# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://unit42.paloaltonetworks.com/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/

androydiha.ir
ib3.ibot24.com
gold.teleagent.ir
mr-mehran.tk
shahin-soori.ir
09152104574nazimilad.000webhostapp.com
abolking.000webhostapp.com
botmohsan-apk.000webhostapp.com
darkforceteam.000webhostapp.com
mbosoba.000webhostapp.com
mohsan024024.000webhostapp.com
rr5.000webhostapp.com

# Reference: https://twitter.com/LukasStefanko/status/1249120527995883520

siteapi-iran6545852.fandogh.cloud
sunpax.ga

# Generic trails

/Bot/Ejsahahbot/
/bots/rat/upload_file.php
/hackelmi_bot/index.php
/Ratjadidebot/index.php
