<commit_before># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/malwaremustd1e/status/1256977666084761602
# Reference: https://www.virustotal.com/gui/domain/1.versionday.xyz/relations

1.versionday.xyz

# Reference: https://intezer.com/blog/research/kaiji-chinese-iot-malware-turning-to-golang/
# Reference: https://otx.alienvault.com/pulse/5eb19b29d53d234ac978f51b

aresboot.xyz
cu.versiondat.xyz

# Reference: https://twitter.com/albertzsigovits/status/1264909051227451395

192.168.3.11:35565
0.versiondat.xyz

# Reference: https://twitter.com/albertzsigovits/status/1265196913067991040

2s11.com
6x66.com
cocoserver.xyz

# Reference: https://twitter.com/r3dbU7z/status/1271053327242014721

192.168.127.12:808<commit_msg>Update elf_kaiji.txt<commit_after># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/malwaremustd1e/status/1256977666084761602
# Reference: https://www.virustotal.com/gui/domain/1.versionday.xyz/relations

1.versionday.xyz

# Reference: https://intezer.com/blog/research/kaiji-chinese-iot-malware-turning-to-golang/
# Reference: https://otx.alienvault.com/pulse/5eb19b29d53d234ac978f51b

aresboot.xyz
cu.versiondat.xyz

# Reference: https://twitter.com/albertzsigovits/status/1264909051227451395

192.168.3.11:35565
0.versiondat.xyz

# Reference: https://twitter.com/albertzsigovits/status/1265196913067991040

2s11.com
6x66.com
cocoserver.xyz

# Reference: https://twitter.com/r3dbU7z/status/1271053327242014721

192.168.127.12:808

# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/
# Reference: https://otx.alienvault.com/pulse/5ef223cce7849b037b7614a5

172.16.58.3:10086
{'fraction_non_alphanumeric': 0.13305613305613306, 'fraction_numerical': 0.15956340956340956, 'mean_word_length': 5.459731543624161, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 18, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 5, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3087004', 'n_tokens_mistral': 942, 'n_tokens_neox': 743, 'n_words': 79}