add: bph report iocs and daily drop helper

1 files changed, 30 insertions, 0 deletions

diff --git a/kevlar/2026-08-23/iocs/README.md b/kevlar/2026-08-23/iocs/README.md
new file mode 100644
index 0000000..f870413
--- /dev/null
+++ b/kevlar/2026-08-23/iocs/README.md
@@ -0,0 +1,30 @@
+# Weekly BP Report -- 2026-08-23
+
+Generated: 2026-08-24T03:05:00Z
+ASNs covered: 25
+Sponge sessions found: 132,852 (17 ASNs active, window 2026-08-17..2026-08-24)
+Honeylabs events found: ~14,000 (13 ASNs with events)
+Censys IPs enriched: 10
+Anomalies flagged: 14 (see changes/anomalies.csv)
+
+## Key findings
+
+1. AUROLOGIC (AS30823): compromised Windows Server 2016 AD domain controller
+   `erp01.ad.reiscrew.de` (45.11.18.33) now runs RDP sweeps (`mstshash=hello`, 455 events).
+2. FLOKINET beacon host 185.100.87.136 rotated endpoint from `/api/client/update`
+   (SPARK COMMIT) to `POST /api/checkin`; same TLS fingerprint both weeks.
+3. PLI-AS +341%: market-maker bot discovery scanner (mmsk-scout/mm-scout), .env prober,
+   DCE/RPC scanner; shared HASSH with PFCLOUD clone fleet persists (week 3).
+4. PFCLOUD proxy-validation fleet confirmed: azenv.net / httpbin.org CONNECT / socks5 /
+   proxy.flarevpn.digital judges; GreyNoise flags Ivanti/Pulse/F5/CrushFTP scanning.
+5. KAOPU-HK 38.54.2.0/24 port-sprawl farm: ~100 HTTP listeners per host.
+6. YE-series Xray panel certs span 6 monitored ASNs; AEZA carries 26k+.
+
+## Sources and errors
+
+- Sponge (Arkime): online, data 2026-03-12..2026-08-24. Tag aggregation returns 0 rows
+  for all ASNs (known limitation); IP/port aggregations used instead.
+- Honeylabs: no rate-limit errors.
+- Censys: 10,000 credits at start of run; ~50 aggregate + 10 host lookups used.
+- Blog post: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-08-23-weekly-bulletproof-report.md
+  (build verified, 0 errors)