<commit_before># Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~HawkEye-ES/detailed-analysis.aspx

mail.tonysizzo.com

# Reference: https://malware.news/t/lammers-stealers-and-rats-same-technics-like-formbook-malware-to-install-jrat-and-hawkeye/21919

smtp.doctorework.com

# Reference: https://twitter.com/ViriBack/status/1035692468459720704

deltafood-ae.com

# Reference: https://www.symantec.com/blogs/threat-intelligence/african-financial-attacks

noreply377.ddns.net

# Reference: https://twitter.com/James_inthe_box/status/1110190083750019072
# Reference: https://twitter.com/James_inthe_box/status/1113756951102590976

lumsdancorp.com

# Reference: https://twitter.com/x42x5a/status/1111655960991490048

ftp.cnvester.com

# Reference: https://twitter.com/x42x5a/status/1115572987816742912

se1ec.com

# Reference: https://otx.alienvault.com/pulse/5cb4b6a2d0c46e38f066376a/

toshioco.com
spldernet.com
tfvn.com.vn
kamagra4uk.com
jhssourcingltd.com
pioneerfitting.com
positronicsindia.com
guideofgeorgia.org
gulfclouds.site
shirkeswitch.net
scseguros.pt
pomf.cat
a.pomf.cat
happytohelpyou.in

# Reference: https://twitter.com/Racco42/status/1124275914530013184
# Reference: https://app.any.run/tasks/6edf4315-11f1-4dca-91fd-4bb581382a5e

smtp.lavadaexpress.pw

# Reference: https://twitter.com/x42x5a/status/1126039075843190784

tain00.5gbfree.com

# Reference: https://twitter.com/dvk01uk/status/1121281997643636736
# Reference: https://app.any.run/tasks/653e0ec4-396d-4930-b91c-9b110debf1cf

ftp.nxgenbiz.us

# Reference: https://twitter.com/anyrun_app/status/1133252677402537984
# Reference: https://app.any.run/tasks/a73f9b70-0f5b-4deb-826f-9e7099ede0fb/

smtp.uml-db.com

# Reference: https://twitter.com/_Bear_Crawl_/status/1134092277071134720

mail.constreite-qatar.com
mail.riyyan.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1140603897523949568
# Reference: https://app.any.run/tasks/7555c697-f2af-42e5-8a14-ae19d7657aa9/

172.16.58.3:36530<commit_msg>Update hawkeye.txt<commit_after># Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~HawkEye-ES/detailed-analysis.aspx

mail.tonysizzo.com

# Reference: https://malware.news/t/lammers-stealers-and-rats-same-technics-like-formbook-malware-to-install-jrat-and-hawkeye/21919

smtp.doctorework.com

# Reference: https://twitter.com/ViriBack/status/1035692468459720704

deltafood-ae.com

# Reference: https://www.symantec.com/blogs/threat-intelligence/african-financial-attacks

noreply377.ddns.net

# Reference: https://twitter.com/James_inthe_box/status/1110190083750019072
# Reference: https://twitter.com/James_inthe_box/status/1113756951102590976

lumsdancorp.com

# Reference: https://twitter.com/x42x5a/status/1111655960991490048

ftp.cnvester.com

# Reference: https://twitter.com/x42x5a/status/1115572987816742912

se1ec.com

# Reference: https://otx.alienvault.com/pulse/5cb4b6a2d0c46e38f066376a/

toshioco.com
spldernet.com
tfvn.com.vn
kamagra4uk.com
jhssourcingltd.com
pioneerfitting.com
positronicsindia.com
guideofgeorgia.org
gulfclouds.site
shirkeswitch.net
scseguros.pt
pomf.cat
a.pomf.cat
happytohelpyou.in

# Reference: https://twitter.com/Racco42/status/1124275914530013184
# Reference: https://app.any.run/tasks/6edf4315-11f1-4dca-91fd-4bb581382a5e

smtp.lavadaexpress.pw

# Reference: https://twitter.com/x42x5a/status/1126039075843190784

tain00.5gbfree.com

# Reference: https://twitter.com/dvk01uk/status/1121281997643636736
# Reference: https://app.any.run/tasks/653e0ec4-396d-4930-b91c-9b110debf1cf

ftp.nxgenbiz.us

# Reference: https://twitter.com/anyrun_app/status/1133252677402537984
# Reference: https://app.any.run/tasks/a73f9b70-0f5b-4deb-826f-9e7099ede0fb/

smtp.uml-db.com

# Reference: https://twitter.com/_Bear_Crawl_/status/1134092277071134720

mail.constreite-qatar.com
mail.riyyan.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1140603897523949568
# Reference: https://app.any.run/tasks/7555c697-f2af-42e5-8a14-ae19d7657aa9/

172.16.58.3:36530

# Reference: https://twitter.com/dvk01uk/status/1143456085090738177
# Reference: https://app.any.run/tasks/f6d94749-2625-42be-820a-3ccab8f28242/

192.168.3.11:26
mail.smpn15bo<EMAIL>.sch.id
{'fraction_non_alphanumeric': 0.1334070796460177, 'fraction_numerical': 0.16592920353982302, 'mean_word_length': 5.296657381615599, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 42, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 3, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '799979', 'n_tokens_mistral': 2372, 'n_tokens_neox': 1914, 'n_words': 166}