chore: weekly BPH updateHEADmain

1 files changed, 580 insertions, 0 deletions

diff --git a/kevlar/2026-09-07/honeylabs/user-agents-all.json b/kevlar/2026-09-07/honeylabs/user-agents-all.json
new file mode 100644
index 0000000..3e8f85c
--- /dev/null
+++ b/kevlar/2026-09-07/honeylabs/user-agents-all.json
@@ -0,0 +1,580 @@
+[
+ {
+  "asn": "AS210644",
+  "name": "AEZA-AS",
+  "value": "libredtail-http",
+  "event_count": 50,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T22:44:34",
+  "last_seen": "2026-09-02T15:29:27",
+  "top_ports": [
+   443,
+   2375
+  ],
+  "countries": [
+   "NL"
+  ]
+ },
+ {
+  "asn": "AS14956",
+  "name": "ROUTERHOSTING",
+  "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0",
+  "event_count": 4,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T06:47:31",
+  "last_seen": "2026-09-04T19:38:08",
+  "top_ports": [
+   2095,
+   8008
+  ],
+  "countries": [
+   "US"
+  ]
+ },
+ {
+  "asn": "AS14956",
+  "name": "ROUTERHOSTING",
+  "value": "Python-urllib/3.13",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-06T15:51:16",
+  "last_seen": "2026-09-06T15:51:16",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "US"
+  ]
+ },
+ {
+  "asn": "AS14956",
+  "name": "ROUTERHOSTING",
+  "value": "Python/3.13 aiohttp/3.13.5",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T17:01:38",
+  "last_seen": "2026-09-03T17:01:38",
+  "top_ports": [
+   7860
+  ],
+  "countries": [
+   "US"
+  ]
+ },
+ {
+  "asn": "AS14956",
+  "name": "ROUTERHOSTING",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-02T02:45:38",
+  "last_seen": "2026-09-02T02:45:38",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "US"
+  ]
+ },
+ {
+  "asn": "AS51852",
+  "name": "PLI-AS",
+  "value": "Mozilla/5.0",
+  "event_count": 19,
+  "unique_ips": 2,
+  "first_seen": "2026-08-31T15:32:52",
+  "last_seen": "2026-09-04T19:27:10",
+  "top_ports": [
+   8443,
+   2087
+  ],
+  "countries": [
+   "CH"
+  ]
+ },
+ {
+  "asn": "AS51852",
+  "name": "PLI-AS",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36",
+  "event_count": 3,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T12:06:48",
+  "last_seen": "2026-09-01T12:06:54",
+  "top_ports": [
+   80,
+   443
+  ],
+  "countries": [
+   "CH"
+  ]
+ },
+ {
+  "asn": "AS51852",
+  "name": "PLI-AS",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
+  "event_count": 3,
+  "unique_ips": 1,
+  "first_seen": "2026-09-04T18:34:20",
+  "last_seen": "2026-09-04T19:27:10",
+  "top_ports": [
+   2087
+  ],
+  "countries": [
+   "CH"
+  ]
+ },
+ {
+  "asn": "AS51852",
+  "name": "PLI-AS",
+  "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0",
+  "event_count": 2,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T07:55:46",
+  "last_seen": "2026-09-02T18:13:22",
+  "top_ports": [
+   32400,
+   8085
+  ],
+  "countries": [
+   "CH"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Go-http-client/1.1",
+  "event_count": 372,
+  "unique_ips": 5,
+  "first_seen": "2026-08-31T00:35:35",
+  "last_seen": "2026-09-06T23:47:43",
+  "top_ports": [
+   4550,
+   4747,
+   222,
+   8000,
+   11434
+  ],
+  "countries": [
+   "NL",
+   "DE"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "0day",
+  "event_count": 200,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T01:11:46",
+  "last_seen": "2026-09-06T07:38:01",
+  "top_ports": [
+   8181,
+   8080,
+   18080,
+   18088,
+   8888
+  ],
+  "countries": [
+   "DE"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",
+  "event_count": 126,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T02:03:10",
+  "last_seen": "2026-09-06T17:30:01",
+  "top_ports": [
+   80,
+   443,
+   8500,
+   8090,
+   3000
+  ],
+  "countries": [
+   "NL"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 zgrab/0.x",
+  "event_count": 95,
+  "unique_ips": 5,
+  "first_seen": "2026-08-31T00:50:18",
+  "last_seen": "2026-09-06T21:26:21",
+  "top_ports": [
+   8000,
+   8001,
+   443,
+   9000,
+   88
+  ],
+  "countries": [
+   "NL"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "kubo-probe/1.0",
+  "event_count": 12,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T11:11:43",
+  "last_seen": "2026-09-02T16:28:23",
+  "top_ports": [
+   5001,
+   8080
+  ],
+  "countries": [
+   "DE"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36",
+  "event_count": 10,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T10:08:26",
+  "last_seen": "2026-09-05T08:05:52",
+  "top_ports": [
+   80
+  ],
+  "countries": [
+   "NL"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36",
+  "event_count": 6,
+  "unique_ips": 1,
+  "first_seen": "2026-09-05T12:54:20",
+  "last_seen": "2026-09-05T13:26:20",
+  "top_ports": [
+   8090
+  ],
+  "countries": [
+   "NL"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36",
+  "event_count": 4,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T09:55:22",
+  "last_seen": "2026-09-02T01:32:40",
+  "top_ports": [
+   80
+  ],
+  "countries": [
+   "NL"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T10:40:15",
+  "last_seen": "2026-09-01T10:40:15",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T06:45:24",
+  "last_seen": "2026-09-01T06:45:24",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T07:27:42",
+  "last_seen": "2026-08-31T07:27:42",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T09:52:59",
+  "last_seen": "2026-08-31T09:52:59",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T10:27:07",
+  "last_seen": "2026-09-03T10:27:07",
+  "top_ports": [
+   8080
+  ],
+  "countries": [
+   "NL"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T18:59:50",
+  "last_seen": "2026-08-31T18:59:50",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T07:30:45",
+  "last_seen": "2026-09-01T07:30:45",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T07:08:42",
+  "last_seen": "2026-08-31T07:08:42",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T19:29:52",
+  "last_seen": "2026-08-31T19:29:52",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "value": "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.17",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T22:17:09",
+  "last_seen": "2026-08-31T22:17:09",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "UA"
+  ]
+ },
+ {
+  "asn": "AS216246",
+  "name": "RU-AEZA-AS",
+  "value": "Python-urllib/3.10",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T20:05:03",
+  "last_seen": "2026-09-03T20:05:03",
+  "top_ports": [
+   8006
+  ],
+  "countries": [
+   "RU"
+  ]
+ },
+ {
+  "asn": "AS200651",
+  "name": "FLOKINET",
+  "value": "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17",
+  "event_count": 3,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T20:46:54",
+  "last_seen": "2026-09-03T23:55:20",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "RO"
+  ]
+ },
+ {
+  "asn": "AS200651",
+  "name": "FLOKINET",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0",
+  "event_count": 3,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T20:46:53",
+  "last_seen": "2026-09-03T23:55:19",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "RO"
+  ]
+ },
+ {
+  "asn": "AS200651",
+  "name": "FLOKINET",
+  "value": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0",
+  "event_count": 3,
+  "unique_ips": 1,
+  "first_seen": "2026-09-06T20:33:31",
+  "last_seen": "2026-09-06T22:18:29",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "RO"
+  ]
+ },
+ {
+  "asn": "AS200651",
+  "name": "FLOKINET",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
+  "event_count": 3,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T12:25:00",
+  "last_seen": "2026-09-01T14:07:55",
+  "top_ports": [
+   8443
+  ],
+  "countries": [
+   "RO"
+  ]
+ },
+ {
+  "asn": "AS200651",
+  "name": "FLOKINET",
+  "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2",
+  "event_count": 3,
+  "unique_ips": 1,
+  "first_seen": "2026-08-31T01:12:02",
+  "last_seen": "2026-08-31T06:06:56",
+  "top_ports": [
+   443
+  ],
+  "countries": [
+   "RO"
+  ]
+ },
+ {
+  "asn": "AS198953",
+  "name": "PROTON66",
+  "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T02:11:21",
+  "last_seen": "2026-09-03T02:11:21",
+  "top_ports": [
+   8006
+  ],
+  "countries": [
+   "RU"
+  ]
+ },
+ {
+  "asn": "AS198953",
+  "name": "PROTON66",
+  "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T02:10:04",
+  "last_seen": "2026-09-03T02:10:04",
+  "top_ports": [
+   8006
+  ],
+  "countries": [
+   "RU"
+  ]
+ },
+ {
+  "asn": "AS198953",
+  "name": "PROTON66",
+  "value": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0 - github.com/anasbousselham/)",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-01T05:50:24",
+  "last_seen": "2026-09-01T05:50:24",
+  "top_ports": [
+   10443
+  ],
+  "countries": [
+   "RU"
+  ]
+ },
+ {
+  "asn": "AS198953",
+  "name": "PROTON66",
+  "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36",
+  "event_count": 1,
+  "unique_ips": 1,
+  "first_seen": "2026-09-03T02:10:02",
+  "last_seen": "2026-09-03T02:10:02",
+  "top_ports": [
+   8006
+  ],
+  "countries": [
+   "RU"
+  ]
+ }
+]
\ No newline at end of file