rule bulwark_https_bulwarkblack_com_dropcatch_domains_reputation_not_trust
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/dropcatch-domains-reputation-not-trust/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:23:45Z"
        tlp = "TLP:CLEAR"
        indicator_count = "31"
    strings:
        $s0 = "ads-analytic.com" ascii wide nocase  // Domains
        $s1 = "advanceslibrary.com" ascii wide nocase  // Domains
        $s2 = "blacksaltys.com" ascii wide nocase  // Domains
        $s3 = "blackshelter.org" ascii wide nocase  // Domains
        $s4 = "blocksovetnik.ru" ascii wide nocase  // Domains
        $s5 = "bluegaslamp.org" ascii wide nocase  // Domains
        $s6 = "brodirect3s.site" ascii wide nocase  // Domains
        $s7 = "cdnjslibraries.com" ascii wide nocase  // Domains
        $s8 = "checkoutbump.com" ascii wide nocase  // Domains
        $s9 = "draggedline.org" ascii wide nocase  // Domains
        $s10 = "getshopstar.com" ascii wide nocase  // Domains
        $s11 = "gsstats.ru" ascii wide nocase  // Domains
        $s12 = "hpmdnetwork.ru" ascii wide nocase  // Domains
        $s13 = "imhd.io" ascii wide nocase  // Domains
        $s14 = "jqueryapihelpers.com" ascii wide nocase  // Domains
        $s15 = "lzdatheme.com" ascii wide nocase  // Domains
        $s16 = "magesource.su" ascii wide nocase  // Domains
        $s17 = "memtkh.com" ascii wide nocase  // Domains
        $s18 = "pausewatchings.com" ascii wide nocase  // Domains
        $s19 = "pills-europe.com" ascii wide nocase  // Domains
        $s20 = "propush.me" ascii wide nocase  // Domains
        $s21 = "renpaste.top" ascii wide nocase  // Domains
        $s22 = "renteres.ru" ascii wide nocase  // Domains
        $s23 = "simplejscdn.com" ascii wide nocase  // Domains
        $s24 = "slurpslimes.org" ascii wide nocase  // Domains
        $s25 = "sport2news.com" ascii wide nocase  // Domains
        $s26 = "tofuturepubs.com" ascii wide nocase  // Domains
        $s27 = "weatherplllatform.com" ascii wide nocase  // Domains
        $s28 = "webpixel.app" ascii wide nocase  // Domains
        $s29 = "wesq.me" ascii wide nocase  // Domains
        $s30 = "windowlight.org" ascii wide nocase  // Domains
    condition:
        any of ($s*)
}