diff options
Diffstat (limited to 'kevlar/2026-08-10/censys')
7 files changed, 25 insertions, 0 deletions
diff --git a/kevlar/2026-08-10/censys/aggregations-AS138915.ndjson b/kevlar/2026-08-10/censys/aggregations-AS138915.ndjson new file mode 100644 index 0000000..b2b8502 --- /dev/null +++ b/kevlar/2026-08-10/censys/aggregations-AS138915.ndjson @@ -0,0 +1,2 @@ +{"field":"host.services.port","buckets":[{"count":7134,"key":"22"},{"count":2659,"key":"443"},{"count":2574,"key":"32080"},{"count":2508,"key":"43080"},{"count":2383,"key":"40003"},{"count":2375,"key":"40801"},{"count":2368,"key":"40803"},{"count":2364,"key":"40804"},{"count":2360,"key":"40810"},{"count":2323,"key":"80"},{"count":902,"key":"123"},{"count":670,"key":"8080"},{"count":553,"key":"3389"},{"count":518,"key":"135"},{"count":511,"key":"139"},{"count":504,"key":"445"},{"count":486,"key":"3081"},{"count":485,"key":"3082"},{"count":450,"key":"3083"},{"count":411,"key":"3084"}],"total_count":12909} +{"field":"host.labels.value","buckets":[{"count":12909,"key":"BULLETPROOF"},{"count":99,"key":"IPV6"}],"total_count":12909} diff --git a/kevlar/2026-08-10/censys/aggregations-AS14956.ndjson b/kevlar/2026-08-10/censys/aggregations-AS14956.ndjson new file mode 100644 index 0000000..ee5eff1 --- /dev/null +++ b/kevlar/2026-08-10/censys/aggregations-AS14956.ndjson @@ -0,0 +1,3 @@ +{"field":"host.services.port","buckets":[{"count":14391,"key":"22"},{"count":8131,"key":"443"},{"count":7773,"key":"3389"},{"count":7041,"key":"80"},{"count":1092,"key":"2096"},{"count":992,"key":"135"},{"count":860,"key":"8443"},{"count":852,"key":"445"},{"count":786,"key":"53"},{"count":769,"key":"5985"},{"count":643,"key":"139"},{"count":617,"key":"25"},{"count":599,"key":"8080"},{"count":571,"key":"21"},{"count":522,"key":"111"},{"count":502,"key":"3000"},{"count":458,"key":"993"},{"count":431,"key":"143"},{"count":409,"key":"110"},{"count":401,"key":"587"}],"total_count":24735} +{"field":"host.services.software.product","buckets":[{"count":13496,"key":"openssh"},{"count":9533,"key":"nginx"},{"count":2533,"key":"express"},{"count":1564,"key":"http_server"},{"count":1199,"key":"dovecot"},{"count":1028,"key":"http_api"},{"count":894,"key":"google_web_services"},{"count":893,"key":"web_server"},{"count":660,"key":"jquery"},{"count":634,"key":"caddy"},{"count":576,"key":"internet_information_services"},{"count":548,"key":"bootstrap"},{"count":548,"key":"ghost"},{"count":547,"key":"app_and_api_protector"},{"count":475,"key":"next.js"},{"count":465,"key":"php"},{"count":452,"key":"python"},{"count":429,"key":"postfix"},{"count":416,"key":"waf"},{"count":414,"key":"uvicorn"}],"total_count":24735} +{"field":"host.labels.value","buckets":[{"count":24735,"key":"BULLETPROOF"},{"count":196,"key":"IPV6"}],"total_count":24735} diff --git a/kevlar/2026-08-10/censys/aggregations-AS51396.ndjson b/kevlar/2026-08-10/censys/aggregations-AS51396.ndjson new file mode 100644 index 0000000..5e0b497 --- /dev/null +++ b/kevlar/2026-08-10/censys/aggregations-AS51396.ndjson @@ -0,0 +1,3 @@ +{"field":"host.services.port","buckets":[{"count":833,"key":"22"},{"count":339,"key":"80"},{"count":260,"key":"443"},{"count":100,"key":"1407"},{"count":99,"key":"11407"},{"count":74,"key":"8080"},{"count":70,"key":"2096"},{"count":69,"key":"53"},{"count":67,"key":"111"},{"count":61,"key":"6239"},{"count":61,"key":"16239"},{"count":60,"key":"9634"},{"count":60,"key":"19634"},{"count":59,"key":"3389"},{"count":52,"key":"6046"},{"count":52,"key":"16046"},{"count":46,"key":"25"},{"count":45,"key":"8875"},{"count":45,"key":"18875"},{"count":43,"key":"8443"}],"total_count":1910} +{"field":"host.services.software.product","buckets":[{"count":751,"key":"openssh"},{"count":353,"key":"nginx"},{"count":158,"key":"http_server"},{"count":135,"key":"express"},{"count":72,"key":"php"},{"count":59,"key":"dovecot"},{"count":57,"key":"virtual_environment"},{"count":56,"key":"pve"},{"count":50,"key":"jquery"},{"count":33,"key":"http_api"},{"count":32,"key":"postfix"},{"count":31,"key":"node_exporter"},{"count":30,"key":"tinyproxy"},{"count":29,"key":"bootstrap"},{"count":28,"key":"drupal"},{"count":27,"key":"cms"},{"count":24,"key":"authoritative_server"},{"count":22,"key":"traefik_proxy"},{"count":21,"key":"mariadb"},{"count":20,"key":"uvicorn"}],"total_count":1910} +{"field":"host.labels.value","buckets":[{"count":1910,"key":"BULLETPROOF"},{"count":20,"key":"IPV6"}],"total_count":1910} diff --git a/kevlar/2026-08-10/censys/aggregations-AS51852.ndjson b/kevlar/2026-08-10/censys/aggregations-AS51852.ndjson new file mode 100644 index 0000000..18c5273 --- /dev/null +++ b/kevlar/2026-08-10/censys/aggregations-AS51852.ndjson @@ -0,0 +1,2 @@ +{"field":"host.services.port","buckets":[{"count":4402,"key":"443"},{"count":4061,"key":"22"},{"count":3413,"key":"161"},{"count":2714,"key":"80"},{"count":1896,"key":"123"},{"count":1519,"key":"53"},{"count":855,"key":"25"},{"count":828,"key":"500"},{"count":804,"key":"21"},{"count":796,"key":"143"},{"count":790,"key":"993"},{"count":783,"key":"110"},{"count":693,"key":"587"},{"count":660,"key":"1194"},{"count":616,"key":"8082"},{"count":577,"key":"111"},{"count":405,"key":"995"},{"count":370,"key":"465"},{"count":323,"key":"2096"},{"count":318,"key":"3306"}],"total_count":8621} +{"field":"host.labels.value","buckets":[{"count":8621,"key":"BULLETPROOF"},{"count":37,"key":"IPV6"}],"total_count":8621} diff --git a/kevlar/2026-08-10/censys/aggregations-AS57043.ndjson b/kevlar/2026-08-10/censys/aggregations-AS57043.ndjson new file mode 100644 index 0000000..9c4fb9d --- /dev/null +++ b/kevlar/2026-08-10/censys/aggregations-AS57043.ndjson @@ -0,0 +1,2 @@ +{"field":"host.services.port","buckets":[{"count":76586,"key":"22"},{"count":50699,"key":"443"},{"count":31226,"key":"80"},{"count":15128,"key":"2096"},{"count":8522,"key":"8443"},{"count":3622,"key":"111"},{"count":3058,"key":"8080"},{"count":2604,"key":"2053"},{"count":2564,"key":"2222"},{"count":2328,"key":"53"},{"count":1986,"key":"8000"},{"count":1820,"key":"9100"},{"count":1791,"key":"21"},{"count":1682,"key":"3389"},{"count":1616,"key":"25"},{"count":1540,"key":"3000"},{"count":1284,"key":"1881"},{"count":1274,"key":"2212"},{"count":1215,"key":"6767"},{"count":1210,"key":"587"}],"total_count":100475} +{"field":"host.labels.value","buckets":[{"count":100475,"key":"BULLETPROOF"},{"count":18,"key":"IPV6"}],"total_count":100475} diff --git a/kevlar/2026-08-10/censys/fleet-correlation.csv b/kevlar/2026-08-10/censys/fleet-correlation.csv new file mode 100644 index 0000000..1efcbba --- /dev/null +++ b/kevlar/2026-08-10/censys/fleet-correlation.csv @@ -0,0 +1,5 @@ +linkage_type,ips,indicator +shared_ssh_hostkey,204.76.203.221,204.76.203.214,"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e" +shared_hassh,204.76.203.221,204.76.203.214,"41ff3ecd1458b0bf86e1b4891636213e" +shared_hassh,45.135.193.193,45.135.194.113,144.172.104.239,144.172.100.63,172.86.119.157,"e42184b06d45385a906f0803d04c83da" +shared_proxy_service,204.76.203.221,204.76.203.214,"HTTP proxy port 9191 407" diff --git a/kevlar/2026-08-10/censys/ip-enrichments.ndjson b/kevlar/2026-08-10/censys/ip-enrichments.ndjson new file mode 100644 index 0000000..8b3adf3 --- /dev/null +++ b/kevlar/2026-08-10/censys/ip-enrichments.ndjson @@ -0,0 +1,8 @@ +{"ip":"204.76.203.221","asn":51396,"org":"Pfcloud UG","country":"NL","city":"Eygelshoven","ssh":"OpenSSH_8.9p1","hassh":"41ff3ecd1458b0bf86e1b4891636213e","hostkey":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e","services":["22/SSH","9191/HTTP-proxy-407"],"greynoise":"malicious","tags":["Open Proxy Scanner","SOCKS5 Proxy Scanner","Web Crawler"]} +{"ip":"204.76.203.214","asn":51396,"org":"Pfcloud UG","country":"NL","city":"Eygelshoven","ssh":"OpenSSH_8.9p1","hassh":"41ff3ecd1458b0bf86e1b4891636213e","hostkey":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e","services":["22/SSH","9191/HTTP-proxy-407"],"greynoise":"malicious","tags":["Open Proxy Scanner","SOCKS5 Proxy Scanner","Web Crawler"]} +{"ip":"45.135.193.193","asn":51396,"org":"Pfcloud UG","country":"DE","city":"Langen","ssh":"OpenSSH_9.6p1","hassh":"e42184b06d45385a906f0803d04c83da","hostkey":"bf2a0ebc24a49e1d4466e269eeabe0d8b9526c8b8deddc03fc208b1cba988e74","services":["22/SSH"],"greynoise":"malicious","tags":["Sensitive File Access","XSS","Open Proxy Scanner","TLS/SSL Crawler"]} +{"ip":"45.135.194.113","asn":51396,"org":"Pfcloud UG","country":"DE","city":"Langen","ssh":"OpenSSH_9.6p1","hassh":"e42184b06d45385a906f0803d04c83da","hostkey":"(rsa-only)","services":["22/SSH"],"greynoise":"malicious","tags":["Go HTTP Client","Open Proxy Scanner","SOCKS5 Proxy Scanner"]} +{"ip":"144.172.104.239","asn":14956,"org":"RouterHosting LLC","country":"US","city":"Ogden","ssh":"OpenSSH_9.6p1","hassh":"e42184b06d45385a906f0803d04c83da","hostkey":"fc963d275662527ae1b71519d5ef9afc5972ed6dd2414e9642c409a47e1a78d9","services":["22/SSH"],"greynoise":"unknown"} +{"ip":"144.172.100.63","asn":14956,"org":"RouterHosting LLC","country":"US","city":"Ogden","ssh":"OpenSSH_9.6p1","hassh":"e42184b06d45385a906f0803d04c83da","hostkey":"488f39d627ec9bf372e44ca551f624a8d7fc2dd4bc46dc9f14b05656203dae92","services":["22/SSH"],"dns":"100+ domains (openmaven.org, hostabro.net, uddoktaserver.org etc)"} +{"ip":"172.86.119.157","asn":14956,"org":"RouterHosting LLC","country":"US","city":"Ogden","ssh":"OpenSSH_9.6p1","hassh":"e42184b06d45385a906f0803d04c83da","hostkey":"e48ae97d81e970d14ac2618c8fd387b65a578ad88e2c460cd621f78b06c4cc90","services":["22/SSH"],"greynoise":"unknown"} +{"ip":"179.43.150.26","asn":51852,"org":"Private Layer INC","country":"CH","city":"Bellinzona","ssh":"OpenSSH_8.4p1 Debian","hassh":"779664e66160bf75999f091fce5edb5a","hostkey":"168ce880df9a408b4f257de4e0a1e623fe8ff09f0c5d681020230209cecf4fcf","services":["22/SSH"],"greynoise":"unknown"} |