chore: weekly asn update

4 files changed, 59 insertions, 0 deletions

diff --git a/kevlar/2026-06-15/iocs/README.md b/kevlar/2026-06-15/iocs/README.md
new file mode 100644
index 0000000..54139dd
--- /dev/null
+++ b/kevlar/2026-06-15/iocs/README.md
@@ -0,0 +1,7 @@
+# Weekly BP Report -- 2026-06-15
+
+Generated: 2026-06-15T12:00:00Z
+ASNs covered: 26
+Honeylabs events found: ~52,000+
+Censys IPs enriched: 9 ASNs (aggregation data)
+Anomalies flagged: 3 (Proton66 massive spike, June 14 global spike, QWINS LTD new entrant)
diff --git a/kevlar/2026-06-15/iocs/all-observed-ips.txt b/kevlar/2026-06-15/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..e2b1a8f
--- /dev/null
+++ b/kevlar/2026-06-15/iocs/all-observed-ips.txt
@@ -0,0 +1,37 @@
+# AS198953 - PROTON66 (Proton66 OOO)
+37.77.150.67
+176.120.22.147
+176.120.22.240
+# AS51396 - PFCLOUD (Pfcloud UG)
+45.135.193.193
+204.76.203.206
+176.65.139.103
+204.76.203.219
+176.65.139.31
+176.65.139.130
+176.65.132.141
+176.65.139.36
+176.65.149.27
+176.65.148.147
+176.65.149.30
+176.65.139.151
+176.65.149.212
+204.76.203.81
+176.65.139.140
+176.65.149.31
+45.153.34.117
+176.65.149.203
+176.65.148.2
+176.65.148.216
+# AS210644 - AEZA-AS (Aeza International Ltd)
+138.124.99.219
+109.172.95.248
+85.192.31.14
+# AS200651 - FLOKINET (FlokiNET ehf)
+185.100.87.136
+# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited)
+154.205.145.161
+# AS209847 - THE (WorkTitans B.V.)
+45.83.20.230
+# AS213702 - QWINS LTD (QWINS LTD)
+194.238.57.3
diff --git a/kevlar/2026-06-15/iocs/c2-paths.txt b/kevlar/2026-06-15/iocs/c2-paths.txt
new file mode 100644
index 0000000..5140d0e
--- /dev/null
+++ b/kevlar/2026-06-15/iocs/c2-paths.txt
@@ -0,0 +1,2 @@
+/images/transparentpix.gif  -- SPARK C2 beacon path, 2 events, 185.100.87.136, FLOKINET
+/images/json?  -- Docker API scan path, 6 events, 154.205.145.161, KAOPU-HK
diff --git a/kevlar/2026-06-15/iocs/fingerprints.txt b/kevlar/2026-06-15/iocs/fingerprints.txt
new file mode 100644
index 0000000..81daedd
--- /dev/null
+++ b/kevlar/2026-06-15/iocs/fingerprints.txt
@@ -0,0 +1,13 @@
+# JA4 TLS Fingerprints
+t13i1909h2_9dc949149365_97f8aa674fd9  -- SPARK C2 beacon, 1 IP (185.100.87.136), FLOKINET
+t13i1310h1_f57a46bbacb6_e7c285222651  -- Firefox 140 on Linux, 1 IP (45.83.20.230), THE
+
+# JA3 Legacy Fingerprints
+7c1e207beb00684bbbe144f1b0abe1d5  -- SPARK C2 beacon (JA3 counterpart of above)
+
+# JA4H HTTP Fingerprints
+ge11nn0400_88d30a62b7ad  -- SPARK C2 HTTP client, 1 IP, FLOKINET
+ge11nn0400_9c3956fad5da  -- go-dockerclient Docker API scanner, KAOPU-HK
+
+# HASSH SSH Fingerprints
+f555226df1963d1d3c09daf865abdc9a  -- libssh 0.9.6, 3 IPs (138.124.99.219, 109.172.95.248, 85.192.31.14), AEZA