chore: weekly BPH update

4 files changed, 225 insertions, 0 deletions

diff --git a/kevlar/2026-07-27/iocs/README.md b/kevlar/2026-07-27/iocs/README.md
new file mode 100644
index 0000000..f1edfd9
--- /dev/null
+++ b/kevlar/2026-07-27/iocs/README.md
@@ -0,0 +1,8 @@
+# Weekly BP Report -- 2026-07-27
+
+Generated: 2026-07-27T12:00:00Z
+ASNs covered: 26
+Sponge sessions found: ~95,000+
+Honeylabs events found: 3,326
+Censys IPs enriched: 10
+Anomalies flagged: 2 (PFCLOUD cloned SSH fleet, PROTON66 Redis campaign)
diff --git a/kevlar/2026-07-27/iocs/all-observed-ips.txt b/kevlar/2026-07-27/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..bc63782
--- /dev/null
+++ b/kevlar/2026-07-27/iocs/all-observed-ips.txt
@@ -0,0 +1,156 @@
+# AS57043 - HOSTKEY-AS
+66.248.205.44
+103.27.156.128
+132.243.234.156
+
+# AS209847 - THE
+45.144.28.70
+45.82.252.106
+92.118.233.6
+5.181.20.206
+45.12.129.166
+
+# AS210644 - AEZA-AS
+77.221.153.3
+85.192.31.14
+138.124.99.219
+77.221.158.41
+212.113.102.0
+138.124.51.186
+138.124.59.186
+89.22.229.195
+
+# AS138915 - KAOPU-HK
+38.54.2.209
+38.54.2.232
+38.54.2.61
+38.54.2.13
+38.54.2.170
+154.90.37.55
+
+# AS14956 - ROUTERHOSTING
+107.189.27.179
+172.86.117.95
+144.172.109.224
+172.86.90.76
+216.126.239.17
+172.86.114.169
+45.61.129.23
+144.172.104.239
+172.86.119.189
+144.172.112.26
+172.86.126.18
+144.172.100.179
+144.172.110.153
+144.172.100.235
+
+# AS51852 - PLI-AS
+190.211.255.210
+179.43.133.154
+179.43.163.26
+179.43.186.223
+179.43.134.114
+179.43.168.58
+81.17.28.130
+179.43.186.199
+
+# AS400992 - ZHOUYISAT
+23.172.217.77
+23.172.217.87
+185.121.15.184
+185.219.7.27
+23.177.185.239
+
+# AS51396 - PFCLOUD
+204.76.203.231
+204.76.203.18
+176.65.148.147
+45.153.34.235
+45.156.87.204
+45.135.193.193
+204.76.203.49
+176.65.149.30
+176.65.149.212
+176.65.149.31
+176.65.149.27
+176.65.148.132
+176.65.134.3
+176.65.149.67
+176.65.148.125
+204.76.203.30
+176.65.148.144
+176.65.148.2
+176.65.149.55
+45.135.194.10
+176.65.148.250
+176.65.148.29
+176.65.149.220
+176.65.149.64
+176.65.149.236
+
+# AS198953 - PROTON66
+37.77.150.67
+176.120.22.16
+37.77.150.119
+176.120.22.61
+176.120.22.147
+176.120.22.240
+193.143.1.66
+
+# AS200593 - PROSPERO
+91.215.85.104
+91.202.233.79
+91.215.85.193
+91.215.85.106
+91.202.233.8
+
+# AS214940 - KPRONET
+77.83.39.197
+45.144.212.53
+77.83.39.94
+77.83.39.36
+77.83.39.42
+77.83.39.119
+77.83.39.24
+
+# AS200651 - FLOKINET
+185.100.87.136
+185.10.68.96
+185.246.190.66
+185.100.85.79
+185.146.232.146
+
+# AS216246 - RU-AEZA-AS
+138.124.14.150
+77.110.105.96
+79.137.192.106
+178.159.94.237
+85.192.30.81
+
+# AS30823 - AUROLOGIC
+172.86.94.49
+172.86.93.75
+45.153.243.249
+41.216.188.21
+45.138.173.7
+
+# AS211720 - Datashield, Inc.
+185.231.33.30
+185.231.33.46
+185.231.33.22
+185.231.32.24
+185.231.32.25
+
+# AS33993 - UFO-AS
+45.144.31.247
+185.235.242.122
+141.98.189.206
+45.150.64.125
+193.201.126.15
+
+# AS213702 - QWINS-LTD
+89.125.48.168
+78.40.209.57
+80.253.249.170
+95.164.53.44
+89.125.48.64
diff --git a/kevlar/2026-07-27/iocs/c2-paths.txt b/kevlar/2026-07-27/iocs/c2-paths.txt
new file mode 100644
index 0000000..f95bece
--- /dev/null
+++ b/kevlar/2026-07-27/iocs/c2-paths.txt
@@ -0,0 +1,25 @@
+# Notable HTTP URL Paths Observed (Honeylabs)
+
+# VPN/Remote Access Portal Probing
+/dana-na/auth/url_default/welcome.cgi  -- Pulse Secure VPN (AEZA, 138.124.51.186)
+/sslvpnLogin.html  -- SSL VPN portal (AEZA, 138.124.51.186)
+/global-protect/login.esp  -- Palo Alto GlobalProtect (AEZA, 138.124.51.186)
+/remote/login  -- Remote access portal (AEZA, 138.124.51.186)
+/+CSCOE+/logon.html  -- Cisco VPN (AEZA, 138.124.51.186)
+/RDWeb/Pages/  -- Microsoft RD Web Access (AEZA, 138.124.51.186)
+
+# General Login Probing
+/login  -- Generic login page (AEZA)
+/Login/Login  -- Generic login page variant (AEZA)
+/cgi/login  -- CGI login (AEZA)
+/my.policy  -- Policy page probe (AEZA)
+
+# Remote Desktop / Guacamole
+/guacamole/  -- Apache Guacamole (AEZA, 138.124.51.186)
+
+# WinRM
+/wsman?PSVersion=5.1.19041.1  -- WinRM probing (KAOPU-HK, 154.90.37.55)
+
+# 3x-ui Proxy Panel
+/assets/login-J3fs_cbU.js  -- 3x-ui panel assets (AEZA, 138.124.51.186:2053)
+/assets/vendor-antd-B5BXDqMa.css  -- 3x-ui UI framework (AEZA)
diff --git a/kevlar/2026-07-27/iocs/fingerprints.txt b/kevlar/2026-07-27/iocs/fingerprints.txt
new file mode 100644
index 0000000..070082d
--- /dev/null
+++ b/kevlar/2026-07-27/iocs/fingerprints.txt
@@ -0,0 +1,36 @@
+# JA4 TLS Fingerprints
+t13i1010h1_61a7ad8aa9b6_3a8073edd8ef  -- AEZA Chrome 147 TLS, 138.124.51.186 (DE)
+t13i1010h1_61a7ad8aa9b6_792d2c6655cb  -- AEZA Chrome 147 variant, 138.124.51.186 (DE)
+
+# JA3 TLS Fingerprints
+b609d5551dcec7e6075e2fc8ca29bf24  -- AEZA, 89.22.229.195 (SE)
+9f4e0ae825047a941af7221fb75e2aae  -- AEZA, 138.124.59.186 (FI)
+16a3089656ab057929b8f221ed08e039  -- AEZA, 138.124.51.186 (DE)
+ef90e14e531115797b650fe07df61586  -- AEZA, 138.124.51.186 (DE)
+29b9a4d7e03eb5a56acf29b67023d0af  -- AEZA, 138.124.51.186 (DE)
+93d55721eced6997d8870e8cd1d93506  -- AEZA, 138.124.51.186 (DE)
+a8281a28aa674efa3ec70f0e2280aa09  -- AEZA, 138.124.51.186 (DE)
+ef761d329875d1a90d84f55cc77c26e6  -- AEZA, 138.124.51.186 (DE)
+8792ac713334cf80a6563b2fae57fee6  -- AEZA, 138.124.51.186 (DE)
+90d877cff6af2964217e30deb28f1b06  -- AEZA, 138.124.51.186 (DE)
+15622ee831c60decc2e6587bb4451da3  -- AEZA, 138.124.51.186 (DE)
+1042cf6e6fc5d5fd1b78c4a2c5cb1047  -- AEZA, 138.124.51.186 (DE)
+629ab1e60a10569e72950b4edda596f1  -- AEZA, 138.124.51.186 (DE)
+48979a11139b02722383a6aefcb9abea  -- AEZA, 138.124.51.186 (DE)
+25b88e110e6628514219bb866b24b2e6  -- AEZA, 138.124.51.186 (DE)
+9cb6cf906a47debccd75799916bdd82e  -- AEZA, 138.124.51.186 (DE)
+331c0c17c9863d6b803c11cff32e62bc  -- AEZA, 138.124.51.186 (DE)
+
+# JA4H HTTP Fingerprints
+po11nn0400_52fce913cf3b  -- KAOPU-HK WinRM Client, 154.90.37.55
+ge11nn05en_5fca7fb4a57a  -- AEZA Chrome 147 HTTP, 138.124.51.186
+ge11cn05en_741f45be9444  -- AEZA Chrome 147 HTTP (+Cisco cookie), 138.124.51.186
+
+# HASSH SSH Fingerprints
+e42184b06d45385a906f0803d04c83da  -- PFCLOUD fleet (multiple 176.65.149.x IPs), identical SSH config
+e42184b06d45385a906f0803d04c83da  -- 45.135.193.193 (PFCLOUD)
+e42184b06d45385a906f0803d04c83da  -- 66.248.205.44 (HOSTKEY)
+e42184b06d45385a906f0803d04c83da  -- 179.43.168.58 (PLI)
+779664e66160bf75999f091fce5edb5a  -- 138.124.51.186 (AEZA, OpenSSH 8.2p1)
+b1bff636ebbdbaa9dd2ad97fd173c956  -- 172.86.114.169 (ROUTERHOSTING, OpenSSH 9.9)
+eb0e0554de9aeb368191c86016a40080  -- 154.90.37.55 (KAOPU-HK, SSH password auth)