the National Network and Information Security Information Notification Center discovered a batch of overseas malicious URLs and malicious IPs. Overseas hacker organizations continuously launched cyber attacks against China and other countries using these URLs and IPs. These malicious URLs and IPs are closely related to specific Trojan programs or Trojan program control terminals. One malicious address is associated with the Nanocore virus family sample, which can expand to achieve various malicious functions, such as mining encrypted currencies and ransomware attacks.