blob: b8e8bdc39768f1a0095912d976f19f8e77d3de3d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
|
# JA4 TLS Fingerprints
t13i1909h2_9dc949149365_97f8aa674fd9 -- FlokiNET C2 beacon (185.100.87.136)
# JA4H HTTP Fingerprints
po11nn0700_fb204b7f5765 -- POST to /login/?login_only=1, Chrome 146, HOSTKEY (82.21.114.69)
ge11nn0500_e2433fe505a0 -- GET /openid_connect/cpanelid, Chrome 146, HOSTKEY (82.21.114.69)
ge11nn0400_9c3956fad5da -- Firefox 140 on Linux, THE (45.83.20.230), KAOPU-HK (154.205.145.161, go-dockerclient)
ge11nn0300_0db47b7d240d -- Go-http-client/1.1, AEZA (77.221.152.105), Pfcloud
po11nn0600_c9506d37ac14 -- SPARK C2 POST, FlokiNET (185.100.87.136)
ge11nn0400_88d30a62b7ad -- Firefox-like UA with TLS, FlokiNET (185.100.87.136)
# HASSH SSH Fingerprints
e54ef3ec27fe1fea7ab64d3fa05359fd -- Go SSH client, WorkTitans THE AS209847 (185.231.207.151)
41ff3ecd1458b0bf86e1b4891636213e -- OpenSSH 8.9p1 server, shared across PLI-AS and Pfcloud
|
