SlowMist also said the payload collects data under criteria that go beyond three rules for specific websites.