diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
| commit | 237f2d9330398e0a0628980056db6b09098d5f2f (patch) | |
| tree | 09f16c0f363ee4a23bdc64cf3cfaab7562a80432 /kevlar/2026-08-17/censys/fleet-correlation.csv | |
| parent | 7439049b2d46c035fda40b27d3f64b0b9f48af8a (diff) | |
feat: update bph iocs
Diffstat (limited to 'kevlar/2026-08-17/censys/fleet-correlation.csv')
| -rw-r--r-- | kevlar/2026-08-17/censys/fleet-correlation.csv | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/censys/fleet-correlation.csv b/kevlar/2026-08-17/censys/fleet-correlation.csv new file mode 100644 index 0000000..276c0ce --- /dev/null +++ b/kevlar/2026-08-17/censys/fleet-correlation.csv @@ -0,0 +1,6 @@ +linkage_type,ips,indicator,asn,notes +shared_service_banner,204.76.203.224+226,ClickHouse banner e5ca3ebf... on 9009 + proxy banner 16f5ca47... on 9191,AS51396,Cloned proxy infra; identical HTTP banner hashes +shared_hassh,77.83.39.6 + 204.76.203.221/214 (prior week),hassh 41ff3ecd1458b0bf86e1b4891636213e,AS51396,SSH client config shared across PFCLOUD fleet; ties .env crawler to cloned proxy infra +xray_panel_certs,YE1/YE2/YR1/YR2 across AS51396/AS57043/AS14956/AS51852/AS138915,"X-UI/Xray panel cert series (YE1=26k+, YE2=27k+, YR1=11k+, YR2=9k+ combined)",multi,Cross-ASN Xray/panel fleet; XUI.one + Gozargah issuer CNs on PFCLOUD +scan_only_nodes,154.93.119.164-169 (KAOPU 154.93.119.0/24),single HTTP service on 4083 returning 404,AS138915,Proxy/CDN node pool; no SSH +tor_relay,185.100.87.136,Onionoo fingerprint 9366185B...,AS200651,Confirmed Tor exit; random-domain TLS cert on 9001 |