From de4c2e99a969eb10708b02d8f2b6f31495eacce8 Mon Sep 17 00:00:00 2001
From: hrbrmstr <bob@rud.is>
Date: Mon, 7 Sep 2026 06:03:32 -0400
Subject: chore: weekly BPH update

---
 kevlar/2026-09-07/honeylabs/asn-enrichments.json | 314 +++++++++++++++++++++++
 1 file changed, 314 insertions(+)
 create mode 100644 kevlar/2026-09-07/honeylabs/asn-enrichments.json

(limited to 'kevlar/2026-09-07/honeylabs/asn-enrichments.json')

diff --git a/kevlar/2026-09-07/honeylabs/asn-enrichments.json b/kevlar/2026-09-07/honeylabs/asn-enrichments.json
new file mode 100644
index 0000000..7e50be2
--- /dev/null
+++ b/kevlar/2026-09-07/honeylabs/asn-enrichments.json
@@ -0,0 +1,314 @@
+[
+ {
+  "asn": "AS51396",
+  "name": "PFCLOUD",
+  "res": {
+   "asn_number": 51396,
+   "org_name": "Pfcloud UG (haftungsbeschrankt)",
+   "total_events": 8500,
+   "unique_ips": 49,
+   "first_seen": "2026-08-31T00:00:25",
+   "last_seen": "2026-09-06T23:58:26",
+   "top_ports": [
+    8080,
+    8888,
+    3128,
+    25565,
+    1081,
+    888,
+    1080,
+    80,
+    4145,
+    8000
+   ],
+   "top_protocols": [
+    "",
+    "tls"
+   ],
+   "source_countries": [
+    "NL",
+    "DE",
+    "UA"
+   ],
+   "top_source_ips": [
+    {
+     "source_ip": "204.76.203.222",
+     "events": 1159
+    },
+    {
+     "source_ip": "204.76.203.221",
+     "events": 1154
+    },
+    {
+     "source_ip": "204.76.203.213",
+     "events": 1123
+    },
+    {
+     "source_ip": "204.76.203.214",
+     "events": 1091
+    },
+    {
+     "source_ip": "204.76.203.49",
+     "events": 836
+    },
+    {
+     "source_ip": "176.65.148.153",
+     "events": 453
+    },
+    {
+     "source_ip": "204.76.203.7",
+     "events": 446
+    },
+    {
+     "source_ip": "45.135.193.193",
+     "events": 400
+    },
+    {
+     "source_ip": "45.135.194.113",
+     "events": 220
+    },
+    {
+     "source_ip": "45.135.193.198",
+     "events": 200
+    }
+   ]
+  }
+ },
+ {
+  "asn": "AS198953",
+  "name": "PROTON66",
+  "res": {
+   "asn_number": 198953,
+   "org_name": "Proton66 OOO",
+   "total_events": 1669,
+   "unique_ips": 4,
+   "first_seen": "2026-08-31T09:44:36",
+   "last_seen": "2026-09-06T14:40:21",
+   "top_ports": [
+    4443,
+    3389,
+    8443,
+    10443,
+    35366,
+    25366,
+    5539,
+    37628,
+    16433,
+    55366
+   ],
+   "top_protocols": [
+    "",
+    "tls"
+   ],
+   "source_countries": [
+    "RU"
+   ],
+   "top_source_ips": [
+    {
+     "source_ip": "176.120.22.61",
+     "events": 1597
+    },
+    {
+     "source_ip": "176.120.22.240",
+     "events": 45
+    },
+    {
+     "source_ip": "193.143.1.66",
+     "events": 24
+    },
+    {
+     "source_ip": "176.120.22.147",
+     "events": 3
+    }
+   ]
+  }
+ },
+ {
+  "asn": "AS14956",
+  "name": "ROUTERHOSTING",
+  "res": {
+   "asn_number": 14956,
+   "org_name": "RouterHosting LLC",
+   "total_events": 95,
+   "unique_ips": 12,
+   "first_seen": "2026-09-01T07:55:37",
+   "last_seen": "2026-09-06T15:51:16",
+   "top_ports": [
+    445,
+    8008,
+    2095,
+    443,
+    1723,
+    7860,
+    5061
+   ],
+   "top_protocols": [
+    "",
+    "tls"
+   ],
+   "source_countries": [
+    "US"
+   ],
+   "top_source_ips": [
+    {
+     "source_ip": "45.61.157.82",
+     "events": 32
+    },
+    {
+     "source_ip": "144.172.108.79",
+     "events": 24
+    },
+    {
+     "source_ip": "144.172.99.200",
+     "events": 16
+    },
+    {
+     "source_ip": "216.126.239.215",
+     "events": 8
+    },
+    {
+     "source_ip": "167.88.168.121",
+     "events": 4
+    },
+    {
+     "source_ip": "45.61.183.10",
+     "events": 4
+    },
+    {
+     "source_ip": "144.172.112.11",
+     "events": 2
+    },
+    {
+     "source_ip": "216.126.227.187",
+     "events": 1
+    },
+    {
+     "source_ip": "45.61.149.189",
+     "events": 1
+    },
+    {
+     "source_ip": "144.172.99.12",
+     "events": 1
+    }
+   ]
+  }
+ },
+ {
+  "asn": "AS210644",
+  "name": "AEZA-AS",
+  "res": {
+   "asn_number": 210644,
+   "org_name": "Aeza Group LLC",
+   "total_events": 51,
+   "unique_ips": 1,
+   "first_seen": "2026-08-31T22:44:34",
+   "last_seen": "2026-09-02T15:29:27",
+   "top_ports": [
+    443,
+    2222,
+    2375
+   ],
+   "top_protocols": [
+    "tls",
+    ""
+   ],
+   "source_countries": [
+    "NL"
+   ],
+   "top_source_ips": [
+    {
+     "source_ip": "185.246.217.150",
+     "events": 51
+    }
+   ]
+  }
+ },
+ {
+  "asn": "AS51852",
+  "name": "PLI-AS",
+  "res": {
+   "asn_number": 51852,
+   "org_name": "Private Layer INC",
+   "total_events": 32,
+   "unique_ips": 5,
+   "first_seen": "2026-08-31T15:32:52",
+   "last_seen": "2026-09-04T19:27:10",
+   "top_ports": [
+    8443,
+    2087,
+    1723,
+    80,
+    32400,
+    443,
+    8085
+   ],
+   "top_protocols": [
+    "",
+    "tls"
+   ],
+   "source_countries": [
+    "CH"
+   ],
+   "top_source_ips": [
+    {
+     "source_ip": "179.43.150.26",
+     "events": 16
+    },
+    {
+     "source_ip": "46.19.142.226",
+     "events": 6
+    },
+    {
+     "source_ip": "141.255.165.66",
+     "events": 5
+    },
+    {
+     "source_ip": "179.43.186.220",
+     "events": 3
+    },
+    {
+     "source_ip": "179.43.146.27",
+     "events": 2
+    }
+   ]
+  }
+ },
+ {
+  "asn": "AS57043",
+  "name": "HOSTKEY-AS",
+  "res": {
+   "asn_number": 57043,
+   "org_name": "Hostkey B.v.",
+   "total_events": 12,
+   "unique_ips": 2,
+   "first_seen": "2026-08-31T15:39:39",
+   "last_seen": "2026-09-03T03:47:57",
+   "top_ports": [
+    22,
+    19571,
+    42481,
+    5070,
+    44981,
+    20271,
+    14603
+   ],
+   "top_protocols": [
+    ""
+   ],
+   "source_countries": [
+    "GB",
+    "DE"
+   ],
+   "top_source_ips": [
+    {
+     "source_ip": "163.5.16.6",
+     "events": 8
+    },
+    {
+     "source_ip": "82.39.165.100",
+     "events": 4
+    }
+   ]
+  }
+ }
+]
\ No newline at end of file
-- 
cgit v1.2.3