diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-10 07:14:00 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-10 07:14:00 -0400 |
| commit | 7439049b2d46c035fda40b27d3f64b0b9f48af8a (patch) | |
| tree | 64335a1ba8765780114d873f919952776fc48809 /kevlar/2026-08-10/changes/anomalies.csv | |
| parent | dd7a507679c042a9fa100ea4ff3024b2a8c11826 (diff) | |
feat: update bph iocs
Diffstat (limited to 'kevlar/2026-08-10/changes/anomalies.csv')
| -rw-r--r-- | kevlar/2026-08-10/changes/anomalies.csv | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/kevlar/2026-08-10/changes/anomalies.csv b/kevlar/2026-08-10/changes/anomalies.csv new file mode 100644 index 0000000..e2fcbbe --- /dev/null +++ b/kevlar/2026-08-10/changes/anomalies.csv @@ -0,0 +1,7 @@ +severity,asn,anomaly,rationale +high,AS51396,Shared SSH host key across 204.76.203.221+214,Definitive cloned infrastructure; identical HASSH 41ff3ecd... and proxy on 9191 +high,AS51396,New 204.76.203.2xx proxy block,5 new IPs this week all running proxy-checking; volume +37% +medium,AS14956,PPTP brute-force on port 1723,New attack pattern this week; 144.172.100.63 sustained PPTP attempts +medium,AS51852,.env/.git exfiltration pattern,Signature previously on KPRONET now on PLI-AS; 179.43.150.26 probing 8001/8443 +medium,AS198953,MSSQL-TDS on 17 non-standard ports,Expanded brute-force campaign; 176.120.22.61 dominant +low,AS200651,Tor exit relay volume drop -88%,185.100.87.136 still active but reduced |