1
2
3
4
5
6
7
8
9
10
|
type,fingerprint,source_ip,asn,notes
ja4,t13i190800_9dc949149365_97f8aa674fd9,77.83.39.6,AS214940,.env exfil UA-rotator
ja4,t13i251000_b78ed14e2fd0_ab7e3b40a677,77.83.39.94,AS214940,.git/HEAD probe
ja4,t13i1310h1_f57a46bbacb6_e7c285222651,193.247.77.84,AS57043,TLS web probe; also seen on PLI 179.43.146.27
ja4,t13i1909h2_9dc949149365_97f8aa674fd9,185.100.87.136,AS200651,C2 beacon TLS (SPARK)
ja3,7c1e207beb00684bbbe144f1b0abe1d5,185.100.87.136,AS200651,C2 beacon JA3 (SPARK)
ja4h,po11nn0700_e1eadaf42879,154.93.53.239,AS138915,WinRM /wsman; shared with PLI 179.43.185.147
ja4h,po11nn0600_c9506d37ac14,185.100.87.136,AS200651,SPARK POST /api/client/update
hassh,e54ef3ec27fe1fea7ab64d3fa05359fd,185.100.87.136,AS200651,SSH client fingerprint
ja4,t13i311000_e8f1e7e78f70_d41ae481755e,179.43.150.26,AS51852,.env/trpc probes
|
