1
2
3
4
5
6
7
|
severity,asn,anomaly,rationale
high,AS51396,Shared SSH host key across 204.76.203.221+214,Definitive cloned infrastructure; identical HASSH 41ff3ecd... and proxy on 9191
high,AS51396,New 204.76.203.2xx proxy block,5 new IPs this week all running proxy-checking; volume +37%
medium,AS14956,PPTP brute-force on port 1723,New attack pattern this week; 144.172.100.63 sustained PPTP attempts
medium,AS51852,.env/.git exfiltration pattern,Signature previously on KPRONET now on PLI-AS; 179.43.150.26 probing 8001/8443
medium,AS198953,MSSQL-TDS on 17 non-standard ports,Expanded brute-force campaign; 176.120.22.61 dominant
low,AS200651,Tor exit relay volume drop -88%,185.100.87.136 still active but reduced
|
