3 ms·

Or the mySQL dump?

• CGamesPlay 2y ago
  That one appeared to set a replication host and then uses a canary DNS record to do the triggering. The canary payload is just base64 encoded, so it's not hard to reverse engineer if you spot it.