Add malicious URIs to link list

[g0d33p3rsec]

Phishing Domain/URL/IP(s):

https://adobepewjgronjgnwkengkjwengrj.pythonanywhere.com/#OMv?cb=5Se1&VfDbGdT4R4ErD54tR1DtR=support&moD=lQB&wE657UyRfVtO=vendor.zohodesk.in&Hy=9rkEH
https://abobelnejgbeghrbghkbshgbshkfb.pythonanywhere.com/#OMv?cb=5Se1&VfDbGdT4R4ErD54tR1DtR=vivek.kumar1&moD=lQB&wE657UyRfVtO=sc.com&Hy=9rkEH
https://adobebeiownwkjngrjwkenfjkewnf.pythonanywhere.com/#OMv?cb=5Se1&VfDbGdT4R4ErD54tR1DtR=adesh.bhatt&moD=lQB&wE657UyRfVtO=hbkworld.com&Hy=9rkEH

Impersonated domain

https://outlook.office.com/

Describe the issue

While investigating a separate domain I came across these malicious URIs, which were hosted at pythonanywhere.com. Virus total reports Zillya results for the related URI's as "Trojan.HEURKryptik.JS.134"

Related external source

https://www.virustotal.com/gui/file/edd12343c19ebacff6cfdc40d55fdc4b3f130a11a640228272af67eb2ff75b02
https://www.virustotal.com/gui/file/916e5ffa2fe9487e7cf6a9b9bede3dab51381b1f7ac39f8783c11db553957a8d
https://www.virustotal.com/gui/file/3f1eb989431e4a3f572584120033521de83abad0614a9960dae76aea3e2ff5f4

Screenshot

Click to expand

[g0d33p3rsec]

@spirillen I'm not sure how to add this as an issue to your matrix. I don't feel comfortable with wildcarding the domain, only the subdomains, but it looks like the wildcard entry is required. Am I misunderstanding something?

[spirillen]

but it looks like the wildcard entry is required. Am I misunderstanding something?

Just type null as value. It origins from the old template, yet kept to ensure people remember to add domain records 😏

For the subdomains 👍

mypdns/matrix#579