feat: update bph iocs

12 files changed, 45 insertions, 0 deletions

diff --git a/kevlar/2026-08-17/censys/aggregations-AS138915.ndjson b/kevlar/2026-08-17/censys/aggregations-AS138915.ndjson
new file mode 100644
index 0000000..bbd1f15
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS138915.ndjson
@@ -0,0 +1,4 @@
+{"field":"host.services.port","buckets":[{"count":6947,"key":"22"},{"count":2655,"key":"443"},{"count":2544,"key":"32080"},{"count":2488,"key":"43080"},{"count":2362,"key":"40003"},{"count":2355,"key":"40801"},{"count":2346,"key":"40803"},{"count":2345,"key":"40804"},{"count":2333,"key":"40810"},{"count":2314,"key":"80"},{"count":913,"key":"123"},{"count":698,"key":"8080"},{"count":563,"key":"3389"},{"count":524,"key":"135"},{"count":518,"key":"139"},{"count":516,"key":"445"}],"total_count":12717}
+{"field":"host.services.software.product","buckets":[{"count":7386,"key":"openssh"},{"count":6291,"key":"openresty"},{"count":4824,"key":"tengine"},{"count":3093,"key":"nginx"},{"count":920,"key":"http_api"},{"count":208,"key":"openvpn_access_server"},{"count":189,"key":"squid"},{"count":126,"key":"wordpress"}],"total_count":12717}
+{"field":"host.labels.value","buckets":[{"count":12717,"key":"BULLETPROOF"},{"count":99,"key":"IPV6"}],"total_count":12717}
+{"field":"host.services.cert.parsed.issuer.common_name","buckets":[{"count":4711,"key":"GlobalSign GCC R3 OV TLS CA 2024"},{"count":2434,"key":"localhost"},{"count":2393,"key":"prod-vpn.example.com"},{"count":2292,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":2281,"key":"GlobalSign GCC R46 OV TLS CA 2025"},{"count":1206,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":589,"key":"WoTrus RSA DV SSL CA 2"},{"count":322,"key":"YR1"},{"count":292,"key":"WIN-9QFKHJ39QE9"},{"count":243,"key":"YR2"},{"count":242,"key":"QY"},{"count":182,"key":"YE1"},{"count":174,"key":"YE2"},{"count":171,"key":"tls.internal.ypc.org"},{"count":146,"key":"tudog_node_agent._reserved.bytefcdn.com"}],"total_count":12717}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS14956.ndjson b/kevlar/2026-08-17/censys/aggregations-AS14956.ndjson
new file mode 100644
index 0000000..47bf2e9
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS14956.ndjson
@@ -0,0 +1,5 @@
+{"field":"host.services.port","buckets":[{"count":14638,"key":"22"},{"count":8214,"key":"443"},{"count":7699,"key":"3389"},{"count":7119,"key":"80"},{"count":1089,"key":"2096"},{"count":982,"key":"135"},{"count":896,"key":"8443"},{"count":893,"key":"5985"},{"count":849,"key":"445"},{"count":782,"key":"53"},{"count":656,"key":"139"},{"count":633,"key":"25"},{"count":613,"key":"8080"},{"count":565,"key":"21"},{"count":524,"key":"111"},{"count":492,"key":"3000"},{"count":462,"key":"993"},{"count":446,"key":"47001"},{"count":429,"key":"143"},{"count":405,"key":"110"},{"count":404,"key":"587"},{"count":393,"key":"2053"},{"count":324,"key":"3306"},{"count":311,"key":"2222"},{"count":307,"key":"8000"}],"total_count":24964}
+{"field":"host.services.software.product","buckets":[{"count":13734,"key":"openssh"},{"count":9657,"key":"nginx"},{"count":2422,"key":"express"},{"count":1531,"key":"http_server"},{"count":1179,"key":"dovecot"},{"count":1075,"key":"http_api"},{"count":578,"key":"internet_information_services"},{"count":552,"key":"ghost"},{"count":522,"key":"php"},{"count":483,"key":"next.js"},{"count":440,"key":"python"},{"count":439,"key":"postfix"},{"count":389,"key":"traefik_proxy"}],"total_count":24964}
+{"field":"host.labels.value","buckets":[{"count":24964,"key":"BULLETPROOF"},{"count":207,"key":"IPV6"}],"total_count":24964}
+{"field":"host.services.cert.parsed.issuer.common_name","buckets":[{"count":1934,"key":"YE2"},{"count":1791,"key":"YE1"},{"count":1059,"key":"windows-Dallas0"},{"count":974,"key":"YR2"},{"count":901,"key":"YR1"},{"count":895,"key":"invalid2.invalid"},{"count":506,"key":"windows-Utah-4g"},{"count":403,"key":"windows-Amsterd"},{"count":389,"key":"TRAEFIK DEFAULT CERT"},{"count":378,"key":"windows-Utah-4H"},{"count":369,"key":"windows-Utah-2g"},{"count":330,"key":"www.example.com"},{"count":288,"key":"AnyDesk Client"},{"count":269,"key":"windows-LasVega"},{"count":259,"key":"WE1"},{"count":251,"key":"Plesk"},{"count":213,"key":"windows-Utah-8g"},{"count":182,"key":"windows-NewYork"}],"total_count":24964}
+{"field":"host.operating_system.product","buckets":[{"count":12952,"key":"linux"},{"count":5841,"key":"windows"},{"count":215,"key":"ubuntu"},{"count":126,"key":"debian_linux"},{"count":102,"key":"routeros"},{"count":33,"key":"freebsd"}],"total_count":24964}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS198953.ndjson b/kevlar/2026-08-17/censys/aggregations-AS198953.ndjson
new file mode 100644
index 0000000..6a84713
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS198953.ndjson
@@ -0,0 +1,3 @@
+{"field":"host.services.port","buckets":[{"count":171,"key":"22"},{"count":169,"key":"3389"},{"count":91,"key":"80"},{"count":85,"key":"443"},{"count":52,"key":"135"},{"count":41,"key":"137"},{"count":38,"key":"53"},{"count":36,"key":"139"},{"count":36,"key":"5985"},{"count":26,"key":"47001"},{"count":24,"key":"21"},{"count":24,"key":"123"},{"count":21,"key":"25"},{"count":20,"key":"143"},{"count":20,"key":"993"},{"count":19,"key":"110"},{"count":14,"key":"587"},{"count":14,"key":"3000"},{"count":11,"key":"7070"},{"count":11,"key":"8443"},{"count":10,"key":"111"},{"count":10,"key":"8888"},{"count":9,"key":"445"},{"count":8,"key":"7777"},{"count":7,"key":"465"}],"total_count":368}
+{"field":"host.services.software.product","buckets":[{"count":138,"key":"openssh"},{"count":130,"key":"nginx"},{"count":63,"key":"dovecot"},{"count":41,"key":"http_api"},{"count":39,"key":"express"},{"count":34,"key":"http_server"},{"count":32,"key":"fastpanel"},{"count":25,"key":"exim"},{"count":22,"key":"requirejs"},{"count":21,"key":"parallels_plesk_panel"},{"count":21,"key":"prototype"},{"count":17,"key":"proftpd"},{"count":14,"key":"bind"},{"count":14,"key":"plesk"},{"count":12,"key":"postfix"},{"count":12,"key":"pve"},{"count":12,"key":"virtual_environment"},{"count":11,"key":"anydesk"},{"count":6,"key":"internet_information_services"},{"count":6,"key":"php"},{"count":5,"key":"mysql"},{"count":5,"key":"next.js"}],"total_count":368}
+{"field":"host.labels.value","buckets":[{"count":368,"key":"BULLETPROOF"}],"total_count":368}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS200651.ndjson b/kevlar/2026-08-17/censys/aggregations-AS200651.ndjson
new file mode 100644
index 0000000..2b39303
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS200651.ndjson
@@ -0,0 +1,2 @@
+{"field":"host.services.port","buckets":[{"count":2806,"key":"22"},{"count":2067,"key":"443"},{"count":1890,"key":"80"},{"count":392,"key":"53"},{"count":295,"key":"25"},{"count":241,"key":"587"},{"count":227,"key":"993"},{"count":211,"key":"111"},{"count":195,"key":"143"},{"count":176,"key":"110"},{"count":175,"key":"8080"},{"count":159,"key":"2096"},{"count":138,"key":"8443"},{"count":131,"key":"21"},{"count":122,"key":"465"},{"count":102,"key":"9001"},{"count":100,"key":"2087"},{"count":96,"key":"995"},{"count":95,"key":"2083"},{"count":91,"key":"2078"},{"count":85,"key":"2086"},{"count":84,"key":"2077"},{"count":83,"key":"3000"},{"count":82,"key":"2082"},{"count":82,"key":"3306"}],"total_count":3754}
+{"field":"host.labels.value","buckets":[{"count":3754,"key":"BULLETPROOF"},{"count":120,"key":"IPV6"}],"total_count":3754}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS209847.ndjson b/kevlar/2026-08-17/censys/aggregations-AS209847.ndjson
new file mode 100644
index 0000000..3f48d23
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS209847.ndjson
@@ -0,0 +1 @@
+{"field":"host.services.port","buckets":[{"count":1880,"key":"22"},{"count":913,"key":"443"},{"count":662,"key":"53"},{"count":646,"key":"80"},{"count":605,"key":"8080"},{"count":519,"key":"1050"},{"count":517,"key":"1030"},{"count":517,"key":"24442"},{"count":499,"key":"1234"},{"count":499,"key":"1235"},{"count":329,"key":"21"},{"count":327,"key":"1500"},{"count":286,"key":"1501"},{"count":211,"key":"2096"},{"count":184,"key":"8443"},{"count":166,"key":"25"},{"count":162,"key":"993"},{"count":160,"key":"143"},{"count":159,"key":"110"},{"count":157,"key":"587"},{"count":74,"key":"465"},{"count":72,"key":"995"},{"count":67,"key":"2222"},{"count":49,"key":"2053"},{"count":48,"key":"42567"}],"total_count":2824}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS210644.ndjson b/kevlar/2026-08-17/censys/aggregations-AS210644.ndjson
new file mode 100644
index 0000000..81bd67e
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS210644.ndjson
@@ -0,0 +1 @@
+{"field":"host.services.port","buckets":[{"count":62648,"key":"22"},{"count":36830,"key":"443"},{"count":18160,"key":"80"},{"count":12853,"key":"2096"},{"count":8533,"key":"8443"},{"count":6575,"key":"8080"},{"count":3631,"key":"2053"},{"count":2042,"key":"2222"},{"count":1856,"key":"3389"},{"count":1439,"key":"53"},{"count":1312,"key":"51821"},{"count":1216,"key":"3000"},{"count":1176,"key":"8000"},{"count":1110,"key":"25"},{"count":984,"key":"2083"},{"count":983,"key":"9443"},{"count":887,"key":"993"},{"count":883,"key":"587"},{"count":849,"key":"2087"},{"count":832,"key":"1080"},{"count":763,"key":"143"},{"count":707,"key":"110"},{"count":634,"key":"500"},{"count":573,"key":"8444"},{"count":565,"key":"4443"}],"total_count":72465}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS214940.ndjson b/kevlar/2026-08-17/censys/aggregations-AS214940.ndjson
new file mode 100644
index 0000000..abf19c0
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS214940.ndjson
@@ -0,0 +1,2 @@
+{"field":"host.services.port","buckets":[],"total_count":0}
+{"field":"host.labels.value","buckets":[],"total_count":0}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS51396.ndjson b/kevlar/2026-08-17/censys/aggregations-AS51396.ndjson
new file mode 100644
index 0000000..0d0ff7b
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS51396.ndjson
@@ -0,0 +1,5 @@
+{"field":"host.services.port","buckets":[{"count":833,"key":"22"},{"count":339,"key":"80"},{"count":260,"key":"443"},{"count":100,"key":"1407"},{"count":99,"key":"11407"},{"count":74,"key":"8080"},{"count":70,"key":"2096"},{"count":69,"key":"53"},{"count":67,"key":"111"},{"count":61,"key":"6239"},{"count":61,"key":"16239"},{"count":60,"key":"9634"},{"count":60,"key":"19634"},{"count":59,"key":"3389"}],"total_count":1910}
+{"field":"host.services.software.product","buckets":[{"count":753,"key":"openssh"},{"count":382,"key":"nginx"},{"count":171,"key":"http_server"},{"count":148,"key":"http_api"},{"count":135,"key":"express"},{"count":75,"key":"php"},{"count":65,"key":"pve"},{"count":65,"key":"virtual_environment"},{"count":30,"key":"tinyproxy"}],"total_count":1857}
+{"field":"host.labels.value","buckets":[{"count":1857,"key":"BULLETPROOF"},{"count":17,"key":"IPV6"}],"total_count":1857}
+{"field":"host.services.cert.parsed.issuer.common_name","buckets":[{"count":101,"key":"YE1"},{"count":93,"key":"YE2"},{"count":61,"key":"YR1"},{"count":51,"key":"YR2"},{"count":30,"key":"Proxmox Virtual Environment"},{"count":28,"key":"WIN-9QL4SDRB93L"},{"count":23,"key":"TRAEFIK DEFAULT CERT"},{"count":22,"key":"invalid2.invalid"},{"count":19,"key":"WIN-IK7N6SD2UBU"},{"count":18,"key":"Cloudbase-Init WinRM"},{"count":14,"key":"R12"},{"count":12,"key":"XUI.one"},{"count":11,"key":"Gozargah"},{"count":11,"key":"Plesk"},{"count":9,"key":"hosting12.coolsshservers.com"},{"count":9,"key":"srv1.dedusapp.icu"},{"count":8,"key":"*.aapanel.com"}],"total_count":1857}
+{"field":"host.operating_system.product","buckets":[{"count":681,"key":"linux"},{"count":96,"key":"windows"},{"count":36,"key":"debian_linux"},{"count":30,"key":"proxmox"},{"count":14,"key":"ubuntu"}],"total_count":1857}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS51852.ndjson b/kevlar/2026-08-17/censys/aggregations-AS51852.ndjson
new file mode 100644
index 0000000..5dde5d4
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS51852.ndjson
@@ -0,0 +1,5 @@
+{"field":"host.services.port","buckets":[{"count":4348,"key":"443"},{"count":4040,"key":"22"},{"count":3413,"key":"161"},{"count":2727,"key":"80"},{"count":1879,"key":"123"},{"count":1551,"key":"53"},{"count":846,"key":"25"},{"count":827,"key":"500"},{"count":803,"key":"21"},{"count":798,"key":"143"},{"count":790,"key":"993"},{"count":789,"key":"110"},{"count":693,"key":"587"},{"count":658,"key":"1194"},{"count":627,"key":"8082"},{"count":574,"key":"111"},{"count":333,"key":"465"},{"count":327,"key":"995"},{"count":318,"key":"2096"},{"count":316,"key":"3306"},{"count":265,"key":"3333"},{"count":252,"key":"3389"},{"count":242,"key":"8443"},{"count":186,"key":"3128"},{"count":172,"key":"2083"}],"total_count":8542}
+{"field":"host.services.software.product","buckets":[{"count":4613,"key":"nginx"},{"count":3937,"key":"openssh"},{"count":2495,"key":"dovecot"},{"count":1322,"key":"exim"},{"count":835,"key":"openvpn_access_server"},{"count":802,"key":"cpanel"},{"count":739,"key":"bind"},{"count":595,"key":"ceph"},{"count":519,"key":"webmail"},{"count":368,"key":"php"},{"count":355,"key":"proftpd"},{"count":342,"key":"express"},{"count":325,"key":"virtual_environment"},{"count":324,"key":"pve"},{"count":275,"key":"fastpanel"},{"count":264,"key":"litespeed_web_server"},{"count":251,"key":"openresty"},{"count":237,"key":"wordpress"}],"total_count":8542}
+{"field":"host.labels.value","buckets":[{"count":8542,"key":"BULLETPROOF"},{"count":38,"key":"IPV6"}],"total_count":8542}
+{"field":"host.services.cert.parsed.issuer.common_name","buckets":[{"count":1823,"key":"server"},{"count":1474,"key":"YR2"},{"count":845,"key":"YR1"},{"count":828,"key":"Hydra Authentication RSA SubCA #154"},{"count":774,"key":"server.domain.com"},{"count":478,"key":"YE2"},{"count":381,"key":"YE1"},{"count":346,"key":"server.ibras.eu"},{"count":266,"key":"invalid2.invalid"},{"count":175,"key":"Hydra Authentication RSA SubCA #155"},{"count":157,"key":"Plesk"},{"count":152,"key":"Proxmox Virtual Environment"},{"count":130,"key":"Hydra Authentication RSA SubCA #156"},{"count":109,"key":"server.xtreme-results.net"},{"count":104,"key":"localhost"},{"count":72,"key":"(STAGING) Artificial Amaranth YE1"},{"count":66,"key":"(STAGING) Baloney Bulgur YE2"}],"total_count":8542}
+{"field":"host.operating_system.product","buckets":[{"count":3026,"key":"linux"},{"count":206,"key":"windows"},{"count":154,"key":"proxmox"},{"count":128,"key":"enterprise_linux"},{"count":34,"key":"ubuntu"},{"count":30,"key":"debian_linux"},{"count":26,"key":"freebsd"},{"count":25,"key":"centos"},{"count":25,"key":"routeros"},{"count":17,"key":"vmware_esxi_server"}],"total_count":8542}
diff --git a/kevlar/2026-08-17/censys/aggregations-AS57043.ndjson b/kevlar/2026-08-17/censys/aggregations-AS57043.ndjson
new file mode 100644
index 0000000..ea26b05
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS57043.ndjson
@@ -0,0 +1,5 @@
+{"field":"host.services.port","buckets":[{"count":76822,"key":"22"},{"count":50471,"key":"443"},{"count":31791,"key":"80"},{"count":15200,"key":"2096"},{"count":8565,"key":"8443"},{"count":4130,"key":"111"},{"count":3060,"key":"8080"},{"count":2647,"key":"2053"},{"count":2616,"key":"2222"},{"count":2446,"key":"53"},{"count":2131,"key":"9100"},{"count":1995,"key":"8000"},{"count":1904,"key":"21"},{"count":1748,"key":"3389"},{"count":1733,"key":"25"},{"count":1623,"key":"1881"},{"count":1565,"key":"2212"},{"count":1556,"key":"3000"},{"count":1543,"key":"6767"},{"count":1388,"key":"993"},{"count":1371,"key":"587"},{"count":1321,"key":"143"},{"count":1198,"key":"110"},{"count":1140,"key":"9443"},{"count":1058,"key":"9000"}],"total_count":101028}
+{"field":"host.services.software.product","buckets":[{"count":76505,"key":"openssh"},{"count":59487,"key":"nginx"},{"count":9590,"key":"google_web_services"},{"count":9590,"key":"web_server"},{"count":6807,"key":"ghost"},{"count":6803,"key":"app_and_api_protector"},{"count":5516,"key":"express"},{"count":4050,"key":"dovecot"},{"count":3613,"key":"caddy"},{"count":3566,"key":"waf"},{"count":3395,"key":"cloudflare_load_balancer"},{"count":3091,"key":"http_server"},{"count":2279,"key":"uvicorn"},{"count":2048,"key":"traefik_proxy"},{"count":2023,"key":"exim"},{"count":1682,"key":"fastpanel"},{"count":1524,"key":"python"},{"count":1475,"key":"next.js"},{"count":1439,"key":"traffic_server"},{"count":1185,"key":"portainer"},{"count":1058,"key":"openresty"}],"total_count":101028}
+{"field":"host.labels.value","buckets":[{"count":101028,"key":"BULLETPROOF"},{"count":9,"key":"IPV6"}],"total_count":101028}
+{"field":"host.services.cert.parsed.issuer.common_name","buckets":[{"count":13079,"key":"YE2"},{"count":13034,"key":"YE1"},{"count":9707,"key":"invalid2.invalid"},{"count":7371,"key":"YR1"},{"count":4434,"key":"YR2"},{"count":2433,"key":"WE1"},{"count":2369,"key":"GeoTrust TLS RSA CA G1"},{"count":2066,"key":"TRAEFIK DEFAULT CERT"},{"count":1790,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":1583,"key":"hypervisor.hv"},{"count":1530,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":963,"key":"WR1"},{"count":662,"key":"E8"},{"count":647,"key":"E7"},{"count":514,"key":"MySQL_Server_8.0.43_Auto_Generated_CA_Certificate"}],"total_count":101028}
+{"field":"host.operating_system.product","buckets":[{"count":72467,"key":"linux"},{"count":787,"key":"ubuntu"},{"count":580,"key":"windows"},{"count":278,"key":"routeros"},{"count":262,"key":"debian_linux"},{"count":180,"key":"proxmox"},{"count":102,"key":"adaptive_security_appliance_software"},{"count":54,"key":"freebsd"},{"count":41,"key":"vmware_esxi_server"}],"total_count":101028}
diff --git a/kevlar/2026-08-17/censys/fleet-correlation.csv b/kevlar/2026-08-17/censys/fleet-correlation.csv
new file mode 100644
index 0000000..276c0ce
--- /dev/null
+++ b/kevlar/2026-08-17/censys/fleet-correlation.csv
@@ -0,0 +1,6 @@
+linkage_type,ips,indicator,asn,notes
+shared_service_banner,204.76.203.224+226,ClickHouse banner e5ca3ebf... on 9009 + proxy banner 16f5ca47... on 9191,AS51396,Cloned proxy infra; identical HTTP banner hashes
+shared_hassh,77.83.39.6 + 204.76.203.221/214 (prior week),hassh 41ff3ecd1458b0bf86e1b4891636213e,AS51396,SSH client config shared across PFCLOUD fleet; ties .env crawler to cloned proxy infra
+xray_panel_certs,YE1/YE2/YR1/YR2 across AS51396/AS57043/AS14956/AS51852/AS138915,"X-UI/Xray panel cert series (YE1=26k+, YE2=27k+, YR1=11k+, YR2=9k+ combined)",multi,Cross-ASN Xray/panel fleet; XUI.one + Gozargah issuer CNs on PFCLOUD
+scan_only_nodes,154.93.119.164-169 (KAOPU 154.93.119.0/24),single HTTP service on 4083 returning 404,AS138915,Proxy/CDN node pool; no SSH
+tor_relay,185.100.87.136,Onionoo fingerprint 9366185B...,AS200651,Confirmed Tor exit; random-domain TLS cert on 9001
diff --git a/kevlar/2026-08-17/censys/ip-enrichments.ndjson b/kevlar/2026-08-17/censys/ip-enrichments.ndjson
new file mode 100644
index 0000000..775e889
--- /dev/null
+++ b/kevlar/2026-08-17/censys/ip-enrichments.ndjson
@@ -0,0 +1,6 @@
+{"ip":"204.76.203.224","asn":51396,"org":"Pfcloud UG","labels":["BULLETPROOF"],"services":[{"port":9009,"protocol":"HTTP","product":"clickhouse","note":"ClickHouse web UI exposed"},{"port":9191,"protocol":"HTTP","product":"proxy","note":"407 Proxy Auth Required; 'plan expired' - commercial proxy"},{"port":25565,"protocol":"MINECRAFT","product":"Paper 26.1.2","note":"Minecraft server MOTD Z"}],"banner_hash_clickhouse":"e5ca3ebf722088f908c9581a361d8140a30c3e21b55d69f2a68d01a8469be4f4","banner_hash_proxy":"16f5ca474300f3af2568e6cc8afb227e0c77a2de0a68aeb82ebab13dc83e4591","whois":"Intelligence Hosting LLC, Eygelshoven NL"}
+{"ip":"204.76.203.226","asn":51396,"org":"Pfcloud UG","labels":["BULLETPROOF"],"services":[{"port":9009,"protocol":"HTTP","product":"clickhouse","note":"ClickHouse web UI exposed"},{"port":9191,"protocol":"HTTP","product":"proxy","note":"407 Proxy Auth Required"},{"port":25565,"protocol":"MINECRAFT","product":"Paper 26.1.2","note":"Minecraft server MOTD Z"}],"banner_hash_clickhouse":"e5ca3ebf722088f908c9581a361d8140a30c3e21b55d69f2a68d01a8469be4f4","banner_hash_proxy":"16f5ca474300f3af2568e6cc8afb227e0c77a2de0a68aeb82ebab13dc83e4591","whois":"Intelligence Hosting LLC, Eygelshoven NL","clone_of":"204.76.203.224 (identical ClickHouse+proxy banner hashes)"}
+{"ip":"176.120.22.61","asn":198953,"org":"Proton66 OOO","labels":["BULLETPROOF"],"os":"windows (Server 2012 R2, RU)","services":[{"port":135,"protocol":"DCERPC","exposure":"REMOTE_ACCESS","note":"Exposed DCERPC CENSYS-2022-1025"},{"port":137,"protocol":"NETBIOS","note":"Exposed NetBIOS CENSYS-2022-1048"},{"port":3389,"protocol":"RDP","cert":"CN=M051108 self-signed","note":"RDP login screen RU; weak TLS cipher"},{"port":5985,"protocol":"HTTP","product":"Microsoft-HTTPAPI/2.0","note":"WinRM"},{"port":47001,"protocol":"HTTP","product":"Microsoft-HTTPAPI/2.0","note":"WinRM"}],"whois":"Proton66 OOO, St. Petersburg RU"}
+{"ip":"77.83.39.6","asn":51396,"org":"PFCLOUD","labels":["BULLETPROOF"],"os":"linux (Ubuntu, OpenSSH 8.9p1)","services":[{"port":22,"protocol":"SSH","hassh":"41ff3ecd1458b0bf86e1b4891636213e","note":"SAME HASSH as 2026-08-10 PFCLOUD clone pair 204.76.203.221/214"}],"greynoise":"malicious; ENV Crawler, GoogleBot Pretender, TLS/SSL Crawler","whois":"Lanedonet Datacenter NL; bgp 77.83.39.0/24 PFCLOUD","note":"honeylabs event attribution AS214940 KPRONET conflicts with Censys AS51396 PFCLOUD"}
+{"ip":"185.100.87.136","asn":200651,"org":"FlokiNET ehf","labels":["BULLETPROOF","PROXY_SERVER"],"privacy":["tor:true"],"services":[{"port":80,"protocol":"HTTP","product":"tor","note":"Tor exit notice page; X-Your-Address-Is"},{"port":9001,"protocol":"UNKNOWN","tls":true,"note":"Tor OR port; cert www.ic65jfkrs.net issued by www.jqfbaj7qyl35.com (random domain pair, 14-day validity)"},{"port":7288,"protocol":"SSH","product":"OpenSSH 9.9"}],"tor":{"nickname":"PremiumTorExit","fingerprint":"9366185B4ECB1CC3634F475D20FDDFE7A302BAF2","flags":["Exit","Running","Stable","Valid"],"platform":"Tor 0.4.9.11 on Linux","or_address":"185.100.87.136:9001"},"whois":"FlokiNET ehf, Reykjavik IS / Bucharest RO"}
+{"ip":"179.43.150.26","asn":51852,"org":"Private Layer INC","labels":["BULLETPROOF"],"os":"linux (Debian, OpenSSH 8.4p1)","services":[{"port":22,"protocol":"SSH","hostkey_sha256":"168ce880df9a408b4f257de4e0a1e623fe8ff09f0c5d681020230209cecf4fcf"}],"whois":"PRIVATE LAYER INC, MIG23 netblock"}