From 237f2d9330398e0a0628980056db6b09098d5f2f Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 17 Aug 2026 07:45:20 -0400 Subject: feat: update bph iocs --- kevlar/2026-08-17/censys/ip-enrichments.ndjson | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 kevlar/2026-08-17/censys/ip-enrichments.ndjson (limited to 'kevlar/2026-08-17/censys/ip-enrichments.ndjson') diff --git a/kevlar/2026-08-17/censys/ip-enrichments.ndjson b/kevlar/2026-08-17/censys/ip-enrichments.ndjson new file mode 100644 index 0000000..775e889 --- /dev/null +++ b/kevlar/2026-08-17/censys/ip-enrichments.ndjson @@ -0,0 +1,6 @@ +{"ip":"204.76.203.224","asn":51396,"org":"Pfcloud UG","labels":["BULLETPROOF"],"services":[{"port":9009,"protocol":"HTTP","product":"clickhouse","note":"ClickHouse web UI exposed"},{"port":9191,"protocol":"HTTP","product":"proxy","note":"407 Proxy Auth Required; 'plan expired' - commercial proxy"},{"port":25565,"protocol":"MINECRAFT","product":"Paper 26.1.2","note":"Minecraft server MOTD Z"}],"banner_hash_clickhouse":"e5ca3ebf722088f908c9581a361d8140a30c3e21b55d69f2a68d01a8469be4f4","banner_hash_proxy":"16f5ca474300f3af2568e6cc8afb227e0c77a2de0a68aeb82ebab13dc83e4591","whois":"Intelligence Hosting LLC, Eygelshoven NL"} +{"ip":"204.76.203.226","asn":51396,"org":"Pfcloud UG","labels":["BULLETPROOF"],"services":[{"port":9009,"protocol":"HTTP","product":"clickhouse","note":"ClickHouse web UI exposed"},{"port":9191,"protocol":"HTTP","product":"proxy","note":"407 Proxy Auth Required"},{"port":25565,"protocol":"MINECRAFT","product":"Paper 26.1.2","note":"Minecraft server MOTD Z"}],"banner_hash_clickhouse":"e5ca3ebf722088f908c9581a361d8140a30c3e21b55d69f2a68d01a8469be4f4","banner_hash_proxy":"16f5ca474300f3af2568e6cc8afb227e0c77a2de0a68aeb82ebab13dc83e4591","whois":"Intelligence Hosting LLC, Eygelshoven NL","clone_of":"204.76.203.224 (identical ClickHouse+proxy banner hashes)"} +{"ip":"176.120.22.61","asn":198953,"org":"Proton66 OOO","labels":["BULLETPROOF"],"os":"windows (Server 2012 R2, RU)","services":[{"port":135,"protocol":"DCERPC","exposure":"REMOTE_ACCESS","note":"Exposed DCERPC CENSYS-2022-1025"},{"port":137,"protocol":"NETBIOS","note":"Exposed NetBIOS CENSYS-2022-1048"},{"port":3389,"protocol":"RDP","cert":"CN=M051108 self-signed","note":"RDP login screen RU; weak TLS cipher"},{"port":5985,"protocol":"HTTP","product":"Microsoft-HTTPAPI/2.0","note":"WinRM"},{"port":47001,"protocol":"HTTP","product":"Microsoft-HTTPAPI/2.0","note":"WinRM"}],"whois":"Proton66 OOO, St. Petersburg RU"} +{"ip":"77.83.39.6","asn":51396,"org":"PFCLOUD","labels":["BULLETPROOF"],"os":"linux (Ubuntu, OpenSSH 8.9p1)","services":[{"port":22,"protocol":"SSH","hassh":"41ff3ecd1458b0bf86e1b4891636213e","note":"SAME HASSH as 2026-08-10 PFCLOUD clone pair 204.76.203.221/214"}],"greynoise":"malicious; ENV Crawler, GoogleBot Pretender, TLS/SSL Crawler","whois":"Lanedonet Datacenter NL; bgp 77.83.39.0/24 PFCLOUD","note":"honeylabs event attribution AS214940 KPRONET conflicts with Censys AS51396 PFCLOUD"} +{"ip":"185.100.87.136","asn":200651,"org":"FlokiNET ehf","labels":["BULLETPROOF","PROXY_SERVER"],"privacy":["tor:true"],"services":[{"port":80,"protocol":"HTTP","product":"tor","note":"Tor exit notice page; X-Your-Address-Is"},{"port":9001,"protocol":"UNKNOWN","tls":true,"note":"Tor OR port; cert www.ic65jfkrs.net issued by www.jqfbaj7qyl35.com (random domain pair, 14-day validity)"},{"port":7288,"protocol":"SSH","product":"OpenSSH 9.9"}],"tor":{"nickname":"PremiumTorExit","fingerprint":"9366185B4ECB1CC3634F475D20FDDFE7A302BAF2","flags":["Exit","Running","Stable","Valid"],"platform":"Tor 0.4.9.11 on Linux","or_address":"185.100.87.136:9001"},"whois":"FlokiNET ehf, Reykjavik IS / Bucharest RO"} +{"ip":"179.43.150.26","asn":51852,"org":"Private Layer INC","labels":["BULLETPROOF"],"os":"linux (Debian, OpenSSH 8.4p1)","services":[{"port":22,"protocol":"SSH","hostkey_sha256":"168ce880df9a408b4f257de4e0a1e623fe8ff09f0c5d681020230209cecf4fcf"}],"whois":"PRIVATE LAYER INC, MIG23 netblock"} -- cgit v1.2.3