metric,asn,asn_org,prior_value,current_value,delta,delta_pct,category,notes
active_asns,total,,9,15,+6,+67%,expansion,"6 new ASNs active: AS57043, AS138915, AS216139, AS33993, AS216246, AS211720"
event_volume,AS51396,Pfcloud UG,11500,10000+,-1500,-13%,decrease,"PFCLOUD volume slightly decreased but still dominant"
event_volume,AS51852,Private Layer INC,822,1802,+980,+119%,increase,"Significant uptick in Private Layer activity"
event_volume,AS14956,RouterHosting LLC,267,206,-61,-23%,decrease,"RouterHosting activity decreased"
event_volume,AS214940,Kprohost LLC,45,46,+1,+2%,stable,"Kprohost stable"
event_volume,AS198953,Proton66 OOO,35,539,+504,+1440%,surge,"Proton66 massive surge - RDP/SSH/Telnet/FTP bruteforcing"
event_volume,AS200651,FlokiNET ehf,20,20,0,0%,stable,"FlokiNET stable"
event_volume,AS210644,Aeza Group LLC,3,1,-2,-67%,decrease,"Aeza minimal activity"
event_volume,AS400992,ZhouyiSat Comm,4,2,-2,-50%,decrease,"ZhouyiSat minimal"
event_volume,AS200593,Prospero Ooo,2,3890,+3888,+194400%,surge,"Prospero massive surge - scan-only behavior"
new_ips,AS51396,Pfcloud UG,0,3,+3,new,"New IPs: 204.76.203.78/79/80 - coordinated scan cluster"
new_ips,AS51852,Private Layer INC,0,3,+3,new,"New IPs: 179.43.134.114, 179.43.168.58, 179.43.186.241"
new_ips,AS14956,RouterHosting LLC,0,4,+4,new,"New IPs: 144.172.103.227, 216.126.225.168, 144.172.97.10, 167.88.165.96"
new_ips,AS198953,Proton66 OOO,0,2,+2,new,"New IPs: 176.120.22.240, 176.120.22.147, 37.77.150.67"
new_ips,AS200593,Prospero Ooo,0,1,+1,new,"New IP: 91.202.233.79 - 3890 events single IP"
new_ips,AS214940,Kprohost LLC,0,2,+2,new,"New IPs: 77.83.39.119, 77.83.39.94"
new_ips,AS57043,Hostkey B.v.,0,1,+1,new,"New IP: 151.243.173.235 - SSH scanning"
new_ips,AS216139,Iron Hosting Centre,0,1,+1,new,"New IP: 178.208.88.28 - SSH scanning"
new_ips,AS211720,Datashield Inc.,0,1,+1,new,"New IP: 185.231.33.46 - Exchange /ews/ recon"
new_asns,AS57043,Hostkey B.v.,0,1,+1,new,"First observation in Honeylabs"
new_asns,AS138915,KAOPU-HK,0,0,0,0,"Sponge only - NTP/123 traffic, no Honeylabs"
new_asns,AS216139,Iron Hosting Centre,0,1,+1,new,"First observation in Honeylabs"
new_asns,AS33993,TOV Aktor,0,0,0,0,"Sponge only - 2 sessions"
new_asns,AS216246,Qwins-LTD,0,0,0,0,"Sponge only - 93 sessions"
new_asns,AS211720,Datashield Inc.,0,1,+1,new,"First observation - Exchange recon"
new_attack_pattern,AS51396,Pfcloud UG,none,coordinated-scan-cluster,new,new,"Three IPs (204.76.203.78/79/80) with identical start/stop times"
new_attack_pattern,AS198953,Proton66 OOO,rdp-only,multi-protocol-bruteforce,new,new,"Expanded from RDP-only to SSH+Telnet+FTP bruteforcing"
new_attack_pattern,AS200593,Prospero Ooo,minimal,massive-port-scan,new,new,"Single IP generating 3890 events on diverse high ports"
new_attack_pattern,AS211720,Datashield Inc.,none,exchange-ews-recon,new,new,"Exchange /ews/ endpoint reconnaissance"
new_attack_pattern,AS400992,ZhouyiSat Comm,none,env-file-scanning,new,new,"/.env file probing via HTTPS"
new_fingerprint,AS400992,ZhouyiSat,none,ja4-t13i1711h1,new,new,"TLS 1.3 fingerprint for .env scanning"
new_fingerprint,AS200651,FlokiNET,none,ja4-t13i1909h2,new,new,"TLS 1.3 fingerprint for transparentpix.gif probing"
new_fingerprint,AS211720,Datashield,none,ja4-t13i1813h1,new,new,"TLS 1.3 fingerprint for Exchange /ews/ recon"
new_fingerprint,AS57043,Hostkey,none,hassh-f555226d,new,new,"HASSH for libssh_0.9.6 SSH scanning"
new_fingerprint,AS200651,FlokiNET,none,hassh-e54ef3ec,new,new,"HASSH for OpenSSH_10.1 (Tor exit node)"