From a47b685eac21aeedad5c4ab5df5c67a1df905486 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 13 Jul 2026 07:27:00 -0400 Subject: chore: weekly asn update --- kevlar/2026-07-13/changes/diff-vs-prior-week.csv | 36 ++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 kevlar/2026-07-13/changes/diff-vs-prior-week.csv (limited to 'kevlar/2026-07-13/changes/diff-vs-prior-week.csv') diff --git a/kevlar/2026-07-13/changes/diff-vs-prior-week.csv b/kevlar/2026-07-13/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..45bf9bc --- /dev/null +++ b/kevlar/2026-07-13/changes/diff-vs-prior-week.csv @@ -0,0 +1,36 @@ +metric,asn,asn_org,prior_value,current_value,delta,delta_pct,category,notes +active_asns,total,,9,15,+6,+67%,expansion,"6 new ASNs active: AS57043, AS138915, AS216139, AS33993, AS216246, AS211720" +event_volume,AS51396,Pfcloud UG,11500,10000+,-1500,-13%,decrease,"PFCLOUD volume slightly decreased but still dominant" +event_volume,AS51852,Private Layer INC,822,1802,+980,+119%,increase,"Significant uptick in Private Layer activity" +event_volume,AS14956,RouterHosting LLC,267,206,-61,-23%,decrease,"RouterHosting activity decreased" +event_volume,AS214940,Kprohost LLC,45,46,+1,+2%,stable,"Kprohost stable" +event_volume,AS198953,Proton66 OOO,35,539,+504,+1440%,surge,"Proton66 massive surge - RDP/SSH/Telnet/FTP bruteforcing" +event_volume,AS200651,FlokiNET ehf,20,20,0,0%,stable,"FlokiNET stable" +event_volume,AS210644,Aeza Group LLC,3,1,-2,-67%,decrease,"Aeza minimal activity" +event_volume,AS400992,ZhouyiSat Comm,4,2,-2,-50%,decrease,"ZhouyiSat minimal" +event_volume,AS200593,Prospero Ooo,2,3890,+3888,+194400%,surge,"Prospero massive surge - scan-only behavior" +new_ips,AS51396,Pfcloud UG,0,3,+3,new,"New IPs: 204.76.203.78/79/80 - coordinated scan cluster" +new_ips,AS51852,Private Layer INC,0,3,+3,new,"New IPs: 179.43.134.114, 179.43.168.58, 179.43.186.241" +new_ips,AS14956,RouterHosting LLC,0,4,+4,new,"New IPs: 144.172.103.227, 216.126.225.168, 144.172.97.10, 167.88.165.96" +new_ips,AS198953,Proton66 OOO,0,2,+2,new,"New IPs: 176.120.22.240, 176.120.22.147, 37.77.150.67" +new_ips,AS200593,Prospero Ooo,0,1,+1,new,"New IP: 91.202.233.79 - 3890 events single IP" +new_ips,AS214940,Kprohost LLC,0,2,+2,new,"New IPs: 77.83.39.119, 77.83.39.94" +new_ips,AS57043,Hostkey B.v.,0,1,+1,new,"New IP: 151.243.173.235 - SSH scanning" +new_ips,AS216139,Iron Hosting Centre,0,1,+1,new,"New IP: 178.208.88.28 - SSH scanning" +new_ips,AS211720,Datashield Inc.,0,1,+1,new,"New IP: 185.231.33.46 - Exchange /ews/ recon" +new_asns,AS57043,Hostkey B.v.,0,1,+1,new,"First observation in Honeylabs" +new_asns,AS138915,KAOPU-HK,0,0,0,0,"Sponge only - NTP/123 traffic, no Honeylabs" +new_asns,AS216139,Iron Hosting Centre,0,1,+1,new,"First observation in Honeylabs" +new_asns,AS33993,TOV Aktor,0,0,0,0,"Sponge only - 2 sessions" +new_asns,AS216246,Qwins-LTD,0,0,0,0,"Sponge only - 93 sessions" +new_asns,AS211720,Datashield Inc.,0,1,+1,new,"First observation - Exchange recon" +new_attack_pattern,AS51396,Pfcloud UG,none,coordinated-scan-cluster,new,new,"Three IPs (204.76.203.78/79/80) with identical start/stop times" +new_attack_pattern,AS198953,Proton66 OOO,rdp-only,multi-protocol-bruteforce,new,new,"Expanded from RDP-only to SSH+Telnet+FTP bruteforcing" +new_attack_pattern,AS200593,Prospero Ooo,minimal,massive-port-scan,new,new,"Single IP generating 3890 events on diverse high ports" +new_attack_pattern,AS211720,Datashield Inc.,none,exchange-ews-recon,new,new,"Exchange /ews/ endpoint reconnaissance" +new_attack_pattern,AS400992,ZhouyiSat Comm,none,env-file-scanning,new,new,"/.env file probing via HTTPS" +new_fingerprint,AS400992,ZhouyiSat,none,ja4-t13i1711h1,new,new,"TLS 1.3 fingerprint for .env scanning" +new_fingerprint,AS200651,FlokiNET,none,ja4-t13i1909h2,new,new,"TLS 1.3 fingerprint for transparentpix.gif probing" +new_fingerprint,AS211720,Datashield,none,ja4-t13i1813h1,new,new,"TLS 1.3 fingerprint for Exchange /ews/ recon" +new_fingerprint,AS57043,Hostkey,none,hassh-f555226d,new,new,"HASSH for libssh_0.9.6 SSH scanning" +new_fingerprint,AS200651,FlokiNET,none,hassh-e54ef3ec,new,new,"HASSH for OpenSSH_10.1 (Tor exit node)" -- cgit v1.2.3