diff options
Diffstat (limited to 'kevlar/2026-07-13/censys/ip-enrichments.ndjson')
| -rw-r--r-- | kevlar/2026-07-13/censys/ip-enrichments.ndjson | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/kevlar/2026-07-13/censys/ip-enrichments.ndjson b/kevlar/2026-07-13/censys/ip-enrichments.ndjson new file mode 100644 index 0000000..294c149 --- /dev/null +++ b/kevlar/2026-07-13/censys/ip-enrichments.ndjson @@ -0,0 +1,10 @@ +{"_type":"ip_enrichment","ip":"176.65.148.25","asn":"AS51396","org":"Pfcloud UG","country":"NL","greynoise":"malicious","services":[{"port":22,"transport":"tcp","software":"OpenSSH 9.2p1"}],"tags":["rdp-crawler","bruteforcer"],"notes":"GreyNoise classified as malicious. RDP crawler and bruteforcer. OpenSSH 9.2p1 on port 22."} +{"_type":"ip_enrichment","ip":"91.202.233.79","asn":"AS200593","org":"Prospero Ooo","country":"TM","greynoise":"unknown","services":[],"tags":["scan-only"],"notes":"No services visible on Censys. Scan-only behavior in Honeylabs with 3890 events hitting diverse high ports."} +{"_type":"ip_enrichment","ip":"179.43.134.114","asn":"AS51852","org":"Private Layer INC","country":"CH","greynoise":"unknown","services":[{"port":22,"transport":"tcp","software":"OpenSSH 8.9p1","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10"}],"hostname":"hostedby.privatelayer.com","notes":"1518 events in Honeylabs targeting diverse ports. SSH service exposed."} +{"_type":"ip_enrichment","ip":"216.126.239.17","asn":"AS14956","org":"RouterHosting LLC","country":"US","greynoise":"suspicious","services":[{"port":443,"transport":"tcp","software":"nginx"},{"port":80,"transport":"tcp"}],"tags":["wordpress-scanner","crushftp-scanner","ivanti-scanner","owa-scanner"],"hostname":"cloudzy","notes":"GreyNoise suspicious. Multi-vuln scanner: Wordpress, CrushFTP, Ivanti, OWA. 94 events in Honeylabs."} +{"_type":"ip_enrichment","ip":"204.76.203.79","asn":"AS51396","org":"Pfcloud UG","country":"NL","greynoise":"unknown","services":[{"port":22,"transport":"tcp"}],"notes":"992 events in Honeylabs targeting diverse high ports. Output truncated and saved to tool-output cache."} +{"_type":"ip_enrichment","ip":"176.120.22.240","asn":"AS198953","org":"Proton66 OOO","country":"RU","greynoise":"malicious","services":[{"port":3389,"transport":"tcp"},{"port":22,"transport":"tcp"},{"port":23,"transport":"tcp"},{"port":21,"transport":"tcp"}],"tags":["rdp-bruteforcer","ssh-bruteforcer","telnet-bruteforcer","ftp-bruteforcer"],"notes":"GreyNoise malicious. Multi-protocol bruteforcer (RDP, SSH, Telnet, FTP). 429 events in Honeylabs."} +{"_type":"ip_enrichment","ip":"185.100.87.136","asn":"AS200651","org":"FlokiNET ehf","country":"RO","greynoise":"unknown","services":[{"port":9001,"transport":"tcp","software":"Tor 0.4.9.11","banner":"Tor 0.4.9.11"}],"tags":["tor-exit-node"],"hostname":"PremiumTorExit","notes":"Confirmed Tor exit node. Software: Tor 0.4.9.11. Port 9001. 17 events in Honeylabs scanning HTTP/SSH."} +{"_type":"ip_enrichment","ip":"77.83.39.197","asn":"AS214940","org":"Kprohost LLC","country":"UA","greynoise":"unknown","services":[{"port":443,"transport":"tcp"}],"hostname":"lanedonet-datacenter","location":"Kerkrade, NL","notes":"26 events in Honeylabs. Hosted in Lanedonet Datacenter, Kerkrade NL. HTTPS scanning."} +{"_type":"ip_enrichment","ip":"185.231.33.46","asn":"AS211720","org":"Datashield Inc.","country":"SC","greynoise":"unknown","services":[{"port":443,"transport":"tcp"}],"hostname":"short-tan-rat","location":"Seychelles","notes":"4 events in Honeylabs. Hostname 'short-tan-rat'. Exchange /ews/ recon via TLS. Registered in Seychelles."} +{"_type":"ip_enrichment","ip":"185.228.72.109","asn":"AS400992","org":"ZhouyiSat Communications","country":"US","greynoise":"unknown","services":[{"port":443,"transport":"tcp"}],"hostname":"usa.unlimitedteam.space","tls_cert_subject":"CN=usa.unlimitedteam.space","tls_cert_issuer":"WIN-8FIH4EGN4AL (self-signed)","notes":"2 events in Honeylabs. Self-signed cert on hostname usa.unlimitedteam.space. .env file scanning activity."} |