diff options
Diffstat (limited to 'kevlar/2026-08-10/changes')
| -rw-r--r-- | kevlar/2026-08-10/changes/anomalies.csv | 7 | ||||
| -rw-r--r-- | kevlar/2026-08-10/changes/diff-vs-prior-week.csv | 15 |
2 files changed, 22 insertions, 0 deletions
diff --git a/kevlar/2026-08-10/changes/anomalies.csv b/kevlar/2026-08-10/changes/anomalies.csv new file mode 100644 index 0000000..e2fcbbe --- /dev/null +++ b/kevlar/2026-08-10/changes/anomalies.csv @@ -0,0 +1,7 @@ +severity,asn,anomaly,rationale +high,AS51396,Shared SSH host key across 204.76.203.221+214,Definitive cloned infrastructure; identical HASSH 41ff3ecd... and proxy on 9191 +high,AS51396,New 204.76.203.2xx proxy block,5 new IPs this week all running proxy-checking; volume +37% +medium,AS14956,PPTP brute-force on port 1723,New attack pattern this week; 144.172.100.63 sustained PPTP attempts +medium,AS51852,.env/.git exfiltration pattern,Signature previously on KPRONET now on PLI-AS; 179.43.150.26 probing 8001/8443 +medium,AS198953,MSSQL-TDS on 17 non-standard ports,Expanded brute-force campaign; 176.120.22.61 dominant +low,AS200651,Tor exit relay volume drop -88%,185.100.87.136 still active but reduced diff --git a/kevlar/2026-08-10/changes/diff-vs-prior-week.csv b/kevlar/2026-08-10/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..308d4c5 --- /dev/null +++ b/kevlar/2026-08-10/changes/diff-vs-prior-week.csv @@ -0,0 +1,15 @@ +asn,metric,prior_week,this_week,delta,notes +AS51396,honeylabs_events,~8400,11483,+37%,proxy checking continues; new 204.76.203.2xx block +AS51396,new_ips,0,5,"204.76.203.221/214/213/212/222 new this week" +AS51396,shared_hostkey,0,2,"204.76.203.221+214 share SSH key 27c4af41... (cloned infra)" +AS51396,proxy_port,8080/3128,9191,new,"HTTP proxy now on 9191 (was port-paired 8080/3128)" +AS14956,honeylabs_events,~50,206,+312%,PPTP brute-force on 1723 new this week +AS14956,new_attack,0,1,"PPTP (1723) brute from 144.172.100.63; RDP from 216.126.239.150" +AS51852,honeylabs_events,~200,143,-29%,.env/.git exfiltration now on PLI-AS (was KPRONET) +AS51852,new_pattern,0,1,".env/.git exfil from 179.43.150.26 on ports 8001/8443" +AS198953,honeylabs_events,~100,245,+145%,MSSQL-TDS brute on 17 non-standard ports +AS200651,honeylabs_events,~50,6,-88%,Tor relay 185.100.87.136 still active, reduced volume +AS214940,honeylabs_events,~200,9,-96%,.git/.env campaign largely stopped +AS138915,sponge_sessions,818K,862K,+5%,NTP/SSDP amplification continues; 38.54.2.209 dominant +AS216246,honeylabs_events,0,1,new,telnet probe from 193.233.91.113 +AS210644,honeylabs_events,0,4,new,port 4028 probes from 147.45.41.132 |