diff options
79 files changed, 717 insertions, 33 deletions
diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033928_cc772465.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033928_cc772465.ndjson new file mode 100644 index 0000000..febff63 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033928_cc772465.ndjson @@ -0,0 +1,20 @@ +{"doc_count":636,"key":"193.17.95.129"} +{"doc_count":619,"key":"66.248.205.4"} +{"doc_count":141,"key":"82.22.175.192"} +{"doc_count":98,"key":"82.24.19.158"} +{"doc_count":97,"key":"91.239.211.68"} +{"doc_count":60,"key":"151.245.140.36"} +{"doc_count":56,"key":"193.84.2.233"} +{"doc_count":47,"key":"38.124.152.45"} +{"doc_count":39,"key":"46.17.99.102"} +{"doc_count":33,"key":"89.125.61.90"} +{"doc_count":28,"key":"89.125.61.139"} +{"doc_count":22,"key":"151.241.234.73"} +{"doc_count":16,"key":"167.17.182.242"} +{"doc_count":11,"key":"80.91.65.247"} +{"doc_count":11,"key":"103.27.156.128"} +{"doc_count":10,"key":"151.247.219.40"} +{"doc_count":10,"key":"185.23.18.151"} +{"doc_count":10,"key":"185.167.63.77"} +{"doc_count":9,"key":"91.239.211.190"} +{"doc_count":7,"key":"185.130.226.41"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033928_f09232a9.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033928_f09232a9.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033928_f09232a9.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_01cb7645.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_01cb7645.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_01cb7645.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_052a4545.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_052a4545.ndjson new file mode 100644 index 0000000..e892b30 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_052a4545.ndjson @@ -0,0 +1,20 @@ +{"doc_count":455,"key":0} +{"doc_count":379,"key":22} +{"doc_count":131,"key":443} +{"doc_count":104,"key":2222} +{"doc_count":90,"key":8080} +{"doc_count":86,"key":8022} +{"doc_count":78,"key":80} +{"doc_count":78,"key":2053} +{"doc_count":76,"key":2096} +{"doc_count":69,"key":2083} +{"doc_count":69,"key":2087} +{"doc_count":69,"key":8443} +{"doc_count":69,"key":54321} +{"doc_count":67,"key":8880} +{"doc_count":61,"key":10000} +{"doc_count":45,"key":3000} +{"doc_count":45,"key":5000} +{"doc_count":45,"key":9000} +{"doc_count":45,"key":22222} +{"doc_count":44,"key":8000} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_05dc1121.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_05dc1121.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_05dc1121.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_13506234.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_13506234.ndjson new file mode 100644 index 0000000..23cd0bd --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_13506234.ndjson @@ -0,0 +1,20 @@ +{"doc_count":552,"key":22} +{"doc_count":456,"key":8022} +{"doc_count":380,"key":2222} +{"doc_count":289,"key":22222} +{"doc_count":249,"key":80} +{"doc_count":209,"key":23} +{"doc_count":124,"key":8888} +{"doc_count":122,"key":8080} +{"doc_count":101,"key":8081} +{"doc_count":81,"key":5555} +{"doc_count":68,"key":443} +{"doc_count":30,"key":4000} +{"doc_count":30,"key":10000} +{"doc_count":26,"key":2086} +{"doc_count":25,"key":8880} +{"doc_count":23,"key":82} +{"doc_count":23,"key":8000} +{"doc_count":22,"key":88} +{"doc_count":21,"key":1723} +{"doc_count":20,"key":54321} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_479ff05c.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_479ff05c.ndjson new file mode 100644 index 0000000..6829f17 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_479ff05c.ndjson @@ -0,0 +1,20 @@ +{"doc_count":1355,"key":"45.144.28.70"} +{"doc_count":267,"key":"45.82.252.106"} +{"doc_count":91,"key":"92.118.233.6"} +{"doc_count":70,"key":"5.181.20.206"} +{"doc_count":65,"key":"45.12.129.166"} +{"doc_count":62,"key":"45.83.141.120"} +{"doc_count":60,"key":"94.131.106.51"} +{"doc_count":59,"key":"45.83.22.14"} +{"doc_count":56,"key":"45.12.146.245"} +{"doc_count":51,"key":"45.12.136.73"} +{"doc_count":48,"key":"45.89.55.225"} +{"doc_count":47,"key":"31.222.238.6"} +{"doc_count":36,"key":"185.231.206.117"} +{"doc_count":29,"key":"103.231.75.163"} +{"doc_count":26,"key":"45.83.20.230"} +{"doc_count":25,"key":"45.83.143.9"} +{"doc_count":24,"key":"45.12.132.198"} +{"doc_count":18,"key":"91.225.219.200"} +{"doc_count":13,"key":"185.231.207.149"} +{"doc_count":10,"key":"45.15.170.20"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_898f1c34.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_898f1c34.ndjson new file mode 100644 index 0000000..abd58dd --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_898f1c34.ndjson @@ -0,0 +1,20 @@ +{"doc_count":588,"key":"77.221.153.3"} +{"doc_count":523,"key":"85.192.31.14"} +{"doc_count":399,"key":"138.124.99.219"} +{"doc_count":312,"key":"77.221.158.41"} +{"doc_count":218,"key":"212.113.102.0"} +{"doc_count":108,"key":"109.120.184.14"} +{"doc_count":105,"key":"109.107.190.8"} +{"doc_count":100,"key":"89.22.224.187"} +{"doc_count":92,"key":"62.60.158.60"} +{"doc_count":76,"key":"194.76.217.92"} +{"doc_count":73,"key":"185.103.101.180"} +{"doc_count":67,"key":"79.137.197.24"} +{"doc_count":66,"key":"89.208.97.111"} +{"doc_count":64,"key":"138.124.54.172"} +{"doc_count":62,"key":"109.172.95.248"} +{"doc_count":56,"key":"185.103.101.74"} +{"doc_count":55,"key":"147.45.42.137"} +{"doc_count":50,"key":"77.110.99.110"} +{"doc_count":50,"key":"138.124.113.30"} +{"doc_count":38,"key":"138.124.90.153"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_c0c59998.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_c0c59998.ndjson new file mode 100644 index 0000000..ad2e091 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033929_c0c59998.ndjson @@ -0,0 +1,20 @@ +{"doc_count":677,"key":23} +{"doc_count":213,"key":22} +{"doc_count":211,"key":2222} +{"doc_count":99,"key":443} +{"doc_count":82,"key":80} +{"doc_count":82,"key":8000} +{"doc_count":81,"key":8081} +{"doc_count":80,"key":2000} +{"doc_count":80,"key":22222} +{"doc_count":70,"key":8080} +{"doc_count":28,"key":19} +{"doc_count":28,"key":502} +{"doc_count":28,"key":548} +{"doc_count":28,"key":1741} +{"doc_count":28,"key":2150} +{"doc_count":28,"key":2762} +{"doc_count":28,"key":3306} +{"doc_count":28,"key":4242} +{"doc_count":28,"key":6002} +{"doc_count":28,"key":7001} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_2a20d37c.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_2a20d37c.ndjson new file mode 100644 index 0000000..18384a8 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_2a20d37c.ndjson @@ -0,0 +1,20 @@ +{"doc_count":818306,"key":"38.54.2.209"} +{"doc_count":179755,"key":"38.54.2.232"} +{"doc_count":24262,"key":"38.54.2.61"} +{"doc_count":22835,"key":"38.54.2.13"} +{"doc_count":13199,"key":"38.54.2.170"} +{"doc_count":13198,"key":"38.54.2.221"} +{"doc_count":13076,"key":"38.54.2.148"} +{"doc_count":10407,"key":"38.54.2.75"} +{"doc_count":8290,"key":"38.60.191.241"} +{"doc_count":6907,"key":"38.54.2.82"} +{"doc_count":5924,"key":"38.54.2.107"} +{"doc_count":4736,"key":"38.54.2.112"} +{"doc_count":1497,"key":"38.54.2.152"} +{"doc_count":1282,"key":"38.54.2.168"} +{"doc_count":1257,"key":"38.54.2.203"} +{"doc_count":1089,"key":"38.54.2.195"} +{"doc_count":991,"key":"38.60.230.109"} +{"doc_count":803,"key":"38.54.2.120"} +{"doc_count":739,"key":"38.54.2.204"} +{"doc_count":455,"key":"38.54.2.6"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_3da8acb9.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_3da8acb9.ndjson new file mode 100644 index 0000000..e36ab82 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_3da8acb9.ndjson @@ -0,0 +1,20 @@ +{"doc_count":909,"key":"107.189.27.179"} +{"doc_count":572,"key":"167.88.166.32"} +{"doc_count":548,"key":"167.88.165.33"} +{"doc_count":525,"key":"172.86.123.8"} +{"doc_count":521,"key":"167.88.165.44"} +{"doc_count":507,"key":"167.88.165.227"} +{"doc_count":496,"key":"172.86.117.95"} +{"doc_count":395,"key":"172.86.116.74"} +{"doc_count":383,"key":"144.172.109.224"} +{"doc_count":347,"key":"172.86.113.36"} +{"doc_count":303,"key":"172.86.90.76"} +{"doc_count":277,"key":"216.126.239.17"} +{"doc_count":265,"key":"144.172.94.186"} +{"doc_count":177,"key":"172.86.116.32"} +{"doc_count":163,"key":"172.86.90.159"} +{"doc_count":159,"key":"172.86.113.15"} +{"doc_count":156,"key":"144.172.110.38"} +{"doc_count":137,"key":"144.172.117.163"} +{"doc_count":134,"key":"216.126.225.6"} +{"doc_count":129,"key":"167.88.164.223"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_5d29ea15.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_5d29ea15.ndjson new file mode 100644 index 0000000..8c45a3b --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_5d29ea15.ndjson @@ -0,0 +1,4 @@ +{"doc_count":70,"key":22222} +{"doc_count":52,"key":2222} +{"doc_count":27,"key":22} +{"doc_count":1,"key":19898} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_65240c41.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_65240c41.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_65240c41.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_a460b4e1.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_a460b4e1.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_a460b4e1.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_b1c533ba.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_b1c533ba.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_b1c533ba.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_c438c1de.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_c438c1de.ndjson new file mode 100644 index 0000000..5e5e3c7 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_c438c1de.ndjson @@ -0,0 +1,20 @@ +{"doc_count":1636,"key":22} +{"doc_count":383,"key":1723} +{"doc_count":375,"key":23} +{"doc_count":359,"key":5060} +{"doc_count":287,"key":21} +{"doc_count":283,"key":22222} +{"doc_count":257,"key":80} +{"doc_count":232,"key":13} +{"doc_count":225,"key":443} +{"doc_count":208,"key":5901} +{"doc_count":207,"key":19} +{"doc_count":205,"key":2222} +{"doc_count":186,"key":81} +{"doc_count":186,"key":445} +{"doc_count":185,"key":26} +{"doc_count":184,"key":111} +{"doc_count":179,"key":53} +{"doc_count":169,"key":37} +{"doc_count":166,"key":82} +{"doc_count":160,"key":5900} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_daef3ab1.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_daef3ab1.ndjson new file mode 100644 index 0000000..b6f9e7f --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_daef3ab1.ndjson @@ -0,0 +1,7 @@ +{"doc_count":119,"key":"109.120.141.207"} +{"doc_count":18,"key":"185.72.10.233"} +{"doc_count":4,"key":"178.208.88.6"} +{"doc_count":3,"key":"46.30.46.130"} +{"doc_count":3,"key":"178.208.78.17"} +{"doc_count":2,"key":"176.98.185.152"} +{"doc_count":1,"key":"46.30.46.124"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_f194a532.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_f194a532.ndjson new file mode 100644 index 0000000..1e36d9b --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033957_f194a532.ndjson @@ -0,0 +1,20 @@ +{"doc_count":200071,"key":123} +{"doc_count":199244,"key":80} +{"doc_count":154012,"key":443} +{"doc_count":87132,"key":1900} +{"doc_count":67442,"key":5355} +{"doc_count":66383,"key":137} +{"doc_count":51941,"key":5353} +{"doc_count":41060,"key":5678} +{"doc_count":20394,"key":138} +{"doc_count":10150,"key":23} +{"doc_count":4707,"key":0} +{"doc_count":2543,"key":49960} +{"doc_count":2470,"key":34569} +{"doc_count":2024,"key":4242} +{"doc_count":1869,"key":54378} +{"doc_count":1766,"key":46030} +{"doc_count":1520,"key":67} +{"doc_count":1297,"key":35372} +{"doc_count":1278,"key":28591} +{"doc_count":1266,"key":55534} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_30dceb58.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_30dceb58.ndjson new file mode 100644 index 0000000..2eebe97 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_30dceb58.ndjson @@ -0,0 +1,20 @@ +{"doc_count":34924,"key":23} +{"doc_count":21932,"key":22} +{"doc_count":4966,"key":443} +{"doc_count":4374,"key":5432} +{"doc_count":1988,"key":8080} +{"doc_count":1654,"key":135} +{"doc_count":1595,"key":3306} +{"doc_count":1569,"key":8443} +{"doc_count":1561,"key":80} +{"doc_count":623,"key":5060} +{"doc_count":184,"key":8089} +{"doc_count":163,"key":27017} +{"doc_count":156,"key":5061} +{"doc_count":146,"key":3000} +{"doc_count":126,"key":5433} +{"doc_count":108,"key":8090} +{"doc_count":99,"key":5001} +{"doc_count":96,"key":8291} +{"doc_count":88,"key":8000} +{"doc_count":83,"key":5000} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_46da3e54.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_46da3e54.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_46da3e54.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_553191a6.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_553191a6.ndjson new file mode 100644 index 0000000..a4bb579 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_553191a6.ndjson @@ -0,0 +1,20 @@ +{"doc_count":34911,"key":"190.211.255.210"} +{"doc_count":19387,"key":"179.43.133.154"} +{"doc_count":6314,"key":"179.43.163.26"} +{"doc_count":5577,"key":"179.43.186.223"} +{"doc_count":4219,"key":"179.43.134.114"} +{"doc_count":2498,"key":"179.43.139.58"} +{"doc_count":1790,"key":"81.17.28.130"} +{"doc_count":1465,"key":"179.43.143.170"} +{"doc_count":1061,"key":"179.43.150.26"} +{"doc_count":962,"key":"179.43.175.234"} +{"doc_count":931,"key":"46.19.137.194"} +{"doc_count":646,"key":"179.43.146.226"} +{"doc_count":643,"key":"179.43.175.236"} +{"doc_count":577,"key":"179.43.146.227"} +{"doc_count":512,"key":"179.43.168.58"} +{"doc_count":337,"key":"179.43.186.241"} +{"doc_count":187,"key":"179.43.186.240"} +{"doc_count":101,"key":"31.7.63.12"} +{"doc_count":93,"key":"179.43.182.202"} +{"doc_count":63,"key":"179.43.166.138"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_6bbc4d2d.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_6bbc4d2d.ndjson new file mode 100644 index 0000000..2421ad2 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_6bbc4d2d.ndjson @@ -0,0 +1,20 @@ +{"doc_count":877,"key":"23.172.217.77"} +{"doc_count":553,"key":"23.172.217.87"} +{"doc_count":256,"key":"185.121.15.184"} +{"doc_count":158,"key":"185.219.7.27"} +{"doc_count":143,"key":"23.177.185.239"} +{"doc_count":75,"key":"185.121.15.149"} +{"doc_count":63,"key":"130.12.44.88"} +{"doc_count":24,"key":"130.12.47.8"} +{"doc_count":21,"key":"193.46.218.82"} +{"doc_count":20,"key":"23.172.217.58"} +{"doc_count":20,"key":"185.236.25.175"} +{"doc_count":14,"key":"45.150.195.235"} +{"doc_count":7,"key":"185.236.25.178"} +{"doc_count":6,"key":"147.45.124.196"} +{"doc_count":4,"key":"23.172.217.46"} +{"doc_count":3,"key":"147.45.125.75"} +{"doc_count":3,"key":"147.45.125.234"} +{"doc_count":3,"key":"185.250.180.21"} +{"doc_count":2,"key":"23.177.184.46"} +{"doc_count":2,"key":"185.218.16.80"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_6f84d98d.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_6f84d98d.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_6f84d98d.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_7986882c.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_7986882c.ndjson new file mode 100644 index 0000000..ab0ed8c --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T033958_7986882c.ndjson @@ -0,0 +1,20 @@ +{"doc_count":810,"key":80} +{"doc_count":790,"key":443} +{"doc_count":159,"key":8080} +{"doc_count":155,"key":22} +{"doc_count":140,"key":2222} +{"doc_count":120,"key":22222} +{"doc_count":18,"key":1080} +{"doc_count":18,"key":3128} +{"doc_count":6,"key":4022} +{"doc_count":6,"key":39222} +{"doc_count":3,"key":7235} +{"doc_count":3,"key":25565} +{"doc_count":2,"key":23} +{"doc_count":2,"key":222} +{"doc_count":2,"key":389} +{"doc_count":2,"key":3389} +{"doc_count":1,"key":81} +{"doc_count":1,"key":82} +{"doc_count":1,"key":83} +{"doc_count":1,"key":2525} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_01039b89.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_01039b89.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_01039b89.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_1658ae89.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_1658ae89.ndjson new file mode 100644 index 0000000..9eb05b1 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_1658ae89.ndjson @@ -0,0 +1,20 @@ +{"doc_count":407774,"key":22} +{"doc_count":167345,"key":80} +{"doc_count":41965,"key":8088} +{"doc_count":31308,"key":8080} +{"doc_count":24257,"key":5900} +{"doc_count":20117,"key":23} +{"doc_count":9755,"key":81} +{"doc_count":9667,"key":5555} +{"doc_count":9211,"key":8081} +{"doc_count":9211,"key":27017} +{"doc_count":8774,"key":25565} +{"doc_count":7912,"key":0} +{"doc_count":7635,"key":1080} +{"doc_count":7534,"key":3306} +{"doc_count":7396,"key":82} +{"doc_count":6670,"key":88} +{"doc_count":6625,"key":83} +{"doc_count":6455,"key":4000} +{"doc_count":6393,"key":3000} +{"doc_count":5928,"key":8545} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_1b7b247e.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_1b7b247e.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_1b7b247e.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_2b5e0b8f.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_2b5e0b8f.ndjson new file mode 100644 index 0000000..6ace220 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_2b5e0b8f.ndjson @@ -0,0 +1,20 @@ +{"doc_count":140,"key":443} +{"doc_count":73,"key":22} +{"doc_count":71,"key":6060} +{"doc_count":68,"key":80} +{"doc_count":68,"key":1317} +{"doc_count":68,"key":2375} +{"doc_count":68,"key":3000} +{"doc_count":68,"key":3030} +{"doc_count":68,"key":8000} +{"doc_count":68,"key":8080} +{"doc_count":68,"key":8332} +{"doc_count":68,"key":8443} +{"doc_count":68,"key":8501} +{"doc_count":68,"key":8545} +{"doc_count":68,"key":8546} +{"doc_count":68,"key":8551} +{"doc_count":68,"key":8888} +{"doc_count":68,"key":8899} +{"doc_count":68,"key":8900} +{"doc_count":68,"key":9000} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_34778524.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_34778524.ndjson new file mode 100644 index 0000000..0fb4bc0 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_34778524.ndjson @@ -0,0 +1,20 @@ +{"doc_count":46721,"key":"82.117.87.156"} +{"doc_count":11530,"key":"138.124.14.150"} +{"doc_count":5974,"key":"77.110.105.96"} +{"doc_count":1489,"key":"185.103.100.48"} +{"doc_count":235,"key":"79.137.192.106"} +{"doc_count":184,"key":"178.159.94.237"} +{"doc_count":150,"key":"85.192.30.81"} +{"doc_count":137,"key":"176.124.222.50"} +{"doc_count":92,"key":"77.221.151.241"} +{"doc_count":52,"key":"85.192.56.190"} +{"doc_count":51,"key":"185.96.80.121"} +{"doc_count":43,"key":"176.124.222.35"} +{"doc_count":39,"key":"178.159.94.48"} +{"doc_count":33,"key":"178.20.208.185"} +{"doc_count":25,"key":"82.117.87.221"} +{"doc_count":9,"key":"85.192.30.189"} +{"doc_count":5,"key":"176.124.222.72"} +{"doc_count":3,"key":"178.20.208.195"} +{"doc_count":1,"key":"77.110.104.138"} +{"doc_count":1,"key":"178.159.94.165"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_4d6bd594.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_4d6bd594.ndjson new file mode 100644 index 0000000..48244c4 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_4d6bd594.ndjson @@ -0,0 +1,5 @@ +{"doc_count":33,"key":"45.144.31.247"} +{"doc_count":6,"key":"185.235.242.122"} +{"doc_count":4,"key":"141.98.189.206"} +{"doc_count":3,"key":"45.150.64.125"} +{"doc_count":1,"key":"193.201.126.15"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_54ee8be3.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_54ee8be3.ndjson new file mode 100644 index 0000000..3bddce9 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_54ee8be3.ndjson @@ -0,0 +1,20 @@ +{"doc_count":190651,"key":"204.76.203.231"} +{"doc_count":139928,"key":"204.76.203.18"} +{"doc_count":83990,"key":"176.65.148.147"} +{"doc_count":32389,"key":"45.153.34.235"} +{"doc_count":27172,"key":"45.156.87.204"} +{"doc_count":24086,"key":"176.65.139.11"} +{"doc_count":22107,"key":"45.156.87.253"} +{"doc_count":21564,"key":"176.65.151.74"} +{"doc_count":21147,"key":"204.76.203.206"} +{"doc_count":20484,"key":"176.65.132.149"} +{"doc_count":20416,"key":"176.65.148.84"} +{"doc_count":20183,"key":"45.156.87.254"} +{"doc_count":18911,"key":"204.76.203.73"} +{"doc_count":17864,"key":"176.65.132.129"} +{"doc_count":16569,"key":"204.76.203.212"} +{"doc_count":15701,"key":"45.153.34.114"} +{"doc_count":15644,"key":"45.156.87.216"} +{"doc_count":15299,"key":"204.76.203.226"} +{"doc_count":13985,"key":"176.65.148.70"} +{"doc_count":13398,"key":"45.153.34.71"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_b8d54f94.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_b8d54f94.ndjson new file mode 100644 index 0000000..83293fd --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_b8d54f94.ndjson @@ -0,0 +1,7 @@ +{"doc_count":2247,"key":"89.125.48.168"} +{"doc_count":72,"key":"78.40.209.57"} +{"doc_count":11,"key":"80.253.249.170"} +{"doc_count":3,"key":"95.164.53.44"} +{"doc_count":2,"key":"89.125.48.64"} +{"doc_count":2,"key":"95.164.123.100"} +{"doc_count":2,"key":"185.238.191.130"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_d3e7dd43.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_d3e7dd43.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_d3e7dd43.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_f3e5e771.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_f3e5e771.ndjson new file mode 100644 index 0000000..ac5166b --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034020_f3e5e771.ndjson @@ -0,0 +1,6 @@ +{"doc_count":33,"key":22} +{"doc_count":4,"key":80} +{"doc_count":4,"key":443} +{"doc_count":3,"key":0} +{"doc_count":2,"key":7860} +{"doc_count":1,"key":6379} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_2cffc4b3.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_2cffc4b3.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_2cffc4b3.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_6a8a8fb6.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_6a8a8fb6.ndjson new file mode 100644 index 0000000..1a8b467 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_6a8a8fb6.ndjson @@ -0,0 +1,20 @@ +{"doc_count":497,"key":8888} +{"doc_count":398,"key":8080} +{"doc_count":298,"key":80} +{"doc_count":264,"key":81} +{"doc_count":264,"key":82} +{"doc_count":264,"key":2082} +{"doc_count":264,"key":3000} +{"doc_count":264,"key":5000} +{"doc_count":214,"key":1194} +{"doc_count":213,"key":21} +{"doc_count":213,"key":53} +{"doc_count":213,"key":85} +{"doc_count":213,"key":110} +{"doc_count":213,"key":111} +{"doc_count":213,"key":143} +{"doc_count":213,"key":444} +{"doc_count":213,"key":554} +{"doc_count":213,"key":888} +{"doc_count":213,"key":993} +{"doc_count":213,"key":1024} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_88d2994d.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_88d2994d.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_88d2994d.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_db063240.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_db063240.ndjson new file mode 100644 index 0000000..14096b1 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_db063240.ndjson @@ -0,0 +1,20 @@ +{"doc_count":655,"key":443} +{"doc_count":183,"key":80} +{"doc_count":124,"key":8080} +{"doc_count":102,"key":23} +{"doc_count":82,"key":22} +{"doc_count":74,"key":1080} +{"doc_count":66,"key":18190} +{"doc_count":55,"key":444} +{"doc_count":36,"key":19009} +{"doc_count":33,"key":53} +{"doc_count":29,"key":2222} +{"doc_count":28,"key":3128} +{"doc_count":26,"key":9006} +{"doc_count":26,"key":20001} +{"doc_count":25,"key":18264} +{"doc_count":23,"key":8888} +{"doc_count":20,"key":20201} +{"doc_count":17,"key":5555} +{"doc_count":15,"key":20005} +{"doc_count":8,"key":0} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_e51d9818.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_e51d9818.ndjson new file mode 100644 index 0000000..3195816 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034021_e51d9818.ndjson @@ -0,0 +1,20 @@ +{"doc_count":1094,"key":"185.100.87.136"} +{"doc_count":925,"key":"185.100.84.164"} +{"doc_count":110,"key":"185.10.68.96"} +{"doc_count":88,"key":"185.246.190.66"} +{"doc_count":75,"key":"185.100.85.79"} +{"doc_count":75,"key":"185.146.232.146"} +{"doc_count":36,"key":"185.146.232.145"} +{"doc_count":35,"key":"185.100.84.174"} +{"doc_count":34,"key":"185.246.191.8"} +{"doc_count":33,"key":"185.165.171.158"} +{"doc_count":32,"key":"185.146.232.125"} +{"doc_count":31,"key":"185.165.169.121"} +{"doc_count":20,"key":"185.10.68.109"} +{"doc_count":19,"key":"185.146.232.118"} +{"doc_count":12,"key":"185.146.232.142"} +{"doc_count":11,"key":"185.146.233.211"} +{"doc_count":8,"key":"37.228.129.67"} +{"doc_count":8,"key":"185.165.169.248"} +{"doc_count":3,"key":"185.246.188.74"} +{"doc_count":2,"key":"185.100.87.174"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_475dc27a.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_475dc27a.ndjson new file mode 100644 index 0000000..aa57d45 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_475dc27a.ndjson @@ -0,0 +1,16 @@ +{"doc_count":521,"key":"172.86.94.49"} +{"doc_count":39,"key":"172.86.93.75"} +{"doc_count":38,"key":"45.153.243.249"} +{"doc_count":8,"key":"41.216.188.21"} +{"doc_count":8,"key":"45.138.173.7"} +{"doc_count":8,"key":"216.126.229.131"} +{"doc_count":6,"key":"172.86.95.45"} +{"doc_count":5,"key":"172.86.93.168"} +{"doc_count":3,"key":"172.86.94.48"} +{"doc_count":3,"key":"172.86.94.229"} +{"doc_count":2,"key":"45.11.16.143"} +{"doc_count":1,"key":"152.89.244.135"} +{"doc_count":1,"key":"152.89.246.217"} +{"doc_count":1,"key":"160.20.144.83"} +{"doc_count":1,"key":"172.86.92.75"} +{"doc_count":1,"key":"172.86.93.173"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_873386b9.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_873386b9.ndjson new file mode 100644 index 0000000..07321f7 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_873386b9.ndjson @@ -0,0 +1,4 @@ +{"doc_count":3,"key":"154.94.68.6"} +{"doc_count":2,"key":"204.3.179.3"} +{"doc_count":1,"key":"204.3.179.2"} +{"doc_count":1,"key":"204.3.250.24"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_b2b004f3.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_b2b004f3.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_b2b004f3.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_bf68ad33.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_bf68ad33.ndjson new file mode 100644 index 0000000..f328e3a --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034041_bf68ad33.ndjson @@ -0,0 +1,20 @@ +{"doc_count":287,"key":80} +{"doc_count":279,"key":443} +{"doc_count":23,"key":5060} +{"doc_count":6,"key":22} +{"doc_count":4,"key":445} +{"doc_count":2,"key":23} +{"doc_count":2,"key":27017} +{"doc_count":1,"key":21} +{"doc_count":1,"key":53} +{"doc_count":1,"key":1194} +{"doc_count":1,"key":1433} +{"doc_count":1,"key":1434} +{"doc_count":1,"key":1521} +{"doc_count":1,"key":1883} +{"doc_count":1,"key":2022} +{"doc_count":1,"key":2222} +{"doc_count":1,"key":3306} +{"doc_count":1,"key":3389} +{"doc_count":1,"key":5432} +{"doc_count":1,"key":6000} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_10b95def.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_10b95def.ndjson new file mode 100644 index 0000000..9eacaf0 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_10b95def.ndjson @@ -0,0 +1,20 @@ +{"doc_count":2238,"key":22} +{"doc_count":1092,"key":5405} +{"doc_count":936,"key":443} +{"doc_count":214,"key":1433} +{"doc_count":167,"key":3389} +{"doc_count":156,"key":10443} +{"doc_count":133,"key":22222} +{"doc_count":132,"key":4433} +{"doc_count":131,"key":3390} +{"doc_count":131,"key":5678} +{"doc_count":131,"key":6001} +{"doc_count":126,"key":3005} +{"doc_count":125,"key":4443} +{"doc_count":123,"key":80} +{"doc_count":121,"key":8443} +{"doc_count":119,"key":5984} +{"doc_count":117,"key":1434} +{"doc_count":113,"key":5000} +{"doc_count":105,"key":8888} +{"doc_count":104,"key":5005} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_173e4471.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_173e4471.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_173e4471.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_2d3863e4.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_2d3863e4.ndjson new file mode 100644 index 0000000..d849b45 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_2d3863e4.ndjson @@ -0,0 +1 @@ +{"doc_count":5,"key":42021} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_50c66a1a.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_50c66a1a.ndjson new file mode 100644 index 0000000..8528ec9 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_50c66a1a.ndjson @@ -0,0 +1,20 @@ +{"doc_count":102331,"key":"37.77.150.67"} +{"doc_count":2379,"key":"176.120.22.16"} +{"doc_count":2322,"key":"176.120.22.61"} +{"doc_count":1797,"key":"37.77.150.119"} +{"doc_count":1549,"key":"176.120.22.147"} +{"doc_count":1202,"key":"176.120.22.42"} +{"doc_count":1189,"key":"176.120.22.6"} +{"doc_count":1168,"key":"176.120.22.73"} +{"doc_count":1092,"key":"176.120.22.135"} +{"doc_count":993,"key":"176.120.22.113"} +{"doc_count":600,"key":"176.120.22.240"} +{"doc_count":525,"key":"37.77.150.241"} +{"doc_count":512,"key":"176.120.22.52"} +{"doc_count":415,"key":"37.77.150.83"} +{"doc_count":403,"key":"37.77.150.10"} +{"doc_count":392,"key":"176.120.22.66"} +{"doc_count":348,"key":"193.143.1.66"} +{"doc_count":317,"key":"176.120.22.123"} +{"doc_count":238,"key":"176.120.22.122"} +{"doc_count":166,"key":"176.120.22.179"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_7ae3aa87.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_7ae3aa87.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_7ae3aa87.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_8ded704c.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_8ded704c.ndjson new file mode 100644 index 0000000..02b2cb2 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_8ded704c.ndjson @@ -0,0 +1,20 @@ +{"doc_count":94,"key":443} +{"doc_count":69,"key":80} +{"doc_count":65,"key":9443} +{"doc_count":57,"key":4433} +{"doc_count":50,"key":4443} +{"doc_count":50,"key":8443} +{"doc_count":47,"key":444} +{"doc_count":46,"key":3389} +{"doc_count":35,"key":5443} +{"doc_count":34,"key":10443} +{"doc_count":29,"key":6443} +{"doc_count":26,"key":9000} +{"doc_count":25,"key":4444} +{"doc_count":24,"key":7443} +{"doc_count":23,"key":8888} +{"doc_count":22,"key":22} +{"doc_count":22,"key":20443} +{"doc_count":22,"key":30443} +{"doc_count":21,"key":3390} +{"doc_count":21,"key":8081} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_a4401a6a.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_a4401a6a.ndjson new file mode 100644 index 0000000..57e6e40 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_a4401a6a.ndjson @@ -0,0 +1,2 @@ +{"doc_count":4,"key":"62.60.226.79"} +{"doc_count":1,"key":"62.60.226.176"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_c4678c1d.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_c4678c1d.ndjson new file mode 100644 index 0000000..62d2bb1 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_c4678c1d.ndjson @@ -0,0 +1 @@ +{"doc_count":7,"key":0} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_f06626dd.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_f06626dd.ndjson new file mode 100644 index 0000000..8a2e2a9 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_f06626dd.ndjson @@ -0,0 +1,20 @@ +{"doc_count":765,"key":"91.215.85.104"} +{"doc_count":356,"key":"91.202.233.79"} +{"doc_count":305,"key":"91.215.85.193"} +{"doc_count":297,"key":"91.215.85.106"} +{"doc_count":235,"key":"91.202.233.82"} +{"doc_count":195,"key":"91.202.233.8"} +{"doc_count":181,"key":"193.24.123.16"} +{"doc_count":109,"key":"91.202.233.121"} +{"doc_count":99,"key":"193.24.123.55"} +{"doc_count":86,"key":"91.202.233.46"} +{"doc_count":43,"key":"91.202.233.29"} +{"doc_count":41,"key":"91.215.85.40"} +{"doc_count":41,"key":"193.24.123.118"} +{"doc_count":24,"key":"193.24.123.23"} +{"doc_count":18,"key":"91.215.85.34"} +{"doc_count":16,"key":"91.202.233.33"} +{"doc_count":16,"key":"193.24.123.148"} +{"doc_count":12,"key":"193.24.123.58"} +{"doc_count":5,"key":"91.215.85.142"} +{"doc_count":3,"key":"91.202.233.105"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_f9bf120a.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_f9bf120a.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_f9bf120a.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_fd675192.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_fd675192.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034042_fd675192.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_1f8f7ebe.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_1f8f7ebe.ndjson new file mode 100644 index 0000000..10e9ee5 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_1f8f7ebe.ndjson @@ -0,0 +1,20 @@ +{"doc_count":2882,"key":443} +{"doc_count":2704,"key":80} +{"doc_count":2688,"key":25} +{"doc_count":595,"key":587} +{"doc_count":243,"key":465} +{"doc_count":227,"key":2525} +{"doc_count":88,"key":8022} +{"doc_count":36,"key":22222} +{"doc_count":20,"key":26} +{"doc_count":7,"key":8080} +{"doc_count":6,"key":3128} +{"doc_count":6,"key":8888} +{"doc_count":5,"key":48388} +{"doc_count":1,"key":22} +{"doc_count":1,"key":110} +{"doc_count":1,"key":143} +{"doc_count":1,"key":1433} +{"doc_count":1,"key":3000} +{"doc_count":1,"key":3306} +{"doc_count":1,"key":3385} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_24423bfc.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_24423bfc.ndjson new file mode 100644 index 0000000..c717bcb --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_24423bfc.ndjson @@ -0,0 +1,20 @@ +{"doc_count":2350,"key":"77.83.39.197"} +{"doc_count":701,"key":"77.83.39.94"} +{"doc_count":683,"key":"45.144.212.53"} +{"doc_count":649,"key":"77.83.39.36"} +{"doc_count":610,"key":"77.83.39.42"} +{"doc_count":374,"key":"77.83.39.104"} +{"doc_count":373,"key":"77.83.39.86"} +{"doc_count":362,"key":"77.83.39.14"} +{"doc_count":340,"key":"77.83.39.119"} +{"doc_count":240,"key":"77.83.39.54"} +{"doc_count":214,"key":"77.83.39.117"} +{"doc_count":173,"key":"77.83.39.84"} +{"doc_count":171,"key":"77.83.39.159"} +{"doc_count":159,"key":"77.83.39.82"} +{"doc_count":157,"key":"77.83.39.72"} +{"doc_count":142,"key":"77.83.39.27"} +{"doc_count":123,"key":"45.144.212.221"} +{"doc_count":120,"key":"77.83.39.24"} +{"doc_count":112,"key":"77.83.39.49"} +{"doc_count":103,"key":"45.144.212.40"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_5fae95d6.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_5fae95d6.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_5fae95d6.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_7338514f.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_7338514f.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034106_7338514f.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_0087d540.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_0087d540.ndjson new file mode 100644 index 0000000..d1b1feb --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_0087d540.ndjson @@ -0,0 +1,6 @@ +{"doc_count":119,"key":"185.231.33.30"} +{"doc_count":66,"key":"185.231.33.46"} +{"doc_count":32,"key":"185.231.33.22"} +{"doc_count":2,"key":"185.231.32.24"} +{"doc_count":2,"key":"185.231.32.25"} +{"doc_count":1,"key":"185.231.33.38"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_0ff11250.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_0ff11250.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_0ff11250.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_149e1519.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_149e1519.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_149e1519.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_7468108d.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_7468108d.ndjson new file mode 100644 index 0000000..ff66302 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_7468108d.ndjson @@ -0,0 +1,15 @@ +{"doc_count":91,"key":5405} +{"doc_count":32,"key":5900} +{"doc_count":23,"key":443} +{"doc_count":21,"key":3389} +{"doc_count":14,"key":8013} +{"doc_count":10,"key":0} +{"doc_count":7,"key":445} +{"doc_count":6,"key":1434} +{"doc_count":5,"key":1433} +{"doc_count":4,"key":8531} +{"doc_count":2,"key":8081} +{"doc_count":2,"key":8089} +{"doc_count":2,"key":8161} +{"doc_count":2,"key":31337} +{"doc_count":1,"key":7443} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_99faa527.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_99faa527.ndjson new file mode 100644 index 0000000..ff29482 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_99faa527.ndjson @@ -0,0 +1 @@ +{"doc_count":5,"key":"103.236.255.202"} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_a5bd2d12.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_a5bd2d12.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_a5bd2d12.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_bf8163a0.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_bf8163a0.ndjson new file mode 100644 index 0000000..0c00657 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_bf8163a0.ndjson @@ -0,0 +1 @@ +{"doc_count":5,"key":3389} diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_d0456fa1.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_d0456fa1.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_d0456fa1.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_ed51ee02.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_ed51ee02.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_ed51ee02.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_ed9253d2.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_ed9253d2.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_ed9253d2.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_fd7cf8c1.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_fd7cf8c1.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034107_fd7cf8c1.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_07b38f15.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_07b38f15.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_07b38f15.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_5abd286d.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_5abd286d.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_5abd286d.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_6237de4e.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_6237de4e.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_6237de4e.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_8a13e458.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_8a13e458.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_8a13e458.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_93fbcc7b.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_93fbcc7b.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_93fbcc7b.ndjson diff --git a/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_e9b4a8cd.ndjson b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_e9b4a8cd.ndjson new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/kevlar/2026-08-02/honeylabs/session_stats_20260803T034108_e9b4a8cd.ndjson diff --git a/kevlar/2026-08-02/iocs/README.md b/kevlar/2026-08-02/iocs/README.md index 7bef1c9..d255f51 100644 --- a/kevlar/2026-08-02/iocs/README.md +++ b/kevlar/2026-08-02/iocs/README.md @@ -1,25 +1,26 @@ # Weekly BP Report -- 2026-08-02 -Generated: 2026-08-03T03:43:00Z +Generated: 2026-08-03T04:00:00Z ASNs covered: 26 Sponge sessions found: 10,000+ across 21 active ASNs (capped per query) -Honeylabs events found: 8,400 (AS51396 PFCLOUD only; 25 ASNs: zero) -Censys IPs profiled: 6 ASNs (190K+ hosts, all BULLETPROOF-labeled) -Anomalies flagged: 1 (universal BULLETPROOF classification across all profiled ASNs) +Honeylabs events found: 8,400+ across 7 ASNs (PFCLOUD, HOSTKEY, ROUTERHOSTING, PLI-AS, PROTON66, FLOKINET, KPRONET, AUROLOGIC) +Censys IPs profiled: 6 ASN-level + 3 per-IP enrichments (190K+ hosts, all BULLETPROOF-labeled) +Anomalies flagged: 1 (FLOKINET operates Tor exit relay with concurrent brute-force activity) ## Key Findings -- Only 1 of 26 ASNs (PFCLOUD) generated honeypot events; the other 25 show - targeted scanning against real infrastructure -- All Censys-profiled ASNs are universally classified as BULLETPROOF -- KAOPU-HK (AS138915): 818K NTP/SSDP amplification scanning sessions -- PFCLOUD (AS51396): active proxy-checking (SOCKS5 + HTTP CONNECT) against honeypots -- HOSTKEY (AS57043) and AEZA (AS210644): largest infrastructure (100K+ and 69K hosts) -- PLI-AS (AS51852): massive Telnet brute-forcing (34K sessions) -- PROTON66 (AS198953): SSH/MSSQL/RDP scanning (102K sessions from single IP) +- 7 of 26 ASNs generated Honeylabs events (not 1 as initially reported) +- All Censys-profiled hosts are universally classified as BULLETPROOF +- KPRONET: .git/.env exfiltration campaign with 20+ spoofed user agents +- PLI-AS: Multi-modal attack (DCE/RPC, RDP brute, tRPC, WordPress scanning) +- FLOKINET: Tor exit relay (185.100.87.136) with SSH/Telnet brute-force +- HOSTKEY: RTSP camera credential stuffing against Hikvision cameras +- PROTON66: MSSQL-TDS brute-force on non-standard ports +- PFCLOUD: Consistent proxy checking with port-paired infrastructure +- KAOPU-HK: 818K NTP/SSDP amplification scanning sessions (zero Honeylabs) ## Data Sources - Sponge (Arkime): network sensor sessions across full deployment - Honeylabs: global honeypot network, 7-day window (2026-07-27 to 2026-08-02) -- Censys: internet-wide host profiling +- Censys: internet-wide host profiling + per-IP enrichment diff --git a/kevlar/2026-08-02/iocs/all-observed-ips.txt b/kevlar/2026-08-02/iocs/all-observed-ips.txt index 964b94f..640acbd 100644 --- a/kevlar/2026-08-02/iocs/all-observed-ips.txt +++ b/kevlar/2026-08-02/iocs/all-observed-ips.txt @@ -155,3 +155,32 @@ # AS58854 - KAOPY (Kaopu Cloud) 103.236.255.202 +# === IPs from Honeylabs events === +# AS57043 - HOSTKEY (RTSP camera brute-forcing) +163.5.29.40 + +# AS14956 - ROUTERHOSTING (binary protocol + TLS browser) +144.172.100.235 +167.88.168.121 + +# AS51852 - PLI-AS (DCE/RPC, RDP, tRPC, WordPress) +81.17.28.130 +179.43.186.199 +179.43.150.26 +179.43.158.246 + +# AS198953 - PROTON66 (MSSQL brute-force) +176.120.22.61 + +# AS200651 - FLOKINET (SSH/Telnet brute, Tor exit relay) +185.100.87.136 +185.246.188.74 +185.246.190.66 + +# AS30823 - AUROLOGIC (SIP scanning) +216.126.229.131 + +# AS214940 - KPRONET (.git/.env exfiltration) +77.83.39.94 +77.83.39.6 +77.83.39.24 diff --git a/kevlar/2026-08-02/iocs/c2-paths.txt b/kevlar/2026-08-02/iocs/c2-paths.txt index 2b9aae3..0432430 100644 --- a/kevlar/2026-08-02/iocs/c2-paths.txt +++ b/kevlar/2026-08-02/iocs/c2-paths.txt @@ -1,15 +1,22 @@ -# HTTP URL Paths Observed (from prior week Honeylabs data) - -/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE probe -/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN enumeration -/global-protect/login.esp -- Palo Alto GlobalProtect enumeration -/sslvpnLogin.html -- SSL VPN portal enumeration -/guacamole/ -- Apache Guacamole RDP gateway probing -/remote/login -- Generic remote access login probe -/auth/login -- Authentication endpoint probing -/login -- Login page enumeration - -# Note: No URL paths were observed in Honeylabs events from monitored ASNs -# this week. All non-PFCLOUD ASNs registered zero honeypot events. -# PFCLOUD Honeylabs events were proxy-checking (HTTP CONNECT tunnels, SOCKS5) -# rather than HTTP path-based exploitation. +# C2 and Exploitation Paths Observed + +# PLI-AS (AS51852) +/api/trpc/setup.setup -- tRPC setup endpoint targeting, POST with JSON body, port 3000 +/wp-login.php -- WordPress credential enumeration, TLS, Go-http-client/1.1 + +# HOSTKEY (AS57043) +/ISAPI/Streaming/channels/10101 -- Hikvision camera streaming, RTSP DESCRIBE, Basic auth credential stuffing +/Streaming/Channels/10201 -- Hikvision camera streaming (alternate path) + +# KPRONET (AS214940) +/.git/HEAD -- Git repository discovery, secret harvesting +/.git/index -- Git index file enumeration +/.git/config -- Git remote configuration extraction +/.env -- Environment file exfiltration (database creds, API keys, secrets) + +# From prior week, still relevant: +/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE +/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN +/global-protect/login.esp -- Palo Alto GlobalProtect +/sslvpnLogin.html -- SSL VPN portal enumeration +/guacamole/ -- Apache Guacamole RDP gateway probing diff --git a/kevlar/2026-08-02/iocs/fingerprints.txt b/kevlar/2026-08-02/iocs/fingerprints.txt index bd25290..264c0b2 100644 --- a/kevlar/2026-08-02/iocs/fingerprints.txt +++ b/kevlar/2026-08-02/iocs/fingerprints.txt @@ -1,8 +1,19 @@ +# JA4 TLS Fingerprints + +t13i190800_9dc949149365_97f8aa674fd9 -- KPRONET .env exfiltration campaign, 77.83.39.x, Ukraine +t13i251000_b78ed14e2fd0_ab7e3b40a677 -- KPRONET .git/HEAD scanning, 77.83.39.94, Ukraine +t13i190900_9dc949149365_e7c285222651 -- PLI-AS WordPress login scan, 179.43.158.246, Switzerland +t13i1310h1_f57a46bbacb6_e7c285222651 -- ROUTERHOSTING TLS Firefox browser, 167.88.168.121, US + # JA4H HTTP Fingerprints -ge11nn0400_9c3956fad5da -- PFCLOUD Go-http-client/1.1 proxy checker, 204.76.203.78-80 -ge11nn0400_88d30a62b7ad -- PFCLOUD zgrab/0.x web scanner, 176.65.149.236 +ge11nn0500_9af7e0472034 -- KPRONET .env/.git exfiltration (detects despite 20+ UA rotations), 77.83.39.x +po11nr09en_94d98df401ed -- PLI-AS tRPC setup endpoint attack, 179.43.150.26 +ge11nn0400_9c3956fad5da -- PFCLOUD Go-http-client/1.1 proxy checker, 204.76.203.78-80 +ge11nn0400_88d30a62b7ad -- PFCLOUD zgrab/0.x web scanner, 176.65.149.236 +ge11nn0300_0db47b7d240d -- PLI-AS Go-http-client/1.1 wordpress scanner, 179.43.158.246 + +# HASSH SSH Fingerprints -# Note: No JA4 TLS or HASSH SSH fingerprints were observed in Honeylabs events -# from monitored ASNs this week. All non-PFCLOUD ASNs registered zero honeypot -# events in the 2026-07-27 to 2026-08-02 observation window. +e54ef3ec27fe1fea7ab64d3fa05359fd -- FLOKINET OpenSSH 10.1 SSH brute client, 185.100.87.136 +b1bff636ebbdbaa9dd2ad97fd173c956 -- FLOKINET Tor relay OpenSSH 9.9, 185.100.87.136:7288 |