aboutsummaryrefslogtreecommitdiff
path: root/kevlar/2026-08-23/iocs
diff options
context:
space:
mode:
Diffstat (limited to 'kevlar/2026-08-23/iocs')
-rw-r--r--kevlar/2026-08-23/iocs/README.md30
-rw-r--r--kevlar/2026-08-23/iocs/all-observed-ips.txt151
-rw-r--r--kevlar/2026-08-23/iocs/c2-paths.txt39
-rw-r--r--kevlar/2026-08-23/iocs/fingerprints.txt19
4 files changed, 239 insertions, 0 deletions
diff --git a/kevlar/2026-08-23/iocs/README.md b/kevlar/2026-08-23/iocs/README.md
new file mode 100644
index 0000000..f870413
--- /dev/null
+++ b/kevlar/2026-08-23/iocs/README.md
@@ -0,0 +1,30 @@
+# Weekly BP Report -- 2026-08-23
+
+Generated: 2026-08-24T03:05:00Z
+ASNs covered: 25
+Sponge sessions found: 132,852 (17 ASNs active, window 2026-08-17..2026-08-24)
+Honeylabs events found: ~14,000 (13 ASNs with events)
+Censys IPs enriched: 10
+Anomalies flagged: 14 (see changes/anomalies.csv)
+
+## Key findings
+
+1. AUROLOGIC (AS30823): compromised Windows Server 2016 AD domain controller
+ `erp01.ad.reiscrew.de` (45.11.18.33) now runs RDP sweeps (`mstshash=hello`, 455 events).
+2. FLOKINET beacon host 185.100.87.136 rotated endpoint from `/api/client/update`
+ (SPARK COMMIT) to `POST /api/checkin`; same TLS fingerprint both weeks.
+3. PLI-AS +341%: market-maker bot discovery scanner (mmsk-scout/mm-scout), .env prober,
+ DCE/RPC scanner; shared HASSH with PFCLOUD clone fleet persists (week 3).
+4. PFCLOUD proxy-validation fleet confirmed: azenv.net / httpbin.org CONNECT / socks5 /
+ proxy.flarevpn.digital judges; GreyNoise flags Ivanti/Pulse/F5/CrushFTP scanning.
+5. KAOPU-HK 38.54.2.0/24 port-sprawl farm: ~100 HTTP listeners per host.
+6. YE-series Xray panel certs span 6 monitored ASNs; AEZA carries 26k+.
+
+## Sources and errors
+
+- Sponge (Arkime): online, data 2026-03-12..2026-08-24. Tag aggregation returns 0 rows
+ for all ASNs (known limitation); IP/port aggregations used instead.
+- Honeylabs: no rate-limit errors.
+- Censys: 10,000 credits at start of run; ~50 aggregate + 10 host lookups used.
+- Blog post: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-08-23-weekly-bulletproof-report.md
+ (build verified, 0 errors)
diff --git a/kevlar/2026-08-23/iocs/all-observed-ips.txt b/kevlar/2026-08-23/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..ae5ff36
--- /dev/null
+++ b/kevlar/2026-08-23/iocs/all-observed-ips.txt
@@ -0,0 +1,151 @@
+# AS14956 - ROUTERHOSTING (RouterHosting LLC)
+107.189.17.69
+107.189.20.97
+107.189.21.227
+107.189.26.103
+107.189.27.179
+144.172.100.161
+144.172.100.237
+144.172.107.86
+144.172.112.245
+144.172.117.54
+144.172.117.61
+144.172.84.181
+144.172.94.128
+167.88.165.67
+167.88.168.121
+216.126.224.209
+216.126.227.197
+45.61.129.23
+45.61.133.122
+45.61.151.41
+
+# AS30823 - AUROLOGIC (aurologic GmbH)
+45.11.18.33
+45.153.243.249
+
+# AS33993 - UFO-AS
+45.67.230.246
+
+# AS51396 - PFCLOUD (Pfcloud UG)
+176.65.148.243
+176.65.148.84
+204.76.203.18
+204.76.203.224
+204.76.203.225
+204.76.203.226
+204.76.203.49
+204.76.203.7
+204.76.203.73
+45.135.194.24
+45.153.34.112
+45.153.34.149
+45.153.34.151
+45.153.34.161
+45.153.34.235
+45.153.34.71
+45.156.87.13
+45.156.87.147
+45.156.87.216
+45.156.87.253
+
+# AS51852 - PLI-AS
+141.255.165.66
+141.255.165.67
+141.255.165.68
+141.255.165.69
+179.43.133.154
+179.43.139.58
+179.43.140.210
+179.43.146.27
+179.43.150.26
+179.43.167.2
+185.12.44.156
+185.12.44.203
+31.7.57.58
+46.19.137.194
+46.19.138.10
+46.19.138.42
+46.19.138.44
+46.19.138.45
+46.19.138.46
+81.17.28.131
+
+# AS57043 - HOSTKEY-AS
+151.243.3.213
+193.247.77.84
+
+# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited)
+154.90.37.55
+211.155.100.9
+38.54.2.13
+38.54.2.135
+38.54.2.148
+38.54.2.152
+38.54.2.168
+38.54.2.170
+38.54.2.195
+38.54.2.20
+38.54.2.203
+38.54.2.204
+38.54.2.209
+38.54.2.221
+38.54.2.232
+38.54.2.235
+38.54.2.4
+38.54.2.75
+38.54.2.91
+38.54.37.119
+
+# AS198953 - PROTON66
+176.120.22.123
+176.120.22.61
+193.143.1.66
+193.143.1.67
+37.77.150.241
+
+# AS200593 - PROSPERO-AS
+193.24.123.63
+91.202.233.82
+91.215.85.104
+91.215.85.142
+
+# AS200651 - FLOKINET
+185.100.87.136
+185.246.190.83
+185.247.225.201
+37.228.129.67
+
+# AS209847 - THE
+77.91.122.2
+
+# AS210644 - AEZA-AS
+176.124.204.170
+213.108.20.4
+213.165.44.93
+95.181.173.142
+
+# AS211720 - Datashield, Inc.
+185.231.33.46
+
+# AS214351 - FEMOIT
+192.162.199.180
+62.60.226.150
+62.60.226.186
+
+# AS214940 - KPRONET
+77.83.39.108
+77.83.39.11
+77.83.39.15
+77.83.39.24
+77.83.39.4
+77.83.39.6
+77.83.39.94
+
+# AS216246 - RU-AEZA-AS
+178.20.208.134
+
+# AS400992 - ZHOUYISAT-COMMUNICATIONS
+23.172.217.77
+23.172.217.87
+
diff --git a/kevlar/2026-08-23/iocs/c2-paths.txt b/kevlar/2026-08-23/iocs/c2-paths.txt
new file mode 100644
index 0000000..ca0a189
--- /dev/null
+++ b/kevlar/2026-08-23/iocs/c2-paths.txt
@@ -0,0 +1,39 @@
+/ -- ASNs: 14956,51396,51852
+/.git/HEAD -- ASNs: 51396
+/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/containers/json -- ASNs: 14956
+/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/index.php?lang=../../../../../../../../tmp/index1 -- ASNs: 14956
+/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5("hi"));?>+/tmp/index1.php -- ASNs: 14956
+/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello -- ASNs: 14956
+/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/lib/phpunit/Util/PHP/eval-stdin.php -- ASNs: 14956
+/lib/phpunit/phpunit/Util/PHP/eval-stdin.php -- ASNs: 14956
+/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/lib/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/pairs -- ASNs: 51852
+/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello -- ASNs: 14956
+/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/remote/login?lang=en -- ASNs: 198953
+/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/v6/marketmaker/status/1 -- ASNs: 51852
+/version -- ASNs: 51852
+/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956
+http://azenv.net/ -- ASNs: 51396
+http://proxy.flarevpn.digital:8080/judge -- ASNs: 51396
diff --git a/kevlar/2026-08-23/iocs/fingerprints.txt b/kevlar/2026-08-23/iocs/fingerprints.txt
new file mode 100644
index 0000000..b2cae20
--- /dev/null
+++ b/kevlar/2026-08-23/iocs/fingerprints.txt
@@ -0,0 +1,19 @@
+# JA4 TLS Fingerprints
+t13i1310h1_f57a46bbacb6_e7c285222651 -- ASNs: 14956
+t13i251000_b78ed14e2fd0_ab7e3b40a677 -- ASNs: 51396
+t12i210600_76e208dd3e22_f28add8e7af0 -- ASNs: 198953
+
+# JA4H HTTP Fingerprints
+ge11nn0400_9c3956fad5da -- ASNs: 14956,51396,51852
+ge11nn0400_aa8589a6a024 -- ASNs: 51852
+ge11nn0300_341eb0d8946c -- ASNs: 51852
+ge11nn0500_184f44d42a83 -- ASNs: 14956
+ge11nn0500_7992432eef13 -- ASNs: 14956
+ge11nn0700_3161ce9d7233 -- ASNs: 14956
+ge11nn0400_88d30a62b7ad -- ASNs: 51396
+ge11nn0500_9af7e0472034 -- ASNs: 51396
+ge11nn0100_4740ae6347b0 -- ASNs: 51396
+ge11nn0200_549fad093d6b -- ASNs: 198953
+ge11nn0300_80168362a4ec -- ASNs: 198953
+
+# HASSH SSH Fingerprints
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-07 12:08:51 +0000