# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://viriback.com/30-days-later-97-panels/

braithwalte.co.uk/ajjuu/admin.php
braithwalte.co.uk/bass/admin.php
bundletops.ml/bundl/etops/admin.php
carikapapa.ml/apapa/carik/admin.php
carikapapa.ml/carik/admin.php
centranets.ml/anets/centr/admin.php
cuogargaming.com/klinsnip/admin.php
cuogargaming.com/sop/admin.php
dazzlelogs.ml/elogs/dazzl/admin.php
dunysaki.ru/buch-A3/admin.php
efficienci.ml/ienci/effic/admin.php
erintoba.info/user/admin.php
gokubid.review/chife/panelnew/admin.php
gokubid.review/indo/panelnew/admin.php
grandmoney.ml/money/grand/admin.php
hostelunke.ml/lunke/admin.php
hostelunke.ml/lunke/hoste/admin.php
hypercosine.ml/cosi/hyper/admin.php
irishgrind.ml/grind/admin.php
irishgrind.ml/irish/grind/admin.php
pharma–partners.com/bfayz/admin.php
pharma–partners.com/nonib/admin.php
pharma–partners.com/twst/admin.php
preutainer.ml/aine/preut/admin.php
rolexkings.ml/king/rolex/admin.php
stauniverseqp.com/office1/admin.php
stauniverseqp.com/roks2/admin.php
suruperet.ml/eret/surup/admin.php
taineruder.ml/ruder/admin.php
taineruder.ml/ruder/carik/admin.php
theonlygoodman.com/alti/admin.php
theonlygoodman.com/aman/admin.php
theonlygoodman.com/bes/admin.php
theonlygoodman.com/dokuz/admin.php
theonlygoodman.com/dort/admin.php
theonlygoodman.com/on/admin.php
theonlygoodman.com/sekiz/admin.php
theonlygoodman.com/yedi/admin.php
thousandan.ml/lumin/sop/admin.php
totalguage.ml/guage/total/admin.php
uy-akwaibom.ru/wise/Panel/admin.php
viettrust-vn.net/adin/admin.php
viettrust-vn.net/juzz/admin.php
vinglosine.ml/osin/vingl/admin.php

# Reference: https://twitter.com/ViriBack/status/1050543003935416321

paklabourercare-gov.ml/darkcoders/login

# Reference: https://app.cymon.io/search/url/http%3A%2F%2Ffishhd.cn%2Fhmph%2Fpanelnew%2Fgate.php

ark.treassurebank.org/Panel/admin.php
fishhd.cn/hmph/panelnew/gate.php

# Reference: https://twitter.com/ScumBots/status/1053281715404374016

/jackposprivate12/loading.php
/load/jckpos/Panel/loading.php

# Reference: https://twitter.com/pancak3lullz/status/1054800229654945792
# Reference: https://twitter.com/Racco42/status/1051847768657014784

farmaboti.es/oil/panel/panelnew/admin.php
farmaboti.es/oil/panel/panelnew/gate.php

# Reference: https://twitter.com/hexlax/status/1053780496579248130

k3x.xyz

# Reference: https://exchange.xforce.ibmcloud.com/url/sergossss18.myjino.ru/panel/gate.php

sergossss18.myjino.ru/panel/gate.php

# Reference: https://www.virustotal.com/en/url/7305c8bafde11f5f2faf83deaa867508e4be02a9275fb6b5285894c40535d9b3/analysis/

perfectnobody.xyz/Panel/gate.php

# Reference: https://exchange.xforce.ibmcloud.com/url/domsrv.host/panel/gate.php

domsrv.host/panel/gate.php

# Reference: https://exchange.xforce.ibmcloud.com/url/sstorm1k.000webhostapp.com/panel/gate.php

sstorm1k.000webhostapp.com/panel/gate.php

# Reference: https://exchange.xforce.ibmcloud.com/url/pony.lovekhao.com/panel/gate.php

pony.lovekhao.com/panel/gate.php

# Reference: https://twitter.com/avman1995/status/1054260755183353858

medipedics.com/ponygrace/Panel/gate.php

# Reference: https://twitter.com/0bfusCat/status/1054363637274603520

ali55551.co.kr/guwop/General/

# Reference: https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy

cflfuppn.cn/sload/
ellapod.eu/sload/
xityeksmwi.eu/sload/

# Reference: https://twitter.com/benkow_/status/1055005039733944320

filipmoris.ru.com/spt/auth.php

# Reference: https://twitter.com/James_inthe_box/status/1069928327861854208

cm-lagoa.pt/panel/gate.php

# Reference: https://pastebin.com/PTkLE0se

bingobongo.space/io213b5obo/admin.php
finik18topw.cc/login.php
gafigaf.in/panel632541/admin.php
jelouslaodnn.org/bnAgxoxMGuqZidGE/login.php

# Reference: https://twitter.com/ViriBack/status/1069980631805894656

bot.jefferyworks.cf

# Reference: https://pastebin.com/p0vBRBTE

betabot.pw/login.php
mandahp.ie/jjc/PHP/
riyanshoppingbags.com/skins/betpla/PHP/
rollscar.pk/auth

masariqroup.com/cynthia/admin.php
masariqroup.com/kabo/admin.php
masariqroup.com/kabospy/admin.php
masariqroup.com/small/admin.php
masariqroup.com/starmoney/panel/admin.php
sensimatino.us/brothershar/lokituoyr/admin.php
slimpityio3.us/slamiptiop/admin.php
slowidyter.us/derty/eer678y/admin.php
slowidyter.us/locash7/lokiuyto/admin.php

# Generic trail, based on https://pastebin.com/p0vBRBTE

/panelnew/admin.php

# Reference: https://twitter.com/ViriBack/status/1094261293693972480

aquavictus.hr/ap/Panel/index.php

# Reference: https://securelist.com/a-predatory-tale/89779/

predatortop.xyz/login/

# Reference: https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-google-play/

addroider.com/users/login/

# Reference: https://twitter.com/James_inthe_box/status/1103617969962213377

/pony/gate.php

# Reference: https://twitter.com/James_inthe_box/status/1102945901025226752

/panelnew/gate.php

# Reference: https://twitter.com/VK_Intel/status/1018656000948260864

/panel/client.php

# Reference: https://twitter.com/x42x5a/status/1107674030897799168

http://45.67.14.206/login.php

# Reference: https://twitter.com/dvk01uk/status/1092685964743503872

/pamss/gate.php

# Reference: https://twitter.com/PRODAFT/status/1105581121595719681

http://89.105.205.103/auth.php

# Reference: https://twitter.com/benkow_/status/1088009157733683200

/zs/chi/cp.php

# Reference: https://twitter.com/ViriBack/status/1080826513266749451

jurasik.serveminecraft.net

# Reference: https://twitter.com/casual_malware/status/1107441450415992832

/WebPanel/api.php

# Reference: https://blog.fox-it.com/2019/03/27/psixbot-the-evolution-of-a-modular-net-bot/

kyrkymalol.000webhostapp.com/admin/

# Reference: https://twitter.com/ViriBack/status/1111440848787402752

evih.scamfreeweb.com/Webpanel/

# Reference: https://twitter.com/albertzsigovits/status/1113096573284728839

powellpablooo.myjino.ru/auth.php
fnsss77.ru/auth.php
darbl.icu/asfdh4/auth.php

# Reference: https://twitter.com/benkow_/status/1090564148184924160

/p4234anel/admin.php

# Reference: https://twitter.com/stecar792/status/1034858782990512128

wasabbybomba.space/auth/login

# Reference: https://twitter.com/malwrhunterteam/status/1114160025021423616

/panel/admin.php
/panel/gate.php

# Reference: https://twitter.com/ViriBack/status/1114319312838385664
# Reference: https://pastebin.com/bE6zUM90

http://157.230.126.238/auth.php
http://185.139.70.14/auth.php
http://185.212.129.138/auth.php
http://185.212.129.235/auth.php
http://185.212.130.74/auth.php
http://185.212.131.59/auth.php
http://185.232.52.38/auth.php
http://185.232.52.39/auth.php
http://185.232.52.40/auth.php
http://185.232.52.41/auth.php
http://185.232.52.42/auth.php
http://185.48.56.212/auth.php
http://188.120.245.150/auth.php
http://188.166.12.64/auth.php
http://198.71.80.217/auth.php
http://199.204.251.111/auth.php
http://51.254.167.180/auth.php
http://5.188.60.115/auth.php
http://5.188.60.24/auth.php
http://5.188.60.30/auth.php
http://5.188.60.7/auth.php
http://77.83.174.46/auth.php
http://89.105.205.103/auth.php
http://91.243.83.31/auth.php
http://92.63.197.173/auth.php
http://95.81.0.22/auth.php

# Reference: https://twitter.com/x42x5a/status/1114468129327984640

westeast.world/auth/login/

# Reference: https://twitter.com/malwrhunterteam/status/1114510622610403328

litehttp.altervista.org/Panel/page.php

# Reference: https://twitter.com/nullcookies/status/1115006946216747008

lolkek.club/login

# Reference: https://twitter.com/malwrhunterteam/status/1115289020421025792

bestpage1.com/blockchain2018/

# Reference: https://twitter.com/x42x5a/status/1115572987816742912

se1ec.com/login

# Reference: https://otx.alienvault.com/pulse/5cacb6c0bd266902183e424b

gepparlan.myjino.ru/auth.php
j941521.myjino.ru/auth.php

# Reference: https://twitter.com/makflwana/status/1115953092090941440

/ba2/admin.php

# Reference: https://twitter.com/PRODAFT/status/1115153591134752768

ethereums.network

# Reference: https://twitter.com/K_N1kolenko/status/1098500517272137728

cba.demdex.uk.com

# Reference: https://twitter.com/malwrhunterteam/status/1117770064114126849

ark-steal-free.tk
duperu.ru
foxpanel734923vbb2.tk

# Reference: https://twitter.com/dave_daves/status/1119185135646195712

hijaiyh.net

# Reference: https://twitter.com/pancak3lullz/status/1119334013246873600

/pony/panel/admin.php
/pony/panel/gate.php

# Reference: https://twitter.com/JayTHL/status/1119686304202207232

/NetSky/login.php
/auth/NetCloud/login.php

# Reference: https://twitter.com/ViriBack/status/1120311322917388288

ashleywalkerfuns.com/2hYbb4x/login.php
dsuda2.com/upload/login.php

# Reference: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

/newcpanel_gate/gate.php

# Reference: https://twitter.com/ViriBack/status/1122527363772887044

/megumin/panel/

# Reference: https://twitter.com/hexlax/status/988881472403763200

untorsnot.in/voice/gate.php
