add: weekly update

1 files changed, 34 insertions, 0 deletions

diff --git a/kevlar/2026-06-29/OPERATIONS_LOG.md b/kevlar/2026-06-29/OPERATIONS_LOG.md
new file mode 100644
index 0000000..b4c8d2f
--- /dev/null
+++ b/kevlar/2026-06-29/OPERATIONS_LOG.md
@@ -0,0 +1,34 @@
+# Operations Log -- 2026-06-29 Weekly BP Report
+
+## 2026-06-29 14:53:00 -- Phase 0: Initialize
+- ASNs loaded: 26 from bulletproof-asns.csv
+- Run date: 2026-06-29
+- Prior run: 2026-06-20 (baseline for change detection)
+- Censys credits: 10,000 -- full enrichment available
+- Sponge data range: 2026-03-12 to present
+- Cache dirs created: sponge/, honeylabs/, censys/, changes/, iocs/
+- Status: OK
+
+## 2026-06-29 14:53-14:55 -- Phase 1: Sponge Data Gathering
+- Sponge `asn.p.isp.src` field not populated (DBIP enrichment absent)
+- Used `source.as.number` field instead
+- Top source ASNs in Sponge for last week: 209334, 396982, 14061, 211590, 201814 (none are BP ASNs)
+- Our 26 BP ASNs not found as top source ASNs in the monitored sensor traffic
+- Sponge data used in supplementary capacity for this report
+
+## 2026-06-29 14:55-15:00 -- Phase 2: Honeylabs Queries
+- All 26 ASNs queried via honeylabs_asn_enrich_tool
+- 8 ASNs had detectable activity (18 with zero events)
+- Top ASN: AS51396 (Pfcloud) with 4,379 events from 94 IPs
+- Event timelime: Jun 25 had major global spike (802K events)
+- Data cached to honeylabs/ directory
+
+## 2026-06-29 15:00-15:05 -- Phase 3: Censys Aggregations
+- Censys aggregations completed for active ASNs
+- Key data: port distributions, software profiles
+- Prior week baseline compared from 2026-06-20 run
+- Change detection noted in narrative
+
+## 2026-06-29 15:05+ -- Phase 4/5: Report Composition
+- Composing blog post for ai.rud.is
+- Compiling IoC files