<commit_before># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf
# Reference: https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/
# Reference: https://github.com/eset/malware-ioc/tree/master/stantinko

172.16.58.3:81
172.16.58.3:80
192.168.3.11:8000
apihelper.org
biosysltd.com
biosysltd.org
clients1.ultimate-discounter.com
clients2.ultimate-discounter.com
clients3.ultimate-discounter.com
d3dupdate.com
ghosterystore.com
good-journal.net
hdr-group.info
hdr-group.net
hdr-group.org
icloudsrv.com
icloudsrv.info
icloudsrv.net
icloudsrv.org
judgebear.pro
kbdmai.net
mserrep.org
nano-news.info
newssocial.org
news-true.net
nvccupdate.com
rdsbase.com
robothemes.net
safesurfing.me
superbear.pro
teddy-protection.com
teddysave.me
tmrobo.com
tmrobo.org
udiscount.net
udiscounter.org
ultimate-discounter.org
upd-discounter.com
update.ultimate-discounter.com
vp9codec.com
vp9codec.net
wadgeotrust.com
wannaupdate.com
wsaudio.com
wsaudio.net
wsaudio.org
wsslupdate.org
wupdateservice.us

# Reference: https://www.intezer.com/blog/research/stantinkos-proxy-after-your-apache-server/

kdbmai.net

# Generic trails

/images/banners/b1/index.php
/kbdmai/index.php
/kbdmai/dht/index.php
/kbdmai/DRTIPROV/index.php
/kbdmai/winsvc/index.php
/kbdmai/anti_rstrui/index.php<commit_msg>Update stantinko.txt<commit_after># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf
# Reference: https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/
# Reference: https://github.com/eset/malware-ioc/tree/master/stantinko

172.16.58.3:81
172.16.58.3:80
192.168.3.11:8000
apihelper.org
biosysltd.com
biosysltd.org
clients1.ultimate-discounter.com
clients2.ultimate-discounter.com
clients3.ultimate-discounter.com
d3dupdate.com
ghosterystore.com
good-journal.net
hdr-group.info
hdr-group.net
hdr-group.org
icloudsrv.com
icloudsrv.info
icloudsrv.net
icloudsrv.org
judgebear.pro
kbdmai.net
mserrep.org
nano-news.info
newssocial.org
news-true.net
nvccupdate.com
rdsbase.com
robothemes.net
safesurfing.me
superbear.pro
teddy-protection.com
teddysave.me
tmrobo.com
tmrobo.org
udiscount.net
udiscounter.org
ultimate-discounter.org
upd-discounter.com
update.ultimate-discounter.com
vp9codec.com
vp9codec.net
wadgeotrust.com
wannaupdate.com
wsaudio.com
wsaudio.net
wsaudio.org
wsslupdate.org
wupdateservice.us

# Reference: https://www.intezer.com/blog/research/stantinkos-proxy-after-your-apache-server/

kdbmai.net

# Generic trails

/images/banners/b1/index.php
/kbdmai/index.php
/kbdmai/dht/index.php
/kbdmai/DRTIPROV/index.php
/kbdmai/winsvc/index.php
/kbdmai/anti_rstrui/index.php
/kbdmai/
/DRTIPROV/
{'fraction_non_alphanumeric': 0.12122218532049153, 'fraction_numerical': 0.043839256061109264, 'mean_word_length': 5.109533468559838, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 10, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '348327', 'n_tokens_mistral': 1356, 'n_tokens_neox': 1263, 'n_words': 160}