diff options
Diffstat (limited to 'kevlar/2026-08-23/iocs/README.md')
| -rw-r--r-- | kevlar/2026-08-23/iocs/README.md | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/kevlar/2026-08-23/iocs/README.md b/kevlar/2026-08-23/iocs/README.md new file mode 100644 index 0000000..f870413 --- /dev/null +++ b/kevlar/2026-08-23/iocs/README.md @@ -0,0 +1,30 @@ +# Weekly BP Report -- 2026-08-23 + +Generated: 2026-08-24T03:05:00Z +ASNs covered: 25 +Sponge sessions found: 132,852 (17 ASNs active, window 2026-08-17..2026-08-24) +Honeylabs events found: ~14,000 (13 ASNs with events) +Censys IPs enriched: 10 +Anomalies flagged: 14 (see changes/anomalies.csv) + +## Key findings + +1. AUROLOGIC (AS30823): compromised Windows Server 2016 AD domain controller + `erp01.ad.reiscrew.de` (45.11.18.33) now runs RDP sweeps (`mstshash=hello`, 455 events). +2. FLOKINET beacon host 185.100.87.136 rotated endpoint from `/api/client/update` + (SPARK COMMIT) to `POST /api/checkin`; same TLS fingerprint both weeks. +3. PLI-AS +341%: market-maker bot discovery scanner (mmsk-scout/mm-scout), .env prober, + DCE/RPC scanner; shared HASSH with PFCLOUD clone fleet persists (week 3). +4. PFCLOUD proxy-validation fleet confirmed: azenv.net / httpbin.org CONNECT / socks5 / + proxy.flarevpn.digital judges; GreyNoise flags Ivanti/Pulse/F5/CrushFTP scanning. +5. KAOPU-HK 38.54.2.0/24 port-sprawl farm: ~100 HTTP listeners per host. +6. YE-series Xray panel certs span 6 monitored ASNs; AEZA carries 26k+. + +## Sources and errors + +- Sponge (Arkime): online, data 2026-03-12..2026-08-24. Tag aggregation returns 0 rows + for all ASNs (known limitation); IP/port aggregations used instead. +- Honeylabs: no rate-limit errors. +- Censys: 10,000 credits at start of run; ~50 aggregate + 10 host lookups used. +- Blog post: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-08-23-weekly-bulletproof-report.md + (build verified, 0 errors) |