chore: weekly asn update

1 files changed, 32 insertions, 0 deletions

diff --git a/kevlar/2026-07-13/iocs/README.md b/kevlar/2026-07-13/iocs/README.md
new file mode 100644
index 0000000..5ad0bd3
--- /dev/null
+++ b/kevlar/2026-07-13/iocs/README.md
@@ -0,0 +1,32 @@
+# Weekly BP Report -- 2026-07-13
+
+Generated: 2026-07-13T12:00:00Z
+ASNs covered: 26
+Query range: 2026-07-05 through 2026-07-11
+Sponge sessions found: ~21,000+ (15 active ASNs)
+Honeylabs events found: ~16,000+ (12 active ASNs)
+Censys IPs enriched: 10 (per-host enrichment via censys_get_host)
+Anomalies flagged: 11 (2 critical, 4 high, 3 medium, 2 low)
+
+## Directory Structure
+
+- `sponge/` -- Arkime/Sponge session stats per ASN (77 files)
+- `honeylabs/` -- Honeylabs top attackers and fingerprints (2 files)
+- `censys/` -- Censys aggregations, IP enrichments, fleet correlation (3 files)
+- `changes/` -- Change detection vs prior week (2 files)
+- `iocs/` -- Structured IoC files: IPs, fingerprints, C2 paths
+
+## Key Findings
+
+- PFCLOUD (AS51396) remains dominant with 10K+ events and a new coordinated scan cluster (204.76.203.78/79/80)
+- Prospero Ooo (AS200593) surged from 2 to 3890 events -- single IP scan bomb
+- Proton66 (AS198953) expanded from RDP-only to multi-protocol bruteforcing (RDP+SSH+Telnet+FTP)
+- Datashield Inc. (AS211720) new entrant performing Exchange /ews/ reconnaissance
+- ZhouyiSat (AS400992) observed scanning for /.env files to steal credentials
+- FlokiNET (AS200651) Tor exit node (185.100.87.136) actively scanning HTTP/SSH
+- Active ASNs expanded from 9 to 15 (+67%) week over week
+- 11 unique fingerprints collected (4 HASSH, 4 JA4/JA3, 3 JA4H) -- major improvement over prior week
+
+## Web Access
+
+https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-13/