payload:
- +.btt804.com
- +.btt904.com
- +.bttzyw.com
- +.bttzyw.net