1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
# JA4 TLS Client Fingerprints
t13i190800_9dc949149365_97f8aa674fd9 -- .env UA-rotator, 77.83.39.6, KPRONET/PFCLOUD
t13i251000_b78ed14e2fd0_ab7e3b40a677 -- .git/HEAD probe, 77.83.39.94, KPRONET/PFCLOUD
t13i1909h2_9dc949149365_97f8aa674fd9 -- SPARK C2 beacon, 185.100.87.136, FLOKINET
t13i1310h1_f57a46bbacb6_e7c285222651 -- TLS web probe, 193.247.77.84 HOSTKEY; 179.43.146.27 PLI
t13i311000_e8f1e7e78f70_d41ae481755e -- .env/trpc probes, 179.43.150.26, PLI-AS
# JA3 TLS Client Fingerprints
7c1e207beb00684bbbe144f1b0abe1d5 -- SPARK C2 beacon, 185.100.87.136, FLOKINET
19e29534fd49dd27d09234e639c4057e -- .env UA-rotator, 77.83.39.6, KPRONET/PFCLOUD
416eca07dcaad72dec6f76d1277b3eff -- .git/HEAD probe, 77.83.39.94
004556e859f3c26c5d19746b3a957c74 -- 179.43.150.26, PLI-AS
# JA4H HTTP Client Fingerprints
po11nn0600_c9506d37ac14 -- SPARK POST /api/client/update, 185.100.87.136
po11nn0700_e1eadaf42879 -- WinRM /wsman, shared KAOPU 154.93.53.239 + PLI 179.43.185.147
ge11nn0500_9af7e0472034 -- .env/.git exfil over TLS, 77.83.39.6/.94
ge11nn0400_9c3956fad5da -- Go-http-client/1.1 proxy checker, PFCLOUD
# HASSH SSH Client Fingerprints
41ff3ecd1458b0bf86e1b4891636213e -- PFCLOUD cloned fleet + .env crawler (77.83.39.6); also 204.76.203.221/214 prior week
e54ef3ec27fe1fea7ab64d3fa05359fd -- SPARK C2 client, 185.100.87.136, FLOKINET
|
