Loli Stealer configs check stolen log bundles — the output of infostealer malware — and their economy runs on one scarce resource: valid, unexpired, geo-matched cookies for high-value services. A stealer log arriving from an infected machine carries saved passwords, session cookies with expiry timestamps, autofill data, browser metadata, and system fingerprints; the config's job is to run each log through a classification pipeline that separates "this PayPal cookie still carries an authenticated session" from "this Amazon cookie expired three weeks ago" and "this banking cookie is valid but geo-locked to a country the pool cannot exit from." The config dialect differs from checker-client configs (Loli's own block system, its own keycheck semantics), but the anatomy learned in any fork transfers: request blocks carrying the cookie, parsing blocks extracting session-state markers, keycheck classes sorting valid/invalid/expired/banned. This is Loli config-making decoded: the log-bundle anatomy, the cookie-validity flow that actually classifies sessions, the sort-key economics (which domains carry value and why), and the config patterns that survive session-state changes between analysis and use.
ROUTE MAP (PLAIN ENGLISH)
A stealer log bundle is structured, not freeform: a per-victim folder carrying cookies (browser cookie-store exports, domain-keyed, each entry carrying name, value, expiry timestamp, path, secure flag), passwords (site-keyed plaintext pairs from the browser's credential store), autofill (addresses, cards where the browser stored them), system metadata (OS, browser version, hardware fingerprint, country inferred from IP at infection time), and sometimes session artifacts beyond cookies (local-storage tokens, extension data). The checking config consumes one bundle at a time: parse the cookie file, filter to target domains (the config's domain-list: PayPal, Amazon, banking, crypto exchange, email — whatever the operation's value map prioritizes), and for each cookie run a validity probe — an HTTP request to the target domain carrying the cookie, classified by the response: authenticated-content markers (account dashboard HTML, API session-state responses) = valid-session, login-redirect or auth-challenge responses = expired/dead-session, geo-block or IP-reputation responses = valid-but-unusable-without-matching-egress, challenge-page responses = captcha-class (needs solve or matching-egress retry).
The sort economics drive everything. Cookies from high-value domains (financial, email-as-reset-anchor, crypto) carry conversion value; the same cookie from a low-value domain (forum, news-site) is weight. Expiry timestamps pre-filter (an expired cookie never earns a probe request); geo metadata from the infection-time IP sets the egress-matching requirement (a cookie infected in Germany wants a German exit to present coherent session geography); and the browser-version metadata matters because target-side session validation sometimes correlates user-agent family with session age — a cookie born in Chrome 120 presenting through a mismatched UA string reads as session-theft to aggressive session-integrity layers.
STEP 1 - LOG BUNDLE PARSING
STEP 2 - THE COOKIE-VALIDITY PROBE FLOW
STEP 3 - THE CONFIG PATTERNS THAT HOLD
STEP 4 - DOMAIN VALUE MAP AND SORT ECONOMICS
WORKED EXAMPLE - A BUNDLE, END TO END
Bundle arrives: 412 cookie records across 87 domains, system-info shows Chrome 121, infection-country DE. Parse layer: expiry pre-filter kills 289 expired records; domain-list filter (tier-one and tier-two only) keeps 61 candidate cookies across 14 domains; metadata join stamps each with Chrome-121-UA and DE-egress requirement. Probe layer: each cookie checked through a German residential exit, paced at one probe per domain per 8 seconds, UA set to the matching Chrome family/version string. Classification results: 18 valid-session (7 PayPal-class financial, 4 email-provider, 3 crypto exchange, 4 retail — the financial and email records carrying API-layer session-validity markers as anchors), 22 expired-session (login-redirect class — mostly short-session financial domains where the server killed sessions days before the check ran), 9 conditional (geo-block responses — valid-looking cookies that need a different DE-exit or reputation-cleaner egress to confirm), 6 challenge-class (Cloudflare markers on two retail domains — parked for solve-assisted re-probe), 6 dead-at-probe (hard auth-failures). Egress accounting: one DE residential binding for the whole bundle's probes (session coherence), ~51 probe requests total, wall time under 10 minutes at the pacing knob; the 18 valid-session records write to valid.txt with full metadata joins and the probe-timestamp, the 9 conditional write with required-geo tags for the re-probe queue, and the bundle-level stats (18/61 valid-rate, financial-tier valid-rate 7/14) roll into the operation's weekly domain-list tuning review.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
A stealer log bundle is structured, not freeform: a per-victim folder carrying cookies (browser cookie-store exports, domain-keyed, each entry carrying name, value, expiry timestamp, path, secure flag), passwords (site-keyed plaintext pairs from the browser's credential store), autofill (addresses, cards where the browser stored them), system metadata (OS, browser version, hardware fingerprint, country inferred from IP at infection time), and sometimes session artifacts beyond cookies (local-storage tokens, extension data). The checking config consumes one bundle at a time: parse the cookie file, filter to target domains (the config's domain-list: PayPal, Amazon, banking, crypto exchange, email — whatever the operation's value map prioritizes), and for each cookie run a validity probe — an HTTP request to the target domain carrying the cookie, classified by the response: authenticated-content markers (account dashboard HTML, API session-state responses) = valid-session, login-redirect or auth-challenge responses = expired/dead-session, geo-block or IP-reputation responses = valid-but-unusable-without-matching-egress, challenge-page responses = captcha-class (needs solve or matching-egress retry).
The sort economics drive everything. Cookies from high-value domains (financial, email-as-reset-anchor, crypto) carry conversion value; the same cookie from a low-value domain (forum, news-site) is weight. Expiry timestamps pre-filter (an expired cookie never earns a probe request); geo metadata from the infection-time IP sets the egress-matching requirement (a cookie infected in Germany wants a German exit to present coherent session geography); and the browser-version metadata matters because target-side session validation sometimes correlates user-agent family with session age — a cookie born in Chrome 120 presenting through a mismatched UA string reads as session-theft to aggressive session-integrity layers.
STEP 1 - LOG BUNDLE PARSING
- Cookie-store parsing: the browser cookie exports (JSON or SQLite-derived formats depending on the stealer family) get normalized into name-value-expiry records per domain; expiry timestamps (epoch format) pre-filter against current time — expired cookies sort to dead without probing; the secure and same-site flags survive normalization because probe requests must respect them (a Secure cookie on an HTTPS-only probe path, path-scoped cookies only sent when the probe URL matches scope).
- Domain prioritization: the bundle's domains get scored against the operation's value map (financial-services and email providers at top, crypto exchanges next, major retail below, long tail parked) — the config's domain-list parameter defines which domains get probed at all; probing everything in a bundle wastes egress and session-probe budget on domains whose cookies carry no conversion value regardless of validity.
- Metadata join: infection-time country, browser version, and OS from the bundle's system-info file join each cookie record — the joined record is what the probe request composes from (matching egress country where required, UA string matching the browser family and major version), and what the output record carries for downstream use-decisioning (a valid cookie's usability depends on the metadata discipline around it, not just the cookie string itself).
- Password-pair sidecar: the bundle's password store (site-keyed user
ass pairs) routes to a separate checking flow (credential-validity probes, not cookie probes — the reset-anchor value of email credentials documented in the ATO thread applies here at bundle scale); configs that merge cookie-probe and password-probe logic into one flow conflate two different classification taxonomies — keep them as parallel pipelines sharing only the bundle-parsing layer.
STEP 2 - THE COOKIE-VALIDITY PROBE FLOW
- Probe request composition: target domain's known session-verification endpoint (the account page, the API session-state call — whichever returns unambiguous authenticated-content markers), carrying the cookie header exactly as scoped (secure, path, domain rules respected from the parsed record), UA string matching the bundle's browser metadata, and egress through an exit matching the infection-time geography where the target correlates session geography.
- Classification keycheck: authenticated-content markers (account-page structural strings, API response codes indicating session-state valid) = valid-session; login-redirect chains or auth-challenge responses = expired-session (cookie string was real, session died server-side between infection and check — the common case on financial domains with short session lifetimes); IP-reputation blocks and geo-mismatches = conditional-class (cookie probably valid, egress wrong — re-probe class on matching egress before declaring dead); challenge-page markers = captcha-class (solve or matching-egress retry per the anti-captcha branch logic).
- Expiry-discipline honesty: a cookie's local expiry timestamp is the browser's copy, not the server's authoritative session-death time — cookies with local expiry in the future still classify expired when the server's session died earlier (financial services rotate sessions aggressively), which is why the probe response classification, never the local timestamp alone, decides final validity; the timestamp's real role is pre-filtering obvious dead weight before any probe fires.
- Output classes: valid.txt (cookie + joined metadata + probe-egress used), dead.txt (expired-session class with redirect-detail), conditional.txt (egress-dependent, with required-geo tag), captcha.txt (parked for solve-assisted re-probe), and the never-probed file (expired-at-parse and low-value-domain filters, recorded with reason for audit); each class feeds a different downstream use path, which is why the taxonomy's granularity is the config's real product.
STEP 3 - THE CONFIG PATTERNS THAT HOLD
- Per-bundle state: each log bundle checks as an isolated unit (its own request-context, its own egress binding where geo-matched) — mixing cookies from different bundles into one probe session breaks the metadata coherence (different infection geographies, different browser fingerprints arriving through one exit), which aggressive session-integrity layers score as theft-signature.
- Request pacing: session-probe velocity per target domain gets throttled (the same per-domain pacing discipline as any checker hitting one service from one exit — bursts of session-validations from one IP pattern into reputation scoring); the pacing knob is per-target-domain, not global, because value-dense domains (financial) deserve tighter pacing than the long tail.
- Response-depth keycheck: session-validity markers anchored on API-layer responses (JSON session-state fields) where the target exposes them, structural-HTML markers as fallback — front-end redesigns break HTML anchors; API response codes survive; the longest-lived Loli configs key on the API layer and treat HTML as secondary evidence.
- Re-check discipline: valid-session classifications carry a timestamp; session validity decays (server-side rotation, user password-changes invalidating sessions, security-events killing session sets), so the valid file ages and re-probe passes re-validate before use — a three-week-old "valid" classification is a hypothesis, not a fact, and downstream use treating it as fact burns the cookie and sometimes triggers the security-event that kills the whole related session set.
STEP 4 - DOMAIN VALUE MAP AND SORT ECONOMICS
- Tier one (financial and reset-anchor): banking, payment processors, crypto exchanges, and primary email providers — email sits here because of the reset-anchor economics documented in the ATO thread (inbox ownership cascades into every service anchored to it); cookies from these domains carry the highest conversion value and deserve the tightest pacing, the strictest egress-matching, and the freshest re-check discipline.
- Tier two (major retail and commerce): Amazon-class marketplaces, major merchants — cookies convert through account-age trust (purchase limits, saved instruments, loyalty balances — the loyalty-cashout lane's economics apply at cookie-use scale); value below tier one but volume higher in typical bundles.
- Tier three (social and communications): social platforms, messaging — value in secondary conversion (identity-graph extraction, scam-infrastructure accounts) rather than direct balance; useful for operations that monetize account access graphs, low priority for pure cashout pipelines.
- The long tail: everything else — typically 80%+ of any bundle's domain count carrying near-zero conversion value; the config's domain-list filter exists precisely to keep this tail from consuming probe budget; bundle-level statistics (valid-rate per tier, geo-distribution of valids) feed the next batch's domain-list tuning, which is where experienced Loli operators' configs diverge from template ones.
WORKED EXAMPLE - A BUNDLE, END TO END
Bundle arrives: 412 cookie records across 87 domains, system-info shows Chrome 121, infection-country DE. Parse layer: expiry pre-filter kills 289 expired records; domain-list filter (tier-one and tier-two only) keeps 61 candidate cookies across 14 domains; metadata join stamps each with Chrome-121-UA and DE-egress requirement. Probe layer: each cookie checked through a German residential exit, paced at one probe per domain per 8 seconds, UA set to the matching Chrome family/version string. Classification results: 18 valid-session (7 PayPal-class financial, 4 email-provider, 3 crypto exchange, 4 retail — the financial and email records carrying API-layer session-validity markers as anchors), 22 expired-session (login-redirect class — mostly short-session financial domains where the server killed sessions days before the check ran), 9 conditional (geo-block responses — valid-looking cookies that need a different DE-exit or reputation-cleaner egress to confirm), 6 challenge-class (Cloudflare markers on two retail domains — parked for solve-assisted re-probe), 6 dead-at-probe (hard auth-failures). Egress accounting: one DE residential binding for the whole bundle's probes (session coherence), ~51 probe requests total, wall time under 10 minutes at the pacing knob; the 18 valid-session records write to valid.txt with full metadata joins and the probe-timestamp, the 9 conditional write with required-geo tags for the re-probe queue, and the bundle-level stats (18/61 valid-rate, financial-tier valid-rate 7/14) roll into the operation's weekly domain-list tuning review.
WORKING SEQUENCE
Code:
loli config flow: bundle parse (cookies+passwords+system-info) -> expiry pre-filter (local timestamp kills obvious dead) -> domain-list filter (tier map: financial/email/crypto > retail > social > tail) -> metadata join (UA family+version, infection-geo egress requirement) -> per-bundle probe session (one egress binding, domain-paced, UA matched) -> classify: valid-session (API/HTML auth markers), expired (redirect class), conditional (egress-dependent, re-probe tag), captcha (solve branch) -> password sidecar as parallel pipeline -> valid-file ages, re-probe before use, bundle stats feed domain-list tuningQUICK ANSWERS
- What does a Loli config actually check? Stealer-log bundles — the infected-machine exports carrying cookies, passwords, autofill, and system metadata; the config parses the bundle, filters cookies to value-dense domains, probes session-validity per cookie with metadata-coherent requests, and classifies: valid-session, expired, egress-conditional, or captcha-parked — the classification taxonomy feeding whatever conversion pipeline consumes the results.
- Why do valid-looking cookies still fail downstream? Session-validity decays server-side (rotation, password-changes, security-events) and aggressive targets correlate session geography and browser fingerprint with the cookie's origin metadata — a three-week-old valid-classification used without re-probe, or presented through mismatched egress/UA, reads as session-theft to integrity layers and burns the cookie plus sometimes the related session set; freshness and metadata coherence are use-preconditions, not niceties.
- What is the conditional class for? Cookies that probe as geo-blocked or reputation-blocked rather than auth-dead — the session itself looks intact but the egress was wrong (country mismatch, burned IP-range); these re-probe on matching, reputation-clean egress before any validity verdict, because declaring them dead throws away real sessions and declaring them valid without re-probe burns them on first use from bad exits.
- Why check cookies per-bundle, not in bulk across bundles? Each bundle carries one victim's coherent fingerprint (infection-geo, browser version, system metadata) — mixing cookies from different bundles into one probe session presents unrelated fingerprints through one egress, which is a theft-signature any session-integrity layer scores immediately; per-bundle isolation keeps each probe stream internally coherent, which is what keeps valid-rates honest and egress reputation intact.
- Where does the password sidecar fit? As a parallel pipeline sharing only the bundle-parsing layer — site-keyed credential pairs classify through credential-validity probes (login-flow checks) with their own taxonomy, and the reset-anchor economics (email credentials cascading into every service anchored to that inbox) put email-tier password pairs at the same value tier as financial cookies; merging cookie-probe and password-probe logic into one flow conflates two different classification taxonomies and muddies both result sets.
- How long does a valid-session classification stay true? Hours-to-days on financial domains (short session lifetimes, aggressive rotation), days-to-weeks on retail and social; the timestamp on every valid-record is what lets consumers apply age-discipline — re-probe before use regardless of age class, treat stale "valid" as a hypothesis, because the server's session-death clock runs independently of the local expiry timestamp the bundle carried.
RELATED