diff options
Diffstat (limited to 'kevlar/2026-06-15/iocs')
| -rw-r--r-- | kevlar/2026-06-15/iocs/README.md | 7 | ||||
| -rw-r--r-- | kevlar/2026-06-15/iocs/all-observed-ips.txt | 37 | ||||
| -rw-r--r-- | kevlar/2026-06-15/iocs/c2-paths.txt | 2 | ||||
| -rw-r--r-- | kevlar/2026-06-15/iocs/fingerprints.txt | 13 |
4 files changed, 59 insertions, 0 deletions
diff --git a/kevlar/2026-06-15/iocs/README.md b/kevlar/2026-06-15/iocs/README.md new file mode 100644 index 0000000..54139dd --- /dev/null +++ b/kevlar/2026-06-15/iocs/README.md @@ -0,0 +1,7 @@ +# Weekly BP Report -- 2026-06-15 + +Generated: 2026-06-15T12:00:00Z +ASNs covered: 26 +Honeylabs events found: ~52,000+ +Censys IPs enriched: 9 ASNs (aggregation data) +Anomalies flagged: 3 (Proton66 massive spike, June 14 global spike, QWINS LTD new entrant) diff --git a/kevlar/2026-06-15/iocs/all-observed-ips.txt b/kevlar/2026-06-15/iocs/all-observed-ips.txt new file mode 100644 index 0000000..e2b1a8f --- /dev/null +++ b/kevlar/2026-06-15/iocs/all-observed-ips.txt @@ -0,0 +1,37 @@ +# AS198953 - PROTON66 (Proton66 OOO) +37.77.150.67 +176.120.22.147 +176.120.22.240 +# AS51396 - PFCLOUD (Pfcloud UG) +45.135.193.193 +204.76.203.206 +176.65.139.103 +204.76.203.219 +176.65.139.31 +176.65.139.130 +176.65.132.141 +176.65.139.36 +176.65.149.27 +176.65.148.147 +176.65.149.30 +176.65.139.151 +176.65.149.212 +204.76.203.81 +176.65.139.140 +176.65.149.31 +45.153.34.117 +176.65.149.203 +176.65.148.2 +176.65.148.216 +# AS210644 - AEZA-AS (Aeza International Ltd) +138.124.99.219 +109.172.95.248 +85.192.31.14 +# AS200651 - FLOKINET (FlokiNET ehf) +185.100.87.136 +# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited) +154.205.145.161 +# AS209847 - THE (WorkTitans B.V.) +45.83.20.230 +# AS213702 - QWINS LTD (QWINS LTD) +194.238.57.3 diff --git a/kevlar/2026-06-15/iocs/c2-paths.txt b/kevlar/2026-06-15/iocs/c2-paths.txt new file mode 100644 index 0000000..5140d0e --- /dev/null +++ b/kevlar/2026-06-15/iocs/c2-paths.txt @@ -0,0 +1,2 @@ +/images/transparentpix.gif -- SPARK C2 beacon path, 2 events, 185.100.87.136, FLOKINET +/images/json? -- Docker API scan path, 6 events, 154.205.145.161, KAOPU-HK diff --git a/kevlar/2026-06-15/iocs/fingerprints.txt b/kevlar/2026-06-15/iocs/fingerprints.txt new file mode 100644 index 0000000..81daedd --- /dev/null +++ b/kevlar/2026-06-15/iocs/fingerprints.txt @@ -0,0 +1,13 @@ +# JA4 TLS Fingerprints +t13i1909h2_9dc949149365_97f8aa674fd9 -- SPARK C2 beacon, 1 IP (185.100.87.136), FLOKINET +t13i1310h1_f57a46bbacb6_e7c285222651 -- Firefox 140 on Linux, 1 IP (45.83.20.230), THE + +# JA3 Legacy Fingerprints +7c1e207beb00684bbbe144f1b0abe1d5 -- SPARK C2 beacon (JA3 counterpart of above) + +# JA4H HTTP Fingerprints +ge11nn0400_88d30a62b7ad -- SPARK C2 HTTP client, 1 IP, FLOKINET +ge11nn0400_9c3956fad5da -- go-dockerclient Docker API scanner, KAOPU-HK + +# HASSH SSH Fingerprints +f555226df1963d1d3c09daf865abdc9a -- libssh 0.9.6, 3 IPs (138.124.99.219, 109.172.95.248, 85.192.31.14), AEZA |