diff options
| author | hrbrmstr <bob@rud.is> | 2026-07-06 06:36:32 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-07-06 06:36:32 -0400 |
| commit | 083a60f55cfc8b33735117feb6df6904342818b5 (patch) | |
| tree | a923e83319a601d644f3dffcf7721cdec094b671 /kevlar/2026-07-04/iocs/README.md | |
| parent | ba215928b4f787ea110d7e02e20eb65b0d3b976f (diff) | |
chore: weekly asn update
Diffstat (limited to 'kevlar/2026-07-04/iocs/README.md')
| -rw-r--r-- | kevlar/2026-07-04/iocs/README.md | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/kevlar/2026-07-04/iocs/README.md b/kevlar/2026-07-04/iocs/README.md new file mode 100644 index 0000000..fdb3979 --- /dev/null +++ b/kevlar/2026-07-04/iocs/README.md @@ -0,0 +1,27 @@ +# Weekly BP Report -- 2026-07-04 + +Generated: 2026-07-06T10:30:00Z +ASNs covered: 26 +Sponge sessions found: ~41,000+ (all BP ASNs) +Honeylabs events found: ~12,000+ (9 active ASNs) +Censys IPs enriched: 26 (aggregation level) +Anomalies flagged: 2 (PFCLOUD 2.6x volume increase, Proton66 RDP credential stuffing) + +## Directory Structure + +- `sponge/` -- Arkime/Sponge session stats per ASN (IP, port, tag distributions, timeline) +- `honeylabs/` -- Honeylabs top attackers, events per ASN +- `censys/` -- Censys aggregations per ASN (ports, software, labels, TLS issuers, OS) +- `changes/` -- Change detection vs prior week +- `iocs/` -- Structured IoC files: IPs, fingerprints, C2 paths + +## Web Access + +https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-04/ + +## Key Findings + +- PFCLOUD (AS51396) event volume surged 2.6x to 11,500+ events +- All 26 monitored ASNs carry BULLETPROOF label per Censys +- Proton66 showing RDP credential stuffing pattern from Moscow +- RouterHosting demonstrating multi-vector scanning (HTTP, SMTP, SMB, SIP, Minecraft) |