aboutsummaryrefslogtreecommitdiff
path: root/kevlar/2026-07-27/iocs/fingerprints.txt
blob: 070082d16cd2b7cfed367a08754e857870194a9a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
# JA4 TLS Fingerprints
t13i1010h1_61a7ad8aa9b6_3a8073edd8ef  -- AEZA Chrome 147 TLS, 138.124.51.186 (DE)
t13i1010h1_61a7ad8aa9b6_792d2c6655cb  -- AEZA Chrome 147 variant, 138.124.51.186 (DE)

# JA3 TLS Fingerprints
b609d5551dcec7e6075e2fc8ca29bf24  -- AEZA, 89.22.229.195 (SE)
9f4e0ae825047a941af7221fb75e2aae  -- AEZA, 138.124.59.186 (FI)
16a3089656ab057929b8f221ed08e039  -- AEZA, 138.124.51.186 (DE)
ef90e14e531115797b650fe07df61586  -- AEZA, 138.124.51.186 (DE)
29b9a4d7e03eb5a56acf29b67023d0af  -- AEZA, 138.124.51.186 (DE)
93d55721eced6997d8870e8cd1d93506  -- AEZA, 138.124.51.186 (DE)
a8281a28aa674efa3ec70f0e2280aa09  -- AEZA, 138.124.51.186 (DE)
ef761d329875d1a90d84f55cc77c26e6  -- AEZA, 138.124.51.186 (DE)
8792ac713334cf80a6563b2fae57fee6  -- AEZA, 138.124.51.186 (DE)
90d877cff6af2964217e30deb28f1b06  -- AEZA, 138.124.51.186 (DE)
15622ee831c60decc2e6587bb4451da3  -- AEZA, 138.124.51.186 (DE)
1042cf6e6fc5d5fd1b78c4a2c5cb1047  -- AEZA, 138.124.51.186 (DE)
629ab1e60a10569e72950b4edda596f1  -- AEZA, 138.124.51.186 (DE)
48979a11139b02722383a6aefcb9abea  -- AEZA, 138.124.51.186 (DE)
25b88e110e6628514219bb866b24b2e6  -- AEZA, 138.124.51.186 (DE)
9cb6cf906a47debccd75799916bdd82e  -- AEZA, 138.124.51.186 (DE)
331c0c17c9863d6b803c11cff32e62bc  -- AEZA, 138.124.51.186 (DE)

# JA4H HTTP Fingerprints
po11nn0400_52fce913cf3b  -- KAOPU-HK WinRM Client, 154.90.37.55
ge11nn05en_5fca7fb4a57a  -- AEZA Chrome 147 HTTP, 138.124.51.186
ge11cn05en_741f45be9444  -- AEZA Chrome 147 HTTP (+Cisco cookie), 138.124.51.186

# HASSH SSH Fingerprints
e42184b06d45385a906f0803d04c83da  -- PFCLOUD fleet (multiple 176.65.149.x IPs), identical SSH config
e42184b06d45385a906f0803d04c83da  -- 45.135.193.193 (PFCLOUD)
e42184b06d45385a906f0803d04c83da  -- 66.248.205.44 (HOSTKEY)
e42184b06d45385a906f0803d04c83da  -- 179.43.168.58 (PLI)
779664e66160bf75999f091fce5edb5a  -- 138.124.51.186 (AEZA, OpenSSH 8.2p1)
b1bff636ebbdbaa9dd2ad97fd173c956  -- 172.86.114.169 (ROUTERHOSTING, OpenSSH 9.9)
eb0e0554de9aeb368191c86016a40080  -- 154.90.37.55 (KAOPU-HK, SSH password auth)