add: bph report iocs

4 files changed, 578 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/iocs/README.md b/kevlar/2026-08-31/iocs/README.md
new file mode 100644
index 0000000..1be87b8
--- /dev/null
+++ b/kevlar/2026-08-31/iocs/README.md
@@ -0,0 +1,13 @@
+# Weekly BP Report -- 2026-08-31
+
+Generated: 2026-08-31T12:30:00Z
+ASNs covered: 25
+Sponge top-talker sessions: 2,651,854
+Honeylabs sampled events: 492
+Censys IPs enriched: 10
+Anomalies flagged: 50
+
+## Notes
+- Sponge sensor fleet reconfigured 2026-08-28. Week-over-week deltas vs 2026-08-23 are NOT comparable; this run is the new baseline (see changes/diff-vs-prior-week.csv for recorded raw deltas).
+- Honeypot fleet campaign data (2026-08-28 to 2026-08-31) contributed attack observations and attacker IoCs. Deception internals are excluded by policy.
+- Blog post: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-08-31-weekly-bulletproof-report.md
diff --git a/kevlar/2026-08-31/iocs/all-observed-ips.txt b/kevlar/2026-08-31/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..2a2239c
--- /dev/null
+++ b/kevlar/2026-08-31/iocs/all-observed-ips.txt
@@ -0,0 +1,495 @@
+# Sources observed by Sponge (Arkime) and Honeylabs, 2026-08-24 to 2026-08-31
+
+# AS57043 - HOSTKEY-AS
+103.27.156.128
+151.241.155.245
+151.241.234.73
+151.245.140.36
+151.247.219.40
+167.17.182.242
+185.23.18.151
+193.17.95.129
+193.84.2.233
+212.237.219.206
+38.124.152.45
+38.143.19.97
+46.17.99.102
+66.248.205.4
+80.91.65.247
+82.22.175.192
+82.24.19.158
+89.125.61.139
+89.125.61.90
+91.239.211.68
+
+# AS209847 - THE
+103.231.75.163
+185.231.206.117
+185.231.207.149
+31.222.238.6
+45.12.129.166
+45.12.132.198
+45.12.136.73
+45.12.146.245
+45.144.28.70
+45.82.252.106
+45.83.141.120
+45.83.143.9
+45.83.20.230
+45.83.22.14
+45.89.55.225
+5.181.20.206
+77.91.122.2
+91.225.219.200
+92.118.233.6
+94.131.106.51
+
+# AS210644 - AEZA-AS
+109.107.190.8
+109.120.184.14
+109.172.95.248
+138.124.54.172
+138.124.91.58
+138.124.99.219
+147.45.71.214
+176.124.203.177
+185.103.101.180
+185.103.101.74
+185.246.217.150
+194.76.217.92
+212.113.102.0
+213.165.46.78
+213.165.46.83
+217.144.190.138
+62.60.158.60
+77.221.153.3
+77.221.158.41
+79.137.197.24
+81.19.137.20
+85.192.31.14
+89.208.97.111
+89.22.224.187
+
+# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited)
+154.90.37.55
+38.54.2.107
+38.54.2.112
+38.54.2.120
+38.54.2.13
+38.54.2.135
+38.54.2.148
+38.54.2.152
+38.54.2.168
+38.54.2.170
+38.54.2.195
+38.54.2.203
+38.54.2.204
+38.54.2.209
+38.54.2.221
+38.54.2.232
+38.54.2.61
+38.54.2.75
+38.54.2.82
+38.60.191.241
+38.60.230.109
+
+# AS14956 - ROUTERHOSTING (RouterHosting LLC)
+107.189.17.181
+107.189.26.103
+107.189.27.179
+144.172.100.235
+144.172.109.224
+144.172.110.38
+144.172.111.21
+144.172.115.222
+144.172.116.49
+144.172.94.186
+144.172.94.243
+144.172.99.12
+153.75.82.185
+167.88.165.227
+167.88.165.33
+167.88.165.44
+167.88.166.32
+167.88.168.121
+172.86.113.15
+172.86.113.36
+172.86.114.162
+172.86.114.254
+172.86.116.32
+172.86.116.74
+172.86.117.95
+172.86.123.8
+172.86.90.159
+172.86.90.76
+172.86.91.225
+216.126.225.6
+216.126.227.184
+216.126.239.17
+45.59.117.74
+45.61.129.23
+45.61.170.85
+45.61.177.179
+45.61.177.185
+45.61.182.81
+
+# AS216139 - IRONHOST
+109.120.141.207
+176.98.185.152
+178.208.78.17
+178.208.88.6
+185.72.10.233
+46.30.46.124
+46.30.46.130
+
+# AS51852 - PLI-AS
+141.255.165.66
+141.255.165.67
+141.255.165.68
+141.255.165.69
+179.43.133.154
+179.43.134.114
+179.43.139.58
+179.43.143.170
+179.43.146.226
+179.43.146.227
+179.43.146.27
+179.43.150.26
+179.43.163.26
+179.43.167.2
+179.43.168.58
+179.43.175.234
+179.43.175.236
+179.43.182.200
+179.43.186.223
+179.43.186.241
+185.12.44.133
+190.211.255.210
+46.19.137.194
+46.19.138.10
+81.17.28.130
+81.17.28.131
+
+# AS400992 - ZHOUYISAT-COMMUNICATIONS
+130.12.44.88
+130.12.47.8
+147.45.124.196
+147.45.125.234
+147.45.125.75
+185.121.15.149
+185.121.15.184
+185.219.7.27
+185.236.25.175
+185.236.25.178
+185.250.180.21
+193.46.218.239
+193.46.218.82
+194.48.142.134
+23.172.217.46
+23.172.217.58
+23.172.217.77
+23.172.217.87
+23.177.184.46
+23.177.185.239
+45.150.195.235
+
+# AS33993 - UFO-AS
+141.98.189.206
+185.235.242.122
+193.201.126.15
+45.144.31.247
+45.150.64.125
+45.67.230.246
+
+# AS51396 - PFCLOUD (Pfcloud UG)
+176.65.132.129
+176.65.132.149
+176.65.134.52
+176.65.139.11
+176.65.148.147
+176.65.148.216
+176.65.148.226
+176.65.148.29
+176.65.148.71
+176.65.148.84
+176.65.148.96
+176.65.149.188
+176.65.149.201
+176.65.149.212
+176.65.149.220
+176.65.149.224
+176.65.149.230
+176.65.149.236
+176.65.149.27
+176.65.149.30
+176.65.149.31
+176.65.149.64
+176.65.149.67
+176.65.151.74
+204.76.203.14
+204.76.203.18
+204.76.203.206
+204.76.203.212
+204.76.203.226
+204.76.203.231
+204.76.203.4
+204.76.203.49
+204.76.203.7
+204.76.203.73
+45.135.193.193
+45.135.193.198
+45.135.194.113
+45.135.194.99
+45.153.34.112
+45.153.34.114
+45.153.34.149
+45.153.34.235
+45.156.87.204
+45.156.87.216
+45.156.87.253
+45.156.87.254
+77.83.39.94
+94.183.174.77
+
+# AS213702 - QWINS-LTD
+185.238.191.130
+78.40.209.57
+80.253.249.170
+84.21.189.148
+89.125.48.168
+89.125.48.64
+95.164.123.100
+95.164.53.44
+
+# AS216246 - RU-AEZA-AS
+138.124.14.150
+176.124.222.35
+176.124.222.50
+176.124.222.72
+178.159.94.237
+178.159.94.48
+178.20.208.185
+178.20.208.195
+185.103.100.48
+185.221.199.82
+185.96.80.121
+194.26.229.20
+77.110.105.96
+77.221.151.241
+79.137.192.106
+82.117.87.156
+82.117.87.221
+85.192.30.189
+85.192.30.81
+85.192.56.190
+
+# AS200651 - FLOKINET
+185.10.68.109
+185.10.68.96
+185.100.84.164
+185.100.84.174
+185.100.85.79
+185.100.87.136
+185.146.232.118
+185.146.232.125
+185.146.232.142
+185.146.232.145
+185.146.232.146
+185.146.233.211
+185.165.169.121
+185.165.169.248
+185.165.171.158
+185.246.188.74
+185.246.190.66
+185.246.191.8
+185.247.225.201
+37.228.129.67
+
+# AS30823 - AUROLOGIC (aurologic GmbH)
+152.89.244.135
+152.89.246.217
+160.20.144.83
+172.86.92.75
+172.86.93.168
+172.86.93.173
+172.86.93.75
+172.86.94.229
+172.86.94.48
+172.86.94.49
+172.86.94.82
+172.86.95.26
+172.86.95.45
+216.126.229.131
+41.216.188.21
+45.11.16.143
+45.11.18.33
+45.138.173.7
+45.153.243.249
+
+# AS140666 - ADPL-AS-AP (ANY DIGITAL PTE. LTD.)
+154.94.68.6
+204.3.179.2
+204.3.179.3
+204.3.250.24
+
+# AS214351 - FEMOIT
+192.162.199.180
+62.60.226.150
+62.60.226.176
+62.60.226.186
+62.60.226.79
+
+# AS198953 - PROTON66
+176.120.22.113
+176.120.22.122
+176.120.22.123
+176.120.22.135
+176.120.22.147
+176.120.22.16
+176.120.22.179
+176.120.22.240
+176.120.22.42
+176.120.22.43
+176.120.22.52
+176.120.22.6
+176.120.22.61
+176.120.22.66
+176.120.22.73
+193.143.1.66
+37.77.150.10
+37.77.150.119
+37.77.150.241
+37.77.150.67
+37.77.150.83
+
+# AS200593 - PROSPERO-AS
+193.24.123.118
+193.24.123.148
+193.24.123.16
+193.24.123.23
+193.24.123.55
+193.24.123.58
+193.24.123.63
+91.202.233.121
+91.202.233.29
+91.202.233.33
+91.202.233.46
+91.202.233.79
+91.202.233.8
+91.202.233.82
+91.215.85.104
+91.215.85.106
+91.215.85.142
+91.215.85.193
+91.215.85.34
+91.215.85.40
+
+# AS214940 - KPRONET
+45.144.212.221
+45.144.212.40
+45.144.212.53
+77.83.39.104
+77.83.39.117
+77.83.39.119
+77.83.39.14
+77.83.39.159
+77.83.39.197
+77.83.39.24
+77.83.39.27
+77.83.39.36
+77.83.39.42
+77.83.39.54
+77.83.39.6
+77.83.39.72
+77.83.39.82
+77.83.39.84
+77.83.39.86
+77.83.39.94
+
+# AS211720 - Datashield, Inc.
+185.231.32.24
+185.231.32.25
+185.231.33.22
+185.231.33.30
+185.231.33.38
+185.231.33.46
+
+# AS58854 - KAOPY (Kaopu Cloud)
+103.236.255.202
+
+# Honeypot fleet - attacker hosts (3-day campaigns, 2026-08-28 to 2026-08-31)
+# Feo Prest SRL (DE) - credential sweeps
+213.209.159.175
+
+# SS-Net (RO) - credential sweeps, cross-node
+80.94.95.211
+
+# Pfcloud UG (NL) - continuous low-and-slow recon
+204.76.203.18
+
+# Techoff Srv Ltd (NL/BG) - industrial template sweeps
+45.148.10.183
+45.148.10.238
+93.123.109.163
+
+# RMP Protection Ltd (BG) - CI/SSH config crawler
+93.152.223.194
+
+# Bulgarian-linked - control-node credential sweep
+87.120.104.29
+
+# State Cyber Protection (UA) - scanner
+193.29.204.107
+
+# Datacamp/CDN (DE) - malware dropper dictionary blast
+169.150.201.29
+
+# Google Cloud - template sweeps / xmlrpc brute / metadata hunt
+35.245.230.215
+136.110.80.233
+34.166.182.179
+34.50.64.250
+34.92.76.191
+35.247.178.64
+34.28.244.5
+34.63.40.186
+
+# DigitalOcean - registry-hunt rotation (3 IP sets, 3 days)
+206.189.19.19
+159.89.127.165
+64.225.75.246
+178.128.207.138
+142.93.129.190
+165.22.34.189
+157.245.113.227
+167.71.175.236
+143.110.213.72
+207.154.212.47
+143.244.168.161
+143.110.217.244
+159.223.132.86
+157.230.19.140
+64.227.32.66
+
+# DELTA Fiber Nederland (residential) - NightAgent multi-stage intrusion
+81.172.241.94
+
+# WorldStream B.V. (NL) - WHM/cPanel + wp-batch probes
+185.165.242.182
+
+# HostRoyale Technologies (US) - WHM/cPanel + wp-batch probes
+43.225.189.141
+
+# Miteflux Technologies (AE) - POST-heavy prober
+31.59.160.30
+
+# Alibaba (SG) - scanner
+47.84.110.109
+
+# Akamai Connected Cloud (ID) - scanner
+172.232.253.221
+
+# Office National des Postes (MA) - POST-bearing phpunit/wp-batch
+41.251.202.89
+105.138.220.253
+
diff --git a/kevlar/2026-08-31/iocs/c2-paths.txt b/kevlar/2026-08-31/iocs/c2-paths.txt
new file mode 100644
index 0000000..8503a7b
--- /dev/null
+++ b/kevlar/2026-08-31/iocs/c2-paths.txt
@@ -0,0 +1,24 @@
+# Notable paths, 2026-08-24 to 2026-08-31
+
+/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- PHPUnit RCE swarm, 3 days, fleet-wide; NightAgent POST variant carries <?php echo "NightAgent";?>
+/v2/_catalog  -- Docker Registry catalog enumeration (registry-hunt campaign)
+/v2/internal/api-gateway/tags/list  -- internal registry enumeration (registry-hunt)
+/v2/internal/api-gateway/manifests/latest  -- internal registry enumeration (registry-hunt)
+/v2/internal/auth-service/tags/list  -- internal registry enumeration (registry-hunt)
+/console/  -- WebLogic console login probe (registry-hunt journey step)
+/login.action  -- Confluence login probe (registry-hunt journey step)
+/___proxy_subdomain_whm/login, /___proxy_subdomain_cpanel  -- WHM/cPanel proxy-subdomain probes
+/xmlrpc.php  -- 8,146 POST brute in 31 minutes (34.63.40.186, GCP)
+/wp-json/batch/v1  -- WordPress batch abuse; forged X-Forwarded-For: 127.0.0.1 on all requests; SQLi multiplex variant carries UNION SELECT with CONCAT(0x7c7c, HEX(...), 0x7c7c)
+/fetch, /proxy  -- SSRF proxy discovery (metadata-hunt campaign)
+/.mcp.json  -- MCP endpoint discovery probe
+/@fs/etc/passwd, /@fs/proc/self/environ  -- Vite dev-server traversal probes
+/global-protect/login.esp  -- Palo Alto GlobalProtect login brute (176.120.22.43)
+/+CSCOE+/logon.html  -- Cisco ASA clientless VPN login probe (176.120.22.43)
+/api/checkin  -- beacon checkin (FLOKINET 185.100.87.136)
+/eventmanager  -- beacon poll (FLOKINET 185.100.87.136)
+/api/client/update?arch=amd64&commit=08059e95dacaf  -- beacon update pull (FLOKINET 185.100.87.136)
+/v1/getinfo  -- high-port agent info request (AEZA 147.45.71.214)
+http://azenv.net/  -- proxy validation target (PFCLOUD 204.76.203.7)
+/1.bat, /0x83911d24Fx.sh, /.tygahhh/ENCRYPTED.ps1  -- malware dropper dictionary samples (169.150.201.29)
+/.env, /.aws/credentials, /.azure/credentials, /tfstate, /firebase.json  -- credential harvest sweep paths (CREDSWEEP)
diff --git a/kevlar/2026-08-31/iocs/fingerprints.txt b/kevlar/2026-08-31/iocs/fingerprints.txt
new file mode 100644
index 0000000..344497d
--- /dev/null
+++ b/kevlar/2026-08-31/iocs/fingerprints.txt
@@ -0,0 +1,46 @@
+# Fingerprints observed via Honeylabs, 2026-08-24 to 2026-08-31
+
+t12i130500_2d7513195f68_e51b7354d87f  -- JA4, AS210644 (AEZA-AS), source 217.144.190.138
+ge11nn0500_9af7e0472034  -- JA4H, AS210644 (AEZA-AS), source 217.144.190.138
+ge11nn0400_88d30a62b7ad  -- JA4H, AS210644 (AEZA-AS), source 217.144.190.138
+t13i1909h2_9dc949149365_97f8aa674fd9  -- JA4, AS210644 (AEZA-AS), source 147.45.71.214
+19532158b559096b89b1a5f7d17175b2  -- HASSH, AS210644 (AEZA-AS), source 185.246.217.150
+t13i190900_9dc949149365_e7c285222651  -- JA4, AS210644 (AEZA-AS), source 176.124.203.177
+t13i220900_231e334592e8_29829a46703f  -- JA4, AS138915 (KAOPU-HK (Kaopu Cloud HK Limited)), source 154.90.37.55
+po11nn0400_52fce913cf3b  -- JA4H, AS138915 (KAOPU-HK (Kaopu Cloud HK Limited)), source 154.90.37.55
+ge11nn0500_39072d476f20  -- JA4H, AS14956 (ROUTERHOSTING (RouterHosting LLC)), source 107.189.26.103
+t13i100900_61a7ad8aa9b6_88aa062a14c8  -- JA4, AS14956 (ROUTERHOSTING (RouterHosting LLC)), source 144.172.99.12
+ge11nn0300_7fd797acd99d  -- JA4H, AS14956 (ROUTERHOSTING (RouterHosting LLC)), source 144.172.99.12
+bf7dbf67fa9b26ee9f9deb99c49320ba  -- HASSH, AS14956 (ROUTERHOSTING (RouterHosting LLC)), source 45.61.182.81
+ge11nn0400_9c3956fad5da  -- JA4H, AS14956 (ROUTERHOSTING (RouterHosting LLC)), source 167.88.168.121
+t13i311000_e8f1e7e78f70_d41ae481755e  -- JA4, AS14956 (ROUTERHOSTING (RouterHosting LLC)), source 144.172.115.222
+ge11nn0400_9c3956fad5da  -- JA4H, AS51852 (PLI-AS), source 81.17.28.131
+ge11nn0300_341eb0d8946c  -- JA4H, AS51852 (PLI-AS), source 179.43.150.26
+t13i1310h1_f57a46bbacb6_e7c285222651  -- JA4, AS51852 (PLI-AS), source 179.43.146.27
+ge11nn0400_9c3956fad5da  -- JA4H, AS51396 (PFCLOUD (Pfcloud UG)), source 45.135.194.113
+ge11nn0400_88d30a62b7ad  -- JA4H, AS51396 (PFCLOUD (Pfcloud UG)), source 176.65.149.236
+t13i140900_cbb2034c60b8_e7c285222651  -- JA4, AS51396 (PFCLOUD (Pfcloud UG)), source 176.65.148.226
+ge11nn0500_cac2c496544b  -- JA4H, AS51396 (PFCLOUD (Pfcloud UG)), source 176.65.148.226
+ge11nn0500_9af7e0472034  -- JA4H, AS51396 (PFCLOUD (Pfcloud UG)), source 176.65.149.201
+t13i190800_9dc949149365_97f8aa674fd9  -- JA4, AS51396 (PFCLOUD (Pfcloud UG)), source 45.135.193.198
+ge10nn0200_3ed38b250d3d  -- JA4H, AS51396 (PFCLOUD (Pfcloud UG)), source 45.135.193.198
+t13i1909h2_9dc949149365_97f8aa674fd9  -- JA4, AS51396 (PFCLOUD (Pfcloud UG)), source 176.65.149.188
+ge11nn0500_d3a2dcb1cd63  -- JA4H, AS51396 (PFCLOUD (Pfcloud UG)), source 176.65.148.71
+t13i251000_b78ed14e2fd0_ab7e3b40a677  -- JA4, AS51396 (PFCLOUD (Pfcloud UG)), source 77.83.39.94
+e54ef3ec27fe1fea7ab64d3fa05359fd  -- HASSH, AS200651 (FLOKINET), source 185.100.87.136
+po11nn0600_c9506d37ac14  -- JA4H, AS200651 (FLOKINET), source 185.100.87.136
+t13i1909h2_9dc949149365_97f8aa674fd9  -- JA4, AS200651 (FLOKINET), source 185.100.87.136
+ge11nn0400_88d30a62b7ad  -- JA4H, AS200651 (FLOKINET), source 185.100.87.136
+po11nn0500_e4a47a99f1ac  -- JA4H, AS200651 (FLOKINET), source 185.100.87.136
+ge11nn0500_2d30dc89d981  -- JA4H, AS214351 (FEMOIT), source 192.162.199.180
+t13i1010h1_61a7ad8aa9b6_792d2c6655cb  -- JA4, AS198953 (PROTON66), source 176.120.22.43
+po11nn18en_9a6afedbb443  -- JA4H, AS198953 (PROTON66), source 176.120.22.43
+t13i1010h1_61a7ad8aa9b6_3a8073edd8ef  -- JA4, AS198953 (PROTON66), source 176.120.22.43
+ge11nn0400_8b1ed2202073  -- JA4H, AS198953 (PROTON66), source 176.120.22.43
+ge11cn06ru_b2fb244bb31f  -- JA4H, AS198953 (PROTON66), source 176.120.22.43
+po11nn0500_63d29dec8e1d  -- JA4H, AS198953 (PROTON66), source 176.120.22.43
+ge11nn05en_3bd45b6f184e  -- JA4H, AS198953 (PROTON66), source 176.120.22.43
+
+# Cross-run correlations
+t13i1909h2_9dc949149365_97f8aa674fd9  -- beacon family: FLOKINET 185.100.87.136 (prior weeks) AND AEZA 147.45.71.214 (this week)
+