From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/iocs/all-observed-ips.txt | 495 ++++++++++++++++++++++++++++ 1 file changed, 495 insertions(+) create mode 100644 kevlar/2026-08-31/iocs/all-observed-ips.txt (limited to 'kevlar/2026-08-31/iocs/all-observed-ips.txt') diff --git a/kevlar/2026-08-31/iocs/all-observed-ips.txt b/kevlar/2026-08-31/iocs/all-observed-ips.txt new file mode 100644 index 0000000..2a2239c --- /dev/null +++ b/kevlar/2026-08-31/iocs/all-observed-ips.txt @@ -0,0 +1,495 @@ +# Sources observed by Sponge (Arkime) and Honeylabs, 2026-08-24 to 2026-08-31 + +# AS57043 - HOSTKEY-AS +103.27.156.128 +151.241.155.245 +151.241.234.73 +151.245.140.36 +151.247.219.40 +167.17.182.242 +185.23.18.151 +193.17.95.129 +193.84.2.233 +212.237.219.206 +38.124.152.45 +38.143.19.97 +46.17.99.102 +66.248.205.4 +80.91.65.247 +82.22.175.192 +82.24.19.158 +89.125.61.139 +89.125.61.90 +91.239.211.68 + +# AS209847 - THE +103.231.75.163 +185.231.206.117 +185.231.207.149 +31.222.238.6 +45.12.129.166 +45.12.132.198 +45.12.136.73 +45.12.146.245 +45.144.28.70 +45.82.252.106 +45.83.141.120 +45.83.143.9 +45.83.20.230 +45.83.22.14 +45.89.55.225 +5.181.20.206 +77.91.122.2 +91.225.219.200 +92.118.233.6 +94.131.106.51 + +# AS210644 - AEZA-AS +109.107.190.8 +109.120.184.14 +109.172.95.248 +138.124.54.172 +138.124.91.58 +138.124.99.219 +147.45.71.214 +176.124.203.177 +185.103.101.180 +185.103.101.74 +185.246.217.150 +194.76.217.92 +212.113.102.0 +213.165.46.78 +213.165.46.83 +217.144.190.138 +62.60.158.60 +77.221.153.3 +77.221.158.41 +79.137.197.24 +81.19.137.20 +85.192.31.14 +89.208.97.111 +89.22.224.187 + +# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited) +154.90.37.55 +38.54.2.107 +38.54.2.112 +38.54.2.120 +38.54.2.13 +38.54.2.135 +38.54.2.148 +38.54.2.152 +38.54.2.168 +38.54.2.170 +38.54.2.195 +38.54.2.203 +38.54.2.204 +38.54.2.209 +38.54.2.221 +38.54.2.232 +38.54.2.61 +38.54.2.75 +38.54.2.82 +38.60.191.241 +38.60.230.109 + +# AS14956 - ROUTERHOSTING (RouterHosting LLC) +107.189.17.181 +107.189.26.103 +107.189.27.179 +144.172.100.235 +144.172.109.224 +144.172.110.38 +144.172.111.21 +144.172.115.222 +144.172.116.49 +144.172.94.186 +144.172.94.243 +144.172.99.12 +153.75.82.185 +167.88.165.227 +167.88.165.33 +167.88.165.44 +167.88.166.32 +167.88.168.121 +172.86.113.15 +172.86.113.36 +172.86.114.162 +172.86.114.254 +172.86.116.32 +172.86.116.74 +172.86.117.95 +172.86.123.8 +172.86.90.159 +172.86.90.76 +172.86.91.225 +216.126.225.6 +216.126.227.184 +216.126.239.17 +45.59.117.74 +45.61.129.23 +45.61.170.85 +45.61.177.179 +45.61.177.185 +45.61.182.81 + +# AS216139 - IRONHOST +109.120.141.207 +176.98.185.152 +178.208.78.17 +178.208.88.6 +185.72.10.233 +46.30.46.124 +46.30.46.130 + +# AS51852 - PLI-AS +141.255.165.66 +141.255.165.67 +141.255.165.68 +141.255.165.69 +179.43.133.154 +179.43.134.114 +179.43.139.58 +179.43.143.170 +179.43.146.226 +179.43.146.227 +179.43.146.27 +179.43.150.26 +179.43.163.26 +179.43.167.2 +179.43.168.58 +179.43.175.234 +179.43.175.236 +179.43.182.200 +179.43.186.223 +179.43.186.241 +185.12.44.133 +190.211.255.210 +46.19.137.194 +46.19.138.10 +81.17.28.130 +81.17.28.131 + +# AS400992 - ZHOUYISAT-COMMUNICATIONS +130.12.44.88 +130.12.47.8 +147.45.124.196 +147.45.125.234 +147.45.125.75 +185.121.15.149 +185.121.15.184 +185.219.7.27 +185.236.25.175 +185.236.25.178 +185.250.180.21 +193.46.218.239 +193.46.218.82 +194.48.142.134 +23.172.217.46 +23.172.217.58 +23.172.217.77 +23.172.217.87 +23.177.184.46 +23.177.185.239 +45.150.195.235 + +# AS33993 - UFO-AS +141.98.189.206 +185.235.242.122 +193.201.126.15 +45.144.31.247 +45.150.64.125 +45.67.230.246 + +# AS51396 - PFCLOUD (Pfcloud UG) +176.65.132.129 +176.65.132.149 +176.65.134.52 +176.65.139.11 +176.65.148.147 +176.65.148.216 +176.65.148.226 +176.65.148.29 +176.65.148.71 +176.65.148.84 +176.65.148.96 +176.65.149.188 +176.65.149.201 +176.65.149.212 +176.65.149.220 +176.65.149.224 +176.65.149.230 +176.65.149.236 +176.65.149.27 +176.65.149.30 +176.65.149.31 +176.65.149.64 +176.65.149.67 +176.65.151.74 +204.76.203.14 +204.76.203.18 +204.76.203.206 +204.76.203.212 +204.76.203.226 +204.76.203.231 +204.76.203.4 +204.76.203.49 +204.76.203.7 +204.76.203.73 +45.135.193.193 +45.135.193.198 +45.135.194.113 +45.135.194.99 +45.153.34.112 +45.153.34.114 +45.153.34.149 +45.153.34.235 +45.156.87.204 +45.156.87.216 +45.156.87.253 +45.156.87.254 +77.83.39.94 +94.183.174.77 + +# AS213702 - QWINS-LTD +185.238.191.130 +78.40.209.57 +80.253.249.170 +84.21.189.148 +89.125.48.168 +89.125.48.64 +95.164.123.100 +95.164.53.44 + +# AS216246 - RU-AEZA-AS +138.124.14.150 +176.124.222.35 +176.124.222.50 +176.124.222.72 +178.159.94.237 +178.159.94.48 +178.20.208.185 +178.20.208.195 +185.103.100.48 +185.221.199.82 +185.96.80.121 +194.26.229.20 +77.110.105.96 +77.221.151.241 +79.137.192.106 +82.117.87.156 +82.117.87.221 +85.192.30.189 +85.192.30.81 +85.192.56.190 + +# AS200651 - FLOKINET +185.10.68.109 +185.10.68.96 +185.100.84.164 +185.100.84.174 +185.100.85.79 +185.100.87.136 +185.146.232.118 +185.146.232.125 +185.146.232.142 +185.146.232.145 +185.146.232.146 +185.146.233.211 +185.165.169.121 +185.165.169.248 +185.165.171.158 +185.246.188.74 +185.246.190.66 +185.246.191.8 +185.247.225.201 +37.228.129.67 + +# AS30823 - AUROLOGIC (aurologic GmbH) +152.89.244.135 +152.89.246.217 +160.20.144.83 +172.86.92.75 +172.86.93.168 +172.86.93.173 +172.86.93.75 +172.86.94.229 +172.86.94.48 +172.86.94.49 +172.86.94.82 +172.86.95.26 +172.86.95.45 +216.126.229.131 +41.216.188.21 +45.11.16.143 +45.11.18.33 +45.138.173.7 +45.153.243.249 + +# AS140666 - ADPL-AS-AP (ANY DIGITAL PTE. LTD.) +154.94.68.6 +204.3.179.2 +204.3.179.3 +204.3.250.24 + +# AS214351 - FEMOIT +192.162.199.180 +62.60.226.150 +62.60.226.176 +62.60.226.186 +62.60.226.79 + +# AS198953 - PROTON66 +176.120.22.113 +176.120.22.122 +176.120.22.123 +176.120.22.135 +176.120.22.147 +176.120.22.16 +176.120.22.179 +176.120.22.240 +176.120.22.42 +176.120.22.43 +176.120.22.52 +176.120.22.6 +176.120.22.61 +176.120.22.66 +176.120.22.73 +193.143.1.66 +37.77.150.10 +37.77.150.119 +37.77.150.241 +37.77.150.67 +37.77.150.83 + +# AS200593 - PROSPERO-AS +193.24.123.118 +193.24.123.148 +193.24.123.16 +193.24.123.23 +193.24.123.55 +193.24.123.58 +193.24.123.63 +91.202.233.121 +91.202.233.29 +91.202.233.33 +91.202.233.46 +91.202.233.79 +91.202.233.8 +91.202.233.82 +91.215.85.104 +91.215.85.106 +91.215.85.142 +91.215.85.193 +91.215.85.34 +91.215.85.40 + +# AS214940 - KPRONET +45.144.212.221 +45.144.212.40 +45.144.212.53 +77.83.39.104 +77.83.39.117 +77.83.39.119 +77.83.39.14 +77.83.39.159 +77.83.39.197 +77.83.39.24 +77.83.39.27 +77.83.39.36 +77.83.39.42 +77.83.39.54 +77.83.39.6 +77.83.39.72 +77.83.39.82 +77.83.39.84 +77.83.39.86 +77.83.39.94 + +# AS211720 - Datashield, Inc. +185.231.32.24 +185.231.32.25 +185.231.33.22 +185.231.33.30 +185.231.33.38 +185.231.33.46 + +# AS58854 - KAOPY (Kaopu Cloud) +103.236.255.202 + +# Honeypot fleet - attacker hosts (3-day campaigns, 2026-08-28 to 2026-08-31) +# Feo Prest SRL (DE) - credential sweeps +213.209.159.175 + +# SS-Net (RO) - credential sweeps, cross-node +80.94.95.211 + +# Pfcloud UG (NL) - continuous low-and-slow recon +204.76.203.18 + +# Techoff Srv Ltd (NL/BG) - industrial template sweeps +45.148.10.183 +45.148.10.238 +93.123.109.163 + +# RMP Protection Ltd (BG) - CI/SSH config crawler +93.152.223.194 + +# Bulgarian-linked - control-node credential sweep +87.120.104.29 + +# State Cyber Protection (UA) - scanner +193.29.204.107 + +# Datacamp/CDN (DE) - malware dropper dictionary blast +169.150.201.29 + +# Google Cloud - template sweeps / xmlrpc brute / metadata hunt +35.245.230.215 +136.110.80.233 +34.166.182.179 +34.50.64.250 +34.92.76.191 +35.247.178.64 +34.28.244.5 +34.63.40.186 + +# DigitalOcean - registry-hunt rotation (3 IP sets, 3 days) +206.189.19.19 +159.89.127.165 +64.225.75.246 +178.128.207.138 +142.93.129.190 +165.22.34.189 +157.245.113.227 +167.71.175.236 +143.110.213.72 +207.154.212.47 +143.244.168.161 +143.110.217.244 +159.223.132.86 +157.230.19.140 +64.227.32.66 + +# DELTA Fiber Nederland (residential) - NightAgent multi-stage intrusion +81.172.241.94 + +# WorldStream B.V. (NL) - WHM/cPanel + wp-batch probes +185.165.242.182 + +# HostRoyale Technologies (US) - WHM/cPanel + wp-batch probes +43.225.189.141 + +# Miteflux Technologies (AE) - POST-heavy prober +31.59.160.30 + +# Alibaba (SG) - scanner +47.84.110.109 + +# Akamai Connected Cloud (ID) - scanner +172.232.253.221 + +# Office National des Postes (MA) - POST-bearing phpunit/wp-batch +41.251.202.89 +105.138.220.253 + -- cgit v1.2.3