454	Country: US	SSASN2 - SECURED SERVERS LLC
	Domain Names: 1
		covidstimuluscalc[.]com
198.185.159.144	ASN: 53831	Country: US	SQUARESPACE - Squarespace, Inc.
	Domain Names: 2
		covidstriketeam[.]com
		innovationforcovid[.]com
108.179.194.9	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		covidsuministrosmedicos[.]com
50.63.202.81	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		covidtestsondemand[.]com
199.59.242.153	ASN: 395082	Country: US	BODIS-NJ - Bodis, LLC
	Domain Names: 1
		covidtrackig[.]com
208.113.168.235	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		covidtxt[.]com
185.34.194.235	ASN: 197712	Country: ES	CDMON sistemes@cdmon.com
	Domain Names: 1
		covidvallescolabora[.]com
208.76.249.34	ASN: 21769	Country: US	AS-COLOAM - Colocation America Corporation
	Domain Names: 1
		cpapforcovid[.]com
162.255.119.202	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		curacaocovid19[.]com
104.24.112.168	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		datacovid-19[.]com
3.13.31.214	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		dearcovid[.]com
165.22.230.124	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		didcovidstop[.]com
162.241.218.214	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 2
		duringcovid19[.]com
		gethelpcovidoregon[.]com
217.160.0.21	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		equipoanticovid[.]com
103.145.227.118	ASN: 139456	Country: ID	AS139456
	Domain Names: 1
		exitcovid[.]com
103.224.182.246	ASN: 133618	Country: AU	TRELLIAN-AS-AP Trellian Pty. Limited
	Domain Names: 1
		facebookcovid19[.]com
35.208.104.111	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		flcovidupdates[.]com
217.160.0.103	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		foro-covid19[.]com
34.82.119.32	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 1
		forocovid19[.]com
104.24.98.197	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		helpendcovid19[.]com
198.71.233.65	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		helpinghand4covid19[.]com
81.171.195.201	ASN: 8426	Country: GB	CLARANET-AS ClaraNET LTD
	Domain Names: 1
		helpstopcovid19[.]life
103.131.50.226	ASN: 136851	Country: ID	IDNIC-COLO-AS-ID PT ARDETAMEDIA GLOBAL KOMPUTINDO
	Domain Names: 1
		herbalcovid19[.]com
184.168.221.77	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		hometestforcovid19[.]com
116.202.200.182	ASN: 24940	Country: DE	HETZNER-AS
	Domain Names: 1
		hotline-covid-19[.]net
102.133.224.201	ASN: 8075	Country: US	MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation
	Domain Names: 1
		illovocovid19[.]com
144.208.64.173	ASN: 22611	Country: US	IMH-WEST - InMotion Hosting, Inc.
	Domain Names: 1
		killcovidqaltek[.]com
13.229.38.226	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		kittestcovid19[.]com
104.18.62.63	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		liveupdatecovid19[.]com
198.71.233.96	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		majlcovid[.]com
185.81.4.203	ASN: 52030	Country: IT	SERVERPLAN-AS
	Domain Names: 2
		mascherineanticovid[.]com
		mascherineanticovid19[.]com
107.180.25.163	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		mastercovidactualizacion[.]com
93.174.4.8	ASN: 48348	Country: ES	CLOUDBUILDERS
	Domain Names: 1
		mediadorescovid19[.]com
62.149.128.154	ASN: 31034	Country: IT	ARUBA-ASN
	Domain Names: 1
		medicalcovidsupplier[.]com
103.28.100.4	ASN: 132117	Country: TH	MOINET-AS-AP Ministry of Interior
	Domain Names: 1
		moicovid[.]com
167.114.126.57	ASN: 16276	Country: FR	OVH
	Domain Names: 1
		mu-covid[.]com
104.24.121.125	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		mycovidodds[.]com
62.116.169.161	ASN: 15456	Country: DE	INTERNETX-AS
	Domain Names: 1
		nadal-covid[.]com
192.185.139.6	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 2
		ngtest-covid19-info[.]com
		statcovid[.]com
194.58.112.174	ASN: 197695	Country: RU	AS-REG
	Domain Names: 1
		nocovidvirus[.]com
199.34.228.159	ASN: 27647	Country: US	WEEBLY - Weebly, Inc.
	Domain Names: 1
		nyccovidrelief[.]com
104.19.240.93	ASN: 13335	Country: US	CLOUDFLARENET - Cloudflare, Inc.
	Domain Names: 1
		okccovid[.]com
156.67.222.128	ASN: 47583	Country: LT	AS-HOSTINGER
	Domain Names: 1
		pedulicovid19[.]net
112.78.2.48	ASN: 45538	Country: VN	ODS-AS-VN Online data services
	Domain Names: 1
		phongdichcovid[.]com
216.40.47.17	ASN: 15348	Country: CA	TUCOWS - Tucows.com Co.
	Domain Names: 1
		postcovid19ocs[.]com
162.241.61.23	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		quarentenacovid-19[.]com
216.104.165.88	ASN: 10732	Country: US	TIERRANET - TierraNet Inc.
	Domain Names: 2
		quit4covid[.]com
		quitforcovid[.]com
217.160.0.116	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		rechtsberatung-covid19[.]com
87.239.8.18	ASN: 207647	Country: NL	INTENTION-AS
	Domain Names: 1
		saas4covid[.]com
185.199.111.153	ASN: 54113	Country: US	FASTLY - Fastly
	Domain Names: 1
		saasforcovid[.]com
166.62.27.148	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		sarscov2-covid[.]com
173.236.225.31	ASN: 26347	Country: US	DREAMHOST-AS - New Dream Network, LLC
	Domain Names: 1
		sincasacovid19[.]com
206.188.192.60	ASN: 55002	Country: US	DEFENSE-NET - Defense.Net, Inc
	Domain Names: 1
		smallbusinesscovid19disasterrelief[.]com
162.210.70.23	ASN: 394695	Country: US	PUBLIC-DOMAIN-REGISTRY - PDR
	Domain Names: 1
		smartcovid19[.]com
23.111.145.18	ASN: 29802	Country: US	HVC-AS - HIVELOCITY VENTURES CORP
	Domain Names: 1
		socialvisacovid[.]com
77.104.132.234	ASN: 36351	Country: US	SOFTLAYER - SoftLayer Technologies Inc.
	Domain Names: 1
		solutionsforcovid-19[.]com
91.216.107.147	ASN: 16347	Country: FR	RMI-FITECH
	Domain Names: 1
		stop-covid19-ci[.]com
217.160.0.155	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		stopviruscovid19[.]com
132.148.230.42	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		studentagainstcovid19[.]com
198.71.232.4	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		supplyforcovid19[.]com
192.185.199.117	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		survivingcovid2020[.]com
78.142.211.39	ASN: 209853	Country: TR	AS209853
	Domain Names: 1
		terapicovid19[.]com
89.40.174.146	ASN: 60087	Country: IT	ASSUPERNOVA
	Domain Names: 1
		test-covid19[.]net
185.253.212.22	ASN: 48707	Country: PL	GREENER-AS
	Domain Names: 1
		testsforcovid19[.]com
43.252.88.207	ASN: 17439	Country: IN	NETMAGIC-AP Netmagic Datacenter Mumbai
	Domain Names: 1
		thecovid19info[.]com
35.209.62.13	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		thecovid19lawgroup[.]com
35.232.188.105	ASN: 15169	Country: US	GOOGLE - Google LLC
	Domain Names: 1
		thecovidclaimer[.]com
70.40.220.135	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		thecoviddashboard[.]com
23.92.22.245	ASN: 63949	Country: US	LINODE-AP Linode, LLC
	Domain Names: 1
		togetherwefightcovid[.]com
94.237.3.129	ASN: 202053	Country: FI	UPCLOUD
	Domain Names: 1
		trackcovid19ph[.]com
98.129.229.114	ASN: 53824	Country: US	LIQUIDWEB - Liquid Web, L.L.C
	Domain Names: 1
		txcovid[.]com
217.160.230.219	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		ukcovid19help[.]com
217.160.0.110	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		ukcovid19support[.]com
74.117.219.198	ASN: 53997	Country: US	DNC-HOLDINGS-INC - DNC Holdings, Inc.
	Domain Names: 3
		vasculitiscovid[.]com
		vasculitiscovid[.]net
		realpandemicviruses[.]com
104.248.50.87	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		visualizecovid19[.]com
217.160.0.173	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		yosobrevivialcovid[.]com
52.9.66.109	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		zipcovid[.]com
195.211.74.112	ASN: 51696	Country: NL	ANTAGONIST-AS
	Domain Names: 1
		antivirusproviders[.]com
217.160.223.203	ASN: 8560	Country: DE	ONEANDONE-AS Brauerstrasse 48
	Domain Names: 1
		antivirusscheibe[.]com
66.225.201.55	ASN: 23352	Country: US	SERVERCENTRAL - Server Central Network
	Domain Names: 4
		b2bvirussafesolutions[.]com
		virusbusterprograms[.]com
		virusfreeprograms[.]com
		virusfreesolution[.]com
184.168.221.71	ASN: 38726	Country: VN	VTCDIGICOM-AS-VN VTC DIGICOM
	Domain Names: 1
		beyondvirus[.]com
162.241.252.74	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		ccp-virus[.]net
116.202.132.34	ASN: 24940	Country: DE	HETZNER-AS
	Domain Names: 1
		datavsvirus[.]com
54.154.44.39	ASN: 16509	Country: US	AMAZON-02 - Amazon.com, Inc.
	Domain Names: 1
		diariodeumvirus[.]com
102.134.56.89	ASN: 328543	Country: Unknown	AS328543
	Domain Names: 1
		fake-antivirus[.]com
69.172.201.153	ASN: 19324	Country: US	DOSARREST - Dosarrest Internet Security LTD
	Domain Names: 1
		mutatingvirus[.]com
77.32.223.236	ASN: 200484	Country: FR	SENDINBLUE-ASN
	Domain Names: 1
		myvirustesting[.]email
74.117.219.199	ASN: 53997	Country: US	DNC-HOLDINGS-INC - DNC Holdings, Inc.
	Domain Names: 2
		pandemic-virus[.]com
		viruskitsusa[.]com
162.255.119.222	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		postvirusera[.]com
81.19.154.98	ASN: 38955	Country: AT	WORLD4YOU
	Domain Names: 2
		stop-virus-shop[.]com
		stopvirus-shop[.]com
176.126.165.32	ASN: 59684	Country: KG	ASHOSTER
	Domain Names: 1
		stopvirus[.]biz
176.122.159.103	ASN: 25820	Country: CA	IT7NET - IT7 Networks Inc
	Domain Names: 1
		treatmentvirus[.]com
192.64.119.123	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		trumppvirus[.]com
50.63.202.91	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		vanquishthevirus[.]com
87.236.16.9	ASN: 198610	Country: RU	BEGET-AS
	Domain Names: 1
		virus-antiseptik[.]com
50.63.202.68	ASN: 26496	Country: US	AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC
	Domain Names: 1
		virusafeplace[.]com
35.214.181.191	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		virusalarms[.]com
173.231.209.32	ASN: 54641	Country: US	INMOTI-1 - InMotion Hosting, Inc.
	Domain Names: 1
		virusdatamaps[.]com
206.189.254.171	ASN: 14061	Country: US	DIGITALOCEAN-ASN - DigitalOcean, LLC
	Domain Names: 1
		virussanitizingproducts[.]com
162.255.119.160	ASN: 22612	Country: US	NAMECHEAP-NET - Namecheap, Inc.
	Domain Names: 1
		virusshow[.]com
192.185.20.88	ASN: 46606	Country: US	UNIFIEDLAYER-AS-1 - Unified Layer
	Domain Names: 1
		virustaticusa[.]com
35.214.141.28	ASN: 19527	Country: US	GOOGLE-2 - Google LLC
	Domain Names: 1
		virusypandemias[.]com
109.70.26.37	ASN: 48287	Country: RU	RU-SERVICE-AS
	Domain Names: 1
		withoutvirus[.]com
204.44.192.34	ASN: 8100	Country: US	ASN-QUADRANET-GLOBAL - QuadraNet, Inc
	Domain Names: 1
		worsethanvirus[.]com

++++++++++++++++++++++++++++++
Domains Registered on 31MAR2020
++++++++++++++++++++++++++++++