chore: weekly BPH updateHEADmain

4 files changed, 239 insertions, 0 deletions

diff --git a/kevlar/2026-09-07/iocs/README.md b/kevlar/2026-09-07/iocs/README.md
new file mode 100644
index 0000000..7dbe1d9
--- /dev/null
+++ b/kevlar/2026-09-07/iocs/README.md
@@ -0,0 +1,12 @@
+# Weekly BP Report -- 2026-09-07
+
+Generated: 2026-09-07T10:02:32Z
+ASNs covered: 25
+Sponge sessions found (top-talker sums): 138339
+Honeylabs events found (sampled): 416
+Censys IPs enriched: 10
+Anomalies flagged: 47
+
+Baseline note: the 2026-08-31 run cached unbounded Arkime windows. This run
+re-queried the prior week (2026-08-24 to 2026-08-31) with matched 7-day bounds
+for all percentage comparisons. See changes/prior-window-2026-08-24_31.json.
diff --git a/kevlar/2026-09-07/iocs/all-observed-ips.txt b/kevlar/2026-09-07/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..0504e9c
--- /dev/null
+++ b/kevlar/2026-09-07/iocs/all-observed-ips.txt
@@ -0,0 +1,152 @@
+# all observed source IPs, week 2026-08-31 to 2026-09-07 (Sponge + Honeylabs)
+# AS57043 - HOSTKEY-AS
+82.38.67.164  # sponge:162
+5.39.217.86  # sponge:24
+163.5.16.6  # honeylabs:8
+31.207.46.105  # sponge:7
+82.39.165.100  # honeylabs:4
+66.151.40.231  # sponge:2
+82.21.150.241  # sponge:1
+# AS209847 - THE
+77.91.122.2  # sponge:3
+# AS210644 - AEZA-AS
+185.246.217.150  # honeylabs:51
+77.110.110.145  # sponge:45
+138.124.102.8  # sponge:33
+213.165.32.131  # sponge:11
+46.226.167.103  # sponge:7
+85.192.24.119  # sponge:1
+# AS138915 - KAOPU-HK
+38.54.2.209  # sponge:30290
+38.54.2.232  # sponge:13234
+38.54.2.13  # sponge:1438
+38.54.2.75  # sponge:848
+38.54.2.168  # sponge:675
+38.54.2.170  # sponge:674
+38.54.2.221  # sponge:311
+38.60.227.250  # sponge:97
+38.54.2.204  # sponge:75
+38.54.2.203  # sponge:61
+38.54.2.4  # sponge:41
+38.54.2.9  # sponge:29
+38.54.2.91  # sponge:17
+38.54.2.235  # sponge:12
+38.54.2.22  # sponge:11
+38.54.2.195  # sponge:11
+38.54.2.233  # sponge:11
+38.54.2.55  # sponge:8
+38.54.2.71  # sponge:8
+38.54.2.146  # sponge:8
+# AS14956 - ROUTERHOSTING
+144.172.104.123  # sponge:70
+144.172.102.126  # sponge:54
+144.172.97.249  # sponge:50
+45.61.157.82  # honeylabs:32
+144.172.104.147  # sponge:30
+144.172.108.79  # honeylabs:24
+144.172.115.90  # sponge:20
+144.172.99.200  # honeylabs:16
+167.88.168.121  # sponge:7 honeylabs:4
+144.172.117.61  # sponge:8
+216.126.239.215  # honeylabs:8
+107.189.22.128  # sponge:6
+216.126.227.187  # sponge:5 honeylabs:1
+45.61.149.189  # sponge:4 honeylabs:1
+172.86.89.217  # sponge:4
+45.61.183.10  # honeylabs:4
+107.189.26.103  # sponge:2
+144.172.91.28  # sponge:2
+144.172.98.217  # sponge:2
+144.172.112.11  # honeylabs:2
+45.59.117.222  # sponge:1
+45.61.129.23  # sponge:1
+45.61.151.41  # sponge:1
+107.189.27.179  # sponge:1
+144.172.84.178  # sponge:1
+144.172.102.30  # sponge:1
+144.172.100.114  # honeylabs:1
+144.172.99.12  # honeylabs:1
+144.172.115.222  # honeylabs:1
+# AS51852 - PLI-AS
+46.19.138.10  # sponge:50
+179.43.150.26  # sponge:16 honeylabs:16
+179.43.146.27  # sponge:12 honeylabs:2
+179.43.186.220  # sponge:10 honeylabs:3
+46.19.142.226  # sponge:4 honeylabs:6
+141.255.165.66  # honeylabs:5
+141.255.165.67  # sponge:3
+141.255.165.69  # sponge:1
+179.43.189.73  # sponge:1
+# AS400992 - ZHOUYISAT
+23.172.217.87  # sponge:167
+23.172.217.77  # sponge:33
+194.48.142.88  # sponge:25
+194.48.142.134  # sponge:1
+# AS51396 - PFCLOUD
+204.76.203.4  # sponge:56644
+204.76.203.18  # sponge:6091
+45.156.87.13  # sponge:3167
+204.76.203.214  # sponge:2690 honeylabs:25
+204.76.203.222  # sponge:2621 honeylabs:20
+204.76.203.221  # sponge:2600 honeylabs:18
+204.76.203.213  # sponge:2538 honeylabs:20
+176.65.148.243  # sponge:1836 honeylabs:2
+45.156.87.93  # sponge:1572
+176.65.148.84  # sponge:1532
+204.76.203.49  # sponge:1521
+45.153.34.149  # sponge:788
+45.153.34.181  # sponge:787
+45.156.87.166  # sponge:787
+45.135.194.24  # sponge:546
+204.76.203.7  # sponge:487
+176.65.148.93  # sponge:475
+176.65.149.67  # sponge:453
+45.135.193.198  # sponge:410
+45.135.193.193  # sponge:393 honeylabs:8
+176.65.134.48  # honeylabs:4
+176.65.149.27  # honeylabs:1
+176.65.149.31  # honeylabs:1
+176.65.149.212  # honeylabs:1
+# AS216246 - RU-AEZA-AS
+45.151.101.38  # honeylabs:1
+176.124.222.61  # honeylabs:1
+# AS200651 - FLOKINET
+185.100.87.136  # sponge:73 honeylabs:24
+185.100.85.48  # sponge:3
+# AS30823 - AUROLOGIC
+172.86.92.151  # sponge:2
+# AS198953 - PROTON66
+176.120.22.61  # sponge:1415 honeylabs:64
+176.120.22.240  # sponge:44 honeylabs:30
+176.120.22.147  # sponge:8
+193.143.1.66  # honeylabs:6
+176.120.22.123  # sponge:2
+# AS200593 - PROSPERO-AS
+91.215.85.104  # sponge:1
+# AS214940 - KPRONET
+77.83.39.94  # sponge:46
+77.83.39.108  # sponge:11
+77.83.39.144  # sponge:2
+# AS211720 - Datashield
+185.231.33.46  # sponge:20
+# AS216309 - INVISIONTECH-GROUP-SRL
+67.219.214.53  # sponge:2
+67.219.214.90  # sponge:2
+67.219.214.127  # sponge:2
+67.219.214.145  # sponge:2
+67.219.214.154  # sponge:2
+67.219.214.247  # sponge:2
+67.219.214.1  # sponge:1
+67.219.214.2  # sponge:1
+67.219.214.17  # sponge:1
+67.219.214.19  # sponge:1
+67.219.214.27  # sponge:1
+67.219.214.32  # sponge:1
+67.219.214.33  # sponge:1
+67.219.214.36  # sponge:1
+67.219.214.50  # sponge:1
+67.219.214.52  # sponge:1
+67.219.214.55  # sponge:1
+67.219.214.57  # sponge:1
+67.219.214.58  # sponge:1
+67.219.214.60  # sponge:1
diff --git a/kevlar/2026-09-07/iocs/c2-paths.txt b/kevlar/2026-09-07/iocs/c2-paths.txt
new file mode 100644
index 0000000..1ed0dfb
--- /dev/null
+++ b/kevlar/2026-09-07/iocs/c2-paths.txt
@@ -0,0 +1,41 @@
+# notable HTTP paths observed, week 2026-08-31 to 2026-09-07
+/remote/login?lang=en  -- 30 hit(s), AS198953
+/  -- 11 hit(s), AS14956, AS51852, AS200651
+/.env  -- 5 hit(s), AS14956, AS51852
+/login/?login_only=1  -- 3 hit(s), AS51852
+/openid_connect/cpanelid  -- 3 hit(s), AS51852
+/eventmanager  -- 3 hit(s), AS200651
+/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows  -- 3 hit(s), AS200651
+/api/checkin  -- 3 hit(s), AS200651
+/images/transparentpix.gif  -- 3 hit(s), AS200651
+/containers/json  -- 2 hit(s), AS210644
+http://proxy.flarevpn.digital:8080/judge  -- 2 hit(s), AS51396
+/index.php?lang=../../../../../../../../tmp/index1  -- 1 hit(s), AS210644
+/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5("hi"));?>+/tmp/index1.php  -- 1 hit(s), AS210644
+/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello  -- 1 hit(s), AS210644
+/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello  -- 1 hit(s), AS210644
+/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/lib/phpunit/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
+/lib/phpunit/src/Util/PHP/eval-stdin.php  -- 1 hit(s), AS210644
diff --git a/kevlar/2026-09-07/iocs/fingerprints.txt b/kevlar/2026-09-07/iocs/fingerprints.txt
new file mode 100644
index 0000000..c3de1f3
--- /dev/null
+++ b/kevlar/2026-09-07/iocs/fingerprints.txt
@@ -0,0 +1,34 @@
+# fingerprints observed, week 2026-08-31 to 2026-09-07
+# JA4 TLS client fingerprints
+t13i181000_85036bcba153_d41ae481755e  -- 2 IP(s): 45.151.101.38 (AS216246), 45.61.149.189 (AS14956)
+t12i210600_76e208dd3e22_f28add8e7af0  -- 1 IP(s): 176.120.22.240 (AS198953)
+t13i1909h2_9dc949149365_97f8aa674fd9  -- 1 IP(s): 185.100.87.136 (AS200651)
+t13i170900_5b57614c22b0_78e6aca7449b  -- 1 IP(s): 185.246.217.150 (AS210644)
+t13i190800_9dc949149365_97f8aa674fd9  -- 1 IP(s): 46.19.142.226 (AS51852)
+t13i1310h1_f57a46bbacb6_e7c285222651  -- 1 IP(s): 179.43.146.27 (AS51852)
+t13i131000_f57a46bbacb6_ab7e3b40a677  -- 1 IP(s): 179.43.186.220 (AS51852)
+t13i100900_61a7ad8aa9b6_88aa062a14c8  -- 1 IP(s): 144.172.99.12 (AS14956)
+t13i311000_e8f1e7e78f70_d41ae481755e  -- 1 IP(s): 144.172.115.222 (AS14956)
+
+# JA4H HTTP fingerprints
+ge11nn0400_9c3956fad5da  -- 3 IP(s): 176.65.134.48 (AS51396), 179.43.146.27 (AS51852), 167.88.168.121 (AS14956)
+ge11nn0400_88d30a62b7ad  -- 2 IP(s): 185.100.87.136 (AS200651), 179.43.186.220 (AS51852)
+po11nn0600_def5433ae821  -- 1 IP(s): 45.151.101.38 (AS216246)
+ge11nn0200_549fad093d6b  -- 1 IP(s): 176.120.22.240 (AS198953)
+ge11nn0300_80168362a4ec  -- 1 IP(s): 176.120.22.240 (AS198953)
+po11nn0600_c9506d37ac14  -- 1 IP(s): 185.100.87.136 (AS200651)
+po11nn0500_e4a47a99f1ac  -- 1 IP(s): 185.100.87.136 (AS200651)
+ge11nn0500_7992432eef13  -- 1 IP(s): 185.246.217.150 (AS210644)
+ge11nn0700_3161ce9d7233  -- 1 IP(s): 185.246.217.150 (AS210644)
+po11nn0700_3161ce9d7233  -- 1 IP(s): 185.246.217.150 (AS210644)
+ge11nn0500_3012a89e1aee  -- 1 IP(s): 185.246.217.150 (AS210644)
+po11nn0500_c5c1780925fe  -- 1 IP(s): 46.19.142.226 (AS51852)
+ge11nn0300_0db47b7d240d  -- 1 IP(s): 46.19.142.226 (AS51852)
+ge11nn0300_341eb0d8946c  -- 1 IP(s): 179.43.150.26 (AS51852)
+ge11nn0400_8fd06a127c33  -- 1 IP(s): 45.61.149.189 (AS14956)
+ge11nn0400_c3abebcf3d28  -- 1 IP(s): 216.126.227.187 (AS14956)
+ge11nn0300_7fd797acd99d  -- 1 IP(s): 144.172.99.12 (AS14956)
+
+# HASSH SSH fingerprints
+19532158b559096b89b1a5f7d17175b2  -- 1 IP(s): 185.246.217.150 (AS210644)
+98ddc5604ef6a1006a2b49a58759fbe6  -- 1 IP(s): 82.39.165.100 (AS57043)