This repository contains lists of domains generated by the Flubot DGA.
Flubot v4.7 has slightly altered the DGA where it's no longer selecting a seed value based on the phone number's country code. Instead, it will randomly select a seed value from this list: 1136, 1642, 1813, 1945, 2931.
The files in this repository generated for newer versions will henceforth incorporate the Flubot version instead of the seed value. Such as: flubot_v4.7_202107.txt.
The lists with an explicit seed value (like flubot_2931_202107.txt) are generated for all currently known seeds, as of Flubot v4.6.
The actual seed value as used per country might differ between earlier releases:
| Seed value | Country code(s) |
|---|---|
| 1136 | ES (default) |
| 1642 | UK |
| 1813 | IT |
| 1905 | JP |
| 1945 | AT, CH, DE |
| 2931 | NL, PL, NO, FI, ES, DK, BE |
Distributed under the ISC License. See LICENSE for more information.
Unless otherwise noted, the files in the dga/ directory are shared as TLP:WHITE. See FIRST for more information about the Traffic Light Protocol.