From a47b685eac21aeedad5c4ab5df5c67a1df905486 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 13 Jul 2026 07:27:00 -0400 Subject: chore: weekly asn update --- kevlar/2026-07-13/honeylabs/fingerprints.csv | 12 +++++++++++ kevlar/2026-07-13/honeylabs/top-attackers.csv | 29 +++++++++++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 kevlar/2026-07-13/honeylabs/fingerprints.csv create mode 100644 kevlar/2026-07-13/honeylabs/top-attackers.csv (limited to 'kevlar/2026-07-13/honeylabs') diff --git a/kevlar/2026-07-13/honeylabs/fingerprints.csv b/kevlar/2026-07-13/honeylabs/fingerprints.csv new file mode 100644 index 0000000..2aafc9a --- /dev/null +++ b/kevlar/2026-07-13/honeylabs/fingerprints.csv @@ -0,0 +1,12 @@ +asn,source_ip,fingerprint_type,fingerprint,ssh_client,notes +AS57043,151.243.173.235,hassh,f555226df1963d1d3c09daf865abdc9a,SSH-2.0-libssh_0.9.6,SSH scanning port 22 +AS200651,185.100.87.136,hassh,e54ef3ec27fe1fea7ab64d3fa05359fd,SSH-2.0-OpenSSH_10.1,SSH scanning multiple ports +AS400992,185.228.72.109,ja4,t13i1711h1_ab0a1bf427ad_882d495ac381,,TLS 1.3 .env file scanning +AS400992,185.228.72.109,ja3,fb0c9cea0478d6132076f4cdcb0d5224,,TLS 1.3 .env file scanning +AS400992,185.228.72.109,ja4h,ge11nn0500_2d30dc89d981,,HTTP GET /.env scanning +AS200651,185.100.87.136,ja4,t13i1909h2_9dc949149365_97f8aa674fd9,,TLS 1.3 transparentpix.gif probing +AS200651,185.100.87.136,ja3,7c1e207beb00684bbbe144f1b0abe1d5,,TLS 1.3 transparentpix.gif probing +AS200651,185.100.87.136,ja4h,ge11nn0400_88d30a62b7ad,,HTTP GET on port 444 +AS211720,185.231.33.46,ja4,t13i1813h1_5103eae14fdb_97a66a8f4cb1,,TLS 1.3 Exchange /ews/ recon +AS211720,185.231.33.46,ja3,60eb467937ec4cb8aa43b4008a510ad1,,TLS 1.3 Exchange /ews/ recon +AS211720,185.231.33.46,ja4h,he11nn0500_2d30dc89d981,,HTTP HEAD /ews/ Exchange recon diff --git a/kevlar/2026-07-13/honeylabs/top-attackers.csv b/kevlar/2026-07-13/honeylabs/top-attackers.csv new file mode 100644 index 0000000..95be0e9 --- /dev/null +++ b/kevlar/2026-07-13/honeylabs/top-attackers.csv @@ -0,0 +1,29 @@ +asn,asn_org,source_ip,event_count,first_seen,last_seen,top_ports,country +AS57043,Hostkey B.v.,151.243.173.235,1,2026-07-06T04:55:10,2026-07-06T04:55:10,"22",NL +AS210644,Aeza Group LLC,46.226.162.205,1,2026-07-07T07:42:47,2026-07-07T07:42:47,"61616",GB +AS14956,RouterHosting LLC,216.126.239.17,94,2026-07-05T01:16:11,2026-07-11T23:03:28,"5555,12124,2930,8889,1212",US +AS14956,RouterHosting LLC,144.172.103.227,34,2026-07-05T00:47:25,2026-07-07T16:07:03,"80,8080,443",US +AS14956,RouterHosting LLC,216.126.225.168,33,2026-07-05T15:58:50,2026-07-06T16:27:04,"443,8080,80",US +AS14956,RouterHosting LLC,144.172.97.10,6,2026-07-06T12:21:10,2026-07-10T08:58:39,"5060",US +AS14956,RouterHosting LLC,167.88.165.96,5,2026-07-09T20:56:12,2026-07-11T05:00:53,"8317",US +AS216139,Iron Hosting Centre LTD,178.208.88.28,2,2026-07-07T23:06:43,2026-07-07T23:06:43,"22",NL +AS51852,Private Layer INC,179.43.134.114,1518,2026-07-08T15:11:12,2026-07-09T09:58:14,"5430,64312,1315,1089,3333",CH +AS51852,Private Layer INC,179.43.168.58,252,2026-07-07T09:37:23,2026-07-08T13:32:02,"443",CH +AS51852,Private Layer INC,179.43.186.241,22,2026-07-05T11:06:59,2026-07-06T07:54:39,"443,8291",CH +AS51852,Private Layer INC,179.43.185.147,5,2026-07-08T01:44:49,2026-07-11T22:54:33,"5985",CH +AS400992,ZhouyiSat Communications,185.228.72.109,2,2026-07-09T20:28:17,2026-07-09T20:28:19,"80,443",US +AS51396,Pfcloud UG,176.65.148.25,2600,2026-07-08T02:47:28,2026-07-11T23:56:32,"4441,33998,6002,35389,5005",NL +AS51396,Pfcloud UG,204.76.203.79,992,2026-07-11T03:24:10,2026-07-11T13:26:10,"8801,10800,8868,8003,6250",NL +AS51396,Pfcloud UG,204.76.203.80,950,2026-07-11T03:24:10,2026-07-11T13:26:10,"2052,10050,7000,10280,8119",NL +AS51396,Pfcloud UG,204.76.203.78,926,2026-07-11T03:29:32,2026-07-11T13:26:10,"7780,9057,5228,10031,888",NL +AS51396,Pfcloud UG,45.135.193.193,463,2026-07-05T04:03:08,2026-07-11T22:53:41,"8888,8081,8080,443,81",DE +AS200651,FlokiNET ehf,185.100.87.136,17,2026-07-07T00:56:06,2026-07-11T11:28:15,"80,443,444,8080,22",RO +AS200651,FlokiNET ehf,185.100.84.164,3,2026-07-06T11:56:11,2026-07-06T11:56:12,"5900",RO +AS198953,Proton66 OOO,176.120.22.240,429,2026-07-10T21:47:29,2026-07-11T21:03:39,"4000,1723,143,8080,111",RU +AS198953,Proton66 OOO,176.120.22.147,89,2026-07-05T20:56:36,2026-07-06T07:06:51,"44463,44412,44400,80,8080",RU +AS198953,Proton66 OOO,37.77.150.67,21,2026-07-10T01:36:45,2026-07-10T01:41:55,"1433",RU +AS200593,Prospero Ooo,91.202.233.79,3890,2026-07-10T11:47:30,2026-07-10T23:20:55,"43128,12063,49326,19168,13230",TM +AS214940,Kprohost LLC,77.83.39.197,26,2026-07-05T03:32:41,2026-07-09T06:21:19,"443",UA +AS214940,Kprohost LLC,77.83.39.119,11,2026-07-11T01:42:38,2026-07-11T14:39:06,"443,80",UA +AS214940,Kprohost LLC,77.83.39.94,6,2026-07-10T05:58:09,2026-07-10T16:53:52,"443",UA +AS211720,Datashield Inc.,185.231.33.46,4,2026-07-10T14:44:40,2026-07-10T19:58:52,"443",SC -- cgit v1.2.3