From 7439049b2d46c035fda40b27d3f64b0b9f48af8a Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 10 Aug 2026 07:14:00 -0400 Subject: feat: update bph iocs --- kevlar/2026-08-10/iocs/fingerprints.txt | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 kevlar/2026-08-10/iocs/fingerprints.txt (limited to 'kevlar/2026-08-10/iocs/fingerprints.txt') diff --git a/kevlar/2026-08-10/iocs/fingerprints.txt b/kevlar/2026-08-10/iocs/fingerprints.txt new file mode 100644 index 0000000..1f32888 --- /dev/null +++ b/kevlar/2026-08-10/iocs/fingerprints.txt @@ -0,0 +1,15 @@ +# JA4 TLS Fingerprints +t13i1310h1_f57a46bbacb6_e7c285222651 -- PLI-AS Firefox/140 TLS, 179.43.146.27, Switzerland + +# JA4H HTTP Fingerprints +ge11nn0400_9c3956fad5da -- PFCLOUD Go-http-client/1.1 proxy checker, 45.135.194.113 +ge11nn0400_88d30a62b7ad -- PFCLOUD zgrab/0.x web scanner, 176.65.149.236 +ge10nn0400_17292dadbc7b -- PFCLOUD odin-scanner/0.4, 176.65.148.58 +ge11nn0500_795d05eb4583 -- PFCLOUD websocket cloud-metadata probe, 176.65.148.142 +ge11nn0200_f24fcf356134 -- PFCLOUD cloud-metadata probe, 176.65.148.142 +ge11nn0300_341eb0d8946c -- PLI-AS .env/.git exfiltration, 179.43.150.26 + +# HASSH SSH Fingerprints +41ff3ecd1458b0bf86e1b4891636213e -- PFCLOUD cloned proxy nodes, 204.76.203.221/214 +e42184b06d45385a906f0803d04c83da -- shared OpenSSH 9.6p1 config, PFCLOUD + ROUTERHOSTING +779664e66160bf75999f091fce5edb5a -- PLI-AS OpenSSH 8.4p1 Debian, 179.43.150.26 -- cgit v1.2.3