diff options
Diffstat (limited to 'kevlar/2026-08-02/iocs/all-observed-ips.txt')
| -rw-r--r-- | kevlar/2026-08-02/iocs/all-observed-ips.txt | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/kevlar/2026-08-02/iocs/all-observed-ips.txt b/kevlar/2026-08-02/iocs/all-observed-ips.txt index 964b94f..640acbd 100644 --- a/kevlar/2026-08-02/iocs/all-observed-ips.txt +++ b/kevlar/2026-08-02/iocs/all-observed-ips.txt @@ -155,3 +155,32 @@ # AS58854 - KAOPY (Kaopu Cloud) 103.236.255.202 +# === IPs from Honeylabs events === +# AS57043 - HOSTKEY (RTSP camera brute-forcing) +163.5.29.40 + +# AS14956 - ROUTERHOSTING (binary protocol + TLS browser) +144.172.100.235 +167.88.168.121 + +# AS51852 - PLI-AS (DCE/RPC, RDP, tRPC, WordPress) +81.17.28.130 +179.43.186.199 +179.43.150.26 +179.43.158.246 + +# AS198953 - PROTON66 (MSSQL brute-force) +176.120.22.61 + +# AS200651 - FLOKINET (SSH/Telnet brute, Tor exit relay) +185.100.87.136 +185.246.188.74 +185.246.190.66 + +# AS30823 - AUROLOGIC (SIP scanning) +216.126.229.131 + +# AS214940 - KPRONET (.git/.env exfiltration) +77.83.39.94 +77.83.39.6 +77.83.39.24 |