diff options
Diffstat (limited to 'kevlar/2026-08-10/iocs')
| -rw-r--r-- | kevlar/2026-08-10/iocs/README.md | 17 | ||||
| -rw-r--r-- | kevlar/2026-08-10/iocs/all-observed-ips.txt | 73 | ||||
| -rw-r--r-- | kevlar/2026-08-10/iocs/c2-paths.txt | 11 | ||||
| -rw-r--r-- | kevlar/2026-08-10/iocs/fingerprints.txt | 15 |
4 files changed, 116 insertions, 0 deletions
diff --git a/kevlar/2026-08-10/iocs/README.md b/kevlar/2026-08-10/iocs/README.md new file mode 100644 index 0000000..d8e5949 --- /dev/null +++ b/kevlar/2026-08-10/iocs/README.md @@ -0,0 +1,17 @@ +# Weekly BP Report -- 2026-08-10 + +Generated: 2026-08-10T11:00:00Z +ASNs covered: 26 +Sponge sessions found: 10,000+ across 21 active ASNs (capped per query) +Honeylabs events found: 12,200+ across 8 ASNs (PFCLOUD, ROUTERHOSTING, PLI-AS, PROTON66, FLOKINET, KPRONET, RU-AEZA, AEZA) +Censys IPs enriched: 8 per-IP + 8 ASN-level aggregations (all BULLETPROOF-labeled) +Anomalies flagged: 5 + +## Key Findings + +- PFCLOUD deployed new 204.76.203.2xx proxy block; 2 nodes share SSH host key (cloned infra) +- ROUTERHOSTING added PPTP brute-force on port 1723; event count +312% +- KPRONET .git/.env exfiltration stopped; pattern moved to PLI-AS +- PROTON66 MSSQL-TDS brute on 17 non-standard ports; event count +145% +- FLOKINET Tor exit relay volume dropped 88% +- KAOPU-HK continues NTP/SSDP amplification (862K sessions from single IP) diff --git a/kevlar/2026-08-10/iocs/all-observed-ips.txt b/kevlar/2026-08-10/iocs/all-observed-ips.txt new file mode 100644 index 0000000..0135d73 --- /dev/null +++ b/kevlar/2026-08-10/iocs/all-observed-ips.txt @@ -0,0 +1,73 @@ +# AS51396 - PFCLOUD (Pfcloud UG) +204.76.203.221 +204.76.203.214 +204.76.203.213 +204.76.203.212 +204.76.203.222 +204.76.203.79 +204.76.203.78 +204.76.203.80 +204.76.203.49 +204.76.203.12 +204.76.203.30 +45.135.193.193 +45.135.194.113 +45.135.194.99 +45.135.194.31 +45.135.194.10 +176.65.148.58 +176.65.148.142 +176.65.148.153 +176.65.148.2 +176.65.148.29 +176.65.148.96 +176.65.148.177 +176.65.149.27 +176.65.149.30 +176.65.149.31 +176.65.149.55 +176.65.149.64 +176.65.149.67 +176.65.149.182 +176.65.149.212 +176.65.149.220 +176.65.149.224 +176.65.149.230 +176.65.149.236 +176.65.134.3 +# AS14956 - ROUTERHOSTING (RouterHosting LLC) +144.172.104.239 +144.172.100.63 +172.86.119.157 +144.172.106.244 +167.88.168.121 +216.126.239.150 +45.61.150.67 +144.172.100.235 +144.172.100.9 +172.86.123.118 +# AS51852 - PLI-AS (Private Layer INC) +179.43.150.26 +81.17.28.131 +179.43.186.199 +179.43.146.27 +# AS198953 - PROTON66 (Proton66 OOO) +176.120.22.61 +193.143.1.66 +176.120.22.147 +176.120.22.240 +# AS200651 - FLOKINET (FlokiNET ehf) +185.100.87.136 +# AS214940 - KPRONET (Kprohost LLC) +77.83.39.94 +# AS216246 - RU-AEZA-AS (Aeza Group LLC) +193.233.91.113 +# AS210644 - AEZA-AS (Aeza Group LLC) +147.45.41.132 +94.228.163.7 +# AS138915 - KAOPU-HK (Kaopu Cloud HK) +38.54.2.209 +38.54.2.232 +38.54.2.13 +38.54.2.61 +38.54.2.221 diff --git a/kevlar/2026-08-10/iocs/c2-paths.txt b/kevlar/2026-08-10/iocs/c2-paths.txt new file mode 100644 index 0000000..36aae8c --- /dev/null +++ b/kevlar/2026-08-10/iocs/c2-paths.txt @@ -0,0 +1,11 @@ +# C2 and Exploitation Paths Observed + +# PFCLOUD (AS51396) +http://169.254.169.254/latest/user-data -- cloud metadata probe, 176.65.148.142, port 3001 +/src/universalTouchGamepad.js -- zgrab web scanner probe, 45.135.194.31, ports 3000/3001 +http://proxy.flarevpn.digital:8080/judge -- proxy-quality judge check, 45.135.194.113, port 8019 + +# PLI-AS (AS51852) +/.env -- environment file exfiltration, 179.43.150.26, ports 8001/8443 +/.git -- git repository discovery, 179.43.150.26, ports 8001/8443 +/z5044, /s/5124, /.e2382 -- randomized directory-bruteforce paths, 179.43.150.26 diff --git a/kevlar/2026-08-10/iocs/fingerprints.txt b/kevlar/2026-08-10/iocs/fingerprints.txt new file mode 100644 index 0000000..1f32888 --- /dev/null +++ b/kevlar/2026-08-10/iocs/fingerprints.txt @@ -0,0 +1,15 @@ +# JA4 TLS Fingerprints +t13i1310h1_f57a46bbacb6_e7c285222651 -- PLI-AS Firefox/140 TLS, 179.43.146.27, Switzerland + +# JA4H HTTP Fingerprints +ge11nn0400_9c3956fad5da -- PFCLOUD Go-http-client/1.1 proxy checker, 45.135.194.113 +ge11nn0400_88d30a62b7ad -- PFCLOUD zgrab/0.x web scanner, 176.65.149.236 +ge10nn0400_17292dadbc7b -- PFCLOUD odin-scanner/0.4, 176.65.148.58 +ge11nn0500_795d05eb4583 -- PFCLOUD websocket cloud-metadata probe, 176.65.148.142 +ge11nn0200_f24fcf356134 -- PFCLOUD cloud-metadata probe, 176.65.148.142 +ge11nn0300_341eb0d8946c -- PLI-AS .env/.git exfiltration, 179.43.150.26 + +# HASSH SSH Fingerprints +41ff3ecd1458b0bf86e1b4891636213e -- PFCLOUD cloned proxy nodes, 204.76.203.221/214 +e42184b06d45385a906f0803d04c83da -- shared OpenSSH 9.6p1 config, PFCLOUD + ROUTERHOSTING +779664e66160bf75999f091fce5edb5a -- PLI-AS OpenSSH 8.4p1 Debian, 179.43.150.26 |