1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
# Tier 1 Companions: Exact Signature Twins
These 4 hosts share the complete signature set: same PTR `157279.ip-ptr.tech`, same SSH build `OpenSSH_9.6p1 Ubuntu-3ubuntu13.16`, same HASSH `e42184b06d45385a906f0803d04c83da`, same JA4t scan, same Censys exposure labels.
## Host Details
### 92.118.112.230 (Original Target)
- Block: 92.118.112.0/24
- Location: Atlanta, Georgia, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- GreyNoise: Suspicious -- Login Scanner, PAN-OS CVE-2020-2034 Crawler, F5 BIG-IP Crawler, SQLi
- Censys Reputation: benign (model v0.1.0)
- WHOIS Created: 2021-12-24
### 89.185.80.144 (Original Target)
- Block: 89.185.80.0/24
- Location: Phoenix, Arizona, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- GreyNoise: Suspicious -- same tags plus Suspicious Linux Command
- Censys Reputation: benign
- WHOIS Created: 2024-06-28
### 89.185.80.183 (Original Target)
- Block: 89.185.80.0/24
- Location: Phoenix, Arizona, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- GreyNoise: Suspicious -- same tags plus Path Traversal + Sensitive File Access
- Censys Reputation: benign
- WHOIS Created: 2024-06-28
### 147.45.60.25 (Best New Companion)
- Block: 147.45.60.0/24
- Location: Atlanta, Georgia, US
- ASN: 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP)
- PTR: 157279.ip-ptr.tech
- SSH: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
- HASSH: e42184b06d45385a906f0803d04c83da
- ECDSA Key: a05bfd9d42162150bf91193773642fed509bf8155de96fb468baccd693cce208
- Forward DNS: zubat.org
- GreyNoise: **Suspicious** -- exact same tag set (Login Scanner, PAN-OS, F5, SQLi, Sensitive File Access, Suspicious Linux Command)
- Censys Reputation: benign
- WHOIS Created: 2024-02-22
|
