From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/changes/anomalies.csv | 51 +++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 kevlar/2026-08-31/changes/anomalies.csv (limited to 'kevlar/2026-08-31/changes/anomalies.csv') diff --git a/kevlar/2026-08-31/changes/anomalies.csv b/kevlar/2026-08-31/changes/anomalies.csv new file mode 100644 index 0000000..e42e1f8 --- /dev/null +++ b/kevlar/2026-08-31/changes/anomalies.csv @@ -0,0 +1,51 @@ +asn,type,severity,detail +AS57043,volume,high,top-20 IP session volume +99400% vs prior week (2 -> 1990) +AS57043,churn,medium,20 new source IPs in top-20 vs prior week +AS209847,volume,high,top-20 IP session volume +23650% vs prior week (12 -> 2850) +AS209847,churn,medium,19 new source IPs in top-20 vs prior week +AS210644,volume,high,top-20 IP session volume +1187100% vs prior week (7 -> 83104) +AS210644,churn,medium,20 new source IPs in top-20 vs prior week +AS138915,volume,high,top-20 IP session volume +2118% vs prior week (62216 -> 1380255) +AS14956,volume,high,top-20 IP session volume +5516% vs prior week (154 -> 8649) +AS14956,churn,medium,19 new source IPs in top-20 vs prior week +AS51852,volume,high,top-20 IP session volume +1583% vs prior week (5301 -> 89208) +AS51852,churn,medium,13 new source IPs in top-20 vs prior week +AS400992,volume,high,top-20 IP session volume +1269% vs prior week (217 -> 2970) +AS400992,churn,medium,18 new source IPs in top-20 vs prior week +AS33993,volume,high,top-20 IP session volume +4700% vs prior week (1 -> 48) +AS51396,volume,high,top-20 IP session volume +1684% vs prior week (48952 -> 873217) +AS51396,churn,medium,11 new source IPs in top-20 vs prior week +AS216246,volume,high,top-20 IP session volume +6677500% vs prior week (1 -> 66776) +AS216246,churn,medium,20 new source IPs in top-20 vs prior week +AS200651,volume,high,top-20 IP session volume +1849% vs prior week (167 -> 3255) +AS200651,churn,medium,17 new source IPs in top-20 vs prior week +AS30823,volume,high,top-20 IP session volume +241% vs prior week (274 -> 935) +AS30823,churn,medium,17 new source IPs in top-20 vs prior week +AS214351,volume,medium,top-20 IP session volume +100% vs prior week (9 -> 18) +AS198953,volume,high,top-20 IP session volume +18247% vs prior week (677 -> 124209) +AS198953,churn,medium,16 new source IPs in top-20 vs prior week +AS200593,volume,high,top-20 IP session volume +14695% vs prior week (20 -> 2959) +AS200593,churn,medium,16 new source IPs in top-20 vs prior week +AS214940,volume,high,top-20 IP session volume +3831% vs prior week (219 -> 8609) +AS214940,churn,medium,17 new source IPs in top-20 vs prior week +AS211720,volume,high,top-20 IP session volume +1200% vs prior week (23 -> 299) +AS138915,fingerprint,low,new JA4 fingerprint not in prior week: t13i220900_231e334592e8_29829a46703f +AS138915,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0400_52fce913cf3b +AS14956,fingerprint,low,new HASSH fingerprint not in prior week: bf7dbf67fa9b26ee9f9deb99c49320ba +AS14956,fingerprint,low,new JA4 fingerprint not in prior week: t13i100900_61a7ad8aa9b6_88aa062a14c8 +AS14956,fingerprint,low,new JA4 fingerprint not in prior week: t13i311000_e8f1e7e78f70_d41ae481755e +AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0300_7fd797acd99d +AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_9c3956fad5da +AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0500_39072d476f20 +AS198953,fingerprint,low,new JA4 fingerprint not in prior week: t13i1010h1_61a7ad8aa9b6_3a8073edd8ef +AS198953,fingerprint,low,new JA4 fingerprint not in prior week: t13i1010h1_61a7ad8aa9b6_792d2c6655cb +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11cn06ru_b2fb244bb31f +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_8b1ed2202073 +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn05en_3bd45b6f184e +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0500_63d29dec8e1d +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: po11nn18en_9a6afedbb443 +AS200651,fingerprint,low,new HASSH fingerprint not in prior week: e54ef3ec27fe1fea7ab64d3fa05359fd +AS200651,fingerprint,low,new JA4 fingerprint not in prior week: t13i1909h2_9dc949149365_97f8aa674fd9 +AS200651,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_88d30a62b7ad +AS200651,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0500_e4a47a99f1ac +AS200651,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0600_c9506d37ac14 -- cgit v1.2.3