<commit_before># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://securelist.com/attack-on-zygote-a-new-twist-in-the-evolution-of-mobile-threats/74032/

bridgeph2.zgxuanhao.com
bridgeph2.zgxuanhao.com
bridgeph3.zgxuanhao.com
bridgeph3.zgxuanhao.com
bridgeph4.zgxuanhao.com
bridgeph2.viewvogue.com
bridgeph3.viewvogue.com
bridgeph3.viewvogue.com
bridgeph4.viewvogue.com
bridgecr1.tailebaby.com
bridgecr2.tailebaby.com
bridgecr3.tailebaby.com
bridgecr4.tailebaby.com
bridgecr1.hanltlaw.com
bridgecr2.hanltlaw.com
bridgecr3.hanltlaw.com
bridgecr4.hanltlaw.com

# Reference: https://www.virustotal.com/gui/file/7487d1365ad9c93e0d3a19755ce976d6a50f24f45f08ddae96a549ec8102e865/detection
# Reference: https://research.checkpoint.com/2020/enter-wapdropper-subscribe-users-to-premium-services-by-telecom-companies/
# Reference: https://www.virustotal.com/gui/domain/cooktracking.com/detection
# Reference: https://www.virustotal.com/gui/domain/facebook1mob.com/detection

http://172.16.17.32
ks7br7.3q03on.com
cooktracking.com
facebook1mob.com

# Reference: https://www.virustotal.com/gui/file/1d50b1e05dc2a357316738a731786f2095776eca8c8031be68f7191ff65174ad/detection

172.16.58.3:8081
172.16.17.32:8081
192.168.127.12:8081
koapkmobi.com
okyesmobi.com

# Reference: https://www.virustotal.com/gui/file/b9eda09f2954755082f62e2d7c443552abbedd27a0f35d5054a896b6b20f9c1d/detection
# Reference: https://www.virustotal.com/gui/file/7487d1365ad9c93e0d3a19755ce976d6a50f24f45f08ddae96a549ec8102e865/detection

http://172.16.17.32
http://172.16.31.10
http://192.168.127.12
http://192.168.3.11
/admin201506/uploadApkFile/<commit_msg>Update android_triada.txt<commit_after># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://securelist.com/attack-on-zygote-a-new-twist-in-the-evolution-of-mobile-threats/74032/

bridgeph2.zgxuanhao.com
bridgeph2.zgxuanhao.com
bridgeph3.zgxuanhao.com
bridgeph3.zgxuanhao.com
bridgeph4.zgxuanhao.com
bridgeph2.viewvogue.com
bridgeph3.viewvogue.com
bridgeph3.viewvogue.com
bridgeph4.viewvogue.com
bridgecr1.tailebaby.com
bridgecr2.tailebaby.com
bridgecr3.tailebaby.com
bridgecr4.tailebaby.com
bridgecr1.hanltlaw.com
bridgecr2.hanltlaw.com
bridgecr3.hanltlaw.com
bridgecr4.hanltlaw.com

# Reference: https://www.virustotal.com/gui/file/7487d1365ad9c93e0d3a19755ce976d6a50f24f45f08ddae96a549ec8102e865/detection
# Reference: https://research.checkpoint.com/2020/enter-wapdropper-subscribe-users-to-premium-services-by-telecom-companies/
# Reference: https://www.virustotal.com/gui/domain/cooktracking.com/detection
# Reference: https://www.virustotal.com/gui/domain/facebook1mob.com/detection

http://172.16.17.32
ks7br7.3q03on.com
cooktracking.com
facebook1mob.com

# Reference: https://www.virustotal.com/gui/file/1d50b1e05dc2a357316738a731786f2095776eca8c8031be68f7191ff65174ad/detection

172.16.58.3:8081
172.16.17.32:8081
192.168.127.12:8081
koapkmobi.com
okyesmobi.com

# Reference: https://www.virustotal.com/gui/file/b9eda09f2954755082f62e2d7c443552abbedd27a0f35d5054a896b6b20f9c1d/detection
# Reference: https://www.virustotal.com/gui/file/7487d1365ad9c93e0d3a19755ce976d6a50f24f45f08ddae96a549ec8102e865/detection

http://172.16.17.32
http://172.16.31.10
http://192.168.127.12
http://192.168.3.11
/admin201506/uploadApkFile/

# Reference: https://www.virustotal.com/gui/file/7487d1365ad9c93e0d3a19755ce976d6a50f24f45f08ddae96a549ec8102e865/detection

ykbh.k818ax.com
{'fraction_non_alphanumeric': 0.12124582869855395, 'fraction_numerical': 0.1810344827586207, 'mean_word_length': 6.094674556213017, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 19, 'lorem ipsum': 0, 'www.': 13, 'xml': 0}, 'pii_count': 16, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2126606', 'n_tokens_mistral': 1906, 'n_tokens_neox': 1553, 'n_words': 125}