aboutsummaryrefslogtreecommitdiff
path: root/kevlar/2026-06-29/iocs/fingerprints.txt
diff options
context:
space:
mode:
authorhrbrmstr <bob@rud.is>2026-06-29 11:30:54 -0400
committerhrbrmstr <bob@rud.is>2026-06-29 11:30:54 -0400
commitba215928b4f787ea110d7e02e20eb65b0d3b976f (patch)
tree9461a7d718925d711a0145444d555b8cb8e85e05 /kevlar/2026-06-29/iocs/fingerprints.txt
parentc1f51821d5c91c7d91a48255efef138379e7c8fc (diff)
add: weekly update
Diffstat (limited to 'kevlar/2026-06-29/iocs/fingerprints.txt')
-rw-r--r--kevlar/2026-06-29/iocs/fingerprints.txt10
1 files changed, 10 insertions, 0 deletions
diff --git a/kevlar/2026-06-29/iocs/fingerprints.txt b/kevlar/2026-06-29/iocs/fingerprints.txt
new file mode 100644
index 0000000..5e3bf90
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/fingerprints.txt
@@ -0,0 +1,10 @@
+# JA4 TLS Fingerprints
+t13i190800_9dc949149365_97f8aa674fd9 -- seen on 176.65.132.162, .env scanning, PFCLOUD
+
+# JA4H HTTP Fingerprints
+ge11nn0300_86b6b04cb9cc -- Mozilla/5.0 scanner, multiple IPs, PFCLOUD
+ge11nn0400_9c3956fad5da -- Go-http-client/1.1 proxy probing, PFCLOUD
+ge11nn0400_628fde536a8d -- Go-http-client/1.1 API version probing, PFCLOUD
+ge11nn0400_88d30a62b7ad -- zgrab HTTP scanner, PFCLOUD
+ge11nn0500_9af7e0472034 -- TLS .env scanner, PFCLOUD
+ge10nn0300_86b6b04cb9cc -- Shodan-Pull/1.0 scanner, PFCLOUD