From 7439049b2d46c035fda40b27d3f64b0b9f48af8a Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 10 Aug 2026 07:14:00 -0400 Subject: feat: update bph iocs --- kevlar/2026-08-10/changes/anomalies.csv | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 kevlar/2026-08-10/changes/anomalies.csv (limited to 'kevlar/2026-08-10/changes/anomalies.csv') diff --git a/kevlar/2026-08-10/changes/anomalies.csv b/kevlar/2026-08-10/changes/anomalies.csv new file mode 100644 index 0000000..e2fcbbe --- /dev/null +++ b/kevlar/2026-08-10/changes/anomalies.csv @@ -0,0 +1,7 @@ +severity,asn,anomaly,rationale +high,AS51396,Shared SSH host key across 204.76.203.221+214,Definitive cloned infrastructure; identical HASSH 41ff3ecd... and proxy on 9191 +high,AS51396,New 204.76.203.2xx proxy block,5 new IPs this week all running proxy-checking; volume +37% +medium,AS14956,PPTP brute-force on port 1723,New attack pattern this week; 144.172.100.63 sustained PPTP attempts +medium,AS51852,.env/.git exfiltration pattern,Signature previously on KPRONET now on PLI-AS; 179.43.150.26 probing 8001/8443 +medium,AS198953,MSSQL-TDS on 17 non-standard ports,Expanded brute-force campaign; 176.120.22.61 dominant +low,AS200651,Tor exit relay volume drop -88%,185.100.87.136 still active but reduced -- cgit v1.2.3