path: root/kevlar/2026-08-31/iocs/all-observed-ips.txt

# Sources observed by Sponge (Arkime) and Honeylabs, 2026-08-24 to 2026-08-31

# AS57043 - HOSTKEY-AS
103.27.156.128
151.241.155.245
151.241.234.73
151.245.140.36
151.247.219.40
167.17.182.242
185.23.18.151
193.17.95.129
193.84.2.233
212.237.219.206
38.124.152.45
38.143.19.97
46.17.99.102
66.248.205.4
80.91.65.247
82.22.175.192
82.24.19.158
89.125.61.139
89.125.61.90
91.239.211.68

# AS209847 - THE
103.231.75.163
185.231.206.117
185.231.207.149
31.222.238.6
45.12.129.166
45.12.132.198
45.12.136.73
45.12.146.245
45.144.28.70
45.82.252.106
45.83.141.120
45.83.143.9
45.83.20.230
45.83.22.14
45.89.55.225
5.181.20.206
77.91.122.2
91.225.219.200
92.118.233.6
94.131.106.51

# AS210644 - AEZA-AS
109.107.190.8
109.120.184.14
109.172.95.248
138.124.54.172
138.124.91.58
138.124.99.219
147.45.71.214
176.124.203.177
185.103.101.180
185.103.101.74
185.246.217.150
194.76.217.92
212.113.102.0
213.165.46.78
213.165.46.83
217.144.190.138
62.60.158.60
77.221.153.3
77.221.158.41
79.137.197.24
81.19.137.20
85.192.31.14
89.208.97.111
89.22.224.187

# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited)
154.90.37.55
38.54.2.107
38.54.2.112
38.54.2.120
38.54.2.13
38.54.2.135
38.54.2.148
38.54.2.152
38.54.2.168
38.54.2.170
38.54.2.195
38.54.2.203
38.54.2.204
38.54.2.209
38.54.2.221
38.54.2.232
38.54.2.61
38.54.2.75
38.54.2.82
38.60.191.241
38.60.230.109

# AS14956 - ROUTERHOSTING (RouterHosting LLC)
107.189.17.181
107.189.26.103
107.189.27.179
144.172.100.235
144.172.109.224
144.172.110.38
144.172.111.21
144.172.115.222
144.172.116.49
144.172.94.186
144.172.94.243
144.172.99.12
153.75.82.185
167.88.165.227
167.88.165.33
167.88.165.44
167.88.166.32
167.88.168.121
172.86.113.15
172.86.113.36
172.86.114.162
172.86.114.254
172.86.116.32
172.86.116.74
172.86.117.95
172.86.123.8
172.86.90.159
172.86.90.76
172.86.91.225
216.126.225.6
216.126.227.184
216.126.239.17
45.59.117.74
45.61.129.23
45.61.170.85
45.61.177.179
45.61.177.185
45.61.182.81

# AS216139 - IRONHOST
109.120.141.207
176.98.185.152
178.208.78.17
178.208.88.6
185.72.10.233
46.30.46.124
46.30.46.130

# AS51852 - PLI-AS
141.255.165.66
141.255.165.67
141.255.165.68
141.255.165.69
179.43.133.154
179.43.134.114
179.43.139.58
179.43.143.170
179.43.146.226
179.43.146.227
179.43.146.27
179.43.150.26
179.43.163.26
179.43.167.2
179.43.168.58
179.43.175.234
179.43.175.236
179.43.182.200
179.43.186.223
179.43.186.241
185.12.44.133
190.211.255.210
46.19.137.194
46.19.138.10
81.17.28.130
81.17.28.131

# AS400992 - ZHOUYISAT-COMMUNICATIONS
130.12.44.88
130.12.47.8
147.45.124.196
147.45.125.234
147.45.125.75
185.121.15.149
185.121.15.184
185.219.7.27
185.236.25.175
185.236.25.178
185.250.180.21
193.46.218.239
193.46.218.82
194.48.142.134
23.172.217.46
23.172.217.58
23.172.217.77
23.172.217.87
23.177.184.46
23.177.185.239
45.150.195.235

# AS33993 - UFO-AS
141.98.189.206
185.235.242.122
193.201.126.15
45.144.31.247
45.150.64.125
45.67.230.246

# AS51396 - PFCLOUD (Pfcloud UG)
176.65.132.129
176.65.132.149
176.65.134.52
176.65.139.11
176.65.148.147
176.65.148.216
176.65.148.226
176.65.148.29
176.65.148.71
176.65.148.84
176.65.148.96
176.65.149.188
176.65.149.201
176.65.149.212
176.65.149.220
176.65.149.224
176.65.149.230
176.65.149.236
176.65.149.27
176.65.149.30
176.65.149.31
176.65.149.64
176.65.149.67
176.65.151.74
204.76.203.14
204.76.203.18
204.76.203.206
204.76.203.212
204.76.203.226
204.76.203.231
204.76.203.4
204.76.203.49
204.76.203.7
204.76.203.73
45.135.193.193
45.135.193.198
45.135.194.113
45.135.194.99
45.153.34.112
45.153.34.114
45.153.34.149
45.153.34.235
45.156.87.204
45.156.87.216
45.156.87.253
45.156.87.254
77.83.39.94
94.183.174.77

# AS213702 - QWINS-LTD
185.238.191.130
78.40.209.57
80.253.249.170
84.21.189.148
89.125.48.168
89.125.48.64
95.164.123.100
95.164.53.44

# AS216246 - RU-AEZA-AS
138.124.14.150
176.124.222.35
176.124.222.50
176.124.222.72
178.159.94.237
178.159.94.48
178.20.208.185
178.20.208.195
185.103.100.48
185.221.199.82
185.96.80.121
194.26.229.20
77.110.105.96
77.221.151.241
79.137.192.106
82.117.87.156
82.117.87.221
85.192.30.189
85.192.30.81
85.192.56.190

# AS200651 - FLOKINET
185.10.68.109
185.10.68.96
185.100.84.164
185.100.84.174
185.100.85.79
185.100.87.136
185.146.232.118
185.146.232.125
185.146.232.142
185.146.232.145
185.146.232.146
185.146.233.211
185.165.169.121
185.165.169.248
185.165.171.158
185.246.188.74
185.246.190.66
185.246.191.8
185.247.225.201
37.228.129.67

# AS30823 - AUROLOGIC (aurologic GmbH)
152.89.244.135
152.89.246.217
160.20.144.83
172.86.92.75
172.86.93.168
172.86.93.173
172.86.93.75
172.86.94.229
172.86.94.48
172.86.94.49
172.86.94.82
172.86.95.26
172.86.95.45
216.126.229.131
41.216.188.21
45.11.16.143
45.11.18.33
45.138.173.7
45.153.243.249

# AS140666 - ADPL-AS-AP (ANY DIGITAL PTE. LTD.)
154.94.68.6
204.3.179.2
204.3.179.3
204.3.250.24

# AS214351 - FEMOIT
192.162.199.180
62.60.226.150
62.60.226.176
62.60.226.186
62.60.226.79

# AS198953 - PROTON66
176.120.22.113
176.120.22.122
176.120.22.123
176.120.22.135
176.120.22.147
176.120.22.16
176.120.22.179
176.120.22.240
176.120.22.42
176.120.22.43
176.120.22.52
176.120.22.6
176.120.22.61
176.120.22.66
176.120.22.73
193.143.1.66
37.77.150.10
37.77.150.119
37.77.150.241
37.77.150.67
37.77.150.83

# AS200593 - PROSPERO-AS
193.24.123.118
193.24.123.148
193.24.123.16
193.24.123.23
193.24.123.55
193.24.123.58
193.24.123.63
91.202.233.121
91.202.233.29
91.202.233.33
91.202.233.46
91.202.233.79
91.202.233.8
91.202.233.82
91.215.85.104
91.215.85.106
91.215.85.142
91.215.85.193
91.215.85.34
91.215.85.40

# AS214940 - KPRONET
45.144.212.221
45.144.212.40
45.144.212.53
77.83.39.104
77.83.39.117
77.83.39.119
77.83.39.14
77.83.39.159
77.83.39.197
77.83.39.24
77.83.39.27
77.83.39.36
77.83.39.42
77.83.39.54
77.83.39.6
77.83.39.72
77.83.39.82
77.83.39.84
77.83.39.86
77.83.39.94

# AS211720 - Datashield, Inc.
185.231.32.24
185.231.32.25
185.231.33.22
185.231.33.30
185.231.33.38
185.231.33.46

# AS58854 - KAOPY (Kaopu Cloud)
103.236.255.202

# Honeypot fleet - attacker hosts (3-day campaigns, 2026-08-28 to 2026-08-31)
# Feo Prest SRL (DE) - credential sweeps
213.209.159.175

# SS-Net (RO) - credential sweeps, cross-node
80.94.95.211

# Pfcloud UG (NL) - continuous low-and-slow recon
204.76.203.18

# Techoff Srv Ltd (NL/BG) - industrial template sweeps
45.148.10.183
45.148.10.238
93.123.109.163

# RMP Protection Ltd (BG) - CI/SSH config crawler
93.152.223.194

# Bulgarian-linked - control-node credential sweep
87.120.104.29

# State Cyber Protection (UA) - scanner
193.29.204.107

# Datacamp/CDN (DE) - malware dropper dictionary blast
169.150.201.29

# Google Cloud - template sweeps / xmlrpc brute / metadata hunt
35.245.230.215
136.110.80.233
34.166.182.179
34.50.64.250
34.92.76.191
35.247.178.64
34.28.244.5
34.63.40.186

# DigitalOcean - registry-hunt rotation (3 IP sets, 3 days)
206.189.19.19
159.89.127.165
64.225.75.246
178.128.207.138
142.93.129.190
165.22.34.189
157.245.113.227
167.71.175.236
143.110.213.72
207.154.212.47
143.244.168.161
143.110.217.244
159.223.132.86
157.230.19.140
64.227.32.66

# DELTA Fiber Nederland (residential) - NightAgent multi-stage intrusion
81.172.241.94

# WorldStream B.V. (NL) - WHM/cPanel + wp-batch probes
185.165.242.182

# HostRoyale Technologies (US) - WHM/cPanel + wp-batch probes
43.225.189.141

# Miteflux Technologies (AE) - POST-heavy prober
31.59.160.30

# Alibaba (SG) - scanner
47.84.110.109

# Akamai Connected Cloud (ID) - scanner
172.232.253.221

# Office National des Postes (MA) - POST-bearing phpunit/wp-batch
41.251.202.89
105.138.220.253