Create pinkslipbot.txt
Create pinkslipbot.txt

The second attempt. The single normal applicable sign is ```/bot_serv```. See snippet in article:

```
If any port-forwarding request succeeds (and if other open ports are found), the malware saves the port number into a buffer and removes the port-mapping rule. The port-forwarding results are submitted to the control server using an HTTP POST request:

URL: hxxps://{control server-IP-Address}:{Port}/bot_serv
POST-DATA:
cmd=1&msg={obfuscated-string}&ports=993,80,465,21,50000,61200,61202
````

Google says OK to have such one: ``` inurl:"/bot_serv"```
stamparm/maltrail,stamparm/maltrail,stamparm/maltrail,stamparm/maltrail