diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
| commit | 237f2d9330398e0a0628980056db6b09098d5f2f (patch) | |
| tree | 09f16c0f363ee4a23bdc64cf3cfaab7562a80432 /kevlar/2026-08-17/honeylabs/fingerprints.csv | |
| parent | 7439049b2d46c035fda40b27d3f64b0b9f48af8a (diff) | |
feat: update bph iocs
Diffstat (limited to 'kevlar/2026-08-17/honeylabs/fingerprints.csv')
| -rw-r--r-- | kevlar/2026-08-17/honeylabs/fingerprints.csv | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/honeylabs/fingerprints.csv b/kevlar/2026-08-17/honeylabs/fingerprints.csv new file mode 100644 index 0000000..4239b97 --- /dev/null +++ b/kevlar/2026-08-17/honeylabs/fingerprints.csv @@ -0,0 +1,10 @@ +type,fingerprint,source_ip,asn,notes +ja4,t13i190800_9dc949149365_97f8aa674fd9,77.83.39.6,AS214940,.env exfil UA-rotator +ja4,t13i251000_b78ed14e2fd0_ab7e3b40a677,77.83.39.94,AS214940,.git/HEAD probe +ja4,t13i1310h1_f57a46bbacb6_e7c285222651,193.247.77.84,AS57043,TLS web probe; also seen on PLI 179.43.146.27 +ja4,t13i1909h2_9dc949149365_97f8aa674fd9,185.100.87.136,AS200651,C2 beacon TLS (SPARK) +ja3,7c1e207beb00684bbbe144f1b0abe1d5,185.100.87.136,AS200651,C2 beacon JA3 (SPARK) +ja4h,po11nn0700_e1eadaf42879,154.93.53.239,AS138915,WinRM /wsman; shared with PLI 179.43.185.147 +ja4h,po11nn0600_c9506d37ac14,185.100.87.136,AS200651,SPARK POST /api/client/update +hassh,e54ef3ec27fe1fea7ab64d3fa05359fd,185.100.87.136,AS200651,SSH client fingerprint +ja4,t13i311000_e8f1e7e78f70_d41ae481755e,179.43.150.26,AS51852,.env/trpc probes |