diff options
| author | hrbrmstr <bob@rud.is> | 2026-06-08 07:05:50 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-06-08 07:05:50 -0400 |
| commit | d7a9bac5ba6b053f46ecd5685b60c2ffd89ea528 (patch) | |
| tree | 72e674b58f34b04a92b41b0b268efafff407f68d /kevlar/2026-06-08/iocs/fingerprints.txt | |
| parent | 459bf07097e9da493b92244c2b4d1eb0682dee29 (diff) | |
add: iocs
Diffstat (limited to 'kevlar/2026-06-08/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-06-08/iocs/fingerprints.txt | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/kevlar/2026-06-08/iocs/fingerprints.txt b/kevlar/2026-06-08/iocs/fingerprints.txt new file mode 100644 index 0000000..b8e8bdc --- /dev/null +++ b/kevlar/2026-06-08/iocs/fingerprints.txt @@ -0,0 +1,12 @@ +# JA4 TLS Fingerprints +t13i1909h2_9dc949149365_97f8aa674fd9 -- FlokiNET C2 beacon (185.100.87.136) +# JA4H HTTP Fingerprints +po11nn0700_fb204b7f5765 -- POST to /login/?login_only=1, Chrome 146, HOSTKEY (82.21.114.69) +ge11nn0500_e2433fe505a0 -- GET /openid_connect/cpanelid, Chrome 146, HOSTKEY (82.21.114.69) +ge11nn0400_9c3956fad5da -- Firefox 140 on Linux, THE (45.83.20.230), KAOPU-HK (154.205.145.161, go-dockerclient) +ge11nn0300_0db47b7d240d -- Go-http-client/1.1, AEZA (77.221.152.105), Pfcloud +po11nn0600_c9506d37ac14 -- SPARK C2 POST, FlokiNET (185.100.87.136) +ge11nn0400_88d30a62b7ad -- Firefox-like UA with TLS, FlokiNET (185.100.87.136) +# HASSH SSH Fingerprints +e54ef3ec27fe1fea7ab64d3fa05359fd -- Go SSH client, WorkTitans THE AS209847 (185.231.207.151) +41ff3ecd1458b0bf86e1b4891636213e -- OpenSSH 8.9p1 server, shared across PLI-AS and Pfcloud |