Hello, I'm packet sniffing on most of the Stealers and they are all using this URL.

/secret/keys.php

is anyone familiar with this?