add: bph report iocs

2 files changed, 77 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/changes/anomalies.csv b/kevlar/2026-08-31/changes/anomalies.csv
new file mode 100644
index 0000000..e42e1f8
--- /dev/null
+++ b/kevlar/2026-08-31/changes/anomalies.csv
@@ -0,0 +1,51 @@
+asn,type,severity,detail

+AS57043,volume,high,top-20 IP session volume +99400% vs prior week (2 -> 1990)

+AS57043,churn,medium,20 new source IPs in top-20 vs prior week

+AS209847,volume,high,top-20 IP session volume +23650% vs prior week (12 -> 2850)

+AS209847,churn,medium,19 new source IPs in top-20 vs prior week

+AS210644,volume,high,top-20 IP session volume +1187100% vs prior week (7 -> 83104)

+AS210644,churn,medium,20 new source IPs in top-20 vs prior week

+AS138915,volume,high,top-20 IP session volume +2118% vs prior week (62216 -> 1380255)

+AS14956,volume,high,top-20 IP session volume +5516% vs prior week (154 -> 8649)

+AS14956,churn,medium,19 new source IPs in top-20 vs prior week

+AS51852,volume,high,top-20 IP session volume +1583% vs prior week (5301 -> 89208)

+AS51852,churn,medium,13 new source IPs in top-20 vs prior week

+AS400992,volume,high,top-20 IP session volume +1269% vs prior week (217 -> 2970)

+AS400992,churn,medium,18 new source IPs in top-20 vs prior week

+AS33993,volume,high,top-20 IP session volume +4700% vs prior week (1 -> 48)

+AS51396,volume,high,top-20 IP session volume +1684% vs prior week (48952 -> 873217)

+AS51396,churn,medium,11 new source IPs in top-20 vs prior week

+AS216246,volume,high,top-20 IP session volume +6677500% vs prior week (1 -> 66776)

+AS216246,churn,medium,20 new source IPs in top-20 vs prior week

+AS200651,volume,high,top-20 IP session volume +1849% vs prior week (167 -> 3255)

+AS200651,churn,medium,17 new source IPs in top-20 vs prior week

+AS30823,volume,high,top-20 IP session volume +241% vs prior week (274 -> 935)

+AS30823,churn,medium,17 new source IPs in top-20 vs prior week

+AS214351,volume,medium,top-20 IP session volume +100% vs prior week (9 -> 18)

+AS198953,volume,high,top-20 IP session volume +18247% vs prior week (677 -> 124209)

+AS198953,churn,medium,16 new source IPs in top-20 vs prior week

+AS200593,volume,high,top-20 IP session volume +14695% vs prior week (20 -> 2959)

+AS200593,churn,medium,16 new source IPs in top-20 vs prior week

+AS214940,volume,high,top-20 IP session volume +3831% vs prior week (219 -> 8609)

+AS214940,churn,medium,17 new source IPs in top-20 vs prior week

+AS211720,volume,high,top-20 IP session volume +1200% vs prior week (23 -> 299)

+AS138915,fingerprint,low,new JA4 fingerprint not in prior week: t13i220900_231e334592e8_29829a46703f

+AS138915,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0400_52fce913cf3b

+AS14956,fingerprint,low,new HASSH fingerprint not in prior week: bf7dbf67fa9b26ee9f9deb99c49320ba

+AS14956,fingerprint,low,new JA4 fingerprint not in prior week: t13i100900_61a7ad8aa9b6_88aa062a14c8

+AS14956,fingerprint,low,new JA4 fingerprint not in prior week: t13i311000_e8f1e7e78f70_d41ae481755e

+AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0300_7fd797acd99d

+AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_9c3956fad5da

+AS14956,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0500_39072d476f20

+AS198953,fingerprint,low,new JA4 fingerprint not in prior week: t13i1010h1_61a7ad8aa9b6_3a8073edd8ef

+AS198953,fingerprint,low,new JA4 fingerprint not in prior week: t13i1010h1_61a7ad8aa9b6_792d2c6655cb

+AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11cn06ru_b2fb244bb31f

+AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_8b1ed2202073

+AS198953,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn05en_3bd45b6f184e

+AS198953,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0500_63d29dec8e1d

+AS198953,fingerprint,low,new JA4H fingerprint not in prior week: po11nn18en_9a6afedbb443

+AS200651,fingerprint,low,new HASSH fingerprint not in prior week: e54ef3ec27fe1fea7ab64d3fa05359fd

+AS200651,fingerprint,low,new JA4 fingerprint not in prior week: t13i1909h2_9dc949149365_97f8aa674fd9

+AS200651,fingerprint,low,new JA4H fingerprint not in prior week: ge11nn0400_88d30a62b7ad

+AS200651,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0500_e4a47a99f1ac

+AS200651,fingerprint,low,new JA4H fingerprint not in prior week: po11nn0600_c9506d37ac14

diff --git a/kevlar/2026-08-31/changes/diff-vs-prior-week.csv b/kevlar/2026-08-31/changes/diff-vs-prior-week.csv
new file mode 100644
index 0000000..385b416
--- /dev/null
+++ b/kevlar/2026-08-31/changes/diff-vs-prior-week.csv
@@ -0,0 +1,26 @@
+asn,cur_top20_sessions,prior_top20_sessions,delta_pct,new_ips,gone_ips,new_ports,gone_ports

+AS57043,1990,2,99400%,20,2,23;22;2222;80;8081;2000;8000;22222;8080;502;1741;3306;2762;7001;6002;4242;548;2150;19,6882

+AS209847,2850,12,23650%,19,0,0;22;443;2222;2096;8080;8443;2053;54321;80;2083;8022;2087;8880;9000;10000;5000;3000;8000,

+AS210644,83104,7,1187100%,20,4,22;8022;2222;22222;80;82;88;1723;25565;50000;1883;53;20002;2376;21;444;110;111;85;143,8890;443;6882;2096

+AS138915,1380255,62216,2118%,7,7,23;34569;49960;4242;54378;46030;28591;35372,22;4466;32108;36748;53;10101;64373;39192

+AS14956,8649,154,5516%,19,19,22222;23;8022;21;13;19;5901;2222;81;26;53;111;82;37,3389;5069;5072;5073;8090;5071;0;5076;5068;5070;5067;5075;1080;5074

+AS216139,150,0,n/a,7,0,22222;2222;22;19898,

+AS51852,89208,5301,1583%,13,13,23;5432;135;8080;8443;3306;3000;27017;5061;5433;8291;8000,139;1723;9090;1701;4000;82;9001;0;9091;4001;591;3001

+AS400992,2970,217,1269%,18,0,8080;22;2222;22222;1080;3128;4022;39222;7235;25565;389;3389;23;222;81;83;2525;82,

+AS33993,48,1,4700%,5,0,22;80;443;0;7860;6379,

+AS51396,873217,48952,1684%,11,11,5900;23;81;5555;8081;82;88;83;4000,1081;3128;8000;443;5678;9993;1088;9050;9051

+AS213702,2341,0,n/a,8,0,443;22;6060;8546;8551;9000;8900;8501;80;8332;8899;8443;3030;1317;8888;2375;8080;3000;8545;8000,

+AS216246,66776,1,6677500%,20,1,8888;8080;80;5000;81;2082;82;3000;1194;110;111;554;1024;21;993;888;53;444;85;143,443

+AS200651,3255,167,1849%,17,1,80;23;22;1080;18190;19009;2222;3128;9006;20001;18264;8888;20201;5555,0

+AS30823,935,274,241%,17,0,443;5060;22;445;27017;23;3306;1434;1521;2222;21;5432;6000;1433;1194;53;1883;2022,

+AS140666,7,0,n/a,4,0,0,

+AS214351,18,9,100%,2,0,42021,

+AS198953,124209,677,18247%,16,1,5405;22222;4433;6001;10443;5678;1434;3389;5000;1800;4443;8888,0;5006;3305;1443;3306;4000;2019;3308;1501;3310;1688;3307

+AS200593,2959,20,14695%,16,0,9443;4433;8443;4443;444;3389;5443;10443;6443;9000;4444;20443;7443;8888;40443;30443;3390,1433

+AS214940,8609,219,3831%,17,4,465;8022;2222;22222;26;8080;8888;3128;48388;1433;110;3306;3000;22;143,

+AS206728,0,0,n/a,0,0,,

+AS211720,299,23,1200%,5,0,5405;5900;3389;8013;0;445;30443;1434;21;40443;1433;50443,10443

+AS216309,0,0,n/a,0,0,,

+AS58854,5,0,n/a,1,0,3389,

+AS202685,0,0,n/a,0,0,,

+AS394711,0,0,n/a,0,0,,