From 4294adbcb3a35e85f3107922e953aa98158989d7 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 22 Jun 2026 06:54:25 -0400 Subject: add: 2026-06-20 kevlar iocs --- kevlar/2026-06-20/iocs/README.md | 14 +++ kevlar/2026-06-20/iocs/all-observed-ips.txt | 128 ++++++++++++++++++++++++++++ kevlar/2026-06-20/iocs/c2-paths.txt | 6 ++ kevlar/2026-06-20/iocs/fingerprints.txt | 12 +++ 4 files changed, 160 insertions(+) create mode 100644 kevlar/2026-06-20/iocs/README.md create mode 100644 kevlar/2026-06-20/iocs/all-observed-ips.txt create mode 100644 kevlar/2026-06-20/iocs/c2-paths.txt create mode 100644 kevlar/2026-06-20/iocs/fingerprints.txt (limited to 'kevlar/2026-06-20/iocs') diff --git a/kevlar/2026-06-20/iocs/README.md b/kevlar/2026-06-20/iocs/README.md new file mode 100644 index 0000000..875d851 --- /dev/null +++ b/kevlar/2026-06-20/iocs/README.md @@ -0,0 +1,14 @@ +# Weekly BP Report -- 2026-06-20 + +**Generated:** 2026-06-22T10:44:00Z +**Reporting period:** 2026-06-14 through 2026-06-20 +**ASNs covered:** 26 +**ASNs with activity:** 15 +**Arkime sessions found:** ~180,000+ +**Honeylabs events found:** ~16,500 +**Censys IPs enriched:** 0 (aggregation-only, sufficient for report) +**Anomalies flagged:** 2 (HOSTKEY-AS new entry, PROTON66 normalizing) + +Data sources: Sponge, Honeylabs, Censys +Blog post: +Build verification: passed (0 errors, 0 warnings) diff --git a/kevlar/2026-06-20/iocs/all-observed-ips.txt b/kevlar/2026-06-20/iocs/all-observed-ips.txt new file mode 100644 index 0000000..7e0864a --- /dev/null +++ b/kevlar/2026-06-20/iocs/all-observed-ips.txt @@ -0,0 +1,128 @@ +# All Observed IPs -- Weekly BP Report 2026-06-20 +# Generated: 2026-06-22T10:44:00Z +# +# IPs from Arkime session_stats per-ASN and Honeylabs top_attackers + +# AS51396 -- PFCLOUD (Pfcloud UG) +176.65.148.147 +176.65.139.181 +204.76.203.18 +204.76.203.231 +176.65.139.91 +204.76.203.78 +204.76.203.214 +204.76.203.212 +204.76.203.213 +204.76.203.221 +204.76.203.222 +204.76.203.79 +204.76.203.80 +204.76.203.206 +45.135.193.193 +204.76.203.219 +176.65.148.184 +45.135.194.113 +176.65.139.31 +176.65.132.141 +176.65.139.36 +204.76.203.81 +45.135.194.10 +45.153.34.81 +176.65.139.66 + +# AS138915 -- KAOPU-HK (Kaopu Cloud HK Limited) +38.54.2.209 +38.54.2.232 +38.54.2.13 +38.54.2.82 +38.54.2.75 +149.104.66.228 +38.60.254.173 +154.203.143.169 + +# AS51852 -- PLI-AS (Private Layer INC) +179.43.163.26 +179.43.133.154 +179.43.146.227 +179.43.168.58 +179.43.150.26 +179.43.186.241 +179.43.182.202 + +# AS57043 -- HOSTKEY-AS +193.17.95.129 +193.84.2.233 +91.239.211.190 +194.87.54.140 + +# AS210644 -- AEZA-AS (Aeza International Ltd) +138.124.99.219 +85.192.31.14 +79.137.197.24 +109.172.95.248 +89.22.228.119 +138.124.26.246 +138.124.26.236 + +# AS14956 -- ROUTERHOSTING (RouterHosting LLC) +107.189.17.96 +107.189.27.179 +104.194.157.233 +107.189.24.77 +172.86.116.3 +144.172.100.186 +216.126.239.17 +45.61.134.137 +167.88.165.96 +144.172.107.104 +45.61.128.177 +144.172.104.239 +172.86.114.169 +144.172.91.190 +144.172.110.153 + +# AS214940 -- KPRONET (Kprohost LLC) +77.83.39.197 +77.83.39.14 +77.83.39.42 +77.83.39.94 + +# AS400992 -- ZHOUYISAT (ZhouyiSat Communications) +23.172.217.87 +23.172.217.77 +185.121.15.184 +130.12.44.88 +23.172.217.46 +147.45.124.42 + +# AS198953 -- PROTON66 (Proton66 OOO) +176.120.22.113 +176.120.22.120 +176.120.22.240 +193.143.1.66 +37.77.150.241 + +# AS200651 -- FLOKINET (FlokiNET ehf) +185.100.87.136 +185.100.84.164 +37.228.129.67 + +# AS200593 -- PROSPERO-AS (Prospero Ooo) +91.215.85.106 +91.215.85.193 +91.202.233.105 +193.24.123.118 +193.24.123.148 + +# AS209847 -- THE +92.118.233.6 +2.56.126.111 + +# AS213702 -- QWINS-LTD +80.253.249.170 + +# AS33993 -- UFO-AS +45.144.31.247 + +# AS30823 -- AUROLOGIC +152.89.244.135 diff --git a/kevlar/2026-06-20/iocs/c2-paths.txt b/kevlar/2026-06-20/iocs/c2-paths.txt new file mode 100644 index 0000000..695bd81 --- /dev/null +++ b/kevlar/2026-06-20/iocs/c2-paths.txt @@ -0,0 +1,6 @@ +# Notable HTTP URL Paths Observed -- Weekly BP Report 2026-06-20 +# Generated: 2026-06-22T10:44:00Z + +# UPnP Exploitation +/wanipcn.xml -- SOAP AddPortMapping target, 14 events, KAOPU-HK AS138915 (149.104.66.228, Peru) +/picdesc.xml -- UPnP device description, paired with AddPortMapping, KAOPU-HK AS138915 (149.104.66.228, Peru) diff --git a/kevlar/2026-06-20/iocs/fingerprints.txt b/kevlar/2026-06-20/iocs/fingerprints.txt new file mode 100644 index 0000000..8b74903 --- /dev/null +++ b/kevlar/2026-06-20/iocs/fingerprints.txt @@ -0,0 +1,12 @@ +# Unique Fingerprints Observed -- Weekly BP Report 2026-06-20 +# Generated: 2026-06-22T10:44:00Z + +# JA4 TLS Fingerprints +t13i131000_f57a46bbacb6_ab7e3b40a677 -- Go TLS client, observed on 3 IPs across KAOPU-HK and THE ASNs; TLSv1.3 AES_128_GCM_SHA256 + +# JA3 Legacy Fingerprints +2196848d251b217de8b2c037e356c11d -- Go TLS client (JA3 equivalent of above), seen on KAOPU-HK IPs (38.60.254.173, 154.203.143.169) + +# JA4H HTTP Fingerprints +ge11nn0300_0db47b7d240d -- Go-http-client/1.1, KAOPU-HK (38.60.254.173), probing HTTP/HTTPS/9200 +po11nn0700_4784ccc9db2c -- Mozilla/4.0 compatible MSIE 6.0 UPnP client, KAOPU-HK (149.104.66.228), UPnP AddPortMapping attempts -- cgit v1.2.3