chore: weekly BPH updateHEADmain

1 files changed, 48 insertions, 0 deletions

diff --git a/kevlar/2026-09-07/changes/anomalies.csv b/kevlar/2026-09-07/changes/anomalies.csv
new file mode 100644
index 0000000..6e8c8d1
--- /dev/null
+++ b/kevlar/2026-09-07/changes/anomalies.csv
@@ -0,0 +1,48 @@
+asn,name,severity,type,detail
+"AS57043","HOSTKEY-AS","high","volume_spike","Sponge sessions 6 -> 196 (32.7x)"
+"AS57043","HOSTKEY-AS","medium","new_ports","new dst ports: 80,443,3102,9443,6881"
+"AS210644","AEZA-AS","high","volume_collapse","Sponge sessions 80345 -> 97 (-100%)"
+"AS210644","AEZA-AS","medium","new_ports","new dst ports: 443,8888,22,4145,3128,2080,3125,5678,8254,808,999,1080"
+"AS138915","KAOPU-HK","medium","new_ports","new dst ports: 28591,53,50001,50002,50003,9999,20002,20004,5686"
+"AS14956","ROUTERHOSTING","high","volume_collapse","Sponge sessions 1859 -> 270 (-85%)"
+"AS14956","ROUTERHOSTING","medium","new_ports","new dst ports: 8545,8546,8547,8548,8549,587,7860,8899,8900,445,1723,0"
+"AS51852","PLI-AS","high","volume_collapse","Sponge sessions 737 -> 97 (-87%)"
+"AS51852","PLI-AS","medium","new_ports","new dst ports: 443,8443,5960,6051,7070,7080,8000,8050,2087,5860,6060,2096"
+"AS400992","ZHOUYISAT","medium","new_ports","new dst ports: 2883,2880,2881,2882,2887,2877,2878,2886,2879,2884,2885,25565"
+"AS51396","PFCLOUD","high","volume_spike","Sponge sessions 34932 -> 87938 (2.5x)"
+"AS51396","PFCLOUD","medium","new_ports","new dst ports: 1081,888,1090,1086,1088"
+"AS200651","FLOKINET","medium","new_ports","new dst ports: 8080"
+"AS198953","PROTON66","medium","new_ports","new dst ports: 11443,8443,222,1100,1111,1112,1200"
+"AS214940","KPRONET","medium","new_ports","new dst ports: 2525"
+"AS216309","INVISIONTECH-GROUP-SRL","medium","new_activity","first observed activity: 26 sessions"
+"AS57043","HOSTKEY-AS","medium","new_fingerprints","hassh:98ddc5604ef6a1006a2b49a58759fbe6"
+"AS210644","AEZA-AS","medium","new_fingerprints","ja4:t13i170900_5b57614c22b0_78e6aca7449b, ja4h:ge11nn0500_7992432eef13, ja4h:ge11nn0700_3161ce9d7233, ja4h:po11nn0700_3161ce9d7233, ja4h:ge11nn0500_3012a89e1aee"
+"AS14956","ROUTERHOSTING","medium","new_fingerprints","ja4:t13i181000_85036bcba153_d41ae481755e, ja4h:ge11nn0400_8fd06a127c33, ja4h:ge11nn0400_c3abebcf3d28"
+"AS51852","PLI-AS","medium","new_fingerprints","ja4:t13i190800_9dc949149365_97f8aa674fd9, ja4h:po11nn0500_c5c1780925fe, ja4h:ge11nn0300_0db47b7d240d, ja4h:ge11nn0400_88d30a62b7ad, ja4:t13i131000_f57a46bbacb6_ab7e3b40a677"
+"AS216246","RU-AEZA-AS","medium","new_fingerprints","ja4:t13i181000_85036bcba153_d41ae481755e, ja4h:po11nn0600_def5433ae821"
+"AS198953","PROTON66","medium","new_fingerprints","ja4:t12i210600_76e208dd3e22_f28add8e7af0, ja4h:ge11nn0200_549fad093d6b, ja4h:ge11nn0300_80168362a4ec"
+"AS57043","HOSTKEY-AS","low","censys_host_count_change","visible hosts +908 (now 101919)"
+"AS57043","HOSTKEY-AS","medium","new_cert_issuers","hypervisor.hv, Apple Public EV Server RSA CA 1 - G1, GlobalSign ECC OV SSL CA 2018, GlobalSign RSA OV SSL CA 2018, HARICA DV TLS RSA"
+"AS209847","THE","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, Microsoft TLS G2 RSA CA OCSP 04, vm15882839.example.com, DigiCert Global G2 TLS RSA SHA256 2020 CA1, R13"
+"AS210644","AEZA-AS","medium","new_cert_issuers","HARICA DV TLS RSA, Apple Public EV Server RSA CA 1 - G1, DigiCert Global G2 TLS RSA SHA256 2020 CA1, TRAEFIK DEFAULT CERT, GlobalSign Atlas R46 DV TLS CA 2026 Q3"
+"AS138915","KAOPU-HK","low","censys_host_count_change","visible hosts -1246 (now 12308)"
+"AS138915","KAOPU-HK","medium","new_cert_issuers","QY, tls.internal.ypc.org"
+"AS14956","ROUTERHOSTING","medium","new_cert_issuers","windows-Utah-4H, windows-Utah-2g, AnyDesk Client, Plesk, windows-LasVega"
+"AS216139","IRONHOST","medium","new_cert_issuers","isp13.eurobyte.ru, vps1.dev.mchost.ru, vps1.dev.eurobyte.ru, isp15.eurobyte.ru, GeoTrust TLS RSA CA G1"
+"AS51852","PLI-AS","medium","new_cert_issuers","Hydra Authentication RSA SubCA #154, Proxmox Virtual Environment, Hydra Authentication RSA SubCA #156, Plesk, server.xtreme-results.net"
+"AS400992","ZHOUYISAT","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, Microsoft TLS G2 RSA CA OCSP 04, Apple Public EV Server RSA CA 1 - G1, GlobalSign RSA OV SSL CA 2018, HARICA DV TLS RSA"
+"AS33993","UFO-AS","medium","new_cert_issuers","HARICA DV TLS RSA, GlobalSign RSA OV SSL CA 2018, GlobalSign ECC OV SSL CA 2018, GlobalSign GCC R46 OV TLS CA 2025, Microsoft TLS G2 RSA CA OCSP 04"
+"AS51396","PFCLOUD","medium","new_cert_issuers","Cloudbase-Init WinRM, hosting12.coolsshservers.com, WIN-OU0SUKQBJN2, imap.example.com, srv1.dedusapp.icu"
+"AS213702","QWINS-LTD","medium","new_cert_issuers","GlobalSign Atlas R3 DV TLS CA 2026 Q2, HARICA DV TLS RSA, GlobalSign RSA OV SSL CA 2018, WR1, Apple Public EV Server RSA CA 1 - G1"
+"AS216246","RU-AEZA-AS","medium","new_cert_issuers","HARICA DV TLS RSA, GeoTrust TLS RSA CA G1, WIN-4NFSE1QOBMS, Microsoft TLS G2 RSA CA OCSP 04, GlobalSign GCC R46 OV TLS CA 2025"
+"AS200651","FLOKINET","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, fin01.m-cr.org, Sectigo Public Server Authentication CA DV R36, GlobalSign RSA OV SSL CA 2018, protect@DDoS-Filter.domain"
+"AS30823","AUROLOGIC","medium","new_cert_issuers","WIN-8OA3CCQAE4D, Plesk, Apple Public EV Server RSA CA 1 - G1, DigiCert Global G2 TLS RSA SHA256 2020 CA1, RapidSSL TLS RSA CA G1"
+"AS140666","ADPL-AS-AP","low","censys_host_count_change","visible hosts +3757 (now 6562)"
+"AS140666","ADPL-AS-AP","medium","new_cert_issuers","USDTCDN, SG CA, Root CA, GlobalSign GCC R46 OV TLS CA 2025"
+"AS214351","FEMOIT","medium","new_cert_issuers","vm4980.defhost.co, amgel.yop.nail, def.host.vm, info.devser.loc"
+"AS198953","PROTON66","medium","new_cert_issuers","FASTPANEL, dev-1.secure.host, akrud-1.example.com, mail.the-slasher.com, xmoney-1.example.com"
+"AS200593","PROSPERO-AS","medium","new_cert_issuers","blankilamalice-4.example.com, ads-grab-2.example.com, benjamin-b-2.example.com, AnyDesk Client"
+"AS206728","MEDIALAND-AS","medium","new_cert_issuers","WIN-UKID351J32A"
+"AS211720","Datashield","medium","new_cert_issuers","bad-raven-crab, bright-magenta-, eth0, gentle-red-bee, greedy-cream-ha"
+"AS216309","INVISIONTECH-GROUP-SRL","medium","new_cert_issuers","www.fxzjqfcj6dilr.com"
+"AS58854","KAOPY","medium","new_cert_issuers","宝塔面板, DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1, TrustAsia TLS RSA CA, WIN-M7O7840CVAH, Certum DV TLS G2 R39 CA"
\ No newline at end of file