diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
| commit | 237f2d9330398e0a0628980056db6b09098d5f2f (patch) | |
| tree | 09f16c0f363ee4a23bdc64cf3cfaab7562a80432 /kevlar/2026-08-17/iocs/README.md | |
| parent | 7439049b2d46c035fda40b27d3f64b0b9f48af8a (diff) | |
feat: update bph iocs
Diffstat (limited to 'kevlar/2026-08-17/iocs/README.md')
| -rw-r--r-- | kevlar/2026-08-17/iocs/README.md | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/iocs/README.md b/kevlar/2026-08-17/iocs/README.md new file mode 100644 index 0000000..0c5c2eb --- /dev/null +++ b/kevlar/2026-08-17/iocs/README.md @@ -0,0 +1,19 @@ +# Weekly BP Report -- 2026-08-17 + +Generated: 2026-08-17T11:45:00Z +ASNs covered: 25 +Sponge sessions found: 24,000+ (capped per query; KAOPU-HK + PFCLOUD each >10,000) +Honeylabs events found: ~13,600 across 10 ASNs +Censys IPs enriched: 6 per-IP + 11 ASN-level aggregations +Anomalies flagged: 7 + +## Key Findings + +- PROTON66 MSSQL-TDS brute +594% (~1,700 events); 176.120.22.61 swept 289 ports, likely compromised Win 2012 R2 +- FLOKINET Tor exit 185.100.87.136 beaconing SPARK C2 (POST /api/client/update, secret header, agent UUID) +- KPRONET .git/.env exfil resumed over TLS 443 (77.83.39.6/.94); Censys now attributes space to PFCLOUD +- PFCLOUD .2xx proxy block expanded; 204.76.203.224/226 share ClickHouse + proxy banner hashes (cloned) +- HASSH 41ff3ecd ties 77.83.39.6 (.env crawler) to prior PFCLOUD clone pair +- ROUTERHOSTING PPTP campaign ended; SMBv1 445 brute new +- AEZA qBittorrent peer-scanning 16663 (qB5230) +- KPRONET zero Censys-visible hosts |