_id 5fb6f95b6e308a5ed025ffb0
reference ['']
md5 ['d2030a6ef6083dcdc87248822594c255']
sha1 []
sha256 []
mail []
ip []
domain ['']
url ['']
user lazy_daemon
tweet @abuse_ch @malware_traffic looks like I have to update my blog post on trickbot fake IPs. see . the configs for your sample can be found here: Seems like fake IPs and at least one real IP are mixed together in the config.
id 1329364076733100033
retweets 0
mentions ['@abuse_ch', '@malware_traffic']
hashtags []
date 2020-11-19 10:01:08
timestamp 1605776468