diff options
Diffstat (limited to 'kevlar/2026-09-07/changes')
| -rw-r--r-- | kevlar/2026-09-07/changes/anomalies.csv | 48 | ||||
| -rw-r--r-- | kevlar/2026-09-07/changes/censys-software-changes.csv | 22 | ||||
| -rw-r--r-- | kevlar/2026-09-07/changes/diff-vs-prior-week.csv | 26 | ||||
| -rw-r--r-- | kevlar/2026-09-07/changes/numbers-table.json | 277 | ||||
| -rw-r--r-- | kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json | 1319 |
5 files changed, 1692 insertions, 0 deletions
diff --git a/kevlar/2026-09-07/changes/anomalies.csv b/kevlar/2026-09-07/changes/anomalies.csv new file mode 100644 index 0000000..6e8c8d1 --- /dev/null +++ b/kevlar/2026-09-07/changes/anomalies.csv @@ -0,0 +1,48 @@ +asn,name,severity,type,detail +"AS57043","HOSTKEY-AS","high","volume_spike","Sponge sessions 6 -> 196 (32.7x)" +"AS57043","HOSTKEY-AS","medium","new_ports","new dst ports: 80,443,3102,9443,6881" +"AS210644","AEZA-AS","high","volume_collapse","Sponge sessions 80345 -> 97 (-100%)" +"AS210644","AEZA-AS","medium","new_ports","new dst ports: 443,8888,22,4145,3128,2080,3125,5678,8254,808,999,1080" +"AS138915","KAOPU-HK","medium","new_ports","new dst ports: 28591,53,50001,50002,50003,9999,20002,20004,5686" +"AS14956","ROUTERHOSTING","high","volume_collapse","Sponge sessions 1859 -> 270 (-85%)" +"AS14956","ROUTERHOSTING","medium","new_ports","new dst ports: 8545,8546,8547,8548,8549,587,7860,8899,8900,445,1723,0" +"AS51852","PLI-AS","high","volume_collapse","Sponge sessions 737 -> 97 (-87%)" +"AS51852","PLI-AS","medium","new_ports","new dst ports: 443,8443,5960,6051,7070,7080,8000,8050,2087,5860,6060,2096" +"AS400992","ZHOUYISAT","medium","new_ports","new dst ports: 2883,2880,2881,2882,2887,2877,2878,2886,2879,2884,2885,25565" +"AS51396","PFCLOUD","high","volume_spike","Sponge sessions 34932 -> 87938 (2.5x)" +"AS51396","PFCLOUD","medium","new_ports","new dst ports: 1081,888,1090,1086,1088" +"AS200651","FLOKINET","medium","new_ports","new dst ports: 8080" +"AS198953","PROTON66","medium","new_ports","new dst ports: 11443,8443,222,1100,1111,1112,1200" +"AS214940","KPRONET","medium","new_ports","new dst ports: 2525" +"AS216309","INVISIONTECH-GROUP-SRL","medium","new_activity","first observed activity: 26 sessions" +"AS57043","HOSTKEY-AS","medium","new_fingerprints","hassh:98ddc5604ef6a1006a2b49a58759fbe6" +"AS210644","AEZA-AS","medium","new_fingerprints","ja4:t13i170900_5b57614c22b0_78e6aca7449b, ja4h:ge11nn0500_7992432eef13, ja4h:ge11nn0700_3161ce9d7233, ja4h:po11nn0700_3161ce9d7233, ja4h:ge11nn0500_3012a89e1aee" +"AS14956","ROUTERHOSTING","medium","new_fingerprints","ja4:t13i181000_85036bcba153_d41ae481755e, ja4h:ge11nn0400_8fd06a127c33, ja4h:ge11nn0400_c3abebcf3d28" +"AS51852","PLI-AS","medium","new_fingerprints","ja4:t13i190800_9dc949149365_97f8aa674fd9, ja4h:po11nn0500_c5c1780925fe, ja4h:ge11nn0300_0db47b7d240d, ja4h:ge11nn0400_88d30a62b7ad, ja4:t13i131000_f57a46bbacb6_ab7e3b40a677" +"AS216246","RU-AEZA-AS","medium","new_fingerprints","ja4:t13i181000_85036bcba153_d41ae481755e, ja4h:po11nn0600_def5433ae821" +"AS198953","PROTON66","medium","new_fingerprints","ja4:t12i210600_76e208dd3e22_f28add8e7af0, ja4h:ge11nn0200_549fad093d6b, ja4h:ge11nn0300_80168362a4ec" +"AS57043","HOSTKEY-AS","low","censys_host_count_change","visible hosts +908 (now 101919)" +"AS57043","HOSTKEY-AS","medium","new_cert_issuers","hypervisor.hv, Apple Public EV Server RSA CA 1 - G1, GlobalSign ECC OV SSL CA 2018, GlobalSign RSA OV SSL CA 2018, HARICA DV TLS RSA" +"AS209847","THE","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, Microsoft TLS G2 RSA CA OCSP 04, vm15882839.example.com, DigiCert Global G2 TLS RSA SHA256 2020 CA1, R13" +"AS210644","AEZA-AS","medium","new_cert_issuers","HARICA DV TLS RSA, Apple Public EV Server RSA CA 1 - G1, DigiCert Global G2 TLS RSA SHA256 2020 CA1, TRAEFIK DEFAULT CERT, GlobalSign Atlas R46 DV TLS CA 2026 Q3" +"AS138915","KAOPU-HK","low","censys_host_count_change","visible hosts -1246 (now 12308)" +"AS138915","KAOPU-HK","medium","new_cert_issuers","QY, tls.internal.ypc.org" +"AS14956","ROUTERHOSTING","medium","new_cert_issuers","windows-Utah-4H, windows-Utah-2g, AnyDesk Client, Plesk, windows-LasVega" +"AS216139","IRONHOST","medium","new_cert_issuers","isp13.eurobyte.ru, vps1.dev.mchost.ru, vps1.dev.eurobyte.ru, isp15.eurobyte.ru, GeoTrust TLS RSA CA G1" +"AS51852","PLI-AS","medium","new_cert_issuers","Hydra Authentication RSA SubCA #154, Proxmox Virtual Environment, Hydra Authentication RSA SubCA #156, Plesk, server.xtreme-results.net" +"AS400992","ZHOUYISAT","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, Microsoft TLS G2 RSA CA OCSP 04, Apple Public EV Server RSA CA 1 - G1, GlobalSign RSA OV SSL CA 2018, HARICA DV TLS RSA" +"AS33993","UFO-AS","medium","new_cert_issuers","HARICA DV TLS RSA, GlobalSign RSA OV SSL CA 2018, GlobalSign ECC OV SSL CA 2018, GlobalSign GCC R46 OV TLS CA 2025, Microsoft TLS G2 RSA CA OCSP 04" +"AS51396","PFCLOUD","medium","new_cert_issuers","Cloudbase-Init WinRM, hosting12.coolsshservers.com, WIN-OU0SUKQBJN2, imap.example.com, srv1.dedusapp.icu" +"AS213702","QWINS-LTD","medium","new_cert_issuers","GlobalSign Atlas R3 DV TLS CA 2026 Q2, HARICA DV TLS RSA, GlobalSign RSA OV SSL CA 2018, WR1, Apple Public EV Server RSA CA 1 - G1" +"AS216246","RU-AEZA-AS","medium","new_cert_issuers","HARICA DV TLS RSA, GeoTrust TLS RSA CA G1, WIN-4NFSE1QOBMS, Microsoft TLS G2 RSA CA OCSP 04, GlobalSign GCC R46 OV TLS CA 2025" +"AS200651","FLOKINET","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, fin01.m-cr.org, Sectigo Public Server Authentication CA DV R36, GlobalSign RSA OV SSL CA 2018, protect@DDoS-Filter.domain" +"AS30823","AUROLOGIC","medium","new_cert_issuers","WIN-8OA3CCQAE4D, Plesk, Apple Public EV Server RSA CA 1 - G1, DigiCert Global G2 TLS RSA SHA256 2020 CA1, RapidSSL TLS RSA CA G1" +"AS140666","ADPL-AS-AP","low","censys_host_count_change","visible hosts +3757 (now 6562)" +"AS140666","ADPL-AS-AP","medium","new_cert_issuers","USDTCDN, SG CA, Root CA, GlobalSign GCC R46 OV TLS CA 2025" +"AS214351","FEMOIT","medium","new_cert_issuers","vm4980.defhost.co, amgel.yop.nail, def.host.vm, info.devser.loc" +"AS198953","PROTON66","medium","new_cert_issuers","FASTPANEL, dev-1.secure.host, akrud-1.example.com, mail.the-slasher.com, xmoney-1.example.com" +"AS200593","PROSPERO-AS","medium","new_cert_issuers","blankilamalice-4.example.com, ads-grab-2.example.com, benjamin-b-2.example.com, AnyDesk Client" +"AS206728","MEDIALAND-AS","medium","new_cert_issuers","WIN-UKID351J32A" +"AS211720","Datashield","medium","new_cert_issuers","bad-raven-crab, bright-magenta-, eth0, gentle-red-bee, greedy-cream-ha" +"AS216309","INVISIONTECH-GROUP-SRL","medium","new_cert_issuers","www.fxzjqfcj6dilr.com" +"AS58854","KAOPY","medium","new_cert_issuers","宝塔面板, DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1, TrustAsia TLS RSA CA, WIN-M7O7840CVAH, Certum DV TLS G2 R39 CA"
\ No newline at end of file diff --git a/kevlar/2026-09-07/changes/censys-software-changes.csv b/kevlar/2026-09-07/changes/censys-software-changes.csv new file mode 100644 index 0000000..9ee8d46 --- /dev/null +++ b/kevlar/2026-09-07/changes/censys-software-changes.csv @@ -0,0 +1,22 @@ +asn,name,new_software +"AS57043","HOSTKEY-AS","dovecot, http_server, next.js, uvicorn, bootstrap" +"AS209847","THE","app_and_api_protector, express, ghost, bootstrap, http_server" +"AS210644","AEZA-AS","uvicorn, next.js, http_server, python, jquery" +"AS138915","KAOPU-HK","python, squid, node_exporter, litespeed_web_server, moment" +"AS14956","ROUTERHOSTING","next.js, internet_information_services, php, bootstrap, python" +"AS216139","IRONHOST","http_server, app_and_api_protector, ghost, php, mysql" +"AS51852","PLI-AS","php, proftpd, express, virtual_environment, pve" +"AS400992","ZHOUYISAT","traffic_server, http_server, bootstrap, jquery, dovecot" +"AS33993","UFO-AS","caddy, http_server, jquery, next.js, traefik_proxy" +"AS51396","PFCLOUD","dovecot, next.js, node_exporter, simplehttp, drupal, tinyproxy" +"AS213702","QWINS-LTD","next.js, openresty, uvicorn, http_server, bootstrap" +"AS216246","RU-AEZA-AS","fastpanel, waf, http_server, uvicorn, google_web_services, web_server" +"AS200651","FLOKINET","next.js, jquery, postfix, webmail, traefik_proxy" +"AS30823","AUROLOGIC","next.js, postfix, app_and_api_protector, ghost, waf" +"AS140666","ADPL-AS-AP","app_and_api_protector, ghost, wordpress, python, http_server" +"AS214351","FEMOIT","bootstrap, php, uvicorn, jquery, bind" +"AS198953","PROTON66","prototype, proftpd, plesk, bind, postfix" +"AS200593","PROSPERO-AS","exim, cpanel, proftpd, postfix, authoritative_server" +"AS211720","Datashield","next.js" +"AS216309","INVISIONTECH-GROUP-SRL","parallels_plesk_panel, requirejs, lodash, plesk, pve" +"AS58854","KAOPY","simplehttp, http_api, tengine, openresty, internet_information_services"
\ No newline at end of file diff --git a/kevlar/2026-09-07/changes/diff-vs-prior-week.csv b/kevlar/2026-09-07/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..bc7b7a9 --- /dev/null +++ b/kevlar/2026-09-07/changes/diff-vs-prior-week.csv @@ -0,0 +1,26 @@ +asn,name,cur_week_sessions,prior_week_sessions,delta_pct,new_source_ips,gone_source_ips,new_ports,gone_ports +"AS57043","HOSTKEY-AS","196","6","3167%","82.38.67.164 5.39.217.86 31.207.46.105 66.151.40.231 82.21.150.241","66.248.207.253 185.130.227.19","80;443;3102;9443;6881","445" +"AS209847","THE","3","41","-93%","","45.140.147.124","","443;2053;8443" +"AS210644","AEZA-AS","97","80345","-100%","77.110.110.145 138.124.102.8 46.226.167.103 85.192.24.119","81.19.137.20 138.124.91.58 213.165.46.78 213.165.46.83 147.45.71.214 213.176.114.183 217.144.190.138 77.221.157.79 185.125.102.59 176.124.203.177","443;8888;22;4145;3128;2080;3125;5678;8254;808;999;1080;1111;4153;6588;8006;8008;8085;8090;8181","1883;50000;20002;2376;4190;2628;64738;801;8787;8822;8844;15000;25565;21;53;82;85;88;110;111" +"AS138915","KAOPU-HK","47859","62991","-24%","38.60.227.250 38.54.2.235 38.54.2.22 38.54.2.233 38.54.2.55 38.54.2.71 38.54.2.146","38.54.2.152 38.54.2.148 38.54.40.83 154.205.139.152 38.54.2.133 38.60.176.11 38.54.126.84","28591;53;50001;50002;50003;9999;20002;20004;5686","47604;51350;43998;22222;34569;58467;16516;5601;25565" +"AS14956","ROUTERHOSTING","270","1859","-85%","144.172.104.123 144.172.102.126 144.172.97.249 144.172.104.147 167.88.168.121 107.189.22.128 216.126.227.187 45.61.149.189 172.86.89.217 107.189.26.103 144.172.91.28 144.172.98.217 45.59.117.222 45.61.129.23 45.61.151.41 144.172.84.178 144.172.102.30","216.126.227.184 216.126.225.6 45.59.117.74 104.194.157.233 144.172.88.96 144.172.117.54 216.126.239.150 107.189.17.69 216.126.239.185 216.126.239.163 172.86.117.85 144.172.94.243 107.189.17.181 144.172.93.238 216.126.239.178 144.172.107.203 144.172.110.233","8545;8546;8547;8548;8549;587;7860;8899;8900;445;1723;0;11211","8888;7500;8161;8008;8081;5001;7443;8088;9080;8000;8085;10000;8001" +"AS216139","IRONHOST","0","0","0%","","","","" +"AS51852","PLI-AS","97","737","-87%","179.43.186.220 46.19.142.226 179.43.189.73","179.43.139.58 179.43.182.200 179.43.133.154 179.43.167.2 81.17.28.131 46.19.137.194 141.255.165.66 46.19.138.45 141.255.165.70 46.19.138.42 46.19.138.44 141.255.165.104 179.43.172.83","443;8443;5960;6051;7070;7080;8000;8050;2087;5860;6060;2096;3128;8006;8008;8082;32400","22;23;139;9000;9090;1723;5080;7680;80;1521;8007;60000;0;7001;8181;9091;9200" +"AS400992","ZHOUYISAT","226","257","-12%","194.48.142.88 194.48.142.134","193.46.218.239","2883;2880;2881;2882;2887;2877;2878;2886;2879;2884;2885;25565","" +"AS33993","UFO-AS","0","0","0%","","","","" +"AS51396","PFCLOUD","87938","34932","152%","204.76.203.4 204.76.203.214 204.76.203.222 204.76.203.221 204.76.203.213 45.135.194.24 176.65.148.93","45.135.194.26 176.65.149.64 176.65.149.224 176.65.149.230 176.65.149.55 176.65.149.212 176.65.149.220","1081;888;1090;1086;1088","23;0;25566;25564;8181" +"AS213702","QWINS-LTD","0","0","0%","","","","" +"AS216246","RU-AEZA-AS","0","2","-100%","","185.221.199.82 194.26.229.20","","80" +"AS200651","FLOKINET","76","62","23%","185.100.85.48","185.247.225.201 37.228.129.67","8080","6882;2222;0" +"AS30823","AUROLOGIC","2","9","-78%","172.86.92.151","45.153.243.249","5060","22" +"AS140666","ADPL-AS-AP","0","0","0%","","","","" +"AS214351","FEMOIT","0","4","-100%","","62.60.226.150","","1723" +"AS198953","PROTON66","1469","2327","-37%","176.120.22.240 176.120.22.147","176.120.22.43 193.143.1.66 37.77.150.241","11443;8443;222;1100;1111;1112;1200","2222;22222;8001;5678;6000;6001;7788" +"AS200593","PROSPERO-AS","1","2","-50%","91.215.85.104","91.215.85.142","443","22" +"AS214940","KPRONET","59","151","-61%","77.83.39.144","77.83.39.6 77.83.39.112 77.83.39.239 77.83.39.17 77.83.39.60 77.83.39.4 77.83.39.118 77.83.39.147 77.83.39.101 77.83.39.217 77.83.39.99 77.83.39.226 77.83.39.89 77.83.39.122 77.83.39.95 77.83.39.119 77.83.39.151 77.83.39.235","2525","2222;465;25" +"AS206728","MEDIALAND-AS","0","0","0%","","","","" +"AS211720","Datashield","20","51","-61%","","","","21;30443;40443" +"AS216309","INVISIONTECH-GROUP-SRL","26","0","new","67.219.214.53 67.219.214.90 67.219.214.127 67.219.214.145 67.219.214.154 67.219.214.247 67.219.214.1 67.219.214.2 67.219.214.17 67.219.214.19 67.219.214.27 67.219.214.32 67.219.214.33 67.219.214.36 67.219.214.50 67.219.214.52 67.219.214.55 67.219.214.57 67.219.214.58 67.219.214.60","","80","" +"AS58854","KAOPY","0","0","0%","","","","" +"AS202685","TR-ARKEL","0","0","0%","","","","" +"AS394711","KORGRID","0","0","0%","","","",""
\ No newline at end of file diff --git a/kevlar/2026-09-07/changes/numbers-table.json b/kevlar/2026-09-07/changes/numbers-table.json new file mode 100644 index 0000000..83cf2cb --- /dev/null +++ b/kevlar/2026-09-07/changes/numbers-table.json @@ -0,0 +1,277 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "sponge_ips": 5, + "sess": 196, + "hl_ips": 2, + "hl_ev": 12, + "hosts": 101919, + "top_port": "80 (HTTP)", + "delta": 3167 + }, + { + "asn": "AS209847", + "name": "THE", + "sponge_ips": 1, + "sess": 3, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 1458, + "top_port": "3389 (RDP)", + "delta": -93 + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "sponge_ips": 5, + "sess": 97, + "hl_ips": 1, + "hl_ev": 51, + "hosts": 71701, + "top_port": "443 (HTTPS)", + "delta": -100 + }, + { + "asn": "AS138915", + "name": "KAOPU-HK", + "sponge_ips": 20, + "sess": 47859, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 12308, + "top_port": "80 (HTTP)", + "delta": -24 + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "sponge_ips": 20, + "sess": 270, + "hl_ips": 12, + "hl_ev": 95, + "hosts": 25632, + "top_port": "22 (SSH)", + "delta": -85 + }, + { + "asn": "AS216139", + "name": "IRONHOST", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 8797, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "sponge_ips": 8, + "sess": 97, + "hl_ips": 5, + "hl_ev": 32, + "hosts": 8634, + "top_port": "443 (HTTPS)", + "delta": -87 + }, + { + "asn": "AS400992", + "name": "ZHOUYISAT", + "sponge_ips": 4, + "sess": 226, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 7982, + "top_port": "443 (HTTPS)", + "delta": -12 + }, + { + "asn": "AS33993", + "name": "UFO-AS", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 4692, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "sponge_ips": 20, + "sess": 87938, + "hl_ips": 20, + "hl_ev": 100, + "hosts": 2005, + "top_port": "22 (SSH)", + "delta": 152 + }, + { + "asn": "AS213702", + "name": "QWINS-LTD", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 7681, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 2, + "hl_ev": 2, + "hosts": 6960, + "top_port": "-", + "delta": -100 + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "sponge_ips": 2, + "sess": 76, + "hl_ips": 1, + "hl_ev": 24, + "hosts": 3824, + "top_port": "443 (HTTPS)", + "delta": 23 + }, + { + "asn": "AS30823", + "name": "AUROLOGIC", + "sponge_ips": 1, + "sess": 2, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 2178, + "top_port": "5060 (SIP)", + "delta": -78 + }, + { + "asn": "AS140666", + "name": "ADPL-AS-AP", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 6562, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS214351", + "name": "FEMOIT", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 744, + "top_port": "-", + "delta": -100 + }, + { + "asn": "AS198953", + "name": "PROTON66", + "sponge_ips": 4, + "sess": 1469, + "hl_ips": 4, + "hl_ev": 100, + "hosts": 359, + "top_port": "4443 (HTTPS-alt)", + "delta": -37 + }, + { + "asn": "AS200593", + "name": "PROSPERO-AS", + "sponge_ips": 1, + "sess": 1, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 340, + "top_port": "443 (HTTPS)", + "delta": -50 + }, + { + "asn": "AS214940", + "name": "KPRONET", + "sponge_ips": 3, + "sess": 59, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 0, + "top_port": "80 (HTTP)", + "delta": -61 + }, + { + "asn": "AS206728", + "name": "MEDIALAND-AS", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 15, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS211720", + "name": "Datashield", + "sponge_ips": 1, + "sess": 20, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 49, + "top_port": "50443 (HTTPS-alt)", + "delta": -61 + }, + { + "asn": "AS216309", + "name": "INVISIONTECH-GROUP-SRL", + "sponge_ips": 20, + "sess": 26, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 37, + "top_port": "80 (HTTP)", + "delta": null + }, + { + "asn": "AS58854", + "name": "KAOPY", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 614, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS202685", + "name": "TR-ARKEL", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 4, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS394711", + "name": "KORGRID", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 3, + "top_port": "-", + "delta": 0 + } +]
\ No newline at end of file diff --git a/kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json b/kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json new file mode 100644 index 0000000..313b2ec --- /dev/null +++ b/kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json @@ -0,0 +1,1319 @@ +{ + "AS57043": { + "name": "HOSTKEY-AS", + "ips": [ + { + "doc_count": 4, + "key": "66.248.207.253" + }, + { + "doc_count": 2, + "key": "185.130.227.19" + } + ], + "ports": [ + { + "doc_count": 4, + "key": 22 + }, + { + "doc_count": 2, + "key": 445 + } + ] + }, + "AS209847": { + "name": "THE", + "ips": [ + { + "doc_count": 37, + "key": "77.91.122.2" + }, + { + "doc_count": 4, + "key": "45.140.147.124" + } + ], + "ports": [ + { + "doc_count": 37, + "key": 3389 + }, + { + "doc_count": 2, + "key": 443 + }, + { + "doc_count": 1, + "key": 2053 + }, + { + "doc_count": 1, + "key": 8443 + } + ] + }, + "AS210644": { + "name": "AEZA-AS", + "ips": [ + { + "doc_count": 26958, + "key": "81.19.137.20" + }, + { + "doc_count": 26454, + "key": "138.124.91.58" + }, + { + "doc_count": 25907, + "key": "213.165.46.78" + }, + { + "doc_count": 876, + "key": "213.165.46.83" + }, + { + "doc_count": 53, + "key": "147.45.71.214" + }, + { + "doc_count": 43, + "key": "213.176.114.183" + }, + { + "doc_count": 30, + "key": "217.144.190.138" + }, + { + "doc_count": 17, + "key": "77.221.157.79" + }, + { + "doc_count": 3, + "key": "185.125.102.59" + }, + { + "doc_count": 2, + "key": "176.124.203.177" + }, + { + "doc_count": 2, + "key": "213.165.32.131" + } + ], + "ports": [ + { + "doc_count": 230, + "key": 1883 + }, + { + "doc_count": 230, + "key": 50000 + }, + { + "doc_count": 223, + "key": 20002 + }, + { + "doc_count": 221, + "key": 2376 + }, + { + "doc_count": 219, + "key": 4190 + }, + { + "doc_count": 218, + "key": 2628 + }, + { + "doc_count": 218, + "key": 64738 + }, + { + "doc_count": 217, + "key": 801 + }, + { + "doc_count": 217, + "key": 8787 + }, + { + "doc_count": 217, + "key": 8822 + }, + { + "doc_count": 217, + "key": 8844 + }, + { + "doc_count": 217, + "key": 15000 + }, + { + "doc_count": 217, + "key": 25565 + }, + { + "doc_count": 216, + "key": 21 + }, + { + "doc_count": 216, + "key": 53 + }, + { + "doc_count": 216, + "key": 82 + }, + { + "doc_count": 216, + "key": 85 + }, + { + "doc_count": 216, + "key": 88 + }, + { + "doc_count": 216, + "key": 110 + }, + { + "doc_count": 216, + "key": 111 + } + ] + }, + "AS138915": { + "name": "KAOPU-HK", + "ips": [ + { + "doc_count": 44479, + "key": "38.54.2.209" + }, + { + "doc_count": 13022, + "key": "38.54.2.232" + }, + { + "doc_count": 1031, + "key": "38.54.2.13" + }, + { + "doc_count": 848, + "key": "38.54.2.75" + }, + { + "doc_count": 771, + "key": "38.54.2.152" + }, + { + "doc_count": 715, + "key": "38.54.2.221" + }, + { + "doc_count": 673, + "key": "38.54.2.168" + }, + { + "doc_count": 673, + "key": "38.54.2.170" + }, + { + "doc_count": 313, + "key": "38.54.2.204" + }, + { + "doc_count": 142, + "key": "38.54.2.148" + }, + { + "doc_count": 94, + "key": "38.54.40.83" + }, + { + "doc_count": 47, + "key": "38.54.2.203" + }, + { + "doc_count": 44, + "key": "38.54.2.4" + }, + { + "doc_count": 39, + "key": "154.205.139.152" + }, + { + "doc_count": 19, + "key": "38.54.2.133" + }, + { + "doc_count": 19, + "key": "38.54.2.195" + }, + { + "doc_count": 18, + "key": "38.60.176.11" + }, + { + "doc_count": 16, + "key": "38.54.2.9" + }, + { + "doc_count": 16, + "key": "38.54.2.91" + }, + { + "doc_count": 12, + "key": "38.54.126.84" + } + ], + "ports": [ + { + "doc_count": 15077, + "key": 123 + }, + { + "doc_count": 11481, + "key": 80 + }, + { + "doc_count": 8036, + "key": 443 + }, + { + "doc_count": 5164, + "key": 5355 + }, + { + "doc_count": 4991, + "key": 137 + }, + { + "doc_count": 3794, + "key": 1900 + }, + { + "doc_count": 3247, + "key": 5353 + }, + { + "doc_count": 2203, + "key": 5678 + }, + { + "doc_count": 1603, + "key": 138 + }, + { + "doc_count": 782, + "key": 47604 + }, + { + "doc_count": 182, + "key": 0 + }, + { + "doc_count": 141, + "key": 67 + }, + { + "doc_count": 129, + "key": 51350 + }, + { + "doc_count": 111, + "key": 43998 + }, + { + "doc_count": 104, + "key": 22222 + }, + { + "doc_count": 96, + "key": 34569 + }, + { + "doc_count": 55, + "key": 58467 + }, + { + "doc_count": 45, + "key": 16516 + }, + { + "doc_count": 40, + "key": 5601 + }, + { + "doc_count": 29, + "key": 25565 + } + ] + }, + "AS14956": { + "name": "ROUTERHOSTING", + "ips": [ + { + "doc_count": 967, + "key": "216.126.227.184" + }, + { + "doc_count": 250, + "key": "216.126.225.6" + }, + { + "doc_count": 221, + "key": "45.59.117.74" + }, + { + "doc_count": 211, + "key": "107.189.27.179" + }, + { + "doc_count": 39, + "key": "104.194.157.233" + }, + { + "doc_count": 38, + "key": "144.172.88.96" + }, + { + "doc_count": 35, + "key": "144.172.115.90" + }, + { + "doc_count": 14, + "key": "144.172.117.54" + }, + { + "doc_count": 14, + "key": "216.126.239.150" + }, + { + "doc_count": 13, + "key": "107.189.17.69" + }, + { + "doc_count": 12, + "key": "216.126.239.185" + }, + { + "doc_count": 9, + "key": "216.126.239.163" + }, + { + "doc_count": 7, + "key": "172.86.117.85" + }, + { + "doc_count": 6, + "key": "144.172.117.61" + }, + { + "doc_count": 5, + "key": "144.172.94.243" + }, + { + "doc_count": 4, + "key": "107.189.17.181" + }, + { + "doc_count": 4, + "key": "144.172.93.238" + }, + { + "doc_count": 4, + "key": "216.126.239.178" + }, + { + "doc_count": 3, + "key": "144.172.107.203" + }, + { + "doc_count": 3, + "key": "144.172.110.233" + } + ], + "ports": [ + { + "doc_count": 375, + "key": 22 + }, + { + "doc_count": 216, + "key": 8022 + }, + { + "doc_count": 104, + "key": 22222 + }, + { + "doc_count": 36, + "key": 80 + }, + { + "doc_count": 36, + "key": 443 + }, + { + "doc_count": 29, + "key": 8080 + }, + { + "doc_count": 25, + "key": 8888 + }, + { + "doc_count": 24, + "key": 7500 + }, + { + "doc_count": 24, + "key": 8161 + }, + { + "doc_count": 23, + "key": 8008 + }, + { + "doc_count": 23, + "key": 8081 + }, + { + "doc_count": 22, + "key": 5001 + }, + { + "doc_count": 22, + "key": 7443 + }, + { + "doc_count": 22, + "key": 8088 + }, + { + "doc_count": 22, + "key": 9080 + }, + { + "doc_count": 21, + "key": 8000 + }, + { + "doc_count": 21, + "key": 8085 + }, + { + "doc_count": 20, + "key": 10000 + }, + { + "doc_count": 18, + "key": 5060 + }, + { + "doc_count": 18, + "key": 8001 + } + ] + }, + "AS216139": { + "name": "IRONHOST", + "ips": [], + "ports": [] + }, + "AS51852": { + "name": "PLI-AS", + "ips": [ + { + "doc_count": 212, + "key": "179.43.139.58" + }, + { + "doc_count": 205, + "key": "179.43.182.200" + }, + { + "doc_count": 86, + "key": "179.43.133.154" + }, + { + "doc_count": 78, + "key": "179.43.167.2" + }, + { + "doc_count": 41, + "key": "81.17.28.131" + }, + { + "doc_count": 30, + "key": "46.19.138.10" + }, + { + "doc_count": 26, + "key": "179.43.150.26" + }, + { + "doc_count": 19, + "key": "46.19.137.194" + }, + { + "doc_count": 11, + "key": "179.43.146.27" + }, + { + "doc_count": 9, + "key": "141.255.165.67" + }, + { + "doc_count": 9, + "key": "141.255.165.69" + }, + { + "doc_count": 3, + "key": "141.255.165.66" + }, + { + "doc_count": 2, + "key": "46.19.138.45" + }, + { + "doc_count": 2, + "key": "141.255.165.70" + }, + { + "doc_count": 1, + "key": "46.19.138.42" + }, + { + "doc_count": 1, + "key": "46.19.138.44" + }, + { + "doc_count": 1, + "key": "141.255.165.104" + }, + { + "doc_count": 1, + "key": "179.43.172.83" + } + ], + "ports": [ + { + "doc_count": 298, + "key": 22 + }, + { + "doc_count": 205, + "key": 23 + }, + { + "doc_count": 118, + "key": 5060 + }, + { + "doc_count": 35, + "key": 139 + }, + { + "doc_count": 15, + "key": 1701 + }, + { + "doc_count": 13, + "key": 9000 + }, + { + "doc_count": 13, + "key": 9090 + }, + { + "doc_count": 8, + "key": 1723 + }, + { + "doc_count": 6, + "key": 5080 + }, + { + "doc_count": 6, + "key": 7680 + }, + { + "doc_count": 5, + "key": 80 + }, + { + "doc_count": 3, + "key": 5062 + }, + { + "doc_count": 2, + "key": 1521 + }, + { + "doc_count": 2, + "key": 8007 + }, + { + "doc_count": 2, + "key": 60000 + }, + { + "doc_count": 1, + "key": 0 + }, + { + "doc_count": 1, + "key": 7001 + }, + { + "doc_count": 1, + "key": 8181 + }, + { + "doc_count": 1, + "key": 9091 + }, + { + "doc_count": 1, + "key": 9200 + } + ] + }, + "AS400992": { + "name": "ZHOUYISAT-COMMUNICATIONS", + "ips": [ + { + "doc_count": 179, + "key": "23.172.217.87" + }, + { + "doc_count": 44, + "key": "193.46.218.239" + }, + { + "doc_count": 34, + "key": "23.172.217.77" + } + ], + "ports": [ + { + "doc_count": 130, + "key": 443 + }, + { + "doc_count": 127, + "key": 80 + } + ] + }, + "AS33993": { + "name": "UFO-AS", + "ips": [], + "ports": [] + }, + "AS51396": { + "name": "PFCLOUD", + "ips": [ + { + "doc_count": 14856, + "key": "204.76.203.18" + }, + { + "doc_count": 3537, + "key": "176.65.148.84" + }, + { + "doc_count": 3175, + "key": "45.156.87.13" + }, + { + "doc_count": 1595, + "key": "45.153.34.181" + }, + { + "doc_count": 1572, + "key": "45.156.87.93" + }, + { + "doc_count": 1448, + "key": "176.65.148.243" + }, + { + "doc_count": 1435, + "key": "45.156.87.166" + }, + { + "doc_count": 1293, + "key": "45.135.194.26" + }, + { + "doc_count": 1085, + "key": "204.76.203.7" + }, + { + "doc_count": 795, + "key": "45.153.34.149" + }, + { + "doc_count": 581, + "key": "204.76.203.49" + }, + { + "doc_count": 569, + "key": "45.135.193.198" + }, + { + "doc_count": 474, + "key": "45.135.193.193" + }, + { + "doc_count": 440, + "key": "176.65.149.67" + }, + { + "doc_count": 364, + "key": "176.65.149.64" + }, + { + "doc_count": 356, + "key": "176.65.149.224" + }, + { + "doc_count": 351, + "key": "176.65.149.230" + }, + { + "doc_count": 342, + "key": "176.65.149.55" + }, + { + "doc_count": 332, + "key": "176.65.149.212" + }, + { + "doc_count": 332, + "key": "176.65.149.220" + } + ], + "ports": [ + { + "doc_count": 15114, + "key": 80 + }, + { + "doc_count": 8674, + "key": 22 + }, + { + "doc_count": 1297, + "key": 23 + }, + { + "doc_count": 486, + "key": 8080 + }, + { + "doc_count": 399, + "key": 27017 + }, + { + "doc_count": 292, + "key": 3306 + }, + { + "doc_count": 216, + "key": 25565 + }, + { + "doc_count": 215, + "key": 0 + }, + { + "doc_count": 204, + "key": 8888 + }, + { + "doc_count": 202, + "key": 8000 + }, + { + "doc_count": 177, + "key": 443 + }, + { + "doc_count": 135, + "key": 3128 + }, + { + "doc_count": 111, + "key": 8545 + }, + { + "doc_count": 94, + "key": 25566 + }, + { + "doc_count": 92, + "key": 9999 + }, + { + "doc_count": 90, + "key": 25564 + }, + { + "doc_count": 88, + "key": 8181 + }, + { + "doc_count": 87, + "key": 1080 + }, + { + "doc_count": 86, + "key": 4145 + }, + { + "doc_count": 85, + "key": 53 + } + ] + }, + "AS213702": { + "name": "QWINS-LTD", + "ips": [], + "ports": [] + }, + "AS216246": { + "name": "RU-AEZA-AS", + "ips": [ + { + "doc_count": 1, + "key": "185.221.199.82" + }, + { + "doc_count": 1, + "key": "194.26.229.20" + } + ], + "ports": [ + { + "doc_count": 2, + "key": 80 + } + ] + }, + "AS200651": { + "name": "FLOKINET", + "ips": [ + { + "doc_count": 49, + "key": "185.100.87.136" + }, + { + "doc_count": 12, + "key": "185.247.225.201" + }, + { + "doc_count": 1, + "key": "37.228.129.67" + } + ], + "ports": [ + { + "doc_count": 25, + "key": 443 + }, + { + "doc_count": 12, + "key": 6882 + }, + { + "doc_count": 10, + "key": 8443 + }, + { + "doc_count": 8, + "key": 22 + }, + { + "doc_count": 6, + "key": 2222 + }, + { + "doc_count": 1, + "key": 0 + } + ] + }, + "AS30823": { + "name": "AUROLOGIC", + "ips": [ + { + "doc_count": 9, + "key": "45.153.243.249" + } + ], + "ports": [ + { + "doc_count": 9, + "key": 22 + } + ] + }, + "AS140666": { + "name": "ADPL-AS-AP", + "ips": [], + "ports": [] + }, + "AS214351": { + "name": "FEMOIT", + "ips": [ + { + "doc_count": 4, + "key": "62.60.226.150" + } + ], + "ports": [ + { + "doc_count": 4, + "key": 1723 + } + ] + }, + "AS198953": { + "name": "PROTON66", + "ips": [ + { + "doc_count": 2192, + "key": "176.120.22.61" + }, + { + "doc_count": 91, + "key": "176.120.22.43" + }, + { + "doc_count": 28, + "key": "193.143.1.66" + }, + { + "doc_count": 13, + "key": "176.120.22.123" + }, + { + "doc_count": 3, + "key": "37.77.150.241" + } + ], + "ports": [ + { + "doc_count": 795, + "key": 2222 + }, + { + "doc_count": 795, + "key": 22222 + }, + { + "doc_count": 41, + "key": 443 + }, + { + "doc_count": 26, + "key": 4433 + }, + { + "doc_count": 25, + "key": 4443 + }, + { + "doc_count": 25, + "key": 10443 + }, + { + "doc_count": 22, + "key": 8001 + }, + { + "doc_count": 21, + "key": 1433 + }, + { + "doc_count": 21, + "key": 1434 + }, + { + "doc_count": 21, + "key": 1500 + }, + { + "doc_count": 21, + "key": 1501 + }, + { + "doc_count": 21, + "key": 1800 + }, + { + "doc_count": 21, + "key": 2008 + }, + { + "doc_count": 21, + "key": 3005 + }, + { + "doc_count": 21, + "key": 3333 + }, + { + "doc_count": 21, + "key": 5000 + }, + { + "doc_count": 21, + "key": 5678 + }, + { + "doc_count": 21, + "key": 6000 + }, + { + "doc_count": 21, + "key": 6001 + }, + { + "doc_count": 21, + "key": 7788 + } + ] + }, + "AS200593": { + "name": "PROSPERO-AS", + "ips": [ + { + "doc_count": 2, + "key": "91.215.85.142" + } + ], + "ports": [ + { + "doc_count": 2, + "key": 22 + } + ] + }, + "AS214940": { + "name": "KPRONET", + "ips": [ + { + "doc_count": 39, + "key": "77.83.39.6" + }, + { + "doc_count": 26, + "key": "77.83.39.94" + }, + { + "doc_count": 17, + "key": "77.83.39.112" + }, + { + "doc_count": 10, + "key": "77.83.39.239" + }, + { + "doc_count": 9, + "key": "77.83.39.17" + }, + { + "doc_count": 7, + "key": "77.83.39.60" + }, + { + "doc_count": 6, + "key": "77.83.39.4" + }, + { + "doc_count": 6, + "key": "77.83.39.118" + }, + { + "doc_count": 6, + "key": "77.83.39.147" + }, + { + "doc_count": 5, + "key": "77.83.39.101" + }, + { + "doc_count": 5, + "key": "77.83.39.217" + }, + { + "doc_count": 3, + "key": "77.83.39.99" + }, + { + "doc_count": 3, + "key": "77.83.39.226" + }, + { + "doc_count": 2, + "key": "77.83.39.89" + }, + { + "doc_count": 2, + "key": "77.83.39.122" + }, + { + "doc_count": 1, + "key": "77.83.39.95" + }, + { + "doc_count": 1, + "key": "77.83.39.108" + }, + { + "doc_count": 1, + "key": "77.83.39.119" + }, + { + "doc_count": 1, + "key": "77.83.39.151" + }, + { + "doc_count": 1, + "key": "77.83.39.235" + } + ], + "ports": [ + { + "doc_count": 80, + "key": 2222 + }, + { + "doc_count": 33, + "key": 443 + }, + { + "doc_count": 32, + "key": 80 + }, + { + "doc_count": 7, + "key": 465 + }, + { + "doc_count": 1, + "key": 25 + } + ] + }, + "AS206728": { + "name": "MEDIALAND-AS", + "ips": [], + "ports": [] + }, + "AS211720": { + "name": "Datashield", + "ips": [ + { + "doc_count": 51, + "key": "185.231.33.46" + } + ], + "ports": [ + { + "doc_count": 6, + "key": 21 + }, + { + "doc_count": 6, + "key": 30443 + }, + { + "doc_count": 6, + "key": 40443 + }, + { + "doc_count": 3, + "key": 4430 + }, + { + "doc_count": 3, + "key": 4444 + }, + { + "doc_count": 3, + "key": 5443 + }, + { + "doc_count": 3, + "key": 6443 + }, + { + "doc_count": 3, + "key": 9443 + }, + { + "doc_count": 3, + "key": 60443 + }, + { + "doc_count": 2, + "key": 443 + }, + { + "doc_count": 2, + "key": 4433 + }, + { + "doc_count": 2, + "key": 4443 + }, + { + "doc_count": 2, + "key": 7443 + }, + { + "doc_count": 2, + "key": 8443 + }, + { + "doc_count": 2, + "key": 10443 + }, + { + "doc_count": 2, + "key": 50443 + }, + { + "doc_count": 1, + "key": 444 + } + ] + }, + "AS216309": { + "name": "INVISIONTECH-GROUP-SRL", + "ips": [], + "ports": [] + }, + "AS58854": { + "name": "KAOPY", + "ips": [], + "ports": [] + }, + "AS202685": { + "name": "TR-ARKEL", + "ips": [], + "ports": [] + }, + "AS394711": { + "name": "KORGRID", + "ips": [], + "ports": [] + } +}
\ No newline at end of file |