1
2
3
4
5
6
7
8
9
10
11
|
correlation_type,ip_a,asn_a,ip_b,asn_b,shared_attribute,confidence,notes
ssh-key-match,176.65.148.25,AS51396,204.76.203.79,AS51396,openssh-version,low,"Both running OpenSSH but different versions (9.2p1 vs unknown)"
shared-hostname-pattern,77.83.39.197,AS214940,77.83.39.119,AS214940,77.83.39.x-range,medium,"Same /24 subnet, same ASN, same HTTPS scanning behavior"
shared-hostname-pattern,77.83.39.197,AS214940,77.83.39.94,AS214940,77.83.39.x-range,medium,"Same /24 subnet, same ASN, same HTTPS scanning behavior"
shared-range,204.76.203.78,AS51396,204.76.203.79,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times"
shared-range,204.76.203.79,AS51396,204.76.203.80,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times"
shared-range,204.76.203.78,AS51396,204.76.203.80,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times"
simultaneous-activity,204.76.203.78,AS51396,204.76.203.79,AS51396,identical-timestamps,high,"All three 204.76.203.78/79/80 started 2026-07-11T03:24:10 and stopped 2026-07-11T13:26:10"
ua-rotation,77.83.39.197,AS214940,77.83.39.119,AS214940,20-distinct-user-agents,medium,"KPRONET IPs cycling through 20 different browser UAs across port 443"
tor-exit-node,185.100.87.136,AS200651,,,tor-software,high,"Confirmed Tor exit node running 0.4.9.11"
self-signed-cert,185.228.72.109,AS400992,,,WIN-8FIH4EGN4AL,high,"Self-signed TLS certificate with hostname usa.unlimitedteam.space"
|
