From b6f4f2af55e81a459cb126da5ef972b9305cf67d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 24 Aug 2026 00:26:19 -0400 Subject: add: bph report iocs and daily drop helper --- kevlar/2026-08-23/censys/fleet-correlation.csv | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 kevlar/2026-08-23/censys/fleet-correlation.csv (limited to 'kevlar/2026-08-23/censys/fleet-correlation.csv') diff --git a/kevlar/2026-08-23/censys/fleet-correlation.csv b/kevlar/2026-08-23/censys/fleet-correlation.csv new file mode 100644 index 0000000..58a3ab3 --- /dev/null +++ b/kevlar/2026-08-23/censys/fleet-correlation.csv @@ -0,0 +1,9 @@ +linkage_type,ips,indicator,asn,notes +shared_hassh,81.17.28.131 + 204.76.203.221/214 (prior weeks),hassh 41ff3ecd1458b0bf86e1b4891636213e,AS51852<->AS51396,Cross-AS shared SSH server config persists week 3; ties PLI-AS scanner to PFCLOUD clone fleet +clone_service_profile,204.76.203.225/.224/.226,ClickHouse 9000/8123 + proxy 9191 + Minecraft 25565,AS51396,Identical service stack across proxy-fleet nodes; .225 idle since 08-20 but infrastructure unchanged +xray_panel_certs,YE1/YE2/YR1/YR2 across AS51396(116/95/50/51) AS57043 AS14956(1835/2044/966/999) AS51852(428/482/925/1442) AS200651(651/583/594/648) AS30823(185/178/92/85) AS210644(13009/13227/3337/5096),"X-UI/Xray panel cert series; AEZA alone carries 26k+ YE-series certs",multi,Cross-ASN Xray/panel fleet persists at scale; strongest signal in AEZA and RouterHosting +cloned_windows_certs,windows-Dallas0(1037) windows-Utah-4g/4H/2g(~1180) windows-Amsterd(417) windows-DE-Fran/Frankfu(117) 172.86.93(55),Windows self-signed cert series reused across many hosts,AS14956 + AS30823,Cloned Windows images in RouterHosting and aurologic ranges; 172.86.93.x cert = RouterHosting subnet cert on aurologic ASN +compromised_corporate_dc,erp01.ad.reiscrew.de (45.11.18.33),AD domain reiscrew.de; LDAP rootDSE + SMB 3.0.2 + RDP RDSTLS,AS30823,German company AD/ERP server on bulletproof ASN doubles as RDP masscan node +beacon_infrastructure,185.100.87.136,Tor exit; POST /api/checkin + transparentpix.gif; ja4 t13i1909h2_9dc949149365_97f8aa674fd9,AS200651,Endpoint rotated from /api/client/update (SPARK COMMIT) to /api/checkin; same host second week +proxy_validation_network,204.76.203.7 + 45.135.194.113 + 45.135.193.193,azenv.net + proxy.flarevpn.digital:8080/judge + httpbin.org CONNECT + socks5 \u0005\u0001\u0000,AS51396,Go-http-client/1.1 fleet validating open proxies; GreyNoise tags Ivanti/Pulse/F5/CrushFTP scanners +port_sprawl_farm,38.54.2.209 + 38.54.2.13/.61/.75/.152/.221/.232,HTTP listeners on ~100 random ports each,AS138915,940k+ Sponge sessions; each /32 answers HTTP on arbitrary ports -- masscan-response farm or proxy pool -- cgit v1.2.3