1 files changed, 78 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/honeylabs/top-attackers.csv b/kevlar/2026-08-31/honeylabs/top-attackers.csv
new file mode 100644
index 0000000..00a064b
--- /dev/null
+++ b/kevlar/2026-08-31/honeylabs/top-attackers.csv
@@ -0,0 +1,78 @@
+asn,name,kind,value,count
+AS210644,AEZA-AS,ip,147.45.71.214,36
+AS210644,AEZA-AS,ip,217.144.190.138,12
+AS210644,AEZA-AS,ip,176.124.203.177,4
+AS210644,AEZA-AS,ip,185.246.217.150,1
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15",18
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0,2
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (CentOS; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0,2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36",2
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0,2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.6.16",2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",2
+AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0,2
+AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18",2
+AS138915,KAOPU-HK (Kaopu Cloud HK Limited),ip,154.90.37.55,1
+AS138915,KAOPU-HK (Kaopu Cloud HK Limited),user_agent,Microsoft WinRM Client,1
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,107.189.26.103,49
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.114.162,32
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.91.225,16
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.114.254,8
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.116.49,8
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.99.12,4
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,107.189.17.181,3
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,45.61.177.185,2
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,45.61.177.179,2
+AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.100.235,2
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,libredtail-http,49
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",4
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,zern-scanner (+https://zern.io),2
+AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0,2
+AS51852,PLI-AS,ip,179.43.167.2,71
+AS51852,PLI-AS,ip,81.17.28.131,56
+AS51852,PLI-AS,ip,179.43.150.26,28
+AS51852,PLI-AS,ip,141.255.165.68,5
+AS51852,PLI-AS,ip,185.12.44.133,4
+AS51852,PLI-AS,ip,141.255.165.69,2
+AS51852,PLI-AS,ip,179.43.146.27,2
+AS51852,PLI-AS,ip,141.255.165.67,2
+AS51852,PLI-AS,ip,141.255.165.66,1
+AS51852,PLI-AS,user_agent,Mozilla/5.0,28
+AS51852,PLI-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64),21
+AS51852,PLI-AS,user_agent,Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0,2
+AS400992,ZHOUYISAT-COMMUNICATIONS,ip,194.48.142.134,1
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.7,1095
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.14,424
+AS51396,PFCLOUD (Pfcloud UG),ip,45.135.193.193,416
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.49,338
+AS51396,PFCLOUD (Pfcloud UG),ip,45.135.194.113,264
+AS51396,PFCLOUD (Pfcloud UG),ip,45.135.193.198,192
+AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.4,171
+AS51396,PFCLOUD (Pfcloud UG),ip,176.65.148.226,111
+AS51396,PFCLOUD (Pfcloud UG),ip,176.65.149.30,103
+AS51396,PFCLOUD (Pfcloud UG),ip,176.65.149.27,103
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Go-http-client/1.1,703
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (compatible; research-scan/1.0),424
+AS51396,PFCLOUD (Pfcloud UG),user_agent,0day,192
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36,111
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 zgrab/0.x,65
+AS51396,PFCLOUD (Pfcloud UG),user_agent,"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36",10
+AS51396,PFCLOUD (Pfcloud UG),user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",3
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0,3
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.14,2
+AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0,1
+AS200651,FLOKINET,ip,185.100.87.136,12
+AS200651,FLOKINET,user_agent,Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0,3
+AS200651,FLOKINET,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safar",3
+AS200651,FLOKINET,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64),2
+AS200651,FLOKINET,user_agent,SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17,1
+AS200651,FLOKINET,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0,1
+AS214351,FEMOIT,ip,62.60.226.150,4
+AS214351,FEMOIT,ip,192.162.199.180,2
+AS214351,FEMOIT,user_agent,python-requests/2.22.0,2
+AS198953,PROTON66,ip,176.120.22.61,1141
+AS198953,PROTON66,ip,176.120.22.43,134
+AS198953,PROTON66,ip,193.143.1.66,31
+AS198953,PROTON66,ip,176.120.22.240,2
+AS198953,PROTON66,user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.",134