From 7439049b2d46c035fda40b27d3f64b0b9f48af8a Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 10 Aug 2026 07:14:00 -0400 Subject: feat: update bph iocs --- kevlar/2026-08-10/honeylabs/events-AS14956.ndjson | 2 ++ kevlar/2026-08-10/honeylabs/events-AS51396.ndjson | 15 +++++++++++++++ kevlar/2026-08-10/honeylabs/fingerprints.csv | 8 ++++++++ kevlar/2026-08-10/honeylabs/top-attackers.csv | 17 +++++++++++++++++ 4 files changed, 42 insertions(+) create mode 100644 kevlar/2026-08-10/honeylabs/events-AS14956.ndjson create mode 100644 kevlar/2026-08-10/honeylabs/events-AS51396.ndjson create mode 100644 kevlar/2026-08-10/honeylabs/fingerprints.csv create mode 100644 kevlar/2026-08-10/honeylabs/top-attackers.csv (limited to 'kevlar/2026-08-10/honeylabs') diff --git a/kevlar/2026-08-10/honeylabs/events-AS14956.ndjson b/kevlar/2026-08-10/honeylabs/events-AS14956.ndjson new file mode 100644 index 0000000..c2dda1e --- /dev/null +++ b/kevlar/2026-08-10/honeylabs/events-AS14956.ndjson @@ -0,0 +1,2 @@ +{"timestamp":"2026-08-07T22:59:07","source_ip":"144.172.100.63","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":1723,"application_protocol":"pptp","event_summary":"PPTP cananian"} +{"timestamp":"2026-08-07T21:52:07","source_ip":"216.126.239.150","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":3389,"application_protocol":"rdp","event_summary":"RDP"} diff --git a/kevlar/2026-08-10/honeylabs/events-AS51396.ndjson b/kevlar/2026-08-10/honeylabs/events-AS51396.ndjson new file mode 100644 index 0000000..bc5b3ad --- /dev/null +++ b/kevlar/2026-08-10/honeylabs/events-AS51396.ndjson @@ -0,0 +1,15 @@ +{"timestamp":"2026-08-09T23:53:23","source_ip":"176.65.149.212","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":7396,"application_protocol":"ssh","event_summary":"SSH-2.0-OpenSSH"} +{"timestamp":"2026-08-09T23:45:57","source_ip":"176.65.149.55","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":25435,"application_protocol":"ssh","event_summary":"SSH-2.0-OpenSSH"} +{"timestamp":"2026-08-09T23:30:10","source_ip":"176.65.134.3","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":11089,"application_protocol":"http_connect","event_summary":"CONNECT 185.65.245.10:7227 python-socks/2.3.0"} +{"timestamp":"2026-08-09T23:23:07","source_ip":"45.135.193.193","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8888,"application_protocol":"http_connect","event_summary":"CONNECT httpbin.org:443"} +{"timestamp":"2026-08-09T22:30:29","source_ip":"45.135.194.113","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8019,"application_protocol":"http_proxy","user_agent":"Go-http-client/1.1","url_path":"http://proxy.flarevpn.digital:8080/judge","http_request_ja4h":"ge11nn0400_9c3956fad5da"} +{"timestamp":"2026-08-09T22:30:28","source_ip":"45.135.194.113","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8019,"application_protocol":"socks5","event_summary":"SOCKS5"} +{"timestamp":"2026-08-09T22:29:56","source_ip":"45.135.194.99","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3128,"application_protocol":"google","event_summary":"CONNECT google.com:443 Go-http-client/1.1"} +{"timestamp":"2026-08-09T22:17:56","source_ip":"176.65.148.2","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":999,"application_protocol":"http_connect","event_summary":"CONNECT 185.65.245.10:7227 python-socks/2.3.0"} +{"timestamp":"2026-08-09T21:56:25","source_ip":"176.65.149.236","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":82,"application_protocol":"http","user_agent":"Mozilla/5.0 zgrab/0.x","http_request_ja4h":"ge11nn0400_88d30a62b7ad"} +{"timestamp":"2026-08-09T20:01:21","source_ip":"176.65.148.142","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3001,"application_protocol":"http_proxy","url_path":"http://169.254.169.254/latest/user-data","http_request_ja4h":"ge11nn0500_795d05eb4583"} +{"timestamp":"2026-08-09T20:00:54","source_ip":"176.65.148.142","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3001,"application_protocol":"http_proxy","url_path":"http://169.254.169.254/latest/user-data","http_request_ja4h":"ge11nn0200_f24fcf356134"} +{"timestamp":"2026-08-09T19:47:08","source_ip":"45.135.194.31","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3001,"application_protocol":"http","user_agent":"Mozilla/5.0 zgrab/0.x","url_path":"/src/universalTouchGamepad.js","http_request_ja4h":"ge11nn0400_88d30a62b7ad"} +{"timestamp":"2026-08-09T20:42:47","source_ip":"176.65.148.153","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":3389,"application_protocol":"rdp","event_summary":"RDP mstshash=Test"} +{"timestamp":"2026-08-09T18:26:01","source_ip":"176.65.148.58","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8069,"application_protocol":"http","user_agent":"odin-scanner/0.4","http_request_ja4h":"ge10nn0400_17292dadbc7b"} +{"timestamp":"2026-08-09T17:30:45","source_ip":"176.65.149.182","asn_number":51396,"asn_org":"Pfcloud UG","dest_port":8880,"application_protocol":"http_connect","event_summary":"CONNECT ipv4-internet.yandex.net:443"} diff --git a/kevlar/2026-08-10/honeylabs/fingerprints.csv b/kevlar/2026-08-10/honeylabs/fingerprints.csv new file mode 100644 index 0000000..3755281 --- /dev/null +++ b/kevlar/2026-08-10/honeylabs/fingerprints.csv @@ -0,0 +1,8 @@ +fingerprint,type,asn,ips,notes +t13i1310h1_f57a46bbacb6_e7c285222651,ja4,AS51852,1,Firefox/140 TLS1.3 +ge11nn0400_9c3956fad5da,ja4h,AS51852,1,Go-http-client +ge11nn0400_88d30a62b7ad,ja4h,AS51396,2,zgrab/0.x +ge10nn0400_17292dadbc7b,ja4h,AS51396,1,odin-scanner/0.4 +ge11nn0500_795d05eb4583,ja4h,AS51396,1,websocket cloud metadata probe +ge11nn0200_f24fcf356134,ja4h,AS51396,1,cloud metadata probe +ge11nn0300_341eb0d8946c,ja4h,AS51852,1,Mozilla/5.0 .env probe diff --git a/kevlar/2026-08-10/honeylabs/top-attackers.csv b/kevlar/2026-08-10/honeylabs/top-attackers.csv new file mode 100644 index 0000000..8ef4389 --- /dev/null +++ b/kevlar/2026-08-10/honeylabs/top-attackers.csv @@ -0,0 +1,17 @@ +asn,ip,events,top_ports,country +AS51396,204.76.203.221,1316,"11908,1090,7892,9991,11439",NL +AS51396,204.76.203.214,1285,"808,20502,3128,4004,2083",NL +AS51396,204.76.203.213,1273,"1256,2016,8800,5021,2222",NL +AS51396,204.76.203.212,1268,"2080,9055,1256,2016,6666",NL +AS51396,204.76.203.222,1252,"2111,16666,8585,9099,5588",NL +AS51396,204.76.203.79,871,"40012,15564,31280,17895,45198",NL +AS51396,204.76.203.78,863,"64531,11111,20021,28888,15300",NL +AS51396,204.76.203.80,837,"60001,17891,20101,60400,17893",NL +AS51396,45.135.193.193,423,"443,8080,8000,81,3128",DE +AS51396,45.135.194.113,324,"8099,8097,8086,8083,8084",DE +AS14956,144.172.104.239,57,"1723,25565,8291,3389",US +AS14956,144.172.100.63,53,"1723,25565,8291,3389",US +AS14956,172.86.119.157,52,"1723,25565,8291,3389",US +AS51852,179.43.150.26,64,"8899,8089,443,3001,8001",CH +AS51852,81.17.28.131,63,"8899,8089,443,3001,8001",CH +AS198953,176.120.22.61,221,"3390,3341,6433,443,8080",RU -- cgit v1.2.3