diff options
Diffstat (limited to 'kevlar/2026-08-10/changes/diff-vs-prior-week.csv')
| -rw-r--r-- | kevlar/2026-08-10/changes/diff-vs-prior-week.csv | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/kevlar/2026-08-10/changes/diff-vs-prior-week.csv b/kevlar/2026-08-10/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..308d4c5 --- /dev/null +++ b/kevlar/2026-08-10/changes/diff-vs-prior-week.csv @@ -0,0 +1,15 @@ +asn,metric,prior_week,this_week,delta,notes +AS51396,honeylabs_events,~8400,11483,+37%,proxy checking continues; new 204.76.203.2xx block +AS51396,new_ips,0,5,"204.76.203.221/214/213/212/222 new this week" +AS51396,shared_hostkey,0,2,"204.76.203.221+214 share SSH key 27c4af41... (cloned infra)" +AS51396,proxy_port,8080/3128,9191,new,"HTTP proxy now on 9191 (was port-paired 8080/3128)" +AS14956,honeylabs_events,~50,206,+312%,PPTP brute-force on 1723 new this week +AS14956,new_attack,0,1,"PPTP (1723) brute from 144.172.100.63; RDP from 216.126.239.150" +AS51852,honeylabs_events,~200,143,-29%,.env/.git exfiltration now on PLI-AS (was KPRONET) +AS51852,new_pattern,0,1,".env/.git exfil from 179.43.150.26 on ports 8001/8443" +AS198953,honeylabs_events,~100,245,+145%,MSSQL-TDS brute on 17 non-standard ports +AS200651,honeylabs_events,~50,6,-88%,Tor relay 185.100.87.136 still active, reduced volume +AS214940,honeylabs_events,~200,9,-96%,.git/.env campaign largely stopped +AS138915,sponge_sessions,818K,862K,+5%,NTP/SSDP amplification continues; 38.54.2.209 dominant +AS216246,honeylabs_events,0,1,new,telnet probe from 193.233.91.113 +AS210644,honeylabs_events,0,4,new,port 4028 probes from 147.45.41.132 |