From b6f4f2af55e81a459cb126da5ef972b9305cf67d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 24 Aug 2026 00:26:19 -0400 Subject: add: bph report iocs and daily drop helper --- kevlar/2026-08-23/iocs/README.md | 30 ++++++ kevlar/2026-08-23/iocs/all-observed-ips.txt | 151 ++++++++++++++++++++++++++++ kevlar/2026-08-23/iocs/c2-paths.txt | 39 +++++++ kevlar/2026-08-23/iocs/fingerprints.txt | 19 ++++ 4 files changed, 239 insertions(+) create mode 100644 kevlar/2026-08-23/iocs/README.md create mode 100644 kevlar/2026-08-23/iocs/all-observed-ips.txt create mode 100644 kevlar/2026-08-23/iocs/c2-paths.txt create mode 100644 kevlar/2026-08-23/iocs/fingerprints.txt (limited to 'kevlar/2026-08-23/iocs') diff --git a/kevlar/2026-08-23/iocs/README.md b/kevlar/2026-08-23/iocs/README.md new file mode 100644 index 0000000..f870413 --- /dev/null +++ b/kevlar/2026-08-23/iocs/README.md @@ -0,0 +1,30 @@ +# Weekly BP Report -- 2026-08-23 + +Generated: 2026-08-24T03:05:00Z +ASNs covered: 25 +Sponge sessions found: 132,852 (17 ASNs active, window 2026-08-17..2026-08-24) +Honeylabs events found: ~14,000 (13 ASNs with events) +Censys IPs enriched: 10 +Anomalies flagged: 14 (see changes/anomalies.csv) + +## Key findings + +1. AUROLOGIC (AS30823): compromised Windows Server 2016 AD domain controller + `erp01.ad.reiscrew.de` (45.11.18.33) now runs RDP sweeps (`mstshash=hello`, 455 events). +2. FLOKINET beacon host 185.100.87.136 rotated endpoint from `/api/client/update` + (SPARK COMMIT) to `POST /api/checkin`; same TLS fingerprint both weeks. +3. PLI-AS +341%: market-maker bot discovery scanner (mmsk-scout/mm-scout), .env prober, + DCE/RPC scanner; shared HASSH with PFCLOUD clone fleet persists (week 3). +4. PFCLOUD proxy-validation fleet confirmed: azenv.net / httpbin.org CONNECT / socks5 / + proxy.flarevpn.digital judges; GreyNoise flags Ivanti/Pulse/F5/CrushFTP scanning. +5. KAOPU-HK 38.54.2.0/24 port-sprawl farm: ~100 HTTP listeners per host. +6. YE-series Xray panel certs span 6 monitored ASNs; AEZA carries 26k+. + +## Sources and errors + +- Sponge (Arkime): online, data 2026-03-12..2026-08-24. Tag aggregation returns 0 rows + for all ASNs (known limitation); IP/port aggregations used instead. +- Honeylabs: no rate-limit errors. +- Censys: 10,000 credits at start of run; ~50 aggregate + 10 host lookups used. +- Blog post: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-08-23-weekly-bulletproof-report.md + (build verified, 0 errors) diff --git a/kevlar/2026-08-23/iocs/all-observed-ips.txt b/kevlar/2026-08-23/iocs/all-observed-ips.txt new file mode 100644 index 0000000..ae5ff36 --- /dev/null +++ b/kevlar/2026-08-23/iocs/all-observed-ips.txt @@ -0,0 +1,151 @@ +# AS14956 - ROUTERHOSTING (RouterHosting LLC) +107.189.17.69 +107.189.20.97 +107.189.21.227 +107.189.26.103 +107.189.27.179 +144.172.100.161 +144.172.100.237 +144.172.107.86 +144.172.112.245 +144.172.117.54 +144.172.117.61 +144.172.84.181 +144.172.94.128 +167.88.165.67 +167.88.168.121 +216.126.224.209 +216.126.227.197 +45.61.129.23 +45.61.133.122 +45.61.151.41 + +# AS30823 - AUROLOGIC (aurologic GmbH) +45.11.18.33 +45.153.243.249 + +# AS33993 - UFO-AS +45.67.230.246 + +# AS51396 - PFCLOUD (Pfcloud UG) +176.65.148.243 +176.65.148.84 +204.76.203.18 +204.76.203.224 +204.76.203.225 +204.76.203.226 +204.76.203.49 +204.76.203.7 +204.76.203.73 +45.135.194.24 +45.153.34.112 +45.153.34.149 +45.153.34.151 +45.153.34.161 +45.153.34.235 +45.153.34.71 +45.156.87.13 +45.156.87.147 +45.156.87.216 +45.156.87.253 + +# AS51852 - PLI-AS +141.255.165.66 +141.255.165.67 +141.255.165.68 +141.255.165.69 +179.43.133.154 +179.43.139.58 +179.43.140.210 +179.43.146.27 +179.43.150.26 +179.43.167.2 +185.12.44.156 +185.12.44.203 +31.7.57.58 +46.19.137.194 +46.19.138.10 +46.19.138.42 +46.19.138.44 +46.19.138.45 +46.19.138.46 +81.17.28.131 + +# AS57043 - HOSTKEY-AS +151.243.3.213 +193.247.77.84 + +# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited) +154.90.37.55 +211.155.100.9 +38.54.2.13 +38.54.2.135 +38.54.2.148 +38.54.2.152 +38.54.2.168 +38.54.2.170 +38.54.2.195 +38.54.2.20 +38.54.2.203 +38.54.2.204 +38.54.2.209 +38.54.2.221 +38.54.2.232 +38.54.2.235 +38.54.2.4 +38.54.2.75 +38.54.2.91 +38.54.37.119 + +# AS198953 - PROTON66 +176.120.22.123 +176.120.22.61 +193.143.1.66 +193.143.1.67 +37.77.150.241 + +# AS200593 - PROSPERO-AS +193.24.123.63 +91.202.233.82 +91.215.85.104 +91.215.85.142 + +# AS200651 - FLOKINET +185.100.87.136 +185.246.190.83 +185.247.225.201 +37.228.129.67 + +# AS209847 - THE +77.91.122.2 + +# AS210644 - AEZA-AS +176.124.204.170 +213.108.20.4 +213.165.44.93 +95.181.173.142 + +# AS211720 - Datashield, Inc. +185.231.33.46 + +# AS214351 - FEMOIT +192.162.199.180 +62.60.226.150 +62.60.226.186 + +# AS214940 - KPRONET +77.83.39.108 +77.83.39.11 +77.83.39.15 +77.83.39.24 +77.83.39.4 +77.83.39.6 +77.83.39.94 + +# AS216246 - RU-AEZA-AS +178.20.208.134 + +# AS400992 - ZHOUYISAT-COMMUNICATIONS +23.172.217.77 +23.172.217.87 + diff --git a/kevlar/2026-08-23/iocs/c2-paths.txt b/kevlar/2026-08-23/iocs/c2-paths.txt new file mode 100644 index 0000000..ca0a189 --- /dev/null +++ b/kevlar/2026-08-23/iocs/c2-paths.txt @@ -0,0 +1,39 @@ +/ -- ASNs: 14956,51396,51852 +/.git/HEAD -- ASNs: 51396 +/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/containers/json -- ASNs: 14956 +/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/index.php?lang=../../../../../../../../tmp/index1 -- ASNs: 14956 +/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php -- ASNs: 14956 +/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello -- ASNs: 14956 +/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/lib/phpunit/Util/PHP/eval-stdin.php -- ASNs: 14956 +/lib/phpunit/phpunit/Util/PHP/eval-stdin.php -- ASNs: 14956 +/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/lib/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/pairs -- ASNs: 51852 +/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello -- ASNs: 14956 +/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/remote/login?lang=en -- ASNs: 198953 +/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/v6/marketmaker/status/1 -- ASNs: 51852 +/version -- ASNs: 51852 +/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- ASNs: 14956 +http://azenv.net/ -- ASNs: 51396 +http://proxy.flarevpn.digital:8080/judge -- ASNs: 51396 diff --git a/kevlar/2026-08-23/iocs/fingerprints.txt b/kevlar/2026-08-23/iocs/fingerprints.txt new file mode 100644 index 0000000..b2cae20 --- /dev/null +++ b/kevlar/2026-08-23/iocs/fingerprints.txt @@ -0,0 +1,19 @@ +# JA4 TLS Fingerprints +t13i1310h1_f57a46bbacb6_e7c285222651 -- ASNs: 14956 +t13i251000_b78ed14e2fd0_ab7e3b40a677 -- ASNs: 51396 +t12i210600_76e208dd3e22_f28add8e7af0 -- ASNs: 198953 + +# JA4H HTTP Fingerprints +ge11nn0400_9c3956fad5da -- ASNs: 14956,51396,51852 +ge11nn0400_aa8589a6a024 -- ASNs: 51852 +ge11nn0300_341eb0d8946c -- ASNs: 51852 +ge11nn0500_184f44d42a83 -- ASNs: 14956 +ge11nn0500_7992432eef13 -- ASNs: 14956 +ge11nn0700_3161ce9d7233 -- ASNs: 14956 +ge11nn0400_88d30a62b7ad -- ASNs: 51396 +ge11nn0500_9af7e0472034 -- ASNs: 51396 +ge11nn0100_4740ae6347b0 -- ASNs: 51396 +ge11nn0200_549fad093d6b -- ASNs: 198953 +ge11nn0300_80168362a4ec -- ASNs: 198953 + +# HASSH SSH Fingerprints -- cgit v1.2.3