Beyond BITTER: MENA Civil Society Targeted in Hack-For-Hire Operation Linke By Lookout Published: 2026-04-08 ยท Archived: 2026-05-07 02:15:59 UTC treasuresland[.]cc clubline[.]cc totpro[.]app store[.]totpro[.]app static[.]totpro[.]app download[.]totpro[.]app imtok[.]io device-update[.]imtok[.]io static[.]newupdate[.]app store[.]newupdate[.]app newupdate[.]app download[.]newupdate[.]app xk[.]linedata[.]sbs test-sale[.]linedata[.]sbs mail[.]linedata[.]sbs linedata[.]sbs idms-manage-on[.]linedata[.]sbs manage-facetimeidms[.]datastatistics[.]nl mail[.]datastatistics[.]nl idms-mng-rec[.]datastatistics[.]nl datastatistics[.]nl d9[.]datastatistics[.]nl concejwkfih9ghksjdfsdf[.]datastatistics[.]nl nb[.]com-ar[.]nl mng-info-doc-mf[.]com-ar[.]nl mng-en[.]com-ar[.]nl mail[.]com-ar[.]nl join-call-ms-team[.]com-ar[.]nl isupport[.]com-ar[.]nl imange[.]com-ar[.]nl imanage[.]com-ar[.]nl drive-mofa-gov-bh[.]com-ar[.]nl com-ar[.]nl qq[.]mfadata[.]cc ms-call-manage[.]mfadata[.]cc mng-rec-mofa-govbh[.]mfadata[.]cc mfadata[.]cc mail[.]mfadata[.]cc id-mng-en[.]mfadata[.]cc condfkdsf34ihfsdf[.]mfadata[.]cc update-release-version-for-android[.]ai-ae[.]io totok-pro[.]ai-ae[.]io test[.]ai-ae[.]io temple-university-zoom-meeting[.]ai-ae[.]io pro-myvpn[.]ai-ae[.]io mail[.]ai-ae[.]io join-secure-call[.]ai-ae[.]io join-cll-secure-wt[.]ai-ae[.]io https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 1 of 26 jn[.]ai-ae[.]io download[.]ai-ae[.]io download-botim-pro[.]ai-ae[.]io botim[.]ai-ae[.]io ai-ae[.]io mail[.]id-us[.]cc id-us[.]cc apple[.]id-us[.]cc id-ac[.]us re-acc[.]cc test[.]signal-help[.]org signal-help[.]org mail[.]signal-help[.]org connect-signal[.]id-ar[.]ca account-validation-required[.]ct[.]ws test[.]en-info[.]live stg[.]en-info[.]live staging[.]en-info[.]live secure[.]en-info[.]live qurcxlny[.]en-info[.]live qa[.]en-info[.]live new[.]en-info[.]live marketing[.]en-info[.]live m[.]en-info[.]live link-signal-org[.]en-info[.]live landings[.]en-info[.]live join-teams[.]en-info[.]live ggdkowww[.]testh[.]en-info[.]live dev[.]en-info[.]live demo[.]en-info[.]live c7a4603c-4442-4001-967e-70797b1143e1[.]en-info[.]live assets[.]en-info[.]live app[.]en-info[.]live api[.]en-info[.]live antrxyke[.]en-info[.]live admin[.]en-info[.]live 978c6bd2-fcba-4758-917e-dc6298b61632[.]en-info[.]live3e8ce93b-34eb-4d31-9243- 4481ffb98cd3[.]en-info[.]live web[.]en-info[.]live vrsompac[.]en-info[.]live v2[.]en-info[.]live v1[.]en-info[.]live uat[.]en-info[.]live tgyoewww[.]rev-auth-num[.]en-info[.]live wegrow[.]ecomservices[.]cc mail[.]ecomservices[.]cc jfhwedkas[.]ecomservices[.]cc ecomservices[.]cc test[.]id-ar[.]org mail[.]id-ar[.]org lnkprtl[.]id-ar[.]org link-signal[.]id-ar[.]org id-ar[.]org app[.]id-ar[.]org yhtesting[.]accountservice[.]cc validate[.]accountservice[.]cc testingdhfhghd[.]accountservice[.]cc https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 2 of 26 testing[.]accountservice[.]cc review[.]accountservice[.]cc protect[.]accountservice[.]cc mail[.]accountservice[.]cc login[.]accountservice[.]cc accountservice[.]cc account-protection[.]accountservice[.]cc ms-mng[.]ac mail[.]ms-mng[.]ac dssdgsdfsdf[.]ms-mng[.]ac signal-chat[.]cc mail[.]signal-chat[.]cc mail[.]ar-me[.]io join-zoom[.]ar-me[.]io connecting[.]ar-me[.]io connect[.]ar-me[.]io ar-me[.]io verify-rev[.]ms-mng[.]ac hotel-menu[.]ms-mng[.]ac new-upl[.]signal-chat[.]cc ale-soun[.]com-en-us[.]info signal-encryption[.]en-ar[.]net mail[.]en-ar[.]net en-ar[.]net mode-rec[.]org-status[.]nl sg-mng-rec[.]datamargin[.]org rec-mng-idmsic[.]datamargin[.]org mail[.]datamargin[.]org datamargin[.]org coonect-fc-cll-rec[.]datamargin[.]org contu3r98fhdsjnksdfsdf[.]datamargin[.]org connact-ft-cll[.]datamargin[.]org rec-mng[.]ms-storedata[.]de rec-mng-mofagovbh[.]ms-storedata[.]de ms-storedata[.]de mofa-gov-bh[.]ms-storedata[.]de main-auth[.]ms-storedata[.]de mail[.]ms-storedata[.]de join-team-invitation-web-call[.]ms-stored cont3ui4dsjk43ggfh[.]ms-storedata[.]de ww12[.]web-signal[.]org web-signal[.]org mode-rec[.]web-signal[.]org mail[.]web-signal[.]org download[.]web-signal[.]org condjfh954thfdg[.]web-signal[.]org 4instalments[.]web-signal[.]org web-signal[.]org-status[.]nl web-sgnl[.]org-status[.]nl signal[.]org-status[.]nl sgnl[.]org-status[.]nl sgnl-web[.]org-status[.]nl org-status[.]nl mail[.]org-status[.]nl app-signal[.]org-status[.]nl drive-i-cloud[.]com-ar[.]me mail[.]storemydata[.]re storemydata[.]re storage-mofa-gov-bh[.]storemydata[.]re rec-ms-mof-gov-eg[.]storemydata[.]re https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 3 of 26 rec-mng-bdf-bh[.]storemydata[.]re pasword-up-date-bdf-bh[.]storemydata[.]re ms-rec[.]storemydata[.]re ms-rec-pmo-gov[.]bh[.]storemydata[.]re ms-rec-ncc-gov-bh[.]storemydata[.]re mofa-gov-bh[.]storemydata[.]re call-ms-team[.]storemydata[.]re bh[.]storemydata[.]re rec-val-info[.]lang-ar[.]me mjkg3hurho34irh3o4iruh3oir34[.]lang-ar[.]me lang-ar[.]me ft-cll[.]lang-ar[.]me update-release-version-for-android[.]com-ar[.]me support[.]com-ar[.]me manage-ms[.]com-ar[.]me mail[.]com-ar[.]me join-call-zoommeeting[.]com-ar[.]me join-call-team-meeting[.]com-ar[.]me imanage[.]com-ar[.]me icloud[.]com-ar[.]me com-ar[.]me rec-mng[.]ms-storedata[.]me ms-storedata[.]me mail[.]ms-storedata[.]me sgnl-app[.]info dash[.]sgnlapp[.]info backup[.]sgnlapp[.]info app[.]sgnlapp[.]info api[.]sgnlapp[.]info admin[.]sgnlapp[.]info account[.]sgnlapp[.]info 90e37f6a-8a3c-4d06-80c9- 5c9d7b967873[.]sgnlapp[.]info 537b8bc1-bcb2-4d23-8eab-5b830ce6e7c6[.]sgnlapp[.]info 4af34aec-0158-49cb-a696- 44c9e4d03ed2[.]sgnlapp[.]info 2fa-encryption[.]sgnlapp[.]info 1a244584-c217-4ae7-87c5- 3a77257a3f61[.]sgnlapp[.]info rwhpowebdisk[.]sgnlapp[.]info web-whatsapp[.]com-en-uk[.]info test[.]com-en-uk[.]info signin-apple[.]com-en-uk[.]info login-apple[.]com-en-uk[.]info com-en-uk[.]info call-video[.]com-en-uk[.]info big[.]com-en-uk[.]info ftpdr1[.]com-sa[.]co ftpd[.]com-sa[.]co com-sa[.]co test[.]review-ar[.]co t1[.]review-ar[.]co signin-apple[.]review-ar[.]co signin-account[.]review-ar[.]co review-ar[.]co number-appleid[.]review-ar[.]co login-live[.]review-ar[.]co login-apple[.]review-ar[.]co ids-login[.]review-ar[.]co id-login[.]review-ar[.]co https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 4 of 26 id-appleid[.]review-ar[.]co host[.]review-ar[.]co get-fil[.]review-ar[.]co get-fi1[.]review-ar[.]co c[.]review-ar[.]co b[.]review-ar[.]co b[.]c[.]review-ar[.]co a[.]review-ar[.]co a[.]b[.]review-ar[.]co a[.]b[.]c[.]review-ar[.]co sgnl-encryption-plugin[.]me-id[.]cc rev-number[.]me-id[.]cc me-id[.]cc i-mange[.]me-id[.]cc chec-res[.]me-id[.]cc henry[.]scott85[.]mail[.]ru twitch9929312[.]com-ln[.]info test-acc[.]com-ln[.]info takm[.]com-ln[.]info signin-yahoo[.]com-ln[.]info signin-live[.]com-ln[.]info remira[.]com-ln[.]info oportun[.]com-ln[.]info neww[.]com-ln[.]info new[.]com-ln[.]info natim[.]com-ln[.]info login-cloud[.]com-ln[.]info get-hot[.]com-ln[.]info get-dh1[.]com-ln[.]info ebrands[.]com-ln[.]info com-ln[.]info account-live[.]com-ln[.]info webvpn[.]mailbdf-bh[.]net vpn[.]mailbdf-bh[.]net staging[.]mailbdf-bh[.]net nhvkncpcalendars[.]mailbdf-bh[.]net app[.]mailbdf-bh[.]net adm[.]mailbdf-bh[.]net 8437ee10-9da5-44b0-897c-749b07c47f41 bh[.]net 7d89036a-0e91-426f-b629- 516286d7b053[.]mailbdf-bh[.]net 349383a5-557c-43e0-a3e8- 85ca92fc70d8[.]mailbdf-bh[.]net join-factime[.]id-me[.]io id-me[.]io connecting[.]id-me[.]io connect[.]id-me[.]io confirm-nums[.]id-me[.]io confirm-num[.]id-me[.]io appleid-apple[.]id-me[.]io auth-rev[.]ar-me[.]cc auth-rev-wi[.]ar-me[.]cc ar-me[.]cc appleid-apple[.]ar-me[.]cc alt-tyu[.]ar-me[.]cc aler78-fhgue[.]ar-me[.]cc djhudft-wd[.]ar-me[.]cc me-en[.]io mail[.]me-en[.]io https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 5 of 26 join-wa[.]me-en[.]io facetime-webs[.]me-en[.]io facetime-web[.]me-en[.]io alet-new[.]me-en[.]io grafana[.]logs[.]re sitemaps[.]en-id[.]me sitemap[.]en-id[.]me mail[.]en-id[.]me m[.]en-id[.]me icloud[.]en-id[.]me icloud[.]com[.]en-id[.]me en-id[.]me com[.]en-id[.]me appleid[.]apple[.]com[.]en-id[.]me apple[.]en-id[.]me apple[.]com[.]en-id[.]me apple-id[.]com[.]en-id[.]me verify-identity[.]me-relay[.]org verify-identity-apple[.]me-relay[.]org tg[.]me-relay[.]org test[.]me-relay[.]org new[.]me-relay[.]org mg-tg[.]me-relay[.]org members[.]me-relay[.]org me-relay[.]org mange-icl0ud[.]me-relay[.]org mail[.]me-relay[.]org join-facetime[.]me-relay[.]org gtedywww[.]api[.]me-relay[.]org dev[.]me-relay[.]org dash[.]me-relay[.]org bvkfztg[.]me-relay[.]org b5f0a8b5-d161-4d11-afde-f82b48bb5766 relay[.]org app[.]me-relay[.]org api[.]me-relay[.]org account[.]me-relay[.]org 60d22c9b-8946-4d84-b73c-3ff6610e49a1[.]me-relay[.]org5be54f27-d133-4414-ab97- a28460472e9a[.]me-relay[.]org 58352d6a-e1a4-489f-b46e-e74535bf677c relay[.]org 3aac32aa-df99-47f8-90c3-697dc9d98442[.]me-relay[.]org verify-apple[.]id-me[.]cc mail[.]id-me[.]cc id-me[.]cc eultewww[.]verify-apple[.]id-me[.]cc eulteverify-apple[.]id-me[.]cc a33d9f71-6bcd-41d3-9f7d-50a90628551f[.]id-me[.]cc74d1f32b-1098-43c1-99ae-3d1d6e14afd7[.]id-me[.]cc 027b1003-dd24-4e93-b74b-8282ff4d6586 ivqkiwebmail[.]mn-id[.]cc join-zoom-meeting[.]com-ar[.]re join-facetime[.]com-ar[.]re id-manage[.]com-ar[.]re com-ar[.]re app[.]ilability[.]net mail[.]track-portal[.]co manage-mofa-govbh[.]le-ar[.]me manage-ms[.]le-ar[.]me https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 6 of 26 join-call-zoom-meeting[.]le-ar[.]me join-call-team-meeting[.]le-ar[.]me gov-bh-mng-rec[.]le-ar[.]me auth-ms-manage[.]le-ar[.]me connecting[.]id-ar[.]cc connect[.]id-ar[.]cc confirm-num[.]id-ar[.]cc aler762b-9873bc78[.]id-ar[.]cc flowiseai[.]en-account[.]info flow[.]uat[.]en-account[.]info flow-alpha[.]en-account[.]info en-account[.]info ebmail[.]login-live[.]en-account[.]info ebmail[.]login-live-online[.]en-account[.]info ebmail[.]en-account[.]info eblogin-live[.]en-account[.]info ebdisk[.]test-id[.]en-account[.]info ebdisk[.]login-live[.]en-account[.]info ebdisk[.]en-account[.]info bi-ci[.]en-account[.]info api[.]ydtyuehugufgeygushguysgudyhg[.]e account[.]info 952cd7f5-55c2-472f-bc9d-08487ef75661[.]random[.]en-account[.]info84d4d991-f6cf-4225-b72a-0123fc2508f3[.]en-account[.]info ydtyuehugufgeygushguysgudyhg[.]en-acc wildcard[.]en-account[.]info uat[.]en-account[.]info testid[.]en-account[.]info test-id[.]en-account[.]info random[.]en-account[.]info mail[.]en-account[.]info login-live[.]en-account[.]info login-live-online[.]en-account[.]info trusted[.]app-info[.]app totok-pro[.]app-info[.]app newsonline[.]ac mail[.]newsonline[.]ac mail[.]app-info[.]app app-info[.]app uk02web-zoom[.]ar-me[.]io join-factime[.]id-ar[.]cc appleid-apple[.]id-ar[.]cc ale763873497ty73[.]id-me[.]io iga[.]gov-bh-mng-rec[.]le-ar[.]me ww12[.]com-en-us[.]me ww1[.]com-en-us[.]me test[.]com-en-us[.]me mail[.]com-en-us[.]me xsacwdc[.]totok-pro[.]ae mail[.]totok-pro[.]ae jdnfhu[.]totok-pro[.]ae download[.]totok-pro[.]ae re-ac[.]cc mzkkajh4rh3if9f3j4[.]re-ac[.]cc mng-re-conection[.]re-ac[.]cc mail[.]re-ac[.]cc loading-mng-blnk[.]re-ac[.]cc loading-cll-join-ft[.]re-ac[.]cc https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 7 of 26 signin-live[.]privacy-ar[.]com signin-ap[.]privacy-ar[.]com privacy-ar[.]com ns2[.]privacy-ar[.]com ns1[.]privacy-ar[.]com new[.]privacy-ar[.]com mail[.]privacy-ar[.]com login-yahoo[.]privacy-ar[.]com login-apple[.]privacy-ar[.]com join-zoom-meeting[.]privacy-ar[.]com fzbidxatfao[.]privacy-ar[.]com ftp[.]privacy-ar[.]com dwwbdgjdyvt[.]privacy-ar[.]com cicd[.]me-ar[.]io ci-flowise[.]me-ar[.]io beta[.]superset[.]me-ar[.]io appleid-number[.]me-ar[.]io appleid-apple[.]me-ar[.]io alpha-visualize[.]me-ar[.]io 6441056b613c32a9[.]appleid-number[.]me-ar[.]io uat[.]me-ar[.]io tess[.]me-ar[.]io superset[.]uat[.]me-ar[.]io superset[.]me-ar[.]io superset-production[.]me-ar[.]io signin-apple[.]me-ar[.]io sandbox[.]cicd[.]me-ar[.]io review-appleid[.]me-ar[.]io report-prod[.]me-ar[.]io qa-insight[.]me-ar[.]io preview-visualizations[.]me-ar[.]io ns2[.]me-ar[.]io ns1[.]me-ar[.]io neww[.]me-ar[.]io new2[.]me-ar[.]io new1[.]me-ar[.]io new[.]me-ar[.]io me-ar[.]io mail[.]me-ar[.]io login-office[.]me-ar[.]io login-apple[.]me-ar[.]io flowise[.]uat[.]me-ar[.]io emv1[.]me-ar[.]io development-flowiseai[.]me-ar[.]io encryption-sgnl-infor[.]mation[.]re drive-i-cloud-infor[.]mation[.]re review-apple[.]info-ar[.]cc nums-apple[.]info-ar[.]cc num-apple[.]info-ar[.]cc info-ar[.]cc get-mywords[.]info-ar[.]cc delivery-dhl[.]info-ar[.]cc mail[.]ilability[.]net llk4nrkl3rnlke3dl4jr30ij030ej0984jiedj04 ilability[.]net humatropeava[.]ilability[.]net d96ff356-4b58-440d-bc5c-4105f95e37da check-data-av[.]ilability[.]net ver-information[.]id-us[.]ca review-apple[.]id-us[.]ca https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 8 of 26 mail[.]id-us[.]ca id-us[.]ca bb[.]id-us[.]ca aa[.]id-us[.]ca test[.]id-en[.]net number-signal[.]id-en[.]net news-reuters-com[.]id-en[.]net news-jpost-com[.]id-en[.]net mail[.]id-en[.]net link-signal[.]id-en[.]net join-signal[.]id-en[.]net id-en[.]net connect-signal[.]id-en[.]net 2fa-signal[.]id-en[.]net wishduv[.]id-en[.]me widethh[.]id-en[.]me test[.]auth[.]id-en[.]me server[.]id-en[.]me rec-auth[.]id-en[.]me jhgjhgjg[.]id-en[.]me id-en[.]me broadcase[.]id-en[.]me auth[.]id-en[.]me auth-rev[.]id-en[.]me auth-manage[.]id-en[.]me xyz-alt[.]id-en[.]co review-apple[.]id-en[.]co nums-rev[.]id-en[.]co num-revs[.]id-en[.]co num-rev[.]id-en[.]co mail[.]id-en[.]co join-facetime[.]id-en[.]co id-en[.]co ft-revs[.]id-en[.]co ft-rev[.]id-en[.]co ft-join[.]id-en[.]co vbnm-altr[.]id-ar[.]me review-apple[.]id-ar[.]me nums-rev[.]id-ar[.]me num-rev[.]id-ar[.]me mail[.]id-ar[.]me join-facetime[.]id-ar[.]me id-ar[.]me ftp[.]id-ar[.]me ft-rev[.]id-ar[.]me ft-joins[.]id-ar[.]me ft-join[.]id-ar[.]me autoconfig[.]id-ar[.]me mail[.]en-uk[.]cc ids-ac[.]en-uk[.]cc get-too[.]en-uk[.]cc get-alr[.]en-uk[.]cc event-nottingham[.]en-uk[.]cc en-uk[.]cc confirm-id[.]en-uk[.]cc appleid[.]en-uk[.]cc api[.]en-uk[.]cc ac-id[.]en-uk[.]cc abc1[.]en-uk[.]cc abc[.]en-uk[.]cc https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 9 of 26 54864-ov[.]en-uk[.]cc test4[.]en-uk[.]cc test2[.]en-uk[.]cc test[.]en-uk[.]cc review-ids[.]en-uk[.]cc review-id[.]en-uk[.]cc review-appleid[.]en-uk[.]cc one-likeme[.]en-uk[.]cc numbers-appleid[.]en-uk[.]cc number-signin[.]en-uk[.]cc number-review[.]en-uk[.]cc number-login[.]en-uk[.]cc number-appleid[.]en-uk[.]cc manage-id[.]en-uk[.]cc parcel-information[.]en-id[.]net courier-assignment[.]en-id[.]net widjhdoijhoisudof[.]serviceinfo[.]cc shryg87uhisd[.]serviceinfo[.]cc serviceinfo[.]cc blksuy8uwhbuioysd[.]serviceinfo[.]cc alerjf7uh3ui8ys[.]serviceinfo[.]cc en-id[.]cc drive-kenza-cv-pdf[.]en-id[.]cc connecting[.]en-id[.]cc connect[.]info[.]en-id[.]cc connect-signal[.]en-id[.]cc ch-th-re[.]en-id[.]cc bltki[.]en-id[.]cc auth-subb[.]en-id[.]cc auth-rev[.]en-id[.]cc appleid-apple-com[.]en-id[.]cc al-ap-cl[.]en-id[.]cc wdki[.]en-id[.]cc sttrn[.]en-id[.]cc short[.]en-id[.]cc rstl[.]en-id[.]cc rev[.]en-id[.]cc rev-id[.]en-id[.]cc my-call-join[.]en-id[.]cc ms[.]connecting[.]en-id[.]cc ms[.]connect[.]info[.]en-id[.]cc manage-delivery[.]en-id[.]cc mail[.]en-id[.]cc log[.]rev[.]en-id[.]cc join-the-calls[.]en-id[.]cc join-the-call[.]en-id[.]cc join-teams[.]en-id[.]cc join-my-calls[.]en-id[.]cc join-facetime[.]en-id[.]cc info[.]en-id[.]cc info-team[.]en-id[.]cc gaza-report[.]en-id[.]cc facetime-apple[.]en-id[.]cc xsadasd[.]en-ar[.]co mail[.]en-ar[.]co mail-auth[.]en-ar[.]co en-ar[.]co xyz-abv[.]connect-signal[.]org mail[.]connect-signal[.]org img8732g97[.]connect-signal[.]org https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 10 of 26 connect-signal[.]org cli38798d7983[.]connect-signal[.]org autoconfig[.]lcloud[.]com-service[.]info autoconfig[.]com-service[.]info apple[.]com-service[.]info account-yahoo[.]com-service[.]info account-live[.]com-service[.]info testid[.]com-service[.]info mail[.]com-service[.]info login-cloud[.]com-service[.]info login-account[.]com-service[.]info lcloud[.]com-service[.]info icloud[.]com-service[.]info facetime-apple[.]com-service[.]info com-service[.]info assets[.]com-info[.]io apple[.]com-info[.]io app[.]com-info[.]io api[.]com-info[.]io a[.]com-info[.]io 8e968722-92c0-4944-93da-58c9ad8f7eeb info[.]io 7381d8b7-6549-4c38-8f8e-069e1c25a577[.]com-info[.]io69f65276-f9bc-40d9-9b53- c3afe3abf4fb[.]com-info[.]io sm[.]sscomusted-device-apple[.]com-info sm[.]comusted-device-apple[.]com-info[.]io sjoin-facetime[.]com-info[.]io sitemaps[.]com-info[.]io sitemap[.]com-info[.]io scomusted-device-apple[.]com-info[.]io sapple[.]com-info[.]io s[.]com-info[.]io rev-num-apl[.]com-info[.]io maisqsssssm[.]sverify-apple[.]com-info[.] mail[.]com-info[.]io m[.]verify-apple[.]com-info[.]io m[.]trusted-device-apple[.]com-info[.]io m[.]sverify-apple[.]com-info[.]io m[.]ssverify-apple[.]com-info[.]io m[.]ssssverify-apple[.]com-info[.]io m[.]sssssverify-apple[.]com-info[.]io m[.]ssssssverify-apple[.]com-info[.]io m[.]sssssssverify-apple[.]com-info[.]io m[.]sssssssssverify-apple[.]com-info[.]io m[.]sscomusted-device-apple[.]com-info[.]io m[.]scomusted-device-apple[.]com-info[.] m[.]sapple[.]com-info[.]io m[.]comusted-device-apple[.]com-info[.]io logmnzth[.]com-info[.]io jyitmsapple[.]com-info[.]io join-facetime[.]com-info[.]io ixcmym[.]sapple[.]com-info[.]io irthhm[.]scomusted-device-apple[.]com-info[.]io icloud-apple[.]com-info[.]io holykssm[.]trusted-device-apple[.]com-in gmflqsssssssssverify-apple[.]com-info[.]io ft-num-apl[.]com-info[.]io ff050e03-e7c3-44f0-9366-b7b739da0d9e[ https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 11 of 26 f368b859-dc30-448c-9587-44879cf4a730[.]com-info[.]io dev[.]com-info[.]io demo[.]com-info[.]io cpjkdafdrw[.]com-info[.]io comusted-device-apple[.]com-info[.]io com-info[.]io blog[.]com-info[.]io b4622d8c-9d06-4fb2-b02e-af37631d5365[.]com-info[.]io verify-apple[.]com-info[.]io ufuzzssssm[.]verify-apple[.]com-info[.]io trusted-device-apple[.]com-info[.]io test[.]com-info[.]io sverify-apple[.]com-info[.]io staging[.]com-info[.]io ssverify-apple[.]com-info[.]io sssverify-apple[.]com-info[.]io ssssverify-apple[.]com-info[.]io sssssverify-apple[.]com-info[.]io ssssssverify-apple[.]com-info[.]io ssssssssverify-apple[.]com-info[.]io sssssssssverify-apple[.]com-info[.]io sssssssverify-apple[.]com-info[.]io ssssssssm[.]verify-apple[.]com-info[.]io ssssssm[.]verify-apple[.]com-info[.]io ssssssm[.]sverify-apple[.]com-info[.]io ssssssm[.]ssverify-apple[.]com-info[.]io sssssm[.]verify-apple[.]com-info[.]io sssssm[.]sverify-apple[.]com-info[.]io sssssm[.]ssverify-apple[.]com-info[.]io ssssm[.]verify-apple[.]com-info[.]io ssssm[.]sverify-apple[.]com-info[.]io ssssm[.]ssverify-apple[.]com-info[.]io sssm[.]verify-apple[.]com-info[.]io sssm[.]trusted-device-apple[.]com-info[.]io sssm[.]sverify-apple[.]com-info[.]io sssm[.]ssverify-apple[.]com-info[.]io sssm[.]ssssverify-apple[.]com-info[.]io ssm[.]verify-apple[.]com-info[.]io ssm[.]trusted-device-apple[.]com-info[.]io ssm[.]sverify-apple[.]com-info[.]io ssm[.]ssverify-apple[.]com-info[.]io ssm[.]ssssverify-apple[.]com-info[.]io ssm[.]sscomusted-device-apple[.]com-info[.]io ssm[.]comusted-device-apple[.]com-info[.]io sslhjsssssverify-apple[.]com-info[.]io sscomusted-device-apple[.]com-info[.]io ssapple[.]com-info[.]io sm[.]verify-apple[.]com-info[.]io sm[.]trusted-device-apple[.]com-info[.]io sm[.]sverify-apple[.]com-info[.]io sm[.]ssverify-apple[.]com-info[.]io sm[.]ssssverify-apple[.]com-info[.]io sm[.]sssssssssverify-apple[.]com-info[.]io zoom[.]com-info[.]io zjzmfsssm[.]ssssverify-apple[.]com-info[.]io zhsexssssssm[.]ssverify-apple[.]com-info[.]io xnwhrsssssm[.]ssverify-apple[.]com-info[ https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 12 of 26 com-en-uk[.]co com-remove[.]info com-ar-me[.]info ns2[.]com-en[.]cc ns1[.]com-en[.]cc mail[.]com-en[.]cc login-apple[.]com-en[.]cc ftp[.]com-en[.]cc exmo[.]com-en[.]cc com-en[.]cc appleid-apple[.]com-en[.]cc m[.]number-appleid[.]com-auth[.]cc login-appleid[.]com-auth[.]cc login-apple[.]com-auth[.]cc ids-appleid[.]com-auth[.]cc id-appleid[.]com-auth[.]cc ftp[.]com-auth[.]cc com-auth[.]cc check-alt[.]com-auth[.]cc appleid-number[.]com-auth[.]cc appleid-apple[.]com-auth[.]cc apple[.]com-auth[.]cc tyskw-appleid[.]com-auth[.]cc signin-appleid[.]com-auth[.]cc review-appleid[.]com-auth[.]cc numbers-appleid[.]com-auth[.]cc number-appleid[.]com-auth[.]cc neww[.]com-auth[.]cc new[.]com-auth[.]cc mail[.]com-auth[.]cc review-appleid[.]com-ar[.]io new[.]com-ar[.]io mail[.]com-ar[.]io com-ar[.]io appleid-number[.]com-ar[.]io appleid-apple[.]com-ar[.]io reportsuscripcion[.]apple[.]com-ar[.]info reportproblem[.]apple[.]com-ar[.]info mail[.]com-ar[.]info lcloud[.]com-ar[.]info iforgot-applehelp[.]com-ar[.]info icloud[.]com-ar[.]info com-ar[.]info appleid[.]com-ar[.]info appleid-apple[.]com-ar[.]info apple[.]com-ar[.]info dash[.]com-ae[.]org crm[.]com-ae[.]org com-ae[.]org clients[.]com-ae[.]org client[.]com-ae[.]org checkdata[.]com-ae[.]org blog[.]com-ae[.]org backend[.]com-ae[.]org app[.]com-ae[.]org api[.]com-ae[.]org ae3eb0c0-ab31-4ea7-a29c-c5886e35721a admin[.]com-ae[.]org account[.]com-ae[.]org 99e27236-9c0a-4c7f-b114-f181d0c00173 https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 13 of 26 76194fdc-fde2-4128-b4e5-6e185e89d224[.]com-ae[.]org 43e92d22-0923-4424-8e4c-6f1aa0397af4[.]com-ae[.]org zpciomail[.]com-ae[.]org webtest[.]com-ae[.]org testy[.]com-ae[.]org testing[.]com-ae[.]org test[.]com-ae[.]org t-mobile[.]com-ae[.]org stg[.]com-ae[.]org staging[.]com-ae[.]org stage[.]com-ae[.]org portal[.]com-ae[.]org old[.]com-ae[.]org new[.]com-ae[.]org members[.]com-ae[.]org mail[.]com-ae[.]org lhyjkqcm[.]com-ae[.]org kb[.]com-ae[.]org join-call-facetime[.]com-ae[.]org ipnzrwww[.]join-call-facetime[.]com-ae[.]org f745f976-7714-445e-abf6-66fc1ab0a7bb[ f127d70b-1bcf-4915-9868-768000ef915d[.]com-ae[.]org encryption-signal[.]com-ae[.]org dsbjbjhb5teufyh85ybf74fbufb7tuvfbf[.]co docs[.]com-ae[.]org dev[.]com-ae[.]org demo[.]com-ae[.]org dashboard[.]com-ae[.]org zoom-meet[.]ar-me[.]cc tehisdjsd[.]ar-info[.]co rec[.]ar-info[.]co mail[.]ar-info[.]co connect[.]ar-info[.]co auth[.]rec[.]ar-info[.]co auth[.]connect[.]ar-info[.]co auth-rev[.]ar-info[.]co ar-info[.]co vhpniqnpchepkxqbsfcjcpanel[.]ar-id[.]co testing[.]ar-id[.]co test[.]ar-id[.]co staging[.]ar-id[.]co rxuoiwebmail[.]ar-id[.]co qnpchepkxqbsfcjcpanel[.]ar-id[.]co portal[.]ar-id[.]co omwtrgap[.]ar-id[.]co kswqfmry[.]ar-id[.]co docs[.]ar-id[.]co demo[.]ar-id[.]co dashboard[.]ar-id[.]co confirm-your-identity[.]ar-id[.]co ck02-fb1ef20944-89b8cbf0[.]ar-id[.]co beta[.]ar-id[.]co backend[.]ar-id[.]co b0d782ca-68ae-4ea6-adea-db30255b4786 asset[.]ar-id[.]co app[.]ar-id[.]co api[.]ar-id[.]co https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 14 of 26 admin[.]ar-id[.]co 53aef03b-0a86-4497-8c1e-23cfcd9f96e5[.]ar-id[.]co verify-id[.]acc-mn[.]info trusted-device-apple[.]acc-mn[.]info test[.]acc-mn[.]info sgnl-link-device[.]acc-mn[.]info mail[.]acc-mn[.]info join-facetime[.]acc-mn[.]info imanage-rev[.]acc-mn[.]info icloudrive[.]acc-mn[.]info ft-rev[.]acc-mn[.]info acc-mn[.]info 734yhihudnsifsdf[.]acc-mn[.]info hi[.]ac-us[.]cc hello[.]ac-us[.]cc appleid-verify[.]ac-us[.]cc ac-us[.]cc testsjdfhksdhfksdf[.]botim-app[.]pro mail[.]botim-app[.]pro download[.]botim-app[.]pro botim-app[.]pro wtzdscpanel[.]logs[.]re sgnl-org[.]logs[.]re rv-mn-en[.]logs[.]re nhcpowtzdscpanel[.]logs[.]re mail[.]logs[.]re logs[.]re kkkwazhbwmwww[.]ft-cll[.]logs[.]re join-facetime[.]logs[.]re imanage[.]logs[.]re hostmaster[.]logs[.]re haven[.]logs[.]re ft-cll[.]logs[.]re document-cloud[.]logs[.]re dayxfgtb[.]logs[.]re coj599r8re8c98r9c99c9[.]logs[.]re bf4398aa-a6c5-4a80-bfda-68132f32059d[.]logs[.]re 2fa-sgnl[.]logs[.]re idms-mng-rec[.]fullrestores[.]re mail[.]datarestores[.]nl idms-sgnl-mn[.]datarestores[.]nl idms-rec[.]datarestores[.]nl idms-mng-rec[.]datarestores[.]nl idms-ft-cll-mng[.]datarestores[.]nl ft-cll-2wefhf34iojofj0ef98h98sd[.]datares control394sdsdf[.]datarestores[.]nl datarestores[.]nl zoom-uk[.]ar-me[.]cc theguardian[.]ar-me[.]cc signin-guardian[.]ar-me[.]cc shrtrn[.]ar-me[.]cc shrt-ap[.]ar-me[.]cc review-apple[.]ar-me[.]cc resmhcx57[.]ar-me[.]cc number-cof[.]ar-me[.]cc number-co[.]ar-me[.]cc mail[.]ar-me[.]cc https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 15 of 26 join[.]ar-me[.]cc join-wd-facetime[.]ar-me[.]cc join-us[.]ar-me[.]cc join-facetime[.]ar-me[.]cc join-face[.]ar-me[.]cc ft-wd[.]ar-me[.]cc ft-blk[.]ar-me[.]cc connecting[.]ar-me[.]cc connect[.]ar-me[.]cc confirm-number[.]ar-me[.]cc number[.]id-en[.]io appleid-apple[.]id-en[.]io webs-ft[.]com-me[.]io web-ft[.]com-me[.]io pdf-cloud[.]com-me[.]io number[.]com-me[.]io mail[.]com-me[.]io com-me[.]io appleid-apple[.]com-me[.]io alet-uebu[.]com-me[.]io manage-iservices[.]en-ir[.]org mail[.]en-ir[.]org join-call[.]bot[.]en-ir[.]org imanage[.]en-ir[.]org encryption-sgnl[.]en-ir[.]org bot[.]en-ir[.]org 2fa-sgnl[.]en-ir[.]org num-wid[.]me-info[.]io num-blk[.]me-info[.]io me-info[.]io mail[.]me-info[.]io join-facetime[.]me-info[.]io ft-wid[.]me-info[.]io ft-blk[.]me-info[.]io appleid-apple[.]me-info[.]io ale-soun[.]me-info[.]io zoom-meet[.]com-cc[.]io uk05web-zoom[.]com-cc[.]io mail[.]com-cc[.]io facetime-nums[.]com-cc[.]io facetime-num[.]com-cc[.]io com-cc[.]io aler-new[.]com-cc[.]io mng-num-blk[.]ar-id[.]cc mail[.]ar-id[.]cc kajkjsa[.]j34idf[.]ar-id[.]cc j34idf[.]ar-id[.]cc ft-cll-join[.]ar-id[.]cc encrytpion-sgnl[.]ar-id[.]cc encryption-sgnl[.]ar-id[.]cc ar-id[.]cc appleids-trusted-number[.]ar-id[.]cc appleids-manage[.]ar-id[.]cc sgnl[.]org-ar[.]net org-ar[.]net num-blk[.]org-ar[.]net mail[.]org-ar[.]net identity[.]org-ar[.]net id-apples-mange[.]org-ar[.]net hydtr[.]org-ar[.]net https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 16 of 26 encryption-sgnl[.]org-ar[.]net dhl[.]org-ar[.]net call-facetime[.]org-ar[.]net appleids[.]org-ar[.]net appleids-truted-number[.]org-ar[.]net yqgsfstaging[.]ale-soun[.]com-en-us[.]info wow-way[.]com-en-us[.]info meeting[.]zm-me[.]co mail[.]host[.]zm-me[.]co autoconfig[.]host[.]zm-me[.]co sky-security[.]id-ar[.]ca shghgwhasd[.]id-ar[.]ca id-ar[.]ca untvhjoin-call-facetime[.]relay-ar[.]co tication[.]net mail[.]cc-ar[.]co cc-ar[.]co review-apple[.]id-ar[.]cc ress[.]id-ar[.]cc num-revw[.]id-ar[.]cc num-rev[.]id-ar[.]cc mail[.]id-ar[.]cc join-facetime[.]id-ar[.]cc id-ar[.]cc ft-revw[.]id-ar[.]cc ft-rev[.]id-ar[.]cc abde-alt[.]id-ar[.]cc abcdef[.]ress[.]id-ar[.]cc protect-bdf-bh[.]owa365[.]org owa365[.]org mail[.]owa365[.]org mail-bdf-bh[.]owa365[.]org test[.]regularsports[.]org sdfgfdg[.]regularsports[.]org myftasdffg[.]regularsports[.]org mail[.]regularsports[.]org dev[.]regularsports[.]org regularsports[.]org mpl[.]jcha[.]com-us[.]io mail[.]com-us[.]io join-faetime[.]com-us[.]io join-facetime[.]com-us[.]io jcha[.]com-us[.]io hgjsdfsdf[.]com-us[.]io com-us[.]io call-ft-connect[.]com-us[.]io test[.]final-restore[.]re rec-mng-idmss[.]final-restore[.]re rec-mng-bdf-gov-bh[.]final-restore[.]re rec-check[.]final-restore[.]re rec-check-mng[.]final-restore[.]re ms-rec-mng[.]final-restore[.]re mng-rec[.]final-restore[.]re mng-rec-mofa-bh[.]final-restore[.]re mng-rec-idmsgnls[.]final-restore[.]re mail[.]final-restore[.]re ft-cll-idmss-rec-mng[.]final-restore[.]re final-restore[.]re file-check[.]final-restore[.]re controlslsdf9h9s93t54[.]final-restore[.]re https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 17 of 26 totokpro[.]app-info[.]me totok-pro[.]app-info[.]me tg-secure-call[.]app-info[.]me rec-cal-tg[.]app-info[.]me mail[.]app-info[.]me join-securecall-tg[.]app-info[.]me app-info[.]me 2fa-authentication[.]sgnlapp[.]info verify-mofa-gov-bh[.]le-ar[.]me verify-bdf[.]le-ar[.]me verify-app[.]le-ar[.]me mail[.]le-ar[.]me le-ar[.]me join-facetime-call[.]le-ar[.]me drive-cloud-app[.]le-ar[.]me num-auth-wtid[.]me-info[.]cc num-auth-blk[.]me-info[.]cc mail[.]me-info[.]cc con-ft-cll[.]me-info[.]cc signal[.]org-ar[.]me org-ar[.]me mail[.]org-ar[.]me link-device-signal[.]org-ar[.]me encryption-key-plugin-signal[.]org-ar[.]m xbwzeasg[.]sgnlapp[.]info web[.]sgnlapp[.]info v2[.]sgnlapp[.]info v1[.]sgnlapp[.]info uat[.]sgnlapp[.]info testing[.]sgnlapp[.]info test[.]sgnlapp[.]info stg[.]sgnlapp[.]info staging[.]sgnlapp[.]info stage[.]sgnlapp[.]info secure[.]sgnlapp[.]info rustore[.]sgnlapp[.]info qa[.]sgnlapp[.]info pxemgvuslqassets[.]sgnlapp[.]info portal[.]sgnlapp[.]info new[.]sgnlapp[.]info marketing[.]sgnlapp[.]info mailer[.]sgnlapp[.]info mail[.]sgnlapp[.]info encryption[.]sgnlapp[.]info encryption-plugin[.]sgnlapp[.]info encryption-plug-in[.]sgnlapp[.]info docs[.]sgnlapp[.]info dev[.]sgnlapp[.]info demo[.]sgnlapp[.]info dashboard[.]sgnlapp[.]info mail[.]connect-signal[.]me mail[.]signal-account[.]org link[.]signal-account[.]org dgsgsd[.]signal-account[.]org call[.]signal-account[.]org num-signal-org[.]en-info[.]co mail[.]en-info[.]co link-signal-org[.]en-info[.]co en-info[.]co totokupdate[.]ai https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 18 of 26 totok-shop[.]com totok-pro[.]io totok-pro[.]app store[.]latestversion[.]ai store[.]appupdate[.]ai static[.]appupdate[.]ai spiralkey[.]co signal[.]ct[.]ws signal-encryption-service[.]ct[.]ws noblico[.]net mail[.]app-totok[.]io latestversion[.]ai download[.]appupdate[.]ai appupdate[.]ai app-totok[.]io ai-messenger[.]co review-apple[.]ids-ar[.]co num-revw[.]ids-ar[.]co num-rev[.]ids-ar[.]co mail[.]ids-ar[.]co join-wa[.]ids-ar[.]co join-facetime[.]ids-ar[.]co ftp[.]ids-ar[.]co ft-revw[.]ids-ar[.]co ft-rev[.]ids-ar[.]co abcde-ress[.]ids-ar[.]co abc-newalt[.]ids-ar[.]co ids-ar[.]co svr-drive[.]com ssl[.]share[.]svr-drive[.]com ssl[.]google[.]svr-drive[.]com signaler-pa[.]share[.]svr-drive[.]com signaler-pa[.]google[.]svr-drive[.]com share[.]svr-drive[.]com securitydomain-pa[.]share[.]svr-drive[.]com securitydomain-pa[.]google[.]svr-drive[.]c play[.]share[.]svr-drive[.]com play[.]google[.]svr-drive[.]com optimizationguide-pa[.]share[.]svr-drive[. optimizationguide-pa[.]google[.]svr-drive[.]com ogs[.]share[.]svr-drive[.]com ogs[.]google[.]svr-drive[.]com myaccount[.]share[.]svr-drive[.]com myaccount[.]google[.]svr-drive[.]com gstatic-fonts[.]share[.]svr-drive[.]com gstatic-fonts[.]google[.]svr-drive[.]com googleapis-fonts[.]share[.]svr-drive[.]com googleapis-fonts[.]google[.]svr-drive[.]co google[.]svr-drive[.]com clients6[.]share[.]svr-drive[.]com clients6[.]google[.]svr-drive[.]com clients5[.]share[.]svr-drive[.]com clients5[.]google[.]svr-drive[.]com clients4[.]share[.]svr-drive[.]com clients4[.]google[.]svr-drive[.]com clients3[.]share[.]svr-drive[.]com clients3[.]google[.]svr-drive[.]com clients2[.]share[.]svr-drive[.]com clients2[.]google[.]svr-drive[.]com clients1[.]share[.]svr-drive[.]com https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 19 of 26 clients1[.]google[.]svr-drive[.]com clients[.]share[.]svr-drive[.]com clients[.]google[.]svr-drive[.]com apis[.]share[.]svr-drive[.]com apis[.]google[.]svr-drive[.]com android[.]clients[.]share[.]svr-drive[.]com android[.]clients[.]google[.]svr-drive[.]com accounts[.]share[.]svr-drive[.]com accounts[.]google[.]svr-drive[.]com accountcapabilities-pa[.]share[.]svr-drive[.]com join-facetime[.]org-ar[.]net join-facetime[.]me-en[.]io join-facetime[.]id-me[.]cc join-facetime[.]en-ir[.]org join-facetime[.]com-me[.]io join-facetime[.]com-cc[.]io join-facetime[.]ar-id[.]cc call-join-facetime[.]ar-id[.]cc w[.]entity-me[.]online uat[.]entity-me[.]online staging[.]entity-me[.]online new[.]entity-me[.]online mail[.]entity-me[.]online jkhjkrkwejrhjsfhkjshrtre[.]entity-me[.]onl fjrbelnjkgl4ntglnfk4rnlkednfoikrnfiornogb[.]entity-me[.]online entity-me[.]online dev[.]entity-me[.]online call-ft-join-id[.]entity-me[.]online bmail[.]entity-me[.]online bdisk[.]entity-me[.]online backup[.]entity-me[.]online asdfkljlkdsdd[.]entity-me[.]online app[.]entity-me[.]online api[.]entity-me[.]online aging[.]entity-me[.]online review-appleid[.]me-en[.]cc number-appleid[.]me-en[.]cc new[.]me-en[.]cc mng-info[.]me-en[.]cc mng-id-val[.]me-en[.]cc mn-id[.]me-en[.]cc me-en[.]cc manage[.]me-en[.]cc manage-id[.]me-en[.]cc mamsdjlahdiu39r73y93y934r79r[.]me-en mail[.]me-en[.]cc join-facetime[.]me-en[.]cc id-validate[.]me-en[.]cc id-mana-ge[.]me-en[.]cc ftp[.]me-en[.]cc ft-cll[.]me-en[.]cc 2fa-mange[.]me-en[.]cc 2fa-manage[.]me-en[.]cc signin-office[.]id-ar[.]ca verify-apple-account-val[.]idate[.]me sgnl-2fa-authentication[.]idate[.]me secure-val[.]idate[.]me mta-sts[.]mail[.]idate[.]me mail[.]idate[.]me lalnrctonpao[.]idate[.]me https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 20 of 26 identity-vel[.]idate[.]me identity-val[.]idate[.]me idate[.]me hostmaster[.]idate[.]me drive-icloud-val[.]idate[.]me dhl-delivery-verification[.]idate[.]me data-val[.]idate[.]me conjhgfkjrg3jk4rgk3jfskjd[.]idate[.]me alumni-columbia-edu-val[.]idate[.]me sdfhsfdj[.]com-ae[.]net mail[.]com-ae[.]net com-ae[.]net android[.]com-ae[.]net zm-web[.]id-ar[.]ca xyz-alt[.]id-ar[.]ca us05web-join-zoom-meeting[.]id-ar[.]ca testt[.]id-ar[.]ca test[.]id-ar[.]ca signal-link-call[.]id-ar[.]ca rin-ss[.]id-ar[.]ca pending-office[.]id-ar[.]ca pdf-sdsg8347gyeduy49yfhf6437gfyrf436[.]id-ar[.]ca numb[.]id-ar[.]ca num-signal[.]id-ar[.]ca mail[.]id-ar[.]ca login-office[.]id-ar[.]ca login-office-validate-identity[.]id-ar[.]ca login-office-auth[.]id-ar[.]ca login-mofa-office[.]id-ar[.]ca link-signal[.]id-ar[.]ca example[.]id-ar[.]ca call-signal[.]id-ar[.]ca 2[.]id-ar[.]ca st-prtl[.]hm-en[.]cc mail[.]hm-en[.]cc m-s-info[.]hm-en[.]cc hot-acc-mail[.]hm-en[.]cc hm-en[.]cc dfdsgsdgsfg[.]hm-en[.]cc connect-signal[.]hm-en[.]cc conne[.]hm-en[.]cc acc-hot-mail[.]hm-en[.]cc rec-mng-infor[.]mation-ae[.]re permanent-infor[.]mation-ae[.]re mng-infor[.]mation-ae[.]re mation-ae[.]re mail[.]mation-ae[.]re sdgsdgsgfdgsdfhdfhdfh[.]ht-id[.]me msoft[.]ht-id[.]me mail[.]ht-id[.]me ht-id[.]me auth-rev[.]ht-id[.]me testing[.]me-mng[.]cc sdfgsdf[.]me-mng[.]cc me-mng[.]cc mail[.]me-mng[.]cc ft-cll[.]me-mng[.]cc https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 21 of 26 blnk-num-mng[.]me-mng[.]cc untvhwww[.]join-call-facetime[.]relay-ar[.]co security[.]icloud[.]relay-ar[.]co relay-ar[.]co mail[.]relay-ar[.]co kgpcaelw[.]relay-ar[.]co join-call-facetime[.]relay-ar[.]co icloud[.]relay-ar[.]co enfiaqkw[.]relay-ar[.]co dev[.]relay-ar[.]co demo[.]relay-ar[.]co asdf[.]relay-ar[.]co app[.]relay-ar[.]co api[.]relay-ar[.]co admin[.]relay-ar[.]co update-nums[.]id-ar[.]co update-num[.]id-ar[.]co testid[.]new[.]id-ar[.]co review-apple[.]id-ar[.]co pdf-icloud[.]id-ar[.]co nums-rev[.]id-ar[.]co num-wrevs[.]id-ar[.]co num-revs[.]id-ar[.]co num-rev[.]id-ar[.]co new[.]id-ar[.]co mail[.]id-ar[.]co join-facetime[.]id-ar[.]co id-ar[.]co ftp[.]id-ar[.]co abcde-res[.]id-ar[.]co abc-ninealt[.]id-ar[.]co srv648[.]co-en[.]app srv1[.]srv648[.]co-en[.]app signin-id[.]co-en[.]app signin-account[.]co-en[.]app number-ids[.]co-en[.]app number-id[.]co-en[.]app number-appleid[.]co-en[.]app mail[.]srv1[.]srv648[.]co-en[.]app mail[.]co-en[.]app jd930iojfhis67349x[.]co-en[.]app id[.]co-en[.]app id-test[.]co-en[.]app ftp[.]co-en[.]app co-en[.]app res-all[.]en-me[.]cc manage-id[.]en-me[.]cc mail[.]en-me[.]cc join-test[.]en-me[.]cc join-facetime[.]en-me[.]cc id[.]en-me[.]cc icloud[.]en-me[.]cc icaresupport-ap[.]en-me[.]cc ftp[.]en-me[.]cc ft-testt[.]id[.]en-me[.]cc ft-srt-id[.]en-me[.]cc ft-rec-id[.]en-me[.]cc ft-fwa-id[.]en-me[.]cc ft-fce-id[.]en-me[.]cc ft-fac-id[.]en-me[.]cc https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 22 of 26 en-me[.]cc docs-icloudrive-file[.]en-me[.]cc connect-signal[.]en-me[.]cc apg-cps[.]en-me[.]cc update[.]totokapp[.]info yhjdshisdg[.]en-info[.]live verify-login[.]en-info[.]live totokapp[.]info testh[.]en-info[.]live shrtstulytdvs[.]en-info[.]live rev-auth-num[.]en-info[.]live mail[.]totokapp[.]info mail[.]en-info[.]live login-security[.]en-info[.]live htkdfsdf[.]en-info[.]live en-info[.]live egbfdg545rgdfg[.]en-info[.]live webtest[.]app-care[.]cc web[.]app-care[.]cc web-info[.]app-care[.]cc testweb[.]app-care[.]cc test[.]web[.]app-care[.]cc test[.]app-care[.]cc page[.]app-care[.]cc mail[.]app-care[.]cc link[.]app-care[.]cc app-care[.]cc msnsge[.]ids-io[.]me mng-ml-bdf-bh[.]ids-io[.]me manage[.]ids-io[.]me mail[.]ids-io[.]me mail-bdf-bh[.]ids-io[.]me join-facetime[.]ids-io[.]me ids-io[.]me ft-cll-rec[.]ids-io[.]me credentials-checking[.]ids-io[.]me cloude-manage[.]ids-io[.]me cloud-manage[.]ids-io[.]me zoom-meet[.]me-ar[.]cc web-wa[.]me-ar[.]cc uk05web-zoom[.]me-ar[.]cc number[.]me-ar[.]cc me-ar[.]cc mail[.]me-ar[.]cc join-telegram[.]me-ar[.]cc join-facetimes[.]me-ar[.]cc join-facetime[.]me-ar[.]cc facetime-nums[.]me-ar[.]cc facetime-num[.]me-ar[.]cc facetime-join[.]me-ar[.]cc appleid-apple[.]me-ar[.]cc aler-new[.]me-ar[.]cc aler-get[.]me-ar[.]cc owa365[.]cc mail[.]owa365[.]cc mail-bdf-bh[.]owa365[.]cc mng-ma-il[.]owa365[.]cc verify-icloud[.]en-id[.]net trusted-device-apple[.]en-id[.]net tracking-dhl[.]en-id[.]net https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 23 of 26 sgnl-2fa-manage[.]en-id[.]net mail[.]en-id[.]net join-facetime[.]en-id[.]net en-id[.]net confirm-your-identity[.]en-id[.]net checkdata[.]en-id[.]net call-ft-connect[.]en-id[.]net review-app-id[.]mn-id[.]cc mn-id[.]cc id-manage[.]mn-id[.]cc ft-rec[.]mn-id[.]cc dpa[.]mn-id[.]cc c0ac71c4-276f-46a4-a7fe-f062c40b47e6[.]mn-id[.]cc963d2ae3-9d60-4704-8262- 5854b6c02d29[.]mn-id[.]cc 67f34c48-a901-44f1-af9d-81c80b03b5ea[ tkmbijoin-meet[.]mn-id[.]cc sitemaps[.]mn-id[.]cc sitemap[.]mn-id[.]cc rin-zm[.]mn-id[.]cc resufg-reg[.]mn-id[.]cc mng[.]mn-id[.]cc mail[.]mn-id[.]cc join-meeting-zm[.]mn-id[.]cc join-facetime[.]mn-id[.]cc id[.]mng[.]mn-id[.]cc id-mnge[.]mn-id[.]cc gahpkwww[.]join-meet[.]mn-id[.]cc ft-mng[.]mn-id[.]cc dps[.]mn-id[.]cc dos[.]mn-id[.]cc dfsdfsdgretgf65sdg[.]mn-id[.]cc 4f66072b-2276-4136-acaa-a1a88e294e4f[.]mn-id[.]cc ft-rev[.]mn-id[.]cc mail[.]ar-id[.]co ar-id[.]co accounts-apple[.]ar-id[.]co zocp[.]zm-me[.]co test[.]zm-me[.]co signal-connect[.]zm-me[.]co s-portel[.]zm-me[.]co mail[.]zm-me[.]co join[.]meeting[.]zm-me[.]co host[.]zm-me[.]co connect-signal[.]zm-me[.]co telegram[.]com-en[.]io secure-signal[.]com-en[.]io numbers[.]com-en[.]io number[.]com-en[.]io mail[.]com-en[.]io join[.]facetime[.]com-en[.]io join-telegram[.]com-en[.]io join-fts[.]com-en[.]io join-ft[.]com-en[.]io join-facetime[.]com-en[.]io id-apple[.]com-en[.]io facetime[.]com-en[.]io com-en[.]io https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 24 of 26 appleid-apple[.]com-en[.]io alr-res[.]com-en[.]io rec-id-check[.]ar-me[.]co mngcontrol[.]ar-me[.]co mail[.]ar-me[.]co join-face-time-service[.]ar-me[.]co id-rec-check[.]ar-me[.]co gsyastf[.]ar-me[.]co d-df-dfd-sddgfssdf[.]ar-me[.]co auth-privacy[..]ar-me[.]co ar-me[.]co manage[.]ac-im[.]cc mail[.]ac-im[.]cc facpl[.]ac-im[.]cc fac[.]ac-im[.]cc cpsl-p[.]ac-im[.]cc ac-im[.]cc 98798hnuyf8diufsd[.]ac-im[.]cc zo-ref[.]mn-id[.]cc join-meet[.]mn-id[.]cc ft-rev-id[.]en-me[.]cc ft-faw-id[.]en-me[.]cc zoomandfghu3grufe[.]id-ar[.]net verify-isupport[.]id-ar[.]net us-04web-zoom[.]id-ar[.]net sgnl-link-device[.]id-ar[.]net sgnl-2fa-authenticate[.]id-ar[.]net mn-rcv-en[.]id-ar[.]net mail[.]id-ar[.]net join-facetime[.]id-ar[.]net id-ar[.]net icloudrive[.]id-ar[.]net dhl-delivery-address[.]id-ar[.]net con[.]call[.]id-ar[.]net call[.]id-ar[.]net call-ft-visual[.]id-ar[.]net rv-mn-en-infor[.]mation[.]re mail[.]mation[.]re join-facetime[.]infor[.]mation[.]re ft-call-control[.]mation[.]re control-my-data[.]mation[.]re sasaf[.]mation[.]re infor[.]mation[.]re idms-rec-infor[.]mation[.]re join-facetime-call-infor[.]mation[.]re mn-rv-en-infor[.]mation[.]re join-call-facetion-infor[.]mation[.]re verify-infor[.]mation[.]re mng-rec[.]fullrestores[.]re cdshfis57945tjfkgdfgdf[.]fullrestores[.]re auth-rec-mng[.]fullrestores[.]re mail[.]fullrestores[.]re join-cll-bot-im[.]fullrestores[.]re fullrestores[.]re ft-cll-2mzkaldlwpfgg[.]fullrestores[.]re mation[.]re cntflksdlkfghdf[.]tication[.]net user-verify-authen[.]tication[.]net data-authn[.]tication[.]net join-facetime-call-authen[.]tication[.]net https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 25 of 26 delivery-verification-authen[.]tication[.]net validate-authn[.]tication[.]net mail[.]tication[.]net cjtjkj45nkejndfk3j4lkfelfwefwef[.]tication[.]net reutowprueptowue[.]tication[.]net dhl-identity-verification-authen[.]tication[ mc-4kdkf3lflj34lfjlj3l4r34r[.]tication[.]net call-ft-enc-authen[.]tication[.]net verify-mail-authn[.]tication[.]net id-en[.]io facetime-web[.]id-en[.]io join-facetime[.]id-en[.]io mail[.]id-en[.]io facetime-webs[.]id-en[.]io alert-new[.]id-en[.]io auth[.]mailbdf-bh[.]net mail[.]mailbdf-bh[.]net rec-mng[.]mailbdf-bh[.]net mailbdf-bh[.]net verify-apple[.]com-ae[.]net encryption-plug-in-signal[.]com-ae[.]net join-facetime[.]com-ae[.]net com-en-us[.]info com-en-us[.]me message-apple[.]com mail[.]message-apple[.]com ns2[.]com-en-us[.]info join-facetime[.]com-en-us[.]info join-zoom[.]com-en-us[.]info login-live[.]com-en-us[.]info account-update[.]ar-id[.]co signal-account[.]org en-ir[.]org totok-pro[.]ae me-info[.]cc connect-signal[.]me zm-me[.]co join-meeting[.]zm-me[.]co relaxmode[.]org track-portal[.]co sgnlapp[.]info accountcapabilities-pa[.]google[.]svr-driv Source: https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire Page 26 of 26 facetime-num[.]me-ar[.]cc aler-new[.]me-ar[.]cc facetime-join[.]me-ar[.]cc aler-get[.]me-ar[.]cc appleid-apple[.]me-ar[.]cc owa365[.]cc mail[.]owa365[.]cc mail-bdf-bh[.]owa365[.]cc mng-ma-il[.]owa365[.]cc verify-icloud[.]en-id[.]net trusted-device-apple[.]en-id[.]net tracking-dhl[.]en-id[.]net Page 23 of 26