chore: weekly asn update

3 files changed, 36 insertions, 0 deletions

diff --git a/kevlar/2026-07-13/censys/aggregations-summary.ndjson b/kevlar/2026-07-13/censys/aggregations-summary.ndjson
new file mode 100644
index 0000000..b7ff529
--- /dev/null
+++ b/kevlar/2026-07-13/censys/aggregations-summary.ndjson
@@ -0,0 +1,15 @@
+{"_type":"aggregation_summary","asn":"AS57043","org":"Hostkey B.v.","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":77000},{"port":80,"count":3000},{"port":443,"count":2500}],"country_dist":[{"country":"NL","count":4500},{"country":"DE","count":1200},{"country":"FI","count":800}],"total_hosts":7800}
+{"_type":"aggregation_summary","asn":"AS210644","org":"Aeza Group LLC","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":64000},{"port":443,"count":15000},{"port":80,"count":12000}],"total_hosts":6800}
+{"_type":"aggregation_summary","asn":"AS138915","org":"KAOPU-HK","labels":["BULLETPROOF"],"top_ports":[{"port":123,"count":9000},{"port":32080,"count":3000},{"port":43080,"count":2500}],"total_hosts":9500}
+{"_type":"aggregation_summary","asn":"AS14956","org":"RouterHosting LLC","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":14625},{"port":3389,"count":8613},{"port":443,"count":7838},{"port":80,"count":6737}],"total_hosts":25713}
+{"_type":"aggregation_summary","asn":"AS216139","org":"Iron Hosting Centre","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":2000},{"port":443,"count":500}],"total_hosts":2100}
+{"_type":"aggregation_summary","asn":"AS51852","org":"Private Layer INC","labels":["BULLETPROOF"],"top_ports":[{"port":80,"count":4886},{"port":443,"count":4534},{"port":22,"count":4300}],"total_hosts":11020}
+{"_type":"aggregation_summary","asn":"AS400992","org":"ZhouyiSat Communications","labels":["BULLETPROOF"],"top_ports":[{"port":80,"count":200},{"port":443,"count":150}],"total_hosts":300}
+{"_type":"aggregation_summary","asn":"AS51396","org":"Pfcloud UG","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":1562},{"port":2000,"count":200},{"port":2001,"count":180}],"software":[{"product":"python","count":120},{"product":"werkzeug","count":80},{"product":"wg-easy","count":45},{"product":"openssh","count":30},{"product":"nginx","count":25}],"total_hosts":3176}
+{"_type":"aggregation_summary","asn":"AS216246","org":"Qwins-LTD","labels":["BULLETPROOF"],"top_ports":[{"port":3389,"count":5000},{"port":5985,"count":3000},{"port":445,"count":2500}],"total_hosts":6000}
+{"_type":"aggregation_summary","asn":"AS200651","org":"FlokiNET ehf","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":3000},{"port":443,"count":1500},{"port":80,"count":1200}],"total_hosts":3500}
+{"_type":"aggregation_summary","asn":"AS198953","org":"Proton66 OOO","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":2500},{"port":3389,"count":1800},{"port":80,"count":900}],"total_hosts":2800}
+{"_type":"aggregation_summary","asn":"AS200593","org":"Prospero Ooo","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":1500},{"port":80,"count":500}],"total_hosts":1800}
+{"_type":"aggregation_summary","asn":"AS214940","org":"Kprohost LLC","labels":["BULLETPROOF"],"top_ports":[{"port":3389,"count":103},{"port":5985,"count":101},{"port":135,"count":100},{"port":139,"count":97},{"port":445,"count":97},{"port":47001,"count":95}],"total_hosts":167}
+{"_type":"aggregation_summary","asn":"AS211720","org":"Datashield Inc.","labels":["BULLETPROOF"],"top_ports":[{"port":443,"count":50},{"port":22,"count":30}],"total_hosts":80}
+{"_type":"aggregation_summary","asn":"AS33993","org":"TOV _Aktor_","labels":["BULLETPROOF"],"total_hosts":0}
diff --git a/kevlar/2026-07-13/censys/fleet-correlation.csv b/kevlar/2026-07-13/censys/fleet-correlation.csv
new file mode 100644
index 0000000..c867e6e
--- /dev/null
+++ b/kevlar/2026-07-13/censys/fleet-correlation.csv
@@ -0,0 +1,11 @@
+correlation_type,ip_a,asn_a,ip_b,asn_b,shared_attribute,confidence,notes
+ssh-key-match,176.65.148.25,AS51396,204.76.203.79,AS51396,openssh-version,low,"Both running OpenSSH but different versions (9.2p1 vs unknown)"
+shared-hostname-pattern,77.83.39.197,AS214940,77.83.39.119,AS214940,77.83.39.x-range,medium,"Same /24 subnet, same ASN, same HTTPS scanning behavior"
+shared-hostname-pattern,77.83.39.197,AS214940,77.83.39.94,AS214940,77.83.39.x-range,medium,"Same /24 subnet, same ASN, same HTTPS scanning behavior"
+shared-range,204.76.203.78,AS51396,204.76.203.79,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times"
+shared-range,204.76.203.79,AS51396,204.76.203.80,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times"
+shared-range,204.76.203.78,AS51396,204.76.203.80,AS51396,204.76.203.x-range,high,"Same /24 subnet, same scan pattern, same start/stop times"
+simultaneous-activity,204.76.203.78,AS51396,204.76.203.79,AS51396,identical-timestamps,high,"All three 204.76.203.78/79/80 started 2026-07-11T03:24:10 and stopped 2026-07-11T13:26:10"
+ua-rotation,77.83.39.197,AS214940,77.83.39.119,AS214940,20-distinct-user-agents,medium,"KPRONET IPs cycling through 20 different browser UAs across port 443"
+tor-exit-node,185.100.87.136,AS200651,,,tor-software,high,"Confirmed Tor exit node running 0.4.9.11"
+self-signed-cert,185.228.72.109,AS400992,,,WIN-8FIH4EGN4AL,high,"Self-signed TLS certificate with hostname usa.unlimitedteam.space"
diff --git a/kevlar/2026-07-13/censys/ip-enrichments.ndjson b/kevlar/2026-07-13/censys/ip-enrichments.ndjson
new file mode 100644
index 0000000..294c149
--- /dev/null
+++ b/kevlar/2026-07-13/censys/ip-enrichments.ndjson
@@ -0,0 +1,10 @@
+{"_type":"ip_enrichment","ip":"176.65.148.25","asn":"AS51396","org":"Pfcloud UG","country":"NL","greynoise":"malicious","services":[{"port":22,"transport":"tcp","software":"OpenSSH 9.2p1"}],"tags":["rdp-crawler","bruteforcer"],"notes":"GreyNoise classified as malicious. RDP crawler and bruteforcer. OpenSSH 9.2p1 on port 22."}
+{"_type":"ip_enrichment","ip":"91.202.233.79","asn":"AS200593","org":"Prospero Ooo","country":"TM","greynoise":"unknown","services":[],"tags":["scan-only"],"notes":"No services visible on Censys. Scan-only behavior in Honeylabs with 3890 events hitting diverse high ports."}
+{"_type":"ip_enrichment","ip":"179.43.134.114","asn":"AS51852","org":"Private Layer INC","country":"CH","greynoise":"unknown","services":[{"port":22,"transport":"tcp","software":"OpenSSH 8.9p1","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10"}],"hostname":"hostedby.privatelayer.com","notes":"1518 events in Honeylabs targeting diverse ports. SSH service exposed."}
+{"_type":"ip_enrichment","ip":"216.126.239.17","asn":"AS14956","org":"RouterHosting LLC","country":"US","greynoise":"suspicious","services":[{"port":443,"transport":"tcp","software":"nginx"},{"port":80,"transport":"tcp"}],"tags":["wordpress-scanner","crushftp-scanner","ivanti-scanner","owa-scanner"],"hostname":"cloudzy","notes":"GreyNoise suspicious. Multi-vuln scanner: Wordpress, CrushFTP, Ivanti, OWA. 94 events in Honeylabs."}
+{"_type":"ip_enrichment","ip":"204.76.203.79","asn":"AS51396","org":"Pfcloud UG","country":"NL","greynoise":"unknown","services":[{"port":22,"transport":"tcp"}],"notes":"992 events in Honeylabs targeting diverse high ports. Output truncated and saved to tool-output cache."}
+{"_type":"ip_enrichment","ip":"176.120.22.240","asn":"AS198953","org":"Proton66 OOO","country":"RU","greynoise":"malicious","services":[{"port":3389,"transport":"tcp"},{"port":22,"transport":"tcp"},{"port":23,"transport":"tcp"},{"port":21,"transport":"tcp"}],"tags":["rdp-bruteforcer","ssh-bruteforcer","telnet-bruteforcer","ftp-bruteforcer"],"notes":"GreyNoise malicious. Multi-protocol bruteforcer (RDP, SSH, Telnet, FTP). 429 events in Honeylabs."}
+{"_type":"ip_enrichment","ip":"185.100.87.136","asn":"AS200651","org":"FlokiNET ehf","country":"RO","greynoise":"unknown","services":[{"port":9001,"transport":"tcp","software":"Tor 0.4.9.11","banner":"Tor 0.4.9.11"}],"tags":["tor-exit-node"],"hostname":"PremiumTorExit","notes":"Confirmed Tor exit node. Software: Tor 0.4.9.11. Port 9001. 17 events in Honeylabs scanning HTTP/SSH."}
+{"_type":"ip_enrichment","ip":"77.83.39.197","asn":"AS214940","org":"Kprohost LLC","country":"UA","greynoise":"unknown","services":[{"port":443,"transport":"tcp"}],"hostname":"lanedonet-datacenter","location":"Kerkrade, NL","notes":"26 events in Honeylabs. Hosted in Lanedonet Datacenter, Kerkrade NL. HTTPS scanning."}
+{"_type":"ip_enrichment","ip":"185.231.33.46","asn":"AS211720","org":"Datashield Inc.","country":"SC","greynoise":"unknown","services":[{"port":443,"transport":"tcp"}],"hostname":"short-tan-rat","location":"Seychelles","notes":"4 events in Honeylabs. Hostname 'short-tan-rat'. Exchange /ews/ recon via TLS. Registered in Seychelles."}
+{"_type":"ip_enrichment","ip":"185.228.72.109","asn":"AS400992","org":"ZhouyiSat Communications","country":"US","greynoise":"unknown","services":[{"port":443,"transport":"tcp"}],"hostname":"usa.unlimitedteam.space","tls_cert_subject":"CN=usa.unlimitedteam.space","tls_cert_issuer":"WIN-8FIH4EGN4AL (self-signed)","notes":"2 events in Honeylabs. Self-signed cert on hostname usa.unlimitedteam.space. .env file scanning activity."}