feat: update bph iocs

4 files changed, 42 insertions, 0 deletions

diff --git a/kevlar/2026-08-10/honeylabs/events-AS14956.ndjson b/kevlar/2026-08-10/honeylabs/events-AS14956.ndjson
new file mode 100644
index 0000000..c2dda1e
--- /dev/null
+++ b/kevlar/2026-08-10/honeylabs/events-AS14956.ndjson
@@ -0,0 +1,2 @@
+{"timestamp":"2026-08-07T22:59:07","source_ip":"144.172.100.63","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":1723,"application_protocol":"pptp","event_summary":"PPTP cananian"}
+{"timestamp":"2026-08-07T21:52:07","source_ip":"216.126.239.150","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":3389,"application_protocol":"rdp","event_summary":"RDP"}
diff --git a/kevlar/2026-08-10/honeylabs/events-AS51396.ndjson b/kevlar/2026-08-10/honeylabs/events-AS51396.ndjson
new file mode 100644
index 0000000..bc5b3ad
--- /dev/null
+++ b/kevlar/2026-08-10/honeylabs/events-AS51396.ndjson
@@ -0,0 +1,15 @@
+{"timestamp":"2026-08-09T23:53:23","source_ip":"176.65.149.212","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":7396,"application_protocol":"ssh","event_summary":"SSH-2.0-OpenSSH"}
+{"timestamp":"2026-08-09T23:45:57","source_ip":"176.65.149.55","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":25435,"application_protocol":"ssh","event_summary":"SSH-2.0-OpenSSH"}
+{"timestamp":"2026-08-09T23:30:10","source_ip":"176.65.134.3","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":11089,"application_protocol":"http_connect","event_summary":"CONNECT 185.65.245.10:7227 python-socks/2.3.0"}
+{"timestamp":"2026-08-09T23:23:07","source_ip":"45.135.193.193","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8888,"application_protocol":"http_connect","event_summary":"CONNECT httpbin.org:443"}
+{"timestamp":"2026-08-09T22:30:29","source_ip":"45.135.194.113","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8019,"application_protocol":"http_proxy","user_agent":"Go-http-client/1.1","url_path":"http://proxy.flarevpn.digital:8080/judge","http_request_ja4h":"ge11nn0400_9c3956fad5da"}
+{"timestamp":"2026-08-09T22:30:28","source_ip":"45.135.194.113","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8019,"application_protocol":"socks5","event_summary":"SOCKS5"}
+{"timestamp":"2026-08-09T22:29:56","source_ip":"45.135.194.99","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3128,"application_protocol":"google","event_summary":"CONNECT google.com:443 Go-http-client/1.1"}
+{"timestamp":"2026-08-09T22:17:56","source_ip":"176.65.148.2","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":999,"application_protocol":"http_connect","event_summary":"CONNECT 185.65.245.10:7227 python-socks/2.3.0"}
+{"timestamp":"2026-08-09T21:56:25","source_ip":"176.65.149.236","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":82,"application_protocol":"http","user_agent":"Mozilla/5.0 zgrab/0.x","http_request_ja4h":"ge11nn0400_88d30a62b7ad"}
+{"timestamp":"2026-08-09T20:01:21","source_ip":"176.65.148.142","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3001,"application_protocol":"http_proxy","url_path":"http://169.254.169.254/latest/user-data","http_request_ja4h":"ge11nn0500_795d05eb4583"}
+{"timestamp":"2026-08-09T20:00:54","source_ip":"176.65.148.142","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3001,"application_protocol":"http_proxy","url_path":"http://169.254.169.254/latest/user-data","http_request_ja4h":"ge11nn0200_f24fcf356134"}
+{"timestamp":"2026-08-09T19:47:08","source_ip":"45.135.194.31","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3001,"application_protocol":"http","user_agent":"Mozilla/5.0 zgrab/0.x","url_path":"/src/universalTouchGamepad.js","http_request_ja4h":"ge11nn0400_88d30a62b7ad"}
+{"timestamp":"2026-08-09T20:42:47","source_ip":"176.65.148.153","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3389,"application_protocol":"rdp","event_summary":"RDP mstshash=Test"}
+{"timestamp":"2026-08-09T18:26:01","source_ip":"176.65.148.58","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8069,"application_protocol":"http","user_agent":"odin-scanner/0.4","http_request_ja4h":"ge10nn0400_17292dadbc7b"}
+{"timestamp":"2026-08-09T17:30:45","source_ip":"176.65.149.182","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8880,"application_protocol":"http_connect","event_summary":"CONNECT ipv4-internet.yandex.net:443"}
diff --git a/kevlar/2026-08-10/honeylabs/fingerprints.csv b/kevlar/2026-08-10/honeylabs/fingerprints.csv
new file mode 100644
index 0000000..3755281
--- /dev/null
+++ b/kevlar/2026-08-10/honeylabs/fingerprints.csv
@@ -0,0 +1,8 @@
+fingerprint,type,asn,ips,notes
+t13i1310h1_f57a46bbacb6_e7c285222651,ja4,AS51852,1,Firefox/140 TLS1.3
+ge11nn0400_9c3956fad5da,ja4h,AS51852,1,Go-http-client
+ge11nn0400_88d30a62b7ad,ja4h,AS51396,2,zgrab/0.x
+ge10nn0400_17292dadbc7b,ja4h,AS51396,1,odin-scanner/0.4
+ge11nn0500_795d05eb4583,ja4h,AS51396,1,websocket cloud metadata probe
+ge11nn0200_f24fcf356134,ja4h,AS51396,1,cloud metadata probe
+ge11nn0300_341eb0d8946c,ja4h,AS51852,1,Mozilla/5.0 .env probe
diff --git a/kevlar/2026-08-10/honeylabs/top-attackers.csv b/kevlar/2026-08-10/honeylabs/top-attackers.csv
new file mode 100644
index 0000000..8ef4389
--- /dev/null
+++ b/kevlar/2026-08-10/honeylabs/top-attackers.csv
@@ -0,0 +1,17 @@
+asn,ip,events,top_ports,country
+AS51396,204.76.203.221,1316,"11908,1090,7892,9991,11439",NL
+AS51396,204.76.203.214,1285,"808,20502,3128,4004,2083",NL
+AS51396,204.76.203.213,1273,"1256,2016,8800,5021,2222",NL
+AS51396,204.76.203.212,1268,"2080,9055,1256,2016,6666",NL
+AS51396,204.76.203.222,1252,"2111,16666,8585,9099,5588",NL
+AS51396,204.76.203.79,871,"40012,15564,31280,17895,45198",NL
+AS51396,204.76.203.78,863,"64531,11111,20021,28888,15300",NL
+AS51396,204.76.203.80,837,"60001,17891,20101,60400,17893",NL
+AS51396,45.135.193.193,423,"443,8080,8000,81,3128",DE
+AS51396,45.135.194.113,324,"8099,8097,8086,8083,8084",DE
+AS14956,144.172.104.239,57,"1723,25565,8291,3389",US
+AS14956,144.172.100.63,53,"1723,25565,8291,3389",US
+AS14956,172.86.119.157,52,"1723,25565,8291,3389",US
+AS51852,179.43.150.26,64,"8899,8089,443,3001,8001",CH
+AS51852,81.17.28.131,63,"8899,8089,443,3001,8001",CH
+AS198953,176.120.22.61,221,"3390,3341,6433,443,8080",RU