diff options
Diffstat (limited to 'kevlar/2026-06-08/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-06-08/iocs/fingerprints.txt | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/kevlar/2026-06-08/iocs/fingerprints.txt b/kevlar/2026-06-08/iocs/fingerprints.txt new file mode 100644 index 0000000..b8e8bdc --- /dev/null +++ b/kevlar/2026-06-08/iocs/fingerprints.txt @@ -0,0 +1,12 @@ +# JA4 TLS Fingerprints +t13i1909h2_9dc949149365_97f8aa674fd9 -- FlokiNET C2 beacon (185.100.87.136) +# JA4H HTTP Fingerprints +po11nn0700_fb204b7f5765 -- POST to /login/?login_only=1, Chrome 146, HOSTKEY (82.21.114.69) +ge11nn0500_e2433fe505a0 -- GET /openid_connect/cpanelid, Chrome 146, HOSTKEY (82.21.114.69) +ge11nn0400_9c3956fad5da -- Firefox 140 on Linux, THE (45.83.20.230), KAOPU-HK (154.205.145.161, go-dockerclient) +ge11nn0300_0db47b7d240d -- Go-http-client/1.1, AEZA (77.221.152.105), Pfcloud +po11nn0600_c9506d37ac14 -- SPARK C2 POST, FlokiNET (185.100.87.136) +ge11nn0400_88d30a62b7ad -- Firefox-like UA with TLS, FlokiNET (185.100.87.136) +# HASSH SSH Fingerprints +e54ef3ec27fe1fea7ab64d3fa05359fd -- Go SSH client, WorkTitans THE AS209847 (185.231.207.151) +41ff3ecd1458b0bf86e1b4891636213e -- OpenSSH 8.9p1 server, shared across PLI-AS and Pfcloud |