diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-03 07:11:48 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-03 07:11:48 -0400 |
| commit | 71ff7fc1ef9e742b78d3b04a23b487fcf478ff50 (patch) | |
| tree | 8fda61762b491552a017aacda4d8c8a14cf578d6 /kevlar/2026-08-02/iocs/all-observed-ips.txt | |
| parent | 89a294a0e93277e5f27fc96710f638a5ac85ab35 (diff) | |
chore: weekly BPH update
Diffstat (limited to 'kevlar/2026-08-02/iocs/all-observed-ips.txt')
| -rw-r--r-- | kevlar/2026-08-02/iocs/all-observed-ips.txt | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/kevlar/2026-08-02/iocs/all-observed-ips.txt b/kevlar/2026-08-02/iocs/all-observed-ips.txt index 964b94f..640acbd 100644 --- a/kevlar/2026-08-02/iocs/all-observed-ips.txt +++ b/kevlar/2026-08-02/iocs/all-observed-ips.txt @@ -155,3 +155,32 @@ # AS58854 - KAOPY (Kaopu Cloud) 103.236.255.202 +# === IPs from Honeylabs events === +# AS57043 - HOSTKEY (RTSP camera brute-forcing) +163.5.29.40 + +# AS14956 - ROUTERHOSTING (binary protocol + TLS browser) +144.172.100.235 +167.88.168.121 + +# AS51852 - PLI-AS (DCE/RPC, RDP, tRPC, WordPress) +81.17.28.130 +179.43.186.199 +179.43.150.26 +179.43.158.246 + +# AS198953 - PROTON66 (MSSQL brute-force) +176.120.22.61 + +# AS200651 - FLOKINET (SSH/Telnet brute, Tor exit relay) +185.100.87.136 +185.246.188.74 +185.246.190.66 + +# AS30823 - AUROLOGIC (SIP scanning) +216.126.229.131 + +# AS214940 - KPRONET (.git/.env exfiltration) +77.83.39.94 +77.83.39.6 +77.83.39.24 |