From b6f4f2af55e81a459cb126da5ef972b9305cf67d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 24 Aug 2026 00:26:19 -0400 Subject: add: bph report iocs and daily drop helper --- kevlar/2026-08-23/changes/anomalies.csv | 15 ++++++++++++++ kevlar/2026-08-23/changes/diff-vs-prior-week.csv | 26 ++++++++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 kevlar/2026-08-23/changes/anomalies.csv create mode 100644 kevlar/2026-08-23/changes/diff-vs-prior-week.csv (limited to 'kevlar/2026-08-23/changes') diff --git a/kevlar/2026-08-23/changes/anomalies.csv b/kevlar/2026-08-23/changes/anomalies.csv new file mode 100644 index 0000000..88c4f26 --- /dev/null +++ b/kevlar/2026-08-23/changes/anomalies.csv @@ -0,0 +1,15 @@ +asn,provider,type,detail,severity +AS57043,HOSTKEY-AS,volume_collapse,-93% (28->2),medium +AS210644,AEZA-AS,volume_collapse,-91% (75->7),medium +AS138915,KAOPU-HK,new_target_ports,32108 36748 39192 4466 64373,low +AS14956,ROUTERHOSTING,new_target_ports,0 1080 5069 5070 5071 5072 5073 5074 5075 5076,low +AS51852,PLI-AS,volume_spike,+341% (1201->5302),high +AS51852,PLI-AS,new_target_ports,139 1701 1723 3001 4000 4001 5001 591 82 9000 9001 9090 9091,low +AS51396,PFCLOUD,new_target_ports,1088 5678 8545 9050 9051,low +AS200651,FLOKINET,volume_spike,+351% (37->167),high +AS200651,FLOKINET,new_target_ports,53 6882 8443,low +AS30823,AUROLOGIC,volume_spike,+5380% (5->274),high +AS30823,AUROLOGIC,new_target_ports,3389 80,low +AS198953,PROTON66,new_target_ports,0 1443 1501 1688 2019 22 2222 3305 3306 3307 3308 3310 4000 443 5006,low +AS200593,PROSPERO-AS,volume_spike,+900% (2->20),high +AS214940,KPRONET,volume_spike,+146% (89->219),high diff --git a/kevlar/2026-08-23/changes/diff-vs-prior-week.csv b/kevlar/2026-08-23/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..b0d241b --- /dev/null +++ b/kevlar/2026-08-23/changes/diff-vs-prior-week.csv @@ -0,0 +1,26 @@ +asn,provider,ips_cur,ips_prior,new_ips,gone_ips,new_ports,gone_ports,sessions_cur,sessions_prior,delta +AS57043,HOSTKEY-AS,2,5,1,4,6882,2000 2222 25 4000 44443 53 55443 69 7443 80 8000 8080 8081 8082 9735,2,28,-93% +AS209847,THE,1,1,0,0,,,12,60,-80% +AS210644,AEZA-AS,4,8,4,8,2096 6882 8890,1434 1443 2053 2223 2224 3016 3022 4000 4001 4433 444 4443 4444 4760 5000 5550 8080 885 95,7,75,-91% +AS138915,KAOPU-HK,20,20,5,5,32108 36748 39192 4466 64373,10547 23456 28591 54102 8001,62464,63176,-1% +AS14956,ROUTERHOSTING,20,20,12,12,0 1080 5069 5070 5071 5072 5073 5074 5075 5076,25565 5061 5062 5063 5064 5066 5080 8291 8545 8546,164,313,-48% +AS216139,IRONHOST,0,0,0,0,,,0,0,0 both weeks +AS51852,PLI-AS,20,11,11,2,139 1701 1723 3001 4000 4001 5001 591 82 9000 9001 9090 9091,1000 1009 1117 1118 1119 1234 135 2000 27610 6060 8080 8088 8899,5302,1201,+341% +AS400992,ZHOUYISAT,2,3,0,1,,,217,152,+43% +AS33993,UFO-AS,1,0,1,0,51820,,1,0,new +AS51396,PFCLOUD,20,20,6,6,1088 5678 8545 9050 9051,4145 53 8081 8443 8888,63088,73949,-15% +AS213702,QWINS-LTD,0,0,0,0,,,0,0,0 both weeks +AS216246,RU-AEZA-AS,1,0,1,0,443,,1,0,new +AS200651,FLOKINET,4,3,2,1,53 6882 8443,8161,167,37,+351% +AS30823,AUROLOGIC,2,1,2,1,3389 80,5060,274,5,+5380% +AS140666,ADPL-AS,0,0,0,0,,,0,0,0 both weeks +AS214351,FEMOIT,3,0,3,0,11434 1723,,9,0,new +AS198953,PROTON66,5,4,2,1,0 1443 1501 1688 2019 22 2222 3305 3306 3307 3308 3310 4000 443 5006,12345 1434 1500 1800 2008 4433 5000 5678 6001 7788 8001 8888 8899 8989 9001,677,1164,-42% +AS200593,PROSPERO-AS,4,1,3,0,1433 22 80,,20,2,+900% +AS214940,KPRONET,7,5,4,2,,465,219,89,+146% +AS206728,MEDIALAND,0,0,0,0,,,0,0,0 both weeks +AS211720,DATASHIELD,1,0,1,0,10443 443 4430 4433 444 4443 7443 8443 9443,,23,0,new +AS216309,INVISIONTECH,0,0,0,0,,,0,0,0 both weeks +AS58854,KAOPY,0,0,0,0,,,0,0,0 both weeks +AS202685,TR-ARKEL,0,0,0,0,,,0,0,0 both weeks +AS394711,KORGRID,0,0,0,0,,,0,0,0 both weeks -- cgit v1.2.3