December 2021

Threat Report on theSurveillance-for-Hire Industry
December 16, 2021
By Mike Dvilyanski, Head of Cyber Espionage Investigations,David Agranovich, Director, Threat Disruption, andNathaniel Gleicher, Head of Security PolicyThreat Report on the Surveillance-for-Hire Industry

2

Summary●

The global surveillance-for-hire industry targets people to collect intelligence, manipulate
and compromise their devices and accounts across the internet.

●

While these “cyber mercenaries” often claim that their services only target criminals andterrorists, our months-long investigation concluded that targeting is in fact indiscriminate
and includes journalists, dissidents, critics of authoritarian regimes, families of opposition
members and human rights activists.

●

We disabled seven entities who targeted people across the internet in over 100 countries;
shared our findings with security researchers, other platforms and policymakers; issued
Cease and Desist warnings; and also alerted people who we believe were targeted to help
them strengthen the security of their accounts.

Threat Report on the Surveillance-for-Hire Industry

3This report is the result of our months-long investigation and disruption of seven entities
providing surveillance-for-hire services to target people across the internet, including journalists
and human rights activists. It outlines the actions we took against them and includes ourresearch into what we call the “surveillance chain” — phases of attack we’ve observed over thecourse of our threat intelligence research. Our hope is to contribute to the broader
understanding of the harms this industry represents worldwide and call on the democratic
governments to take further steps to help protect people and impose oversight on the sellers of
ubiquitous spyware.

What is surveillance-for-hire and how does it work?
In recent months, there has been an increased focus on NSO, the company behind the Pegasus
spyware (i.e. software used to enable surveillance) that we enforced against and sued in 2019.
However, it’s important to realize that NSO is only one piece of a much broader global cyber
mercenary ecosystem. As part of a separate effort, today, we are sharing our findings about
seven entities that engaged in surveillance activity and we will continue to take action against
others as we find them.
The global surveillance-for-hire industry targets people across the internet to collectintelligence, manipulate them into revealing information and compromise their devices andaccounts. While cyber mercenaries often claim that their services and surveillanceware areintended to focus on criminals and terrorists, our investigation found they in fact regularly
targeted journalists, dissidents, critics of authoritarian regimes, families of opposition andhuman rights activists around the world. These companies are part of a sprawling industry thatprovides intrusive software tools and surveillance services indiscriminately to any customer —regardless of who they target or the human rights abuses they might enable.
This ecosystem works to provide powerful capabilities to its clients against victims who in mostcases have no way of knowing they are being targeted. In a sense, this industry "democratizes"
these threats, making them available to government and non-government groups that otherwise
wouldn't have these capabilities to cause harm. They in effect exponentially increase the supplyof threat actors in the world.

Threat Report on the Surveillance-for-Hire Industry

4

We observed three phases of targeting activity by these commercial players that make up their“surveillance chain”: Reconnaissance, Engagement, and Exploitation. Each phase informs thenext and often they repeat in cycles. While some of these entities specialize in one particular
stage of surveillance, others support the entire chain from start to finish. Although public debate
so far has mainly focused on the exploitation phase, it’s critical to disrupt the entire lifecycle of
the attack because the earlier stages enable the later ones. If we can collectively tackle thisthreat earlier in the surveillance chain, it would help stop the harm before it gets to its final, mostserious stage of compromising people’s devices and accounts.
Here are more details and TTPs (the tactics, techniques, and procedures) characteristic for eachattack chain stage.

ReconnaissanceThis first stage of the surveillance chain is typically the least visible to the targets, who aresilently profiled by cyber mercenaries on behalf of their clients, often using software toautomate data collection from across the internet. Firms selling these capabilities typicallymarket themselves as “web intelligence services” to enable collection, retention, analysis andsearchability — both targeted and at scale.
Usually, these services and apps are designed to pull information about targets from all available
online records. They typically scrape and store data from public websites such as blogs, social
media, knowledge management platforms like Wikipedia and Wikidata, news media, forums and“dark web” sites. Surveillanceware often provides the benefit of obfuscating the origin of theactivity through unattributable infrastructure.
One of the primary means of collecting information on social media is the use of fake accounts.
These inauthentic assets can be used to search and view people’s profiles, Friends, Likes andother publicly available information, join Groups and Events, and follow or friend targets. They
are typically managed by the service provider for its clients, or operated by the customers
themselves through software provided by the surveillance-for-hire firm. The level ofsophistication of the fake accounts varies considerably across cyber mercenaries andtheir customers.

Threat Report on the Surveillance-for-Hire Industry

5

Engagement
This second phase of the surveillance chain is typically the most visible to its targets and mostcritical to spot to prevent compromise. It is aimed at establishing contact with the targets or
people close to them in an effort to build trust, solicit information, and trick them into clicking onlinks or downloading files (to enable the next “exploitation” phase).
To do that, the operators typically rely on social engineering tactics and use fictitious personas
to reach out to people via email, phone calls, text messages, or direct messages on social media.
These personas are typically tailored to each particular target to seem credible and avoid tipping
people off to suspect malicious intent. These efforts are often prolonged and involve creatingbackstops for fake personas and organizations across multiple internet services so they appear
more legitimate and can withstand scrutiny. The social engineering aims can range fromobtaining sensitive information desired by the client to targeting the individual with malware toenable full-device digital surveillance. To achieve them, the operators may attempt to direct
people to more direct channels like voice or video calls or even in-person meetings.

Exploitation
The final stage of the surveillance chain manifests as what’s commonly known as “hacking forhire.” Providers may create phishing domains designed to trick targets into giving away theircredentials to sensitive accounts like email, social media, financial services, and corporate
networks. We’ve seen them spoof the domains of news organizations, telecom providers, banks,and URL-shortening services to deceive their victims.
To enable the delivery of malicious “payload,” the operators may either use their own
custom-built exploits or acquire malicious tools from other vendors. The sophistication in toolingvaries significantly across this industry, ranging from off-the-shelf malware easily detected bymost anti-virus software to single-click or even zero-click exploit links sent to the targets.
The ultimate goal is to enable device-level surveillance and monitoring of mobile phones orcomputers. At that point, depending on the exploit, the attacker can access any data on
the target’s phone or computer, including passwords, cookies, access tokens, photos,
videos, messages, address books, as well as silently activate the microphone, camera, andgeo-location tracking.

Threat Report on the Surveillance-for-Hire Industry

6

Our investigative findings and the actions we took
As a result of our months-long investigation, we took action against seven different
surveillance-for-hire entities to disrupt their ability to use their digital infrastructure to abusesocial media platforms and enable surveillance of people across the internet. They provided
services across all three phases of the surveillance chain that were used to indiscriminately
target people. These surveillance providers are based in China, Israel, India, and North
Macedonia. They targeted people in over 100 countries around the world on behalf of
their clients.
To help disrupt these activities, we blocked related infrastructure, banned these entities fromour platform and issued Cease and Desist warnings, putting each of them on notice that theirtargeting of people has no place on our platform and is against our Community Standards. We
also shared our findings with security researchers, other platforms, and policymakers so they too
can take appropriate action. We also notified people who we believe were targeted to help themtake steps to strengthen the security of their accounts.
The entities behind these surveillance operations are persistent, and we expect them to evolve
their tactics. However, our detection systems and threat investigators, as well as other teams inthe broader security community keep improving to make it harder for them to remain
undetected. We will continue to share our findings when possible so people are aware of thethreats we are seeing and can take steps to strengthen the security of their accounts.

Threat Report on the Surveillance-for-Hire Industry

7

Here is what we found1. Cobwebs Technologies
Surveillance chain phases: Reconnaissance, Engagement

We removed about 200 accounts which were operated by Cobwebs and its customers
worldwide. This firm was founded in Israel with offices in the United States and sells access to its
platform that enables reconnaissance across the internet, including Facebook, Instagram,WhatsApp, Twitter, Flickr, public websites and “dark web” sites. In addition to collectingThreat Report on the Surveillance-for-Hire Industry

8

information about their targets, the accounts used by Cobwebs customers also engaged insocial engineering to join closed communities and forums and trick people into revealing
personal information.
Our investigation identified customers in Bangladesh, Hong Kong, the United States, New
Zealand, Mexico, Saudi Arabia, Poland, and other countries. In addition to targeting related tolaw enforcement activities, we also observed frequent targeting of activists, opposition
politicians and government officials in Hong Kong and Mexico.

2. Cognyte
Surveillance chain phases: Reconnaissance, Engagement

We removed about 100 accounts on Facebook and Instagram which were linked to Cognyte(formerly known as WebintPro) and its customers. This firm is based in Israel and sells access to
its platform which enables managing fake accounts across social media platforms including
Facebook, Instagram, Twitter, YouTube, and VKontakte (VK), and other websites tosocial-engineer people and collect data.
Our investigation identified customers in Israel, Serbia, Colombia, Kenya, Morocco, Mexico,
Jordan, Thailand, and Indonesia. Their targets included journalists and politicians aroundthe world.

3. Black Cube
Surveillance chain phases: Reconnaissance, Engagement, Exploitation

We removed about 300 Facebook and Instagram accounts linked to Black Cube, an Israeli-based
firm with offices in the UK, Israel and Spain. It provides surveillance services that include social
engineering and intelligence gathering. Black Cube operated fictitious personas tailored for its
targets: some of them posed as graduate students, NGO and human rights workers, and film andTV producers. They would then attempt to set up calls and obtain the target’s personal email
address, likely for later phishing attacks. Black Cube relied on different tactics to obfuscate its
activity, including by performing unrelated activities, likely to drown out malicious targeting in
the “noise” of the seemingly innocuous social media behavior.

Threat Report on the Surveillance-for-Hire Industry

9

Our investigation found a wide range of customers, including private individuals, businesses, andlaw firms around the world. Targeting by Black Cube on behalf of its customers was also
widespread geographically and across industries, including the medical, mining, minerals andenergy industries. It also included NGOs in Africa, Eastern Europe, and South America, as well as
Palestinian activists. They also targeted people in Russia associated with universities, thetelecom, high tech, consulting, legal, and financial industries, real estate development
and media.

4. Bluehawk CI
Surveillance chain phases: Reconnaissance, Engagement, Exploitation

We removed about 100 Facebook accounts linked to Bluehawk, a firm based in Israel with
offices in the UK and the US. We collaborated on this investigation with The Daily Beast who had
identified a subset of this activity leading us to uncover the full cluster and who’s behind it earlier
this year. Bluehawk sells a wide range of surveillance-for-hire activities that included social
engineering, gathering of litigation-related intelligence about people, and managing fakeaccounts to trick them into installing malware. The individuals behind this firm showedpersistence and continued to try to come back to our platform after we took down dozens of
their accounts.
These fake accounts posed as journalists working for existing media organizations like La
Stampa in Italy and Fox News in the US to trick their targets into giving an on-camera interview.
As reported by The Daily Beast, some of these accounts targeted opponents of the UAE emirate
Ras Al Khaimah, while others attempted to social-engineer people in Qatar and politicians andbusinessmen in the Middle East. Most recently, Bluehawk attempted to create accounts
claiming to be based in Argentina.

5. BellTroX
Surveillance chain phases: Reconnaissance, Engagement, Exploitation

We removed about 400 Facebook accounts, the vast majority of which were inactive for years,
linked to BellTroX and used for reconnaissance, social engineering and to send malicious links.
BellTroX is based in India and sells what’s known as “hacking for hire” services, which wereThreat Report on the Surveillance-for-Hire Industry

10

reported on by researchers at the Citizen Lab and Reuters. Its activity on our platform waslimited and sporadic between 2013 to 2019, after which it paused. BellTroX operated fakeaccounts to impersonate a politician and pose as journalists and environmental activists in an
attempt to social-engineer its targets to solicit information including their email addresses, likely
for phishing attacks at a later stage.
This activity, based on the exact same playbook, re-started in 2021 with a small number ofaccounts impersonating journalists and media personalities to send phishing links and solicit thetargets’ email addresses. Among those targeted were lawyers, doctors, activists, and membersof the clergy in countries including Australia, Angola, Saudi Arabia, and Iceland.

6. Cytrox
Surveillance chain phases: primarily Exploitation

We removed about 300 accounts on Facebook and Instagram linked to Cytrox. This North
Macedonian company develops exploits and sells surveillance tools and malware that enable its
clients to compromise iOS and Android devices. In collaboration with the Citizen Lab, we
obtained copies of iOS and Android malware for further analysis. As a result, our team at Meta
was able to find a vast domain infrastructure that we believe Cytrox used to spoof legitimate
news entities in the countries of their interest and mimic legitimate URL-shortening and social
media services (see the full domain list in the Appendix). They used these domains as part oftheir phishing and compromise campaigns. Cytrox and its customers took steps to tailor their
attacks for particular targets by only infecting people with malware when they passed certain
technical checks, including IP address and device type. If the checks failed, people could be
redirected to legitimate news or other websites.
Our investigation identified customers in Egypt, Armenia, Greece, Saudi Arabia, Oman,
Colombia, Côte d’Ivoire, Vietnam, the Philippines, and Germany. Targets of Cytrox and its
customers included politicians and journalists around the world, including in Egypt and Armenia.
Our findings suggest that Cytrox likely provided services to another threat actor known in the
security community as Sphinx, which targeted people in Egypt and its neighboring countries.

Threat Report on the Surveillance-for-Hire Industry

11

7. An unknown entity in China
Surveillance chain phases: primarily Reconnaissance, Exploitation

We removed about 100 Facebook and Instagram accounts linked to an unidentified entity in
China responsible for developing surveillanceware for Android, iOS, Windows, and also Linux,
Mac OS X, and Solaris operating systems. It also engaged in reconnaissance and social
engineering activity before delivering malicious payload to its targets. While we haven’t beenable to attribute this activity to a particular actor, our investigation and analysis of thecommand-and-control servers behind this surveillance tooling indicate its usage by domestic
law enforcement in China.
In some instances, we found this group’s malware framework deployed along with facialrecognition software developed by a Beijing-based company. At the time of our investigation,access to this framework required not only a username and password but also a SafeNet
SuperDog physical hardware key, likely to make sure that only authorized customers who were
given that key could use it. Analysis of the malware samples distributed by this entity provided
additional insights, indicating that the people behind it were operating on a standard Monday to
Friday work schedule with most software builds occurring on Mondays Beijing time.
Our investigation found that malware tools were used to support surveillance against minority
groups throughout the Asia-Pacific region, including in the Xinjiang region of China, Myanmar,and Hong Kong.

Our response to abuse by surveillance-for-hire groups
The “surveillance-for-hire” entities we removed and described in this report violated multiple
Community Standards and Terms of Service. Given the severity of their violations, we havebanned them from our services. We also alerted around 50,000 people who we believe weretargeted by these malicious activities worldwide, using the alert system we launched in 2015.
We recently updated it to provide people with more granular details about the types of targetingand the actor behind it so they can take steps to protect their accounts, depending on the phaseof the surveillance attack chain we detect in each case.

Threat Report on the Surveillance-for-Hire Industry

12

The existence and proliferation of these services worldwide raises a number of importantquestions. While these cyber mercenaries often claim that their services and surveillanceware
are meant to focus only on criminals and terrorists, our own investigation, independent
researchers, our industry peers and governments have demonstrated that targeting is indeed
indiscriminate and includes journalists, dissidents, critics of authoritarian regimes, families of
opposition and human rights activists. In fact, for platforms like ours, there is no scalable way todiscern the purpose or legitimacy of such targeting. What’s more, the use of these third-party
services obfuscates who each end customer might be, what’s collected and how the information
is being used against vulnerable groups. This is why we focus on enforcing against this behavior,regardless of who’s behind it or who the target might be.
To support the work of law enforcement, we already have authorized channels where
government agencies can submit lawful requests for information, rather than resorting to thesurveillance-for-hire industry which indiscriminately sells these services to anyone willing to pay,
including known bad actors. These channels are designed to safeguard due process and wereport the number and the origin of these requests publicly so that people worldwide have thefull picture.

Threat Report on the Surveillance-for-Hire Industry

13

We will continue to investigate and enforce against anyone abusing our apps. However, thesecyber mercenaries work across many platforms and national boundaries. Their capabilities areused by both nation-states and private enterprises, and effectively lower the barrier to entry foranyone willing to pay. For their targets, it is often impossible to know they are being surveilled
across the internet.
Protecting people against this threat requires a collective effort from platforms, policymakers,
and civil society to counter the underlying market and its incentive structure. We believe a public
discussion about the use of surveillance-for-hire technology is urgently needed to deter theabuse of these capabilities both among those who sell them and those who buy them, anchoredin the following principles:●Greater transparency & oversight: There is a need for a robust international oversightthat establishes transparency and “know your customer” standards for this market andholds surveillance-for-hire entities to these norms.

●

Industry collaboration: Surveillance efforts manifest differently on various techplatforms, making industry collaboration critical if we want to fully understand andmitigate them. We stand ready to work with our peers to investigate abuse, share anddisrupt surveillance-for-hire threats, including by using legal levers, so we can collectively
build deterrence and impose costs on abusive services.

●

Governance & ethics: We welcome domestic and international efforts to raiseaccountability through legislation, export controls and regulatory actions. We also
encourage broader civil society and regulator-led conversations about the ethics of using
these technologies by law enforcement and private companies, as well as creating
effective victim protection regimes.

Until recently, these cyber mercenaries rarely faced consequences when their products wereused to target vulnerable groups like activists, journalists, and minority groups, and cause
serious harm. We’re encouraged to see our peers and governments join the effort we began in2019 and draw attention to this threat. For our collective response against abuse to be effective,
it is imperative for technology platforms, civil society and democratic governments to raise thecosts on this global industry and disincentivize these abusive surveillance-for-hire services. Our
hope with this threat report is to contribute to this global effort and help shine the light on
this industry.

Threat Report on the Surveillance-for-Hire Industry

14

Appendix:
Indicators of Compromise​​related to Cytrox

2y4nothing[.]xyz

bit-li[.]ws

covid19masks[.]shop

5m5[.]io

bit-ly[.]link

crashonline[.]site

addons[.]news

bit-ly[.]org

cut[.]red

adibjan[.]net

bitlly[.]live

cyber[.]country

adservices[.]gr[.]com

bitlyrs[.]com

danas[.]bid

adultpcz[.]xyz

bitt[.]fi

distedc[.]com

advertsservices[.]com

bity[.]ws

download4you[.]xyz

advfb[.]xyz

bityl[.]medragonair[.]xyz

affise[.]app

blacktrail[.]xyz

eagerfox[.]xyz

almasryelyuom[.]com

bmw[.]gr[.]com

ebill[.]cosmote[.]center

alpineai[.]uk

bookjob[.]club

efsyn[.]online

alraeeenews[.]com

browsercheck[.]services

egyqaz[.]com

alraeesnews[.]net

bumabara[.]bid

engine[.]ninja

altsantiri[.]news

burgerprince[.]us

enigmase[.]xyz

amazing[.]labbusinesnews[.]net

enikos[.]news

ancienthistory[.]xyz

canyouc[.]xyz

ereportaz[.]news

android-apps[.]techcarrefourmisr[.]com

espressonews[.]gr[.]com

api-apple-buy[.]com

cbbc01[.]xyz

etisalategypt[.]tech

api-telecommunication[.]ccelebrnewz[.]xyz

etisalatgreen[.]comomcellconn[.]net

ewish[.]cards

applepps[.]com

charmander[.]xyz

fastdownload[.]meapps-ios[.]net

chatwithme[.]store

fastuploads[.]xyz

aramexegypt[.]com

citroen[.]gr[.]com

fbc8213450838f7ae251d4

atheere[.]com

ckforward[.]one

519c195138[.]xyz

audit-pvv[.]com

clockupdate[.]com

ferrari[.]gr[.]com

bank-alahly[.]com

cloudstatistics[.]net

ffoxnewz[.]com

bbcsworld[.]com

cloudtimesync[.]com

fimes[.]gr[.]com

bitlinkin[.]xyz

cnn[.]gr[.]com

fireup[.]xyz

bi[.]tly[.]gr[.]com

connectivitycheck[.]live

fisherman[.]engine[.]ninjabi[.]tly[.]link

connectivitycheck[.]online

flexipagez[.]com

bit-li[.]com

connectivitychecker[.]com

forwardeshoptt[.]com

Threat Report on the Surveillance-for-Hire Industry

15

getsignalapps[.]com

jquery-updater[.]xyz

msas[.]ws

getsignalapps[.]live

kathimerini[.]news

mycoffeeshop[.]shop

getupdatesnow[.]xyz

kinder[.]engine[.]ninja

myfcbk[.]net

goldenscent[.]net

koenigseggg[.]com

mytrips[.]quest

goldenscint[.]com

kohaicorp[.]com

myutbe[.]net

goldescent[.]com

koora-egypt[.]com

mywebsitevpstest[.]xyz

gosokm[.]com

kormoran[.]bidnabd[.]site

guardian-tt[.]mekranos[.]gr[.]com

nabde[.]app

guardnews[.]live

lamborghini-s[.]shop

nassosblog[.]gr[.]com

heaven[.]army

landingpg[.]xyz

nemshi-news[.]xyz

heiiasjournai[.]com

landingpge[.]xyz

nemshi[.]net

hellasjournal[.]company

leanwithme[.]xyz

networkenterprise[.]net

hellasjournal[.]website

lexpress[.]me

newsbeast[.]gr[.]com

hellottec[.]art

lifestyleshops[.]net

newslive2[.]xyz

hempower[.]shop

limk[.]one

newzeto[.]xyz

hopnope[.]xyz

linkit[.]digitalnewzgroup[.]xyz

icloudeu[.]com

linktothisa[.]xyz

niceonase[.]com

icloudflair[.]com

link-m[.]xyz

niceonesa[.]net

iibt[.]xyz

link-protection[.]com

nikjol[.]xyz

ikea-egypt[.]net

liponals[.]store

nissan[.]gr[.]com

ilnk[.]xyz

livingwithbadkidny[.]xyz

novosti[.]bid

in-politics[.]com

llinkedin[.]net

oilgy[.]xyz

infosms-a[.]site

lnkedin[.]org

olexegy[.]com

inservices[.]digital

localegem[.]net

olxeg[.]com

insider[.]gr[.]com

lylink[.]online

omanreal[.]net

instagam[.]click

makeitshort[.]xyz

omeega[.]xyz

instagam[.]in

mifcbook[.]link

onlineservices[.]gr[.]com

instagam[.]photos

md-news-direct[.]com

orangegypt[.]coinstegram[.]cominiiosapps[.]xyz

orchomenos[.]news

invoker[.]icu

mitube1[.]link

otaupdatesios[.]com

ios-apps[.]store

mlinks[.]ws

paok-24[.]com

iosmnbg[.]com

mobnetlink1[.]com

pastepast[.]net

itcgr[.]live

mobnetlink2[.]com

pdfviewer[.]app

itly[.]link

mobnetlink3[.]com

playestore[.]net

itter[.]memozillaupdate[.]xyz

pocopoc[.]xyz

Threat Report on the Surveillance-for-Hire Industry

16

politika[.]bid

speedymax[.]shop

twtter[.]net

politique-koaci[.]info

sportsnewz[.]site

ube[.]gr[.]com

prmopromo[.]com

sports-mdg[.]xyz

uberegypt[.]cn[.]com

pronews[.]gr[.]com

static-graph[.]com

updates4you[.]xyz

protothema[.]live

stonisi[.]news

updateservice[.]centerproupload[.]xyz

supportset[.]net

updatetime[.]zone

ps1link[.]xyz

suzuki[.]gr[.]com

updatingnews[.]xyz

ps2link[.]xyz

svetovid[.]bid

updete[.]xyz

quickupdates[.]xyz

symoty[.]com

url-promo[.]club

qwert[.]xyz

syncservices[.]one

url-tiny[.]app

qwxzyl[.]com

synctimestamp[.]com

uservicescheck[.]com

redeitt[.]com

syncupdate[.]siteuservicesforyou[.]com

safelyredirecting[.]com

telecomegy-ads[.]com

utube[.]digitalsafelyredirecting[.]digitaltelenorconn[.]com

viva[.]gr[.]com

sepenet[.]gr[.]com

tesla-s[.]shop

vodafoneegypt[.]tech

sephoragroup[.]com

teslal[.]shop

vodafonegypt[.]com

servers-mobile[.]info

teslal[.]xyz

wavekli[.]xyz

serviceupdaterequest[.]coteslali[.]com

we-site[.]netmtgrthgsrgwrthwrtgwr[.]xyz

weathear[.]live

sextape225[.]metimestampsync[.]com

weathernewz[.]xyz

shorten[.]fitimeupdate[.]xyz

weathersite[.]online

shortenurls[.]metimeupdateservice[.]com

webaffise[.]com

shortmee[.]one

tiny[.]gr[.]com

wha[.]tsapp[.]me

shortwidgets[.]com

tinylinks[.]live

worldnws[.]xyz

shortxyz[.]com

tinyulrs[.]com

wtc1111[.]com

simetricode[.]uk

tinyurl[.]cloud

wtc2222[.]com

sinai-new[.]com

tiol[.]xyz

wtc3333[.]com

sitepref[.]xyz

tly[.]gr[.]com

xf[.]actor

smsuns[.]com

tly[.]link

xnxx-hub[.]com

snapfire[.]xyz

tovima[.]live

xyvok[.]xyz

sniper[.]pet

trecv[.]xyz

yallakora-egy[.]com

solargoup[.]xyz

trecvf[.]xyz

yo[.]utube[.]digital

solargroup[.]xyz

trkc[.]online

yo[.]utube[.]tospeedy[.]sbs

tsrt[.]xyz

youarefired[.]xyz

speedygonzales[.]xyz

tw[.]itter[.]meyout[.]ube[.]gr[.]com

Threat Report on the Surveillance-for-Hire Industry

youtu-be[.]net
youtub[.]app
youtube[.]gr[.]live
youtube[.]voto
youtubesyncapi[.]com
youtubewatch[.]coyuom7[.]net
z2a[.]digitalz2adigital[.]cloudz2digital[.]cloudzougla[.]gr[.]com
zougla[.]news

17