# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://securelist.com/mobile-banker-riltok/91374/

alr992.date
avito-app.pw
backfround2.pw
background1.xyz
blacksolider93.com
blass9g087.com
brekelter2.com
broplar3hf.xyz
buy-youla.ru
cd78cg210xy0.com
copsoiteess.com
farmatefc93.org
firstclinsop.com
holebrhuhh3.com
holebrhuhh45.com
karambga3j.net
le22999a.pw
leboncoin-bk.top
leboncoin-buy.pw
leboncoin-cz.info
leboncoin-f.pw
leboncoin-jp.info
leboncoin-kp.top
leboncoin-ny.info
leboncoin-ql.top
leboncoin-tr.info
myyoula.ru
sell-avito.ru
sell-youla.ru
sentel8ju67.com
subito-li.pw
subitop.pw
web-gumtree.com
whitehousejosh.com
whitekalgoy3.com
youlaprotect.ru

# Reference: https://twitter.com/benkow_/status/1151047351341072385
# Reference: https://twitter.com/benkow_/status/1151049415345524736
# Reference: https://pastebin.com/Yy4HBYaj

^[a-z]{1,3}\-leboncoin\.(com|info|me|top)$
^leboncoin\-[a-z]{1,3}\.(com|info|me|top)$

# Reference: https://twitter.com/benkow_/status/1143805261024546816

/3lfk3jGj/

# Reference: https://twitter.com/sh1shk0va/status/1196385062457085953

www-willhaben.com

# Generic (heur) detection

/admindo/login.php
/relise2319/gate.php
/relise2319/gating.php
