diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-03 07:11:48 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-03 07:11:48 -0400 |
| commit | 71ff7fc1ef9e742b78d3b04a23b487fcf478ff50 (patch) | |
| tree | 8fda61762b491552a017aacda4d8c8a14cf578d6 /kevlar/2026-08-02/iocs/fingerprints.txt | |
| parent | 89a294a0e93277e5f27fc96710f638a5ac85ab35 (diff) | |
chore: weekly BPH update
Diffstat (limited to 'kevlar/2026-08-02/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-08-02/iocs/fingerprints.txt | 21 |
1 files changed, 16 insertions, 5 deletions
diff --git a/kevlar/2026-08-02/iocs/fingerprints.txt b/kevlar/2026-08-02/iocs/fingerprints.txt index bd25290..264c0b2 100644 --- a/kevlar/2026-08-02/iocs/fingerprints.txt +++ b/kevlar/2026-08-02/iocs/fingerprints.txt @@ -1,8 +1,19 @@ +# JA4 TLS Fingerprints + +t13i190800_9dc949149365_97f8aa674fd9 -- KPRONET .env exfiltration campaign, 77.83.39.x, Ukraine +t13i251000_b78ed14e2fd0_ab7e3b40a677 -- KPRONET .git/HEAD scanning, 77.83.39.94, Ukraine +t13i190900_9dc949149365_e7c285222651 -- PLI-AS WordPress login scan, 179.43.158.246, Switzerland +t13i1310h1_f57a46bbacb6_e7c285222651 -- ROUTERHOSTING TLS Firefox browser, 167.88.168.121, US + # JA4H HTTP Fingerprints -ge11nn0400_9c3956fad5da -- PFCLOUD Go-http-client/1.1 proxy checker, 204.76.203.78-80 -ge11nn0400_88d30a62b7ad -- PFCLOUD zgrab/0.x web scanner, 176.65.149.236 +ge11nn0500_9af7e0472034 -- KPRONET .env/.git exfiltration (detects despite 20+ UA rotations), 77.83.39.x +po11nr09en_94d98df401ed -- PLI-AS tRPC setup endpoint attack, 179.43.150.26 +ge11nn0400_9c3956fad5da -- PFCLOUD Go-http-client/1.1 proxy checker, 204.76.203.78-80 +ge11nn0400_88d30a62b7ad -- PFCLOUD zgrab/0.x web scanner, 176.65.149.236 +ge11nn0300_0db47b7d240d -- PLI-AS Go-http-client/1.1 wordpress scanner, 179.43.158.246 + +# HASSH SSH Fingerprints -# Note: No JA4 TLS or HASSH SSH fingerprints were observed in Honeylabs events -# from monitored ASNs this week. All non-PFCLOUD ASNs registered zero honeypot -# events in the 2026-07-27 to 2026-08-02 observation window. +e54ef3ec27fe1fea7ab64d3fa05359fd -- FLOKINET OpenSSH 10.1 SSH brute client, 185.100.87.136 +b1bff636ebbdbaa9dd2ad97fd173c956 -- FLOKINET Tor relay OpenSSH 9.9, 185.100.87.136:7288 |