# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://viriback.com/30-days-later-97-panels/
# Reference: https://twitter.com/SevenLayerJedi/status/979030953275293702

/adin/admin.php
/ajjuu/admin.php
/alti/admin.php
/alti/gate.php
/aman/admin.php
/aman/gate.php
/bass/admin.php
/bes/admin.php
/bes/gate.php
/bfayz/admin.php
/buch-A3/admin.php
/carik/admin.php
/centr/admin.php
/dazzl/admin.php
/dokuz/admin.php
/dokuz/gate.php
/dort/admin.php
/dort/gate.php
/effic/admin.php
/etops/admin.php
/grand/admin.php
/grind/admin.php
/hoste/admin.php
/hyper/admin.php
/juzz/admin.php
/klinsnip/admin.php
/lunke/admin.php
/nonib/admin.php
/office1/admin.php
/on/admin.php
/on/gate.php
/preut/admin.php
/roks2/admin.php
/rolex/admin.php
/ruder/admin.php
/sekiz/admin.php
/sekiz/gate.php
/sop/admin.php
/sop/gate.php
/surup/admin.php
/total/admin.php
/twst/admin.php
/user/admin.php
/vingl/admin.php
/yedi/admin.php
/yedi/gate.php

# Generic trail, based on https://pastebin.com/p0vBRBTE
# Reference: https://twitter.com/James_inthe_box/status/1102945901025226752

/panelnew/admin.php
/panelnew/gate.php

# Reference: https://twitter.com/VK_Intel/status/1018656000948260864

/panel/client.php

# Reference: https://twitter.com/dvk01uk/status/1092685964743503872

/pamss/gate.php

# Reference: https://twitter.com/benkow_/status/1088009157733683200

/zs/chi/cp.php

# Reference: https://twitter.com/casual_malware/status/1107441450415992832

/WebPanel/api.php

# Reference: https://twitter.com/benkow_/status/1090564148184924160

/p4234anel/admin.php

# Reference: https://twitter.com/malwrhunterteam/status/1114160025021423616

/panel/admin.php
/panel/gate.php

# Reference: https://twitter.com/makflwana/status/1115953092090941440

/ba2/admin.php

# Reference: https://twitter.com/JayTHL/status/1119686304202207232

/NetSky/login.php
/auth/NetCloud/login.php

# Reference: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

/newcpanel_gate/gate.php

# Reference: https://twitter.com/ViriBack/status/1122527363772887044

/megumin/panel/

# Reference: https://twitter.com/dave_daves/status/1129401061696036864

/Mpanel_V1.0.1

# Reference: https://twitter.com/webtobesocial/status/778654938276720642

/FuckYouMother/panel/

# Reference: https://twitter.com/P3pperP0tts/status/1152538885974634496

/34-wp-mailing.php

# Reference: https://twitter.com/ViriBack/status/1155093166841892864

/panels_encoded/login.php

# Reference: https://twitter.com/tkanalyst/status/1166855006596681730

/loader/login.php

# Reference: https://twitter.com/ViriBack/status/1183030287485329410

/panel/auth.php
/panel/login.php
/panel2/admin.php
/panel2/auth.php
/panel2/login.php
/Panel17/admin.php
/Panel17/auth.php
/Panel17/login.php

# Reference: https://twitter.com/pancak3lullz/status/1022845906041929728

/newsite/panelnew/

# Reference: https://twitter.com/darienhuss/status/1192736459167588353 (# Cyber Agent)
# Reference: https://www.virustotal.com/gui/file/04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30/detection
# Reference: http://benkow.cc/wp_prezo.pdf

/android_panel/

# Reference: https://twitter.com/0xCARNAGE/status/1199700157127892992

/webpanel/inc/

# Reference: https://github.com/silence-is-best/c2db#agenttesla

/zin/WebPanel/

# Reference: https://twitter.com/gorimpthon/status/1242842075202109440

/webpanel1/

# Reference: https://www.virustotal.com/gui/file/e394e53e53cd9047d6cff184ac333ef7698a34b777ae3aac82c2c669ef661dfe/detection

/webpanel/getcommands.php
/webpanel/getsettings.php
/webpanel/report.php

# Reference: https://www.virustotal.com/gui/domain/rdssh.xyz/relations
# Reference: https://twitter.com/500mk500/status/1247815865816489985

rdssh.xyz

# Reference: # Reference: https://twitter.com/malwrhunterteam/status/1255907032944775171

/inc/server/gate.php

# Reference: https://twitter.com/bad_packets/status/1255983398775975937

http://213.128.93.199

# Reference: # Reference: https://www.virustotal.com/gui/domain/rabok.io/relations

/webpanel/abj/
/webpanel/coach/

# Reference: https://twitter.com/W3B_B3ND3R/status/1237694235748577280
# Reference: https://www.virustotal.com/gui/ip-address/27.254.33.56/relations

/admin_panel/inj/

# Reference: https://twitter.com/James_inthe_box/status/1258099799066243072

/js/webpanel/

# Reference: https://twitter.com/JAMESWT_MHT/status/1270997007180730368
# Reference: https://twitter.com/James_inthe_box/status/1273983069435789316
# Reference: https://app.any.run/tasks/4dede486-355d-4e84-874c-d9318532db23/

/webpanel/0/inc/
/webpanel/1/inc/
/webpanel/2/inc/
/webpanel/3/inc/
/webpanel/4/inc/
/webpanel/5/inc/
/webpanel/6/inc/
/webpanel/7/inc/
/webpanel/8/inc/
/webpanel/9/inc/

# Generic

/admin_123/auth.php
/admin_123/index.php
/admin_123/gate.php
/admin_123/login.php
/admin_123/page.php
/logz/auth.php
/logz/login.php
/Panel/callback.php
/panel/gate.php
/Panel/index.php
/Panel/page.php
/panel2/gate.php
/panel3_info/index.php
/panel123/auth.php
/panel123/login.php
/panel632541/admin.php
/pnl/auth.php
/pnl/login.php
/webpanel/auth.php
/webpanel/api.php
/webpanel/login.php
/webpanel1/auth.php
/webpanel1/api.php
/webpanel1/login.php
