<commit_before># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: gobrut, marut, stealthworker

# Reference: https://twitter.com/gwillem/status/1125363285883346945

172.16.17.32:8081

# Reference: https://blog.malwarebytes.com/threat-analysis/2019/02/new-golang-brute-forcer-discovered-amid-rise-e-commerce-attacks/

172.16.31.10:7000

# Reference: https://twitter.com/rommeljoven17/status/1126392967986438145

172.16.58.3:7000
172.16.17.32:7000

# Reference: https://twitter.com/VK_Intel/status/1178766622686941184

192.168.3.11:5693

# Reference: https://www.fortinet.com/blog/threat-research/unveiling-stealthworker-campaign.html
# Reference: https://otx.alienvault.com/pulse/5db180ab5034fd0844577b86

172.16.58.3:7000
192.168.127.12:8081
172.16.31.10:8081
172.16.31.10:8085
172.16.17.32:7000
172.16.17.32:7000
192.168.3.11:8081
172.16.17.32:8081
192.168.127.12:7000
172.16.58.3:8086
172.16.31.10:8082
172.16.17.32:8081
192.168.3.11:5693
192.168.127.12:8081
172.16.58.3:7000
192.168.3.11:12568
192.168.127.12:7000
172.16.58.3:7000
192.168.127.12:8081
192.168.3.11:8089
172.16.31.10:28080
192.168.3.11:11679
172.16.17.32:7000
172.16.17.32:6000
172.16.58.3:7000
172.16.31.10:7000
192.168.3.11:8085
172.16.31.10:11679
172.16.31.10:7000
172.16.31.10:8081
172.16.17.32:7000
192.168.3.11:7000
192.168.3.11:8081
172.16.31.1058:7000
172.16.17.32:7000
192.168.127.12:7000
formfactset.org
gofermouse.top
linuxserverb.xyz
prioritywirreles.com
sontorap.top
swiftrocky.org
teamsystems.info

# Reference: https://twitter.com/tkanalyst/status/1226125887256416256
# Reference: https://app.any.run/tasks/36f61504-d0ce-4bfe-be53-3f4a21817677/

172.16.31.10:8888
o4s98myt4.top

# Reference: https://www.virustotal.com/gui/file/46204d823592d0586eee168f4b83d2a3d255bd2b1b92c55b9c089ce3c277554f/detection

172.16.31.10:8888

# Reference: https://www.virustotal.com/gui/file/a3bfec359a9f54a10f2660a5587cedd9d9bc7724d4c29aacb4e791b0992ad912/detection

172.16.31.10:8888

# Reference: https://twitter.com/The_d0c_T0R/status/1127233691451891712

192.168.3.11:8888

# Reference: https://www.virustotal.com/gui/file/c975794ff65c02b63fae1a94006a75294aac13277ca464e3ea7e40de5eda2b14/detection

192.168.127.12:8888

# Reference: https://www.virustotal.com/gui/file/6227bd0736cb4c7502066148606ef2d55ee179c0ef473d046e98ab9a53509b28/detection

192.168.3.11:8085

# Generic

/bots/chkVersion?currVers=
/bots/knock?worker=<commit_msg>Update gobrut.txt<commit_after># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: gobrut, marut, stealthworker

# Reference: https://twitter.com/gwillem/status/1125363285883346945

172.16.17.32:8081

# Reference: https://blog.malwarebytes.com/threat-analysis/2019/02/new-golang-brute-forcer-discovered-amid-rise-e-commerce-attacks/

172.16.31.10:7000

# Reference: https://twitter.com/rommeljoven17/status/1126392967986438145

172.16.58.3:7000
172.16.17.32:7000

# Reference: https://twitter.com/VK_Intel/status/1178766622686941184

192.168.3.11:5693

# Reference: https://www.fortinet.com/blog/threat-research/unveiling-stealthworker-campaign.html
# Reference: https://otx.alienvault.com/pulse/5db180ab5034fd0844577b86

172.16.58.3:7000
192.168.127.12:8081
172.16.31.10:8081
172.16.31.10:8085
172.16.17.32:7000
172.16.17.32:7000
192.168.3.11:8081
172.16.17.32:8081
192.168.127.12:7000
172.16.58.3:8086
172.16.31.10:8082
172.16.17.32:8081
192.168.3.11:5693
192.168.127.12:8081
172.16.58.3:7000
192.168.3.11:12568
192.168.127.12:7000
172.16.58.3:7000
192.168.127.12:8081
192.168.3.11:8089
172.16.31.10:28080
192.168.3.11:11679
172.16.17.32:7000
172.16.17.32:6000
172.16.58.3:7000
172.16.31.10:7000
192.168.3.11:8085
172.16.31.10:11679
172.16.31.10:7000
172.16.31.10:8081
172.16.17.32:7000
192.168.3.11:7000
192.168.3.11:8081
192.168.3.11:7000
172.16.17.32:7000
192.168.127.12:7000
formfactset.org
gofermouse.top
linuxserverb.xyz
prioritywirreles.com
sontorap.top
swiftrocky.org
teamsystems.info

# Reference: https://twitter.com/tkanalyst/status/1226125887256416256
# Reference: https://app.any.run/tasks/36f61504-d0ce-4bfe-be53-3f4a21817677/

172.16.31.10:8888
o4s98myt4.top

# Reference: https://www.virustotal.com/gui/file/46204d823592d0586eee168f4b83d2a3d255bd2b1b92c55b9c089ce3c277554f/detection

172.16.31.10:8888

# Reference: https://www.virustotal.com/gui/file/a3bfec359a9f54a10f2660a5587cedd9d9bc7724d4c29aacb4e791b0992ad912/detection

172.16.31.10:8888

# Reference: https://twitter.com/The_d0c_T0R/status/1127233691451891712

192.168.3.11:8888

# Reference: https://www.virustotal.com/gui/file/c975794ff65c02b63fae1a94006a75294aac13277ca464e3ea7e40de5eda2b14/detection

192.168.127.12:8888

# Reference: https://www.virustotal.com/gui/file/6227bd0736cb4c7502066148606ef2d55ee179c0ef473d046e98ab9a53509b28/detection

192.168.3.11:8085

# Reference: https://www.virustotal.com/gui/file/71200512d3156e464339fa79563ec776b30b79ff10340ac50911d9b90f9e7131/detection

192.168.127.12:8888

# Generic

/bots/chkVersion?currVers=
/bots/knock?worker=
{'fraction_non_alphanumeric': 0.14941634241245136, 'fraction_numerical': 0.3791828793774319, 'mean_word_length': 5.105700712589074, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 29, 'lorem ipsum': 0, 'www.': 11, 'xml': 0}, 'pii_count': 95, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1058262', 'n_tokens_mistral': 3539, 'n_tokens_neox': 2455, 'n_words': 207}