# Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://viriback.com/30-days-later-97-panels/
# Reference: https://twitter.com/SevenLayerJedi/status/979030953275293702

/adin/admin.php
/ajjuu/admin.php
/alti/admin.php
/alti/gate.php
/aman/admin.php
/aman/gate.php
/bass/admin.php
/bes/admin.php
/bes/gate.php
/bfayz/admin.php
/buch-A3/admin.php
/carik/admin.php
/centr/admin.php
/dazzl/admin.php
/dokuz/admin.php
/dokuz/gate.php
/dort/admin.php
/dort/gate.php
/effic/admin.php
/etops/admin.php
/grand/admin.php
/grind/admin.php
/hoste/admin.php
/hyper/admin.php
/juzz/admin.php
/klinsnip/admin.php
/lunke/admin.php
/nonib/admin.php
/office1/admin.php
/on/admin.php
/on/gate.php
/preut/admin.php
/roks2/admin.php
/rolex/admin.php
/ruder/admin.php
/sekiz/admin.php
/sekiz/gate.php
/sop/admin.php
/sop/gate.php
/surup/admin.php
/total/admin.php
/twst/admin.php
/user/admin.php
/vingl/admin.php
/yedi/admin.php
/yedi/gate.php

# Generic trail, based on https://pastebin.com/p0vBRBTE
# Reference: https://twitter.com/James_inthe_box/status/1102945901025226752

/panelnew/admin.php
/panelnew/gate.php

# Reference: https://twitter.com/VK_Intel/status/1018656000948260864

/panel/client.php

# Reference: https://twitter.com/dvk01uk/status/1092685964743503872

/pamss/gate.php

# Reference: https://twitter.com/benkow_/status/1088009157733683200

/zs/chi/cp.php

# Reference: https://twitter.com/casual_malware/status/1107441450415992832

/WebPanel/api.php

# Reference: https://twitter.com/benkow_/status/1090564148184924160

/p4234anel/admin.php

# Reference: https://twitter.com/malwrhunterteam/status/1114160025021423616

/panel/admin.php
/panel/gate.php

# Reference: https://twitter.com/makflwana/status/1115953092090941440

/ba2/admin.php

# Reference: https://twitter.com/JayTHL/status/1119686304202207232

/NetSky/login.php
/auth/NetCloud/login.php

# Reference: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

/newcpanel_gate/gate.php

# Reference: https://twitter.com/ViriBack/status/1122527363772887044

/megumin/panel/

# Reference: https://twitter.com/dave_daves/status/1129401061696036864

/Mpanel_V1.0.1

# Reference: https://twitter.com/webtobesocial/status/778654938276720642

/FuckYouMother/panel/

# Reference: https://twitter.com/P3pperP0tts/status/1152538885974634496

/34-wp-mailing.php

# Reference: https://twitter.com/ViriBack/status/1155093166841892864

/panels_encoded/login.php

# Reference: https://twitter.com/tkanalyst/status/1166855006596681730

/loader/login.php

# Reference: https://twitter.com/ViriBack/status/1183030287485329410

/panel/auth.php
/panel/login.php
/panel2/admin.php
/panel2/auth.php
/panel2/login.php
/Panel17/admin.php
/Panel17/auth.php
/Panel17/login.php

# Reference: https://twitter.com/pancak3lullz/status/1022845906041929728

/newsite/panelnew/

# Reference: https://twitter.com/darienhuss/status/1192736459167588353 (# Cyber Agent)
# Reference: https://www.virustotal.com/gui/file/04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30/detection
# Reference: http://benkow.cc/wp_prezo.pdf

/android_panel/

# Reference: https://twitter.com/0xCARNAGE/status/1199700157127892992

/webpanel/inc/

# Reference: https://github.com/silence-is-best/c2db#agenttesla

/zin/WebPanel/

# Reference: https://twitter.com/gorimpthon/status/1242842075202109440

/webpanel1/

# Reference: https://www.virustotal.com/gui/file/e394e53e53cd9047d6cff184ac333ef7698a34b777ae3aac82c2c669ef661dfe/detection

/webpanel/getcommands.php
/webpanel/getsettings.php
/webpanel/report.php

# Reference: https://www.virustotal.com/gui/domain/rdssh.xyz/relations
# Reference: https://twitter.com/500mk500/status/1247815865816489985

rdssh.xyz

# Reference: # Reference: https://twitter.com/malwrhunterteam/status/1255907032944775171

/inc/server/gate.php

# Reference: https://twitter.com/bad_packets/status/1255983398775975937

http://213.128.93.199

# Reference: # Reference: https://www.virustotal.com/gui/domain/rabok.io/relations

/webpanel/abj/
/webpanel/coach/

# Reference: https://twitter.com/W3B_B3ND3R/status/1237694235748577280
# Reference: https://www.virustotal.com/gui/ip-address/27.254.33.56/relations

/admin_panel/inj/

# Reference: https://twitter.com/James_inthe_box/status/1258099799066243072

/js/webpanel/

# Reference: https://twitter.com/JAMESWT_MHT/status/1270997007180730368
# Reference: https://twitter.com/James_inthe_box/status/1273983069435789316
# Reference: https://app.any.run/tasks/4dede486-355d-4e84-874c-d9318532db23/

/webpanel/0/inc/
/webpanel/1/inc/
/webpanel/2/inc/
/webpanel/3/inc/
/webpanel/4/inc/
/webpanel/5/inc/
/webpanel/6/inc/
/webpanel/7/inc/
/webpanel/8/inc/
/webpanel/9/inc/

# Reference: https://pastebin.com/XdZhSj7j

/covid_tmp/login.php
/covid/login.php
/covid2/login.php

# Reference: https://twitter.com/0bfusCat/status/1250825370854711301

/covid_tmp/gate.php
/covid/gate.php
/covid2/gate.php

# Reference: https://twitter.com/ViriBack/status/1295874240298786818

/admin_panel_x/

# Reference: https://twitter.com/ViriBack/status/1299807425457983488

kitesgcc.com/stater/login.php

# Reference: https://www.virustotal.com/gui/file/e6adf77159291010642dd230f3b63af20a9779ba68617b9e093ce1f4eccd8edd/detection

/rat/login.php

# Reference: https://twitter.com/ViriBack/status/1329581239775490051

/asnbot/login.php

# Reference: https://twitter.com/JCyberSec_/status/1331918362901884930

/newbot/login.php

# Reference: https://twitter.com/InQuest/status/1333557936321388544

http://82.146.41.245

# Reference: https://github.com/stamparm/maltrail/commit/733a4d2029755ad71c84caf07fc8dfb0e8332e60

irmihan.ir

# Reference: https://www.virustotal.com/gui/file/cd7820a08e7c82332ad4af643dd5fd76ddf7477792bea55f371969297655a7a9/detection
# Reference: https://www.virustotal.com/gui/file/594941be0746d39a1acea9bbce3709c0f02d734afff52e5d68a62186c2022e7b/detection

/tCustom/cpanel/

# Reference: https://www.virustotal.com/gui/file/052bd14bbab4e77bd52086a405b30e8bfa210e6820549cb69217333e32184a28/detection
# Reference: https://github.com/stamparm/maltrail/pull/14532/commits/02c159f496f7d40b1f1ecdb0af46a917a5d6b60d

/ajax/panel.htm

# Reference: https://www.virustotal.com/gui/ip-address/89.38.97.71/relations

crmbelgin.com

# Reference: https://twitter.com/reecdeep/status/1362774727736111104

http://172.105.70.225

# Reference: https://twitter.com/D3LabIT/status/1362778009103699975

mobileokey-in.com

# Reference: https://twitter.com/wwp96/status/1364290090839797763
# Reference: https://app.any.run/tasks/d7d282b9-d6c9-4633-9172-569f44582a84/

/Pnl/tasks.php

# Reference: https://twitter.com/wwp96/status/1374085642309804039
# Reference: https://app.any.run/tasks/8f3c8422-e6ea-4738-9e47-c1e7b910e91d/

/niggab-x/panel/

# Reference: https://github.com/hardenedlinux/hardenedlinux-zeek-script/blob/master/scripts/frameworks/intel/OSINT/CYBERCRiME-03-03-19.txt
# Reference: https://www.virustotal.com/gui/file/a49f23aac652d63d1529338a12b3ba424d0b4eab637af8ffa7d9e557fb441a37/detection

/KJdjhUhf84Nfhewfndg/admin.php
/mfbjhth8g4sfmssfgeq/admin.php

# Reference: https://twitter.com/500mk500/status/1390787243984445440

reportyuwt4sbackv97qarke3.com
trackpressure.website

# Reference: https://twitter.com/petrovic082/status/1391398513272135682
# Reference: https://twitter.com/petrovic082/status/1391715478716964864

vmi212260.contaboserver.net
vscode.workingfeedback.cloud

# Reference: http://tracker.viriback.com/dump.php

/~zadmin/

# Generic

/admin_123/auth.php
/admin_123/index.php
/admin_123/gate.php
/admin_123/login.php
/admin_123/page.php
/administrator/he1p/
/bhadmin.php
/bhadminb.php
/bot/adminpanel/
/bot/adminpanel/admin.php
/bot/adminpanel/api.php
/bot/adminpanel/auth.php
/bot/adminpanel/gate.php
/bot/adminpanel/index.php
/bot/adminpanel/login.php
/bot/adminpanel/page.php
/bot/adminpanel/panel.php
/botnet/admin.php
/botnet/api.php
/botnet/auth.php
/botnet/gate.php
/botnet/index.php
/botnet/login.php
/botnet/page.php
/botnet/panel.php
/botpanel/
/bot/Panel/
/C24_Panel/
/cgi%20bin/Panel/
/Formgrab%20Access%20Panel/
/FuckYouMother/panel/
/jujubiadmin/
/logz/auth.php
/logz/login.php
/nd081112/panel.php
/panel/?admin
/panel/?auth
/panel/?callbak
/panel/?gate
/panel/?index
/panel/?login
/Panel/panel/admin.php
/Panel1/panel/admin.php
/Panel2/panel/admin.php
/Panel3/panel/admin.php
/Panel4/panel/admin.php
/Panel5/panel/admin.php
/Panel6/panel/admin.php
/Panel7/panel/admin.php
/Panel8/panel/admin.php
/Panel9/panel/admin.php
/Panel10/panel/admin.php
/Panel/bot.php
/Panel/callback.php
/panel/gate.php
/Panel/index.php
/Panel/page.php
/panel2/gate.php
/panel3_info/index.php
/panel123/admin.php
/panel123/api.php
/panel123/auth.php
/panel123/gate.php
/panel123/index.php
/panel123/login.php
/panel123/page.php
/panel2/cp.php
/panel3/file.php
/panel3/gate.php
/panel632541/admin.php
/panelphp/admin.php
/panelphp/auth.php
/panelphp/callback.php
/panelphp/gate.php
/panelphp/index.php
/panelphp/login.php
/paneltwotwo/
/panl/admin.php
/panl/auth.php
/panl/callback.php
/panl/gate.php
/panl/index.php
/panl/login.php
/pnl/auth.php
/pnl/login.php
/_panelpriv/
/Panel/Web-Panel/
/PowerPanel/
/slim/panel/
/Web%20Panel/upload/
/webpanel/auth.php
/webpanel/api.php
/webpanel/login.php
/webpanel1/auth.php
/webpanel1/api.php
/webpanel1/login.php
