# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: salat stealer

# Reference: https://x.com/suyog41/status/1889999593716506942
# Reference: https://x.com/abuse_ch/status/1952720761472373029
# Reference: https://app.validin.com/detail?find=fd64809b0b5016081e0b04018fa3f90c&type=hash&ref_id=03c4bce5f94#tab=host_pairs (# 2025-08-05)
# Reference: https://www.virustotal.com/gui/file/0c813f621e562cefb8c2099e0e89deb9d92e9b1c8d59969a786c5a3621f285a6/detection

krista-tur.ru
pidorasina.ru
posholnahuy.ru
sa1at.ru
salat.cn
salator.ru
webr.at
webrat.in
webrat.ru
webrat.su
webrat.top
webrat.uk
websalat.top
wrat.in

# Reference: https://x.com/skocherhan/status/1902163232560689553
# Reference: https://www.virustotal.com/gui/file/52a1750dc75795faa2bfdd3405ee027ee7a4fe78928027a5439372312479ca33/detection

194.87.115.90:55880
ws2.webrat.top

# Reference: https://www.virustotal.com/gui/file/0497be05152e5790464006a581ad98f89fc9415f8cfcc135918b2e80493ea28c/detection

193.33.206.11:55880

# Reference: https://www.virustotal.com/gui/file/823c21e5390a943a1dad0ee356712698e7564c5802304375957ce77c0005523d/detection

62.109.0.189:443

# Reference: https://app.validin.com/detail?find=%2FC%3DUS%2FST%3DAbama%2FL%3DObama%2FO%3DEbeme%2FOU%3DKurwa%20bobr%2FCN%3DResolver%2FemailAddress%3Dputin%40kremlin.ru&type=raw&ref_id=86fca993260#tab=host_pairs (# 2025-08-05)

188.213.165.49:443
5.249.150.82:443
62.109.0.189:443
79.137.32.60:443
82.202.130.32:443
90.156.168.187:443

# Reference: https://x.com/Fact_Finder03/status/1958752423226331473

webrat.site

# Reference: https://www.virustotal.com/gui/file/2a445dfd9edba060f9d12ab9223646f73922fc4e1b2945ccc79445bac778fab8/detection

http://193.233.113.101
