diff options
| author | hrbrmstr <bob@rud.is> | 2026-06-08 07:05:50 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-06-08 07:05:50 -0400 |
| commit | d7a9bac5ba6b053f46ecd5685b60c2ffd89ea528 (patch) | |
| tree | 72e674b58f34b04a92b41b0b268efafff407f68d /kevlar/2026-06-08/OPERATIONS_LOG.md | |
| parent | 459bf07097e9da493b92244c2b4d1eb0682dee29 (diff) | |
add: iocs
Diffstat (limited to 'kevlar/2026-06-08/OPERATIONS_LOG.md')
| -rw-r--r-- | kevlar/2026-06-08/OPERATIONS_LOG.md | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/kevlar/2026-06-08/OPERATIONS_LOG.md b/kevlar/2026-06-08/OPERATIONS_LOG.md new file mode 100644 index 0000000..7226f5f --- /dev/null +++ b/kevlar/2026-06-08/OPERATIONS_LOG.md @@ -0,0 +1,38 @@ +# Weekly BP Report -- 2026-06-08 + +## Operations Log + +### 2026-06-08 -- Phase 0: Initialize +- ASNs loaded: 26 (from bulletproof-asns.csv) +- Censys credits: 10,000 +- Prior baseline: NONE (first run -- change detection skipped) +- Gists directory created: ~/Documents/gists/kevlar/2026-06-08/ + +### 2026-06-08 -- Phase 1: Honeylabs Queries +- ASNs with activity: 11 of 26 +- Most active: AS51396 (Pfcloud, ~10K events), AS51852 (Private Layer, 3,796 events), AS198953 (Proton66, 2,189 events) +- ASNs with no activity: AS400992, AS33993, AS216139, AS213702, AS216246, AS30823, AS140666, AS214351, AS206728, AS211720, AS216309, AS58854, AS202685, AS394711 +- Key findings: Pfcloud "riptide" Golang scanning framework, FlokiNET SPARK C2 beaconing +- Calls made: ~80 Honeylabs API calls +- Results cached: Y (events NDJSON per ASN, consolidated top-attackers CSV) +- Errors: None + +### 2026-06-08 -- Phase 2: Censys Profiling +- Credits consumed: ~50 (within budget) +- ASN aggregations run: 11 active ASNs +- Per-IP enrichments: 5 IPs +- Key findings: All major ASNs carry BULLETPROOF label (Censys), Shared HASSH across PLI-AS/Pfcloud, riptide binary path exposed in pprof +- Results cached: Y (aggregations NDJSON, IP enrichments NDJSON) +- Errors: None + +### 2026-06-08 -- Phase 3: Change Detection +- Skipped: First run, no baseline + +### 2026-06-08 -- Phase 4: Blog Post +- Blog post written: src/data/blog/2026-06-08-weekly-bulletproof-report.md +- Build verification: PASSED (0 errors, 0 warnings) +- Key sections: Executive Summary, By the Numbers, Top 5 ASN Deep Dives, Infrastructure Correlation, Fleet Observations, IoCs + +### 2026-06-08 -- Phase 5: IoC Archival +- Files created: all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md +- IPs archived: ~60 unique IPs across 11 ASNs |