diff options
Diffstat (limited to 'kevlar/2026-08-17/changes/diff-vs-prior-week.csv')
| -rw-r--r-- | kevlar/2026-08-17/changes/diff-vs-prior-week.csv | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/changes/diff-vs-prior-week.csv b/kevlar/2026-08-17/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..b4b5f81 --- /dev/null +++ b/kevlar/2026-08-17/changes/diff-vs-prior-week.csv @@ -0,0 +1,18 @@ +asn,metric,prior_week,this_week,delta,notes +AS51396,honeylabs_events,11483,~11500,~0%,.2xx block expanded; 204.76.203.224/225/226 now top (2k+ each); proxy 9191 live w/ 407 plan-expired; ClickHouse 9009 exposed (new) +AS51396,new_ips,5,3,"204.76.203.224/225/226 rose to top; .73/.7 new heavy scanners" +AS51396,new_service,0,2,"ClickHouse web UI on 9009; FlareVPN proxy-judge endpoint (45.135.194.113 proxy.flarevpn.digital)" +AS51396,attribution,0,1,"77.83.39.6/.94 .env exfil: honeylabs=AS214940 KPRONET, Censys=AS51396 PFCLOUD; HASSH 41ff3ecd links to prior PFCLOUD clone pair" +AS14956,honeylabs_events,206,~130,-37%,PPTP 1723 campaign ended (1 event); SMBv1 445 + Minecraft 25565 + SIP 5060/5061 now dominant +AS14956,attack_change,1,1,"PPTP->SMB: 172.86.91.225/89.13/119.138 on 445; ES 9200 probe from 144.172.99.148" +AS51852,honeylabs_events,143,~107,-25%,.env/.git exfil continues (179.43.150.26); new DCE-RPC 135 from 81.17.28.131; Docker API 2375 probe; WinRM /wsman +AS51852,new_pattern,1,1,"Docker unauthenticated API probe (/version, python-requests) from 179.43.175.56" +AS198953,honeylabs_events,245,~1700,+594%,MSSQL-TDS brute massively expanded: 176.120.22.61 swept 289 ports, 1664 events; RDP/Redis from .240; Censys: exposed DCERPC+NetBIOS Win 2012R2 +AS214940,honeylabs_events,9,~16,+78%,.git/.env campaign RESUMED: 77.83.39.6 (UA-rotating /.env over TLS443) + 77.83.39.94 (/.git/HEAD); Censys shows 0 hosts for ASN +AS200651,honeylabs_events,6,~8,+33%,SPARK C2 beacon on 443: POST /api/client/update commit 08059e95 + /eventmanager + /ajax + /FD873AC4-...; RDP mstshash=hello; Tor exit confirmed w/ random-domain cert +AS200651,c2_artifact,0,1,"SPARK COMMIT user agent; secret header 3de172c6...; HASSH e54ef3ec" +AS138915,sponge_sessions,862K,10000+(capped),steady,NTP/SSDP amp continues from 38.54.2.209 (42,490 sessions); new WinRM /wsman probe from 154.93.53.239 +AS138915,censys_profile,0,new,"154.93.119.0/24 scan-only node pool: single HTTP 4083 404; prod-vpn.example.com certs x2393" +AS210644,honeylabs_events,4,~90,new,qBittorrent (qB5230) peer-scanning 16663 from 77.110.106.52; prior week only port 4028 probes +AS57043,honeylabs_events,0,4,new,TLS web probes on 9443/4434/60443 from 193.247.77.84 +AS209847,honeylabs_events,1,0,-100%,no honeypot activity; sponge 3389 RDP scanning from 77.91.122.2 continues (60 sessions) |