diff options
| author | hrbrmstr <bob@rud.is> | 2026-09-07 06:03:32 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-09-07 06:23:41 -0400 |
| commit | de4c2e99a969eb10708b02d8f2b6f31495eacce8 (patch) | |
| tree | ff5be97683e9dbf19ec0387f3a03a90282477dd2 /kevlar/2026-09-07/censys/fleet-correlation.csv | |
| parent | c283bcc507b0a7946a8660677a04da6f53cc77e1 (diff) | |
Diffstat (limited to 'kevlar/2026-09-07/censys/fleet-correlation.csv')
| -rw-r--r-- | kevlar/2026-09-07/censys/fleet-correlation.csv | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/kevlar/2026-09-07/censys/fleet-correlation.csv b/kevlar/2026-09-07/censys/fleet-correlation.csv new file mode 100644 index 0000000..4c38a9e --- /dev/null +++ b/kevlar/2026-09-07/censys/fleet-correlation.csv @@ -0,0 +1,7 @@ +linkage_type,ips,indicator,asn,notes +cloned-image,204.76.203.213; 204.76.203.221; 204.76.203.222,identical SSH algorithm selection + banner comment "Ubuntu-3ubuntu0.17" + OpenSSH 8.9p1 single-service profile,AS51396,PFCLOUD /29 scanner fleet in Eygelshoven NL; 1100+ Honeylabs events each; BULLETPROOF-labeled +identical-service-config,45.61.157.82; 144.172.108.79; 144.172.99.200,Windows RDP (3389) + HTTP API 2.0 on 47001; 144.172.108.79 also MSSQL 2008 (10.0.1600) on 1433,AS14956,ROUTERHOSTING RDP-access fleet Las Vegas/Ogden US; BULLETPROOF-labeled +remote-access-node,176.120.22.61,Windows + RDP 3389 + WinRM 5985 + DCERPC 135,AS198953,PROTON66 St Petersburg RU; 1597 Honeylabs events; Censys BULLETPROOF label +scan-only-node,193.143.1.66,zero open ports visible to Censys,AS198953,PROTON66; 24 Honeylabs events but no exposed services +tor-exit,185.100.87.136,Censys TOR label + SSH 9.9 on non-standard port 7288,AS200651,FLOKINET Bucharest RO; 24 Honeylabs events; BULLETPROOF-labeled +ssh-fingerprint-family,204.76.203.213; 204.76.203.221; 204.76.203.222; 185.246.217.150,identical SSH algorithm selection (curve25519-sha256@libssh.org / ecdsa-sha2-nistp256 / aes128-ctr / hmac-sha2-256),AS51396; AS210644,shared SSH hardening baseline across PFCLOUD and AEZA fleets |