diff options
Diffstat (limited to 'kevlar/2026-07-20/iocs/README.md')
| -rw-r--r-- | kevlar/2026-07-20/iocs/README.md | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/kevlar/2026-07-20/iocs/README.md b/kevlar/2026-07-20/iocs/README.md new file mode 100644 index 0000000..bbc987b --- /dev/null +++ b/kevlar/2026-07-20/iocs/README.md @@ -0,0 +1,48 @@ +# Weekly BP Report -- 2026-07-20 + +Generated: 2026-07-20T11:15:00Z +ASNs covered: 25 (per bulletproof-asns.csv) +Query range: 2026-07-13 through 2026-07-20 (7-day window) +Sponge sessions found: ~6.9M total network traffic across 8 daily buckets +Active ASNs in Sponge: 17 (7 active+Honeylabs; 10 inactive both sources) +Honeylabs events found: ~2,600+ across 7 active ASNs +Censys IPs enriched: 14 IPs (per-host enrichment via censys_get_host) +Censys credits remaining at start: 10,000 +Anomalies flagged: 11 (3 critical, 5 high, 3 medium) + +## Top-Level Findings + +1. **AS200651 (FlokiNET)** - Tor exit 185.100.87.136 effserved as a SPARKRAT C2 callback destination (POST /api/client/update) AND Tor exit. OpenSSH upgraded from 10.1 -> 10.2p1. CRITICAL. +2. **AS216139 (Iron Hosting Centre)** - Sequential port 6001-6050 cluster with uniform 345-348 events each in Censys -- backconnect-C2 listener pattern. CRITICAL. +3. **AS57043 (Hostkey)** - IoT MIPS downloader (aibotnet.su /bins/kla.sh) from NEW IP 132.243.194.215 (Frankfurt). CRITICAL. +4. **AS209847** - Not in Census as AS209847; actually tagged belongs to ASICs41745 FORTIS-AS Baykov Ilya Sergeevich (RU, reg 2026-06-06). 998 Sponge sessions single IP 45.144.28.70. CRITICAL. +5. **AS211720 (Datashield)** - Shifted from /ews/ Exchange recon to MSSQL TDS port 1433 brute (hostname short-tan-rat, self-signed prohaska.beatty.biz cert, TLS 1.0/1.1 still enabled). +6. **AS51396 (Pfcloud)** - NEW scanner tooling 'odin-scanner/0.4' and 'Hello World' UAs. Cluster IPs rotated to 30/.49/.81/.18 from prior 78/79/80 in 204.76.203.0/24. +7. **AS14956 (RouterHosting)** - Exposed Werkzeug/3.1.8 'fofa_monitor' Basic-auth panel on port 5000 (HIGH severity Censys misconfig). +8. **AS400992 (ZhouyiSat)** - Ceased /env scanning this week; censys profile now pure Windows admin (3389/5985/135/445). Behavioral shift. + +## Headline Changes vs Prior Week + +| Metric | Prior (2026-07-13) | Current (2026-07-20) | Δ | Δ% | +|---------------------------------|-------------------:|---------------------:|------:|------:| +| Active ASNs (Sponge or HL) | 15 | 17 | +2 | +13% | +| ASNs in Censys BULLETPROOF | 11 | 12 | +1 | +9% | +| Unique HASSH/JA4H signatures | 11 | ~13 | +2 | +18% | +| Top IP Honeylabs events | 1,518 (AS51852) | 968 (AS200593) | -550 | -36% | +| Critical anomalies flagged | 2 | 3 | +1 | +50% | + +## Directory Structure + +- `sponge/` -- Arkime session stats per ASN (33 stat files + 1 timeline) +- `honeylabs/` -- top-attackers.csv, fingerprints.csv +- `censys/` -- aggregations-summary.ndjson, fleet-correlation.csv +- `changes/` -- diff-vs-prior-week.csv, anomalies.csv +- `iocs/` -- all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md (this file) + +## Web Access + +https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-20/ + +## Operators Log + +See ../OPERATIONS_LOG.md for the full phase-by-phase operations record.
\ No newline at end of file |