diff options
Diffstat (limited to 'kevlar/2026-07-13/censys/fleet-correlation.csv')
| -rw-r--r-- | kevlar/2026-07-13/censys/fleet-correlation.csv | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/kevlar/2026-07-13/censys/fleet-correlation.csv b/kevlar/2026-07-13/censys/fleet-correlation.csv new file mode 100644 index 0000000..c867e6e --- /dev/null +++ b/kevlar/2026-07-13/censys/fleet-correlation.csv @@ -0,0 +1,11 @@ +correlation_type,ip_a,asn_a,ip_b,asn_b,shared_attribute,confidence,notes +ssh-key-match,176.65.148.25,AS51396,204.76.203.79,AS51396,openssh-version,low,"Both running OpenSSH but different versions (9.2p1 vs unknown)" +shared-hostname-pattern,77.83.39.197,AS214940,77.83.39.119,AS214940,77.83.39.x-range,medium,"Same /24 subnet, same ASN, same HTTPS scanning behavior" +shared-hostname-pattern,77.83.39.197,AS214940,77.83.39.94,AS214940,77.83.39.x-range,medium,"Same /24 subnet, same ASN, same HTTPS scanning behavior" +shared-range,204.76.203.78,AS51396,204.76.203.79,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times" +shared-range,204.76.203.79,AS51396,204.76.203.80,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times" +shared-range,204.76.203.78,AS51396,204.76.203.80,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times" +simultaneous-activity,204.76.203.78,AS51396,204.76.203.79,AS51396,identical-timestamps,high,"All three 204.76.203.78/79/80 started 2026-07-11T03:24:10 and stopped 2026-07-11T13:26:10" +ua-rotation,77.83.39.197,AS214940,77.83.39.119,AS214940,20-distinct-user-agents,medium,"KPRONET IPs cycling through 20 different browser UAs across port 443" +tor-exit-node,185.100.87.136,AS200651,,,tor-software,high,"Confirmed Tor exit node running 0.4.9.11" +self-signed-cert,185.228.72.109,AS400992,,,WIN-8FIH4EGN4AL,high,"Self-signed TLS certificate with hostname usa.unlimitedteam.space" |