feat: update bph iocs

1 files changed, 15 insertions, 0 deletions

diff --git a/kevlar/2026-08-10/changes/diff-vs-prior-week.csv b/kevlar/2026-08-10/changes/diff-vs-prior-week.csv
new file mode 100644
index 0000000..308d4c5
--- /dev/null
+++ b/kevlar/2026-08-10/changes/diff-vs-prior-week.csv
@@ -0,0 +1,15 @@
+asn,metric,prior_week,this_week,delta,notes
+AS51396,honeylabs_events,~8400,11483,+37%,proxy checking continues; new 204.76.203.2xx block
+AS51396,new_ips,0,5,"204.76.203.221/214/213/212/222 new this week"
+AS51396,shared_hostkey,0,2,"204.76.203.221+214 share SSH key 27c4af41... (cloned infra)"
+AS51396,proxy_port,8080/3128,9191,new,"HTTP proxy now on 9191 (was port-paired 8080/3128)"
+AS14956,honeylabs_events,~50,206,+312%,PPTP brute-force on 1723 new this week
+AS14956,new_attack,0,1,"PPTP (1723) brute from 144.172.100.63; RDP from 216.126.239.150"
+AS51852,honeylabs_events,~200,143,-29%,.env/.git exfiltration now on PLI-AS (was KPRONET)
+AS51852,new_pattern,0,1,".env/.git exfil from 179.43.150.26 on ports 8001/8443"
+AS198953,honeylabs_events,~100,245,+145%,MSSQL-TDS brute on 17 non-standard ports
+AS200651,honeylabs_events,~50,6,-88%,Tor relay 185.100.87.136 still active, reduced volume
+AS214940,honeylabs_events,~200,9,-96%,.git/.env campaign largely stopped
+AS138915,sponge_sessions,818K,862K,+5%,NTP/SSDP amplification continues; 38.54.2.209 dominant
+AS216246,honeylabs_events,0,1,new,telnet probe from 193.233.91.113
+AS210644,honeylabs_events,0,4,new,port 4028 probes from 147.45.41.132