From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/censys/fleet-correlation.csv | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 kevlar/2026-08-31/censys/fleet-correlation.csv (limited to 'kevlar/2026-08-31/censys/fleet-correlation.csv') diff --git a/kevlar/2026-08-31/censys/fleet-correlation.csv b/kevlar/2026-08-31/censys/fleet-correlation.csv new file mode 100644 index 0000000..eafafd9 --- /dev/null +++ b/kevlar/2026-08-31/censys/fleet-correlation.csv @@ -0,0 +1,11 @@ +ip,asn,as_description,cc,service_count,ports,software,greynoise_class,greynoise_tags +176.120.22.61,AS198953,proton66 - Proton66 OOO,RU,6,135;137;139;3389;5985;47001,http_api,malicious,"Looks Like Windows 7 server,MSSQL TDS PRELOGIN Scanner,MySQL Protocol,RDP Crawler,RDP Protocol,SSH Alternative Port Crawler,SSH Bruteforcer,SSH Connection Attempt,Web Crawler" +204.76.203.7,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,2,22;9001,nginx,malicious,"Carries HTTP Referer,CrushFTP Scanner,F5 BIG-IP Crawler,FTP Protocol,Generic IoT Default Password Attempt,Generic Open Redirect,Generic XSS Commands in Request,Go HTTP Client,ICMPv4 Protocol,Ivanti Co" +204.76.203.14,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,0,,,malicious,"AWS Configuration Scanner,Carries HTTP Referer,CrushFTP Scanner,ENV Crawler,F5 BIG-IP Crawler,Generic /proc Enumeration Attempt,Generic Login Attempt,Generic PHPInfo Access Attempt,Generic Path Traver" +45.135.193.193,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,malicious,"Generic Path Traversal Attempt,Generic Sensitive File Access Attempt,Generic XSS Commands in Request,ICMPv4 Protocol,Looks Like Debian server,Open Proxy Scanner,Ping Scanner,TLS/SSL Crawler,Web Crawle" +204.76.203.49,AS51396,,,0,,,, +45.135.194.113,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,malicious,"Carries HTTP Referer,Go HTTP Client,ICMPv4 Protocol,Looks Like Debian server,Open Proxy Scanner,Ping Scanner,SOCKS5 Proxy Scanner,Web Crawler" +45.135.193.198,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,suspicious,"Generic XSS Commands in Request,ICMPv4 Protocol,Looks Like Debian server,Ping Scanner,TLS/SSL Crawler,Web Crawler" +204.76.203.4,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,unknown, +176.120.22.43,AS198953,proton66 - Proton66 OOO,RU,1,3389,,malicious,"Cisco ASA Scanner,Cisco SSL VPN Bruteforcer,ConnectWise ScreenConnect Auth Bypass Check,CrushFTP Scanner,F5 BIG-IP Crawler,Generic Login Attempt,Generic Path Traversal Attempt,Looks Like Windows 10 la" +176.65.148.226,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,2,22;80,,malicious,"Carries HTTP Referer,ConnectWise ScreenConnect Auth Bypass Check,CrushFTP Scanner,DNS Protocol,F5 BIG-IP Crawler,Generic Sensitive File Access Attempt,Generic XSS Commands in Request,ICMPv4 Protocol,I" -- cgit v1.2.3