From 4294adbcb3a35e85f3107922e953aa98158989d7 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 22 Jun 2026 06:54:25 -0400 Subject: add: 2026-06-20 kevlar iocs --- kevlar/2026-06-20/iocs/fingerprints.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 kevlar/2026-06-20/iocs/fingerprints.txt (limited to 'kevlar/2026-06-20/iocs/fingerprints.txt') diff --git a/kevlar/2026-06-20/iocs/fingerprints.txt b/kevlar/2026-06-20/iocs/fingerprints.txt new file mode 100644 index 0000000..8b74903 --- /dev/null +++ b/kevlar/2026-06-20/iocs/fingerprints.txt @@ -0,0 +1,12 @@ +# Unique Fingerprints Observed -- Weekly BP Report 2026-06-20 +# Generated: 2026-06-22T10:44:00Z + +# JA4 TLS Fingerprints +t13i131000_f57a46bbacb6_ab7e3b40a677 -- Go TLS client, observed on 3 IPs across KAOPU-HK and THE ASNs; TLSv1.3 AES_128_GCM_SHA256 + +# JA3 Legacy Fingerprints +2196848d251b217de8b2c037e356c11d -- Go TLS client (JA3 equivalent of above), seen on KAOPU-HK IPs (38.60.254.173, 154.203.143.169) + +# JA4H HTTP Fingerprints +ge11nn0300_0db47b7d240d -- Go-http-client/1.1, KAOPU-HK (38.60.254.173), probing HTTP/HTTPS/9200 +po11nn0700_4784ccc9db2c -- Mozilla/4.0 compatible MSIE 6.0 UPnP client, KAOPU-HK (149.104.66.228), UPnP AddPortMapping attempts -- cgit v1.2.3