diff options
Diffstat (limited to 'kevlar/2026-08-10/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-08-10/iocs/fingerprints.txt | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/kevlar/2026-08-10/iocs/fingerprints.txt b/kevlar/2026-08-10/iocs/fingerprints.txt new file mode 100644 index 0000000..1f32888 --- /dev/null +++ b/kevlar/2026-08-10/iocs/fingerprints.txt @@ -0,0 +1,15 @@ +# JA4 TLS Fingerprints +t13i1310h1_f57a46bbacb6_e7c285222651 -- PLI-AS Firefox/140 TLS, 179.43.146.27, Switzerland + +# JA4H HTTP Fingerprints +ge11nn0400_9c3956fad5da -- PFCLOUD Go-http-client/1.1 proxy checker, 45.135.194.113 +ge11nn0400_88d30a62b7ad -- PFCLOUD zgrab/0.x web scanner, 176.65.149.236 +ge10nn0400_17292dadbc7b -- PFCLOUD odin-scanner/0.4, 176.65.148.58 +ge11nn0500_795d05eb4583 -- PFCLOUD websocket cloud-metadata probe, 176.65.148.142 +ge11nn0200_f24fcf356134 -- PFCLOUD cloud-metadata probe, 176.65.148.142 +ge11nn0300_341eb0d8946c -- PLI-AS .env/.git exfiltration, 179.43.150.26 + +# HASSH SSH Fingerprints +41ff3ecd1458b0bf86e1b4891636213e -- PFCLOUD cloned proxy nodes, 204.76.203.221/214 +e42184b06d45385a906f0803d04c83da -- shared OpenSSH 9.6p1 config, PFCLOUD + ROUTERHOSTING +779664e66160bf75999f091fce5edb5a -- PLI-AS OpenSSH 8.4p1 Debian, 179.43.150.26 |