diff options
| author | hrbrmstr <bob@rud.is> | 2026-07-13 07:27:00 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-07-13 07:27:00 -0400 |
| commit | a47b685eac21aeedad5c4ab5df5c67a1df905486 (patch) | |
| tree | 132867a1f6cef28c38f4bc43107a0cc6156226be /kevlar/2026-07-13/iocs/c2-paths.txt | |
| parent | 083a60f55cfc8b33735117feb6df6904342818b5 (diff) | |
chore: weekly asn update
Diffstat (limited to 'kevlar/2026-07-13/iocs/c2-paths.txt')
| -rw-r--r-- | kevlar/2026-07-13/iocs/c2-paths.txt | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/kevlar/2026-07-13/iocs/c2-paths.txt b/kevlar/2026-07-13/iocs/c2-paths.txt new file mode 100644 index 0000000..0970ab6 --- /dev/null +++ b/kevlar/2026-07-13/iocs/c2-paths.txt @@ -0,0 +1,21 @@ +# Weekly BP Report -- 2026-07-13 +# Notable HTTP URL paths observed +# Query range: 2026-07-05 through 2026-07-11 + +# .env file scanning (credentials exfiltration) +/.env +# Source: 185.228.72.109 (AS400992 ZhouyiSat) via HTTP GET +# JA4H: ge11nn0500_2d30dc89d981 +# Intent: Retrieve environment variable files containing database credentials, API keys + +# Exchange /ews/ reconnaissance +/ews/ +# Source: 185.231.33.46 (AS211720 Datashield) via HTTP HEAD +# JA4H: he11nn0500_2d30dc89d981 +# Intent: Enumerate Exchange Web Services endpoints for vulnerability exploitation + +# Tor exit node transparentpix.gif probing +/transparentpix.gif +# Source: 185.100.87.136 (AS200651 FlokiNET) via HTTP GET on port 444 +# JA4H: ge11nn0400_88d30a62b7ad +# Intent: Tor exit node connectivity testing or pixel tracking |