# Tier 1 Companions: Exact Signature Twins

These 4 hosts share the complete signature set: same PTR `157279.ip-ptr.tech`, same SSH build `OpenSSH_9.6p1 Ubuntu-3ubuntu13.16`, same HASSH `e42184b06d45385a906f0803d04c83da`, same JA4t scan, same Censys exposure labels.

## Host Details

### 92.118.112.230 (Original Target)

- Block: 92.118.112.0/24
- Location: Atlanta, Georgia, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- GreyNoise: Suspicious -- Login Scanner, PAN-OS CVE-2020-2034 Crawler, F5 BIG-IP Crawler, SQLi
- Censys Reputation: benign (model v0.1.0)
- WHOIS Created: 2021-12-24

### 89.185.80.144 (Original Target)

- Block: 89.185.80.0/24
- Location: Phoenix, Arizona, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- GreyNoise: Suspicious -- same tags plus Suspicious Linux Command
- Censys Reputation: benign
- WHOIS Created: 2024-06-28

### 89.185.80.183 (Original Target)

- Block: 89.185.80.0/24
- Location: Phoenix, Arizona, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- GreyNoise: Suspicious -- same tags plus Path Traversal + Sensitive File Access
- Censys Reputation: benign
- WHOIS Created: 2024-06-28

### 147.45.60.25 (Best New Companion)

- Block: 147.45.60.0/24
- Location: Atlanta, Georgia, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- ECDSA Key: a05bfd9d42162150bf91193773642fed509bf8155de96fb468baccd693cce208
- Forward DNS: zubat.org
- GreyNoise: **Suspicious** -- exact same tag set (Login Scanner, PAN-OS, F5, SQLi, Sensitive File Access, Suspicious Linux Command)
- Censys Reputation: benign
- WHOIS Created: 2024-02-22