import "hash"

rule bulwark_https_bulwarkblack_com_google_disrupts_worlds_largest_residential_proxy_botnet
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/google-disrupts-worlds-largest-residential-proxy-botnet/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "43"
    strings:
        $s0 = "00857cca77b615c369f48ead5f8eb7f3.com" ascii wide nocase  // Domains
        $s1 = "0aa0cf0637d66c0d.com" ascii wide nocase  // Domains
        $s2 = "31d58c226fc5a0aa976e13ca9ecebcc8.com" ascii wide nocase  // Domains
        $s3 = "3k7m1n9p4q2r6s8t0v5w2x4y6z8u9.com" ascii wide nocase  // Domains
        $s4 = "442fe7151fb1e9b5.com" ascii wide nocase  // Domains
        $s5 = "6b86b273ff34fce1.online" ascii wide nocase  // Domains
        $s6 = "7x2k9n4p1q0r5s8t3v6w0y2z4u7b9.com" ascii wide nocase  // Domains
        $s7 = "8b21a945159f23b740c836eb50953818.com" ascii wide nocase  // Domains
        $s8 = "8f00b204e9800998.com" ascii wide nocase  // Domains
        $s9 = "a7b37115ce3cc2eb.com" ascii wide nocase  // Domains
        $s10 = "a8d3b9e1f5c7024d6e0b7a2c9f1d83e5.com" ascii wide nocase  // Domains
        $s11 = "aa86a52a98162b7d.com" ascii wide nocase  // Domains
        $s12 = "af4760df2c08896a9638e26e7dd20aae.com" ascii wide nocase  // Domains
        $s13 = "b5e9a2d7f4c8e3b1a0d6f2e9c5b8a7d.com" ascii wide nocase  // Domains
        $s14 = "bdrv7wlbszfotkqf.uk" ascii wide nocase  // Domains
        $s15 = "cfe47df26c8eaf0a7c136b50c703e173.com" ascii wide nocase  // Domains
        $s16 = "e4f8c1b9a2d7e3f6c0b5a8d9e2f1c4d.com" ascii wide nocase  // Domains
        $s17 = "hexsdk.com" ascii wide nocase  // Domains
        $s18 = "packetsdk.io" ascii wide nocase  // Domains
        $s19 = "packetsdk.net" ascii wide nocase  // Domains
        $s20 = "packetsdk.xyz" ascii wide nocase  // Domains
        $s21 = "v46wd6uramzkmeeo.in" ascii wide nocase  // Domains
        $s22 = "willmam.com" ascii wide nocase  // Domains
        $s23 = "1.3.6.1" ascii wide nocase  // IPv4
        $s24 = "45.78.214.188" ascii wide nocase  // IPv4
        $s25 = "49.51.68.143" ascii wide nocase  // IPv4
        $s26 = "60.2.1.3" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "00857cca77b615c369f48ead5f8eb7f3" or
        hash.md5(0, filesize) == "0c855f87a7574b28df383eca5084fcdc" or
        hash.md5(0, filesize) == "31d58c226fc5a0aa976e13ca9ecebcc8" or
        hash.md5(0, filesize) == "8a9bd7e7a806b2cc606b7a1d8f495662" or
        hash.md5(0, filesize) == "8b21a945159f23b740c836eb50953818" or
        hash.md5(0, filesize) == "993ae4fe78b879239bdc14dfbc0963cd" or
        hash.md5(0, filesize) == "a8d3b9e1f5c7024d6e0b7a2c9f1d83e5" or
        hash.md5(0, filesize) == "af4760df2c08896a9638e26e7dd20aae" or
        hash.md5(0, filesize) == "c8eb024c053f82831f2738bd48afc256" or
        hash.md5(0, filesize) == "cfe47df26c8eaf0a7c136b50c703e173" or
        hash.sha256(0, filesize) == "01ac6012d4316b68bb3165ee451f2fcc494e4e37011a73b8cf2680de3364fcf4" or
        hash.sha256(0, filesize) == "2d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e45" or
        hash.sha256(0, filesize) == "59cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554" or
        hash.sha256(0, filesize) == "aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321f" or
        hash.sha256(0, filesize) == "b0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5b" or
        hash.sha256(0, filesize) == "ba9b1f4cc2c7f4aeda7a1280bbc901671f4ec3edaa17f1db676e17651e9bff5f"
}