From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/changes/anomalies.csv | 51 ++++++++++++++++++++++++ kevlar/2026-08-31/changes/diff-vs-prior-week.csv | 26 ++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 kevlar/2026-08-31/changes/anomalies.csv create mode 100644 kevlar/2026-08-31/changes/diff-vs-prior-week.csv (limited to 'kevlar/2026-08-31/changes') diff --git a/kevlar/2026-08-31/changes/anomalies.csv b/kevlar/2026-08-31/changes/anomalies.csv new file mode 100644 index 0000000..e42e1f8 --- /dev/null +++ b/kevlar/2026-08-31/changes/anomalies.csv @@ -0,0 +1,51 @@ +asn,type,severity,detail +AS57043,volume,high,top-20 IP session volume +99400% vs prior week (2 -> 1990) +AS57043,churn,medium,20 new source IPs in top-20 vs prior week +AS209847,volume,high,top-20 IP session volume +23650% vs prior week (12 -> 2850) +AS209847,churn,medium,19 new source IPs in top-20 vs prior week +AS210644,volume,high,top-20 IP session volume +1187100% vs prior week (7 -> 83104) +AS210644,churn,medium,20 new source IPs in top-20 vs prior week +AS138915,volume,high,top-20 IP session volume +2118% vs prior week (62216 -> 1380255) +AS14956,volume,high,top-20 IP session volume +5516% vs prior week (154 -> 8649) +AS14956,churn,medium,19 new source IPs in top-20 vs prior week +AS51852,volume,high,top-20 IP session volume +1583% vs prior week (5301 -> 89208) +AS51852,churn,medium,13 new source IPs in top-20 vs prior week +AS400992,volume,high,top-20 IP session volume +1269% vs prior week (217 -> 2970) +AS400992,churn,medium,18 new source IPs in top-20 vs prior week +AS33993,volume,high,top-20 IP session volume +4700% vs prior week (1 -> 48) +AS51396,volume,high,top-20 IP session volume +1684% vs prior week (48952 -> 873217) +AS51396,churn,medium,11 new source IPs in top-20 vs prior week +AS216246,volume,high,top-20 IP session volume +6677500% vs prior week (1 -> 66776) +AS216246,churn,medium,20 new source IPs in top-20 vs prior week +AS200651,volume,high,top-20 IP session volume +1849% vs prior week (167 -> 3255) +AS200651,churn,medium,17 new source IPs in top-20 vs prior week +AS30823,volume,high,top-20 IP session volume +241% vs prior week (274 -> 935) +AS30823,churn,medium,17 new source IPs in top-20 vs prior week +AS214351,volume,medium,top-20 IP session volume +100% vs prior week (9 -> 18) +AS198953,volume,high,top-20 IP session volume +18247% vs prior week (677 -> 124209) +AS198953,churn,medium,16 new source IPs in top-20 vs prior week +AS200593,volume,high,top-20 IP session volume +14695% vs prior week (20 -> 2959) +AS200593,churn,medium,16 new source IPs in top-20 vs prior week +AS214940,volume,high,top-20 IP session volume +3831% vs prior week (219 -> 8609) +AS214940,churn,medium,17 new source IPs in top-20 vs prior week +AS211720,volume,high,top-20 IP session volume +1200% vs prior week (23 -> 299) +AS138915,fingerprint,low,new JA4 fingerprint not in prior week: t13i220900_231e334592e8_29829a46703f +AS138915,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0400_52fce913cf3b +AS14956,fingerprint,low,new HASSH fingerprint not in prior week: bf7dbf67fa9b26ee9f9deb99c49320ba +AS14956,fingerprint,low,new JA4 fingerprint not in prior week: t13i100900_61a7ad8aa9b6_88aa062a14c8 +AS14956,fingerprint,low,new JA4 fingerprint not in prior week: t13i311000_e8f1e7e78f70_d41ae481755e +AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0300_7fd797acd99d +AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_9c3956fad5da +AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0500_39072d476f20 +AS198953,fingerprint,low,new JA4 fingerprint not in prior week: t13i1010h1_61a7ad8aa9b6_3a8073edd8ef +AS198953,fingerprint,low,new JA4 fingerprint not in prior week: t13i1010h1_61a7ad8aa9b6_792d2c6655cb +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11cn06ru_b2fb244bb31f +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_8b1ed2202073 +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn05en_3bd45b6f184e +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0500_63d29dec8e1d +AS198953,fingerprint,low,new JA4H fingerprint not in prior week: po11nn18en_9a6afedbb443 +AS200651,fingerprint,low,new HASSH fingerprint not in prior week: e54ef3ec27fe1fea7ab64d3fa05359fd +AS200651,fingerprint,low,new JA4 fingerprint not in prior week: t13i1909h2_9dc949149365_97f8aa674fd9 +AS200651,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_88d30a62b7ad +AS200651,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0500_e4a47a99f1ac +AS200651,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0600_c9506d37ac14 diff --git a/kevlar/2026-08-31/changes/diff-vs-prior-week.csv b/kevlar/2026-08-31/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..385b416 --- /dev/null +++ b/kevlar/2026-08-31/changes/diff-vs-prior-week.csv @@ -0,0 +1,26 @@ +asn,cur_top20_sessions,prior_top20_sessions,delta_pct,new_ips,gone_ips,new_ports,gone_ports +AS57043,1990,2,99400%,20,2,23;22;2222;80;8081;2000;8000;22222;8080;502;1741;3306;2762;7001;6002;4242;548;2150;19,6882 +AS209847,2850,12,23650%,19,0,0;22;443;2222;2096;8080;8443;2053;54321;80;2083;8022;2087;8880;9000;10000;5000;3000;8000, +AS210644,83104,7,1187100%,20,4,22;8022;2222;22222;80;82;88;1723;25565;50000;1883;53;20002;2376;21;444;110;111;85;143,8890;443;6882;2096 +AS138915,1380255,62216,2118%,7,7,23;34569;49960;4242;54378;46030;28591;35372,22;4466;32108;36748;53;10101;64373;39192 +AS14956,8649,154,5516%,19,19,22222;23;8022;21;13;19;5901;2222;81;26;53;111;82;37,3389;5069;5072;5073;8090;5071;0;5076;5068;5070;5067;5075;1080;5074 +AS216139,150,0,n/a,7,0,22222;2222;22;19898, +AS51852,89208,5301,1583%,13,13,23;5432;135;8080;8443;3306;3000;27017;5061;5433;8291;8000,139;1723;9090;1701;4000;82;9001;0;9091;4001;591;3001 +AS400992,2970,217,1269%,18,0,8080;22;2222;22222;1080;3128;4022;39222;7235;25565;389;3389;23;222;81;83;2525;82, +AS33993,48,1,4700%,5,0,22;80;443;0;7860;6379, +AS51396,873217,48952,1684%,11,11,5900;23;81;5555;8081;82;88;83;4000,1081;3128;8000;443;5678;9993;1088;9050;9051 +AS213702,2341,0,n/a,8,0,443;22;6060;8546;8551;9000;8900;8501;80;8332;8899;8443;3030;1317;8888;2375;8080;3000;8545;8000, +AS216246,66776,1,6677500%,20,1,8888;8080;80;5000;81;2082;82;3000;1194;110;111;554;1024;21;993;888;53;444;85;143,443 +AS200651,3255,167,1849%,17,1,80;23;22;1080;18190;19009;2222;3128;9006;20001;18264;8888;20201;5555,0 +AS30823,935,274,241%,17,0,443;5060;22;445;27017;23;3306;1434;1521;2222;21;5432;6000;1433;1194;53;1883;2022, +AS140666,7,0,n/a,4,0,0, +AS214351,18,9,100%,2,0,42021, +AS198953,124209,677,18247%,16,1,5405;22222;4433;6001;10443;5678;1434;3389;5000;1800;4443;8888,0;5006;3305;1443;3306;4000;2019;3308;1501;3310;1688;3307 +AS200593,2959,20,14695%,16,0,9443;4433;8443;4443;444;3389;5443;10443;6443;9000;4444;20443;7443;8888;40443;30443;3390,1433 +AS214940,8609,219,3831%,17,4,465;8022;2222;22222;26;8080;8888;3128;48388;1433;110;3306;3000;22;143, +AS206728,0,0,n/a,0,0,, +AS211720,299,23,1200%,5,0,5405;5900;3389;8013;0;445;30443;1434;21;40443;1433;50443,10443 +AS216309,0,0,n/a,0,0,, +AS58854,5,0,n/a,1,0,3389, +AS202685,0,0,n/a,0,0,, +AS394711,0,0,n/a,0,0,, -- cgit v1.2.3