From de4c2e99a969eb10708b02d8f2b6f31495eacce8 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 7 Sep 2026 06:03:32 -0400 Subject: chore: weekly BPH update --- kevlar/2026-09-07/censys/fleet-correlation.csv | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 kevlar/2026-09-07/censys/fleet-correlation.csv (limited to 'kevlar/2026-09-07/censys/fleet-correlation.csv') diff --git a/kevlar/2026-09-07/censys/fleet-correlation.csv b/kevlar/2026-09-07/censys/fleet-correlation.csv new file mode 100644 index 0000000..4c38a9e --- /dev/null +++ b/kevlar/2026-09-07/censys/fleet-correlation.csv @@ -0,0 +1,7 @@ +linkage_type,ips,indicator,asn,notes +cloned-image,204.76.203.213; 204.76.203.221; 204.76.203.222,identical SSH algorithm selection + banner comment "Ubuntu-3ubuntu0.17" + OpenSSH 8.9p1 single-service profile,AS51396,PFCLOUD /29 scanner fleet in Eygelshoven NL; 1100+ Honeylabs events each; BULLETPROOF-labeled +identical-service-config,45.61.157.82; 144.172.108.79; 144.172.99.200,Windows RDP (3389) + HTTP API 2.0 on 47001; 144.172.108.79 also MSSQL 2008 (10.0.1600) on 1433,AS14956,ROUTERHOSTING RDP-access fleet Las Vegas/Ogden US; BULLETPROOF-labeled +remote-access-node,176.120.22.61,Windows + RDP 3389 + WinRM 5985 + DCERPC 135,AS198953,PROTON66 St Petersburg RU; 1597 Honeylabs events; Censys BULLETPROOF label +scan-only-node,193.143.1.66,zero open ports visible to Censys,AS198953,PROTON66; 24 Honeylabs events but no exposed services +tor-exit,185.100.87.136,Censys TOR label + SSH 9.9 on non-standard port 7288,AS200651,FLOKINET Bucharest RO; 24 Honeylabs events; BULLETPROOF-labeled +ssh-fingerprint-family,204.76.203.213; 204.76.203.221; 204.76.203.222; 185.246.217.150,identical SSH algorithm selection (curve25519-sha256@libssh.org / ecdsa-sha2-nistp256 / aes128-ctr / hmac-sha2-256),AS51396; AS210644,shared SSH hardening baseline across PFCLOUD and AEZA fleets -- cgit v1.2.3