diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-10 07:14:00 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-10 07:14:00 -0400 |
| commit | 7439049b2d46c035fda40b27d3f64b0b9f48af8a (patch) | |
| tree | 64335a1ba8765780114d873f919952776fc48809 /kevlar/2026-08-10/iocs/README.md | |
| parent | dd7a507679c042a9fa100ea4ff3024b2a8c11826 (diff) | |
feat: update bph iocs
Diffstat (limited to 'kevlar/2026-08-10/iocs/README.md')
| -rw-r--r-- | kevlar/2026-08-10/iocs/README.md | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/kevlar/2026-08-10/iocs/README.md b/kevlar/2026-08-10/iocs/README.md new file mode 100644 index 0000000..d8e5949 --- /dev/null +++ b/kevlar/2026-08-10/iocs/README.md @@ -0,0 +1,17 @@ +# Weekly BP Report -- 2026-08-10 + +Generated: 2026-08-10T11:00:00Z +ASNs covered: 26 +Sponge sessions found: 10,000+ across 21 active ASNs (capped per query) +Honeylabs events found: 12,200+ across 8 ASNs (PFCLOUD, ROUTERHOSTING, PLI-AS, PROTON66, FLOKINET, KPRONET, RU-AEZA, AEZA) +Censys IPs enriched: 8 per-IP + 8 ASN-level aggregations (all BULLETPROOF-labeled) +Anomalies flagged: 5 + +## Key Findings + +- PFCLOUD deployed new 204.76.203.2xx proxy block; 2 nodes share SSH host key (cloned infra) +- ROUTERHOSTING added PPTP brute-force on port 1723; event count +312% +- KPRONET .git/.env exfiltration stopped; pattern moved to PLI-AS +- PROTON66 MSSQL-TDS brute on 17 non-standard ports; event count +145% +- FLOKINET Tor exit relay volume dropped 88% +- KAOPU-HK continues NTP/SSDP amplification (862K sessions from single IP) |