From d7a9bac5ba6b053f46ecd5685b60c2ffd89ea528 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 8 Jun 2026 07:05:50 -0400 Subject: add: iocs --- kevlar/2026-06-08/iocs/c2-paths.txt | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 kevlar/2026-06-08/iocs/c2-paths.txt (limited to 'kevlar/2026-06-08/iocs/c2-paths.txt') diff --git a/kevlar/2026-06-08/iocs/c2-paths.txt b/kevlar/2026-06-08/iocs/c2-paths.txt new file mode 100644 index 0000000..0f7b51c --- /dev/null +++ b/kevlar/2026-06-08/iocs/c2-paths.txt @@ -0,0 +1,5 @@ +/login/?login_only=1 -- cPanel login probe, HOSTKEY, port 2086 +/openid_connect/cpanelid -- cPanel OpenID probe, HOSTKEY, port 2086 +/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows -- C2 beacon, FlokiNET, port 443 +/images/json? -- Docker API enumeration (go-dockerclient), KAOPU-HK, ports 2375/2376/4243 +/debug/pprof -- pprof endpoint exposed on riptide scanner, Pfcloud, port 666 -- cgit v1.2.3