diff options
| author | hrbrmstr <bob@rud.is> | 2026-06-22 06:54:25 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-06-22 06:54:25 -0400 |
| commit | 4294adbcb3a35e85f3107922e953aa98158989d7 (patch) | |
| tree | 4af343254c8181155285cc6242c142638fb117da /kevlar/2026-06-20/iocs/fingerprints.txt | |
| parent | bef08f968baf5e0fa534b4c2c95b07ab8416e70c (diff) | |
add: 2026-06-20 kevlar iocs
Diffstat (limited to 'kevlar/2026-06-20/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-06-20/iocs/fingerprints.txt | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/kevlar/2026-06-20/iocs/fingerprints.txt b/kevlar/2026-06-20/iocs/fingerprints.txt new file mode 100644 index 0000000..8b74903 --- /dev/null +++ b/kevlar/2026-06-20/iocs/fingerprints.txt @@ -0,0 +1,12 @@ +# Unique Fingerprints Observed -- Weekly BP Report 2026-06-20 +# Generated: 2026-06-22T10:44:00Z + +# JA4 TLS Fingerprints +t13i131000_f57a46bbacb6_ab7e3b40a677 -- Go TLS client, observed on 3 IPs across KAOPU-HK and THE ASNs; TLSv1.3 AES_128_GCM_SHA256 + +# JA3 Legacy Fingerprints +2196848d251b217de8b2c037e356c11d -- Go TLS client (JA3 equivalent of above), seen on KAOPU-HK IPs (38.60.254.173, 154.203.143.169) + +# JA4H HTTP Fingerprints +ge11nn0300_0db47b7d240d -- Go-http-client/1.1, KAOPU-HK (38.60.254.173), probing HTTP/HTTPS/9200 +po11nn0700_4784ccc9db2c -- Mozilla/4.0 compatible MSIE 6.0 UPnP client, KAOPU-HK (149.104.66.228), UPnP AddPortMapping attempts |