From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/honeylabs/top-attackers.csv | 78 +++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 kevlar/2026-08-31/honeylabs/top-attackers.csv (limited to 'kevlar/2026-08-31/honeylabs/top-attackers.csv') diff --git a/kevlar/2026-08-31/honeylabs/top-attackers.csv b/kevlar/2026-08-31/honeylabs/top-attackers.csv new file mode 100644 index 0000000..00a064b --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/top-attackers.csv @@ -0,0 +1,78 @@ +asn,name,kind,value,count +AS210644,AEZA-AS,ip,147.45.71.214,36 +AS210644,AEZA-AS,ip,217.144.190.138,12 +AS210644,AEZA-AS,ip,176.124.203.177,4 +AS210644,AEZA-AS,ip,185.246.217.150,1 +AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15",18 +AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0,2 +AS210644,AEZA-AS,user_agent,Mozilla/5.0 (CentOS; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0,2 +AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36",2 +AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0,2 +AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",2 +AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.6.16",2 +AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",2 +AS210644,AEZA-AS,user_agent,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0,2 +AS210644,AEZA-AS,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18",2 +AS138915,KAOPU-HK (Kaopu Cloud HK Limited),ip,154.90.37.55,1 +AS138915,KAOPU-HK (Kaopu Cloud HK Limited),user_agent,Microsoft WinRM Client,1 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,107.189.26.103,49 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.114.162,32 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.91.225,16 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,172.86.114.254,8 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.116.49,8 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.99.12,4 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,107.189.17.181,3 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,45.61.177.185,2 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,45.61.177.179,2 +AS14956,ROUTERHOSTING (RouterHosting LLC),ip,144.172.100.235,2 +AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,libredtail-http,49 +AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",4 +AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,zern-scanner (+https://zern.io),2 +AS14956,ROUTERHOSTING (RouterHosting LLC),user_agent,Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0,2 +AS51852,PLI-AS,ip,179.43.167.2,71 +AS51852,PLI-AS,ip,81.17.28.131,56 +AS51852,PLI-AS,ip,179.43.150.26,28 +AS51852,PLI-AS,ip,141.255.165.68,5 +AS51852,PLI-AS,ip,185.12.44.133,4 +AS51852,PLI-AS,ip,141.255.165.69,2 +AS51852,PLI-AS,ip,179.43.146.27,2 +AS51852,PLI-AS,ip,141.255.165.67,2 +AS51852,PLI-AS,ip,141.255.165.66,1 +AS51852,PLI-AS,user_agent,Mozilla/5.0,28 +AS51852,PLI-AS,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64),21 +AS51852,PLI-AS,user_agent,Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0,2 +AS400992,ZHOUYISAT-COMMUNICATIONS,ip,194.48.142.134,1 +AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.7,1095 +AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.14,424 +AS51396,PFCLOUD (Pfcloud UG),ip,45.135.193.193,416 +AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.49,338 +AS51396,PFCLOUD (Pfcloud UG),ip,45.135.194.113,264 +AS51396,PFCLOUD (Pfcloud UG),ip,45.135.193.198,192 +AS51396,PFCLOUD (Pfcloud UG),ip,204.76.203.4,171 +AS51396,PFCLOUD (Pfcloud UG),ip,176.65.148.226,111 +AS51396,PFCLOUD (Pfcloud UG),ip,176.65.149.30,103 +AS51396,PFCLOUD (Pfcloud UG),ip,176.65.149.27,103 +AS51396,PFCLOUD (Pfcloud UG),user_agent,Go-http-client/1.1,703 +AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (compatible; research-scan/1.0),424 +AS51396,PFCLOUD (Pfcloud UG),user_agent,0day,192 +AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36,111 +AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 zgrab/0.x,65 +AS51396,PFCLOUD (Pfcloud UG),user_agent,"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36",10 +AS51396,PFCLOUD (Pfcloud UG),user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",3 +AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0,3 +AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.14,2 +AS51396,PFCLOUD (Pfcloud UG),user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0,1 +AS200651,FLOKINET,ip,185.100.87.136,12 +AS200651,FLOKINET,user_agent,Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0,3 +AS200651,FLOKINET,user_agent,"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safar",3 +AS200651,FLOKINET,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64),2 +AS200651,FLOKINET,user_agent,SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17,1 +AS200651,FLOKINET,user_agent,Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0,1 +AS214351,FEMOIT,ip,62.60.226.150,4 +AS214351,FEMOIT,ip,192.162.199.180,2 +AS214351,FEMOIT,user_agent,python-requests/2.22.0,2 +AS198953,PROTON66,ip,176.120.22.61,1141 +AS198953,PROTON66,ip,176.120.22.43,134 +AS198953,PROTON66,ip,193.143.1.66,31 +AS198953,PROTON66,ip,176.120.22.240,2 +AS198953,PROTON66,user_agent,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.",134 -- cgit v1.2.3