diff options
| author | hrbrmstr <bob@rud.is> | 2026-06-09 20:44:52 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-06-09 20:44:52 -0400 |
| commit | bd417023bfb20a65052611064b6df9e6bf9ad597 (patch) | |
| tree | 37103a3de59cb098eb971c2db22001ee8882f7c6 /2026/asn215540-report/companions-tier1.md | |
| parent | d7a9bac5ba6b053f46ecd5685b60c2ffd89ea528 (diff) | |
add: asn-report
Diffstat (limited to '2026/asn215540-report/companions-tier1.md')
| -rw-r--r-- | 2026/asn215540-report/companions-tier1.md | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/2026/asn215540-report/companions-tier1.md b/2026/asn215540-report/companions-tier1.md new file mode 100644 index 0000000..4a943ea --- /dev/null +++ b/2026/asn215540-report/companions-tier1.md @@ -0,0 +1,55 @@ +# Tier 1 Companions: Exact Signature Twins + +These 4 hosts share the complete signature set: same PTR `157279.ip-ptr.tech`, same SSH build `OpenSSH_9.6p1 Ubuntu-3ubuntu13.16`, same HASSH `e42184b06d45385a906f0803d04c83da`, same JA4t scan, same Censys exposure labels. + +## Host Details + +### 92.118.112.230 (Original Target) + +- Block: 92.118.112.0/24 +- Location: Atlanta, Georgia, US +- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) +- PTR: 157279.ip-ptr.tech +- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 +- HASSH: e42184b06d45385a906f0803d04c83da +- GreyNoise: Suspicious -- Login Scanner, PAN-OS CVE-2020-2034 Crawler, F5 BIG-IP Crawler, SQLi +- Censys Reputation: benign (model v0.1.0) +- WHOIS Created: 2021-12-24 + +### 89.185.80.144 (Original Target) + +- Block: 89.185.80.0/24 +- Location: Phoenix, Arizona, US +- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) +- PTR: 157279.ip-ptr.tech +- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 +- HASSH: e42184b06d45385a906f0803d04c83da +- GreyNoise: Suspicious -- same tags plus Suspicious Linux Command +- Censys Reputation: benign +- WHOIS Created: 2024-06-28 + +### 89.185.80.183 (Original Target) + +- Block: 89.185.80.0/24 +- Location: Phoenix, Arizona, US +- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) +- PTR: 157279.ip-ptr.tech +- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 +- HASSH: e42184b06d45385a906f0803d04c83da +- GreyNoise: Suspicious -- same tags plus Path Traversal + Sensitive File Access +- Censys Reputation: benign +- WHOIS Created: 2024-06-28 + +### 147.45.60.25 (Best New Companion) + +- Block: 147.45.60.0/24 +- Location: Atlanta, Georgia, US +- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) +- PTR: 157279.ip-ptr.tech +- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 +- HASSH: e42184b06d45385a906f0803d04c83da +- ECDSA Key: a05bfd9d42162150bf91193773642fed509bf8155de96fb468baccd693cce208 +- Forward DNS: zubat.org +- GreyNoise: **Suspicious** -- exact same tag set (Login Scanner, PAN-OS, F5, SQLi, Sensitive File Access, Suspicious Linux Command) +- Censys Reputation: benign +- WHOIS Created: 2024-02-22 |