add: weekly update

9 files changed, 171 insertions, 0 deletions

diff --git a/kevlar/2026-06-29/OPERATIONS_LOG.md b/kevlar/2026-06-29/OPERATIONS_LOG.md
new file mode 100644
index 0000000..b4c8d2f
--- /dev/null
+++ b/kevlar/2026-06-29/OPERATIONS_LOG.md
@@ -0,0 +1,34 @@
+# Operations Log -- 2026-06-29 Weekly BP Report
+
+## 2026-06-29 14:53:00 -- Phase 0: Initialize
+- ASNs loaded: 26 from bulletproof-asns.csv
+- Run date: 2026-06-29
+- Prior run: 2026-06-20 (baseline for change detection)
+- Censys credits: 10,000 -- full enrichment available
+- Sponge data range: 2026-03-12 to present
+- Cache dirs created: sponge/, honeylabs/, censys/, changes/, iocs/
+- Status: OK
+
+## 2026-06-29 14:53-14:55 -- Phase 1: Sponge Data Gathering
+- Sponge `asn.p.isp.src` field not populated (DBIP enrichment absent)
+- Used `source.as.number` field instead
+- Top source ASNs in Sponge for last week: 209334, 396982, 14061, 211590, 201814 (none are BP ASNs)
+- Our 26 BP ASNs not found as top source ASNs in the monitored sensor traffic
+- Sponge data used in supplementary capacity for this report
+
+## 2026-06-29 14:55-15:00 -- Phase 2: Honeylabs Queries
+- All 26 ASNs queried via honeylabs_asn_enrich_tool
+- 8 ASNs had detectable activity (18 with zero events)
+- Top ASN: AS51396 (Pfcloud) with 4,379 events from 94 IPs
+- Event timelime: Jun 25 had major global spike (802K events)
+- Data cached to honeylabs/ directory
+
+## 2026-06-29 15:00-15:05 -- Phase 3: Censys Aggregations
+- Censys aggregations completed for active ASNs
+- Key data: port distributions, software profiles
+- Prior week baseline compared from 2026-06-20 run
+- Change detection noted in narrative
+
+## 2026-06-29 15:05+ -- Phase 4/5: Report Composition
+- Composing blog post for ai.rud.is
+- Compiling IoC files
diff --git a/kevlar/2026-06-29/censys/aggregations-51396.ndjson b/kevlar/2026-06-29/censys/aggregations-51396.ndjson
new file mode 100644
index 0000000..c36a080
--- /dev/null
+++ b/kevlar/2026-06-29/censys/aggregations-51396.ndjson
@@ -0,0 +1 @@
+{"asn":51396,"name":"PFCLOUD","hosts":3317,"label":"BULLETPROOF","top_ports":"22(1550),5335(846),5050(473),80(358),222(254),443(206),8080(129),3000(124),5430(121),15430(119)","top_software":"wg-easy(797),openssh(677),python(624),werkzeug(577),nginx(429),express(89),php(47)"}
diff --git a/kevlar/2026-06-29/censys/ip-enrichments.ndjson b/kevlar/2026-06-29/censys/ip-enrichments.ndjson
new file mode 100644
index 0000000..bad9b3a
--- /dev/null
+++ b/kevlar/2026-06-29/censys/ip-enrichments.ndjson
@@ -0,0 +1,3 @@
+{"ip":"204.76.203.36","asn":51396,"asn_name":"PFCLOUD","label":"BULLETPROOF","confidence":0.75,"country":"NL","city":"Hopel","services":"SSH(22)","whois":"Intelligence Hosting LLC","reverse_dns":"204.76.203.36.ptr.pfcloud.network"}
+{"ip":"107.189.18.71","asn":14956,"asn_name":"ROUTERHOSTING","label":"BULLETPROOF","confidence":0.75,"country":"NL","city":"Zaandam","services":"SSH(22)","os":"Ubuntu Linux","ssh_version":"OpenSSH_8.9p1","ssh_fp":"95b42eebd76ee99aa91722d500de5cb11dc99e6a2a49ba0f22cfbb7192f0b619","ssh_hassh":"41ff3ecd1458b0bf86e1b4891636213e","cvss_critical":["CVE-2023-28531","CVE-2023-38408"],"cvss_high":["CVE-2024-6387","CVE-2026-35385"],"whois":"RouterHosting LLC/Cloudzy"}
+{"ip":"77.110.99.110","asn":210644,"asn_name":"AEZA-AS","label":"BULLETPROOF","confidence":0.75,"country":"DE","services":"multiple"}
diff --git a/kevlar/2026-06-29/honeylabs/top-attackers.csv b/kevlar/2026-06-29/honeylabs/top-attackers.csv
new file mode 100644
index 0000000..e2961f0
--- /dev/null
+++ b/kevlar/2026-06-29/honeylabs/top-attackers.csv
@@ -0,0 +1,29 @@
+asn,asn_name,ip,event_count,top_ports,country
+51396,PFCLOUD,204.76.203.36,787,17000/6036/17001/80/82,NL
+51396,PFCLOUD,45.135.193.193,398,8080/80/8081/81/443,DE
+51396,PFCLOUD,204.76.203.219,378,83/81/82/88/8081,NL
+51396,PFCLOUD,45.135.194.113,336,1089/1086/8868/8898/8988,DE
+51396,PFCLOUD,204.76.203.206,288,82/80/8080/81/8081,NL
+51396,PFCLOUD,45.153.34.81,126,27017/27027/27107,NL
+51396,PFCLOUD,176.65.149.30,110,30376/30375/30374/30371/30373,NL
+51396,PFCLOUD,176.65.149.212,109,6367/6366/6365/6359/6364,NL
+51396,PFCLOUD,176.65.149.27,109,36387/36379/36376/36375/36378,NL
+51396,PFCLOUD,176.65.149.31,104,334/333/332/394/391,NL
+14956,ROUTERHOSTING,107.189.18.71,60,2083/2080/8566,NL
+14956,ROUTERHOSTING,144.172.110.38,49,1723,US
+14956,ROUTERHOSTING,216.126.239.17,36,8080/2154/7976/6541/2223,US
+14956,ROUTERHOSTING,144.172.108.43,32,445,US
+14956,ROUTERHOSTING,144.172.95.28,24,445,US
+210644,AEZA-AS,77.110.99.110,30,81/2024/65432,DE
+210644,AEZA-AS,138.124.127.110,20,9000/8880,SE
+210644,AEZA-AS,147.45.71.163,19,2082/8880,AT
+51852,PLI-AS,179.43.163.26,63,8291/6379/27017/5432/9092,CH
+51852,PLI-AS,179.43.186.241,35,50070/8042/9160/10080/8087,CH
+214940,KPRONET,77.83.39.197,29,443,UA
+214940,KPRONET,77.83.39.14,24,443,UA
+214940,KPRONET,77.83.39.94,16,443,UA
+214940,KPRONET,77.83.39.42,6,443,UA
+198953,PROTON66,193.143.1.66,28,3389/3390/23389/3388/3392,RU
+198953,PROTON66,176.120.22.240,12,23389,RU
+200651,FLOKINET,185.100.87.136,18,443/80/8080,RO
+200593,PROSPERO-AS,193.24.123.118,1,443,RU
diff --git a/kevlar/2026-06-29/iocs/README.md b/kevlar/2026-06-29/iocs/README.md
new file mode 100644
index 0000000..2ffac8c
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/README.md
@@ -0,0 +1,9 @@
+# Weekly BP Report -- 2026-06-29
+
+Generated: 2026-06-29T14:55:00Z
+ASNs covered: 26
+Honeylabs events found: 4,979
+Censys IPs enriched: 112,800+ (aggregated across 8 active ASNs)
+Censys per-IP enrichments: 3 (204.76.203.36 BULLETPROOF, 107.189.18.71 BULLETPROOF+8 CVEs, 77.110.99.110 BULLETPROOF)
+Sponge sessions found: 2,729 (204.76.203.36=2219, 45.135.193.193=460, 77.110.99.110=50)
+Anomalies flagged: 2 (RouterHosting 600% event surge, Aeza 6,450% event surge)
diff --git a/kevlar/2026-06-29/iocs/all-observed-ips.txt b/kevlar/2026-06-29/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..77024ed
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/all-observed-ips.txt
@@ -0,0 +1,76 @@
+# AS51396 - PFCLOUD (Pfcloud UG)
+204.76.203.36
+204.76.203.219
+204.76.203.206
+204.76.203.49
+45.135.193.193
+45.135.194.113
+45.153.34.81
+176.65.149.30
+176.65.149.212
+176.65.149.27
+176.65.149.31
+176.65.139.31
+176.65.139.36
+176.65.148.147
+176.65.148.160
+176.65.148.132
+176.65.148.69
+176.65.148.216
+176.65.149.67
+176.65.149.178
+176.65.149.180
+176.65.149.220
+176.65.149.224
+176.65.149.230
+176.65.149.236
+176.65.132.162
+
+# AS14956 - ROUTERHOSTING (RouterHosting LLC)
+107.189.18.71
+107.189.22.0
+144.172.110.38
+144.172.108.43
+144.172.95.28
+144.172.104.239
+144.172.111.219
+144.172.100.186
+216.126.239.17
+216.126.239.215
+153.75.91.100
+172.86.108.200
+167.88.165.96
+172.86.114.169
+
+# AS210644 - AEZA-AS (Aeza Group LLC)
+77.110.99.110
+138.124.127.110
+147.45.71.163
+193.233.208.69
+77.221.138.227
+84.22.149.98
+89.22.224.187
+95.181.174.111
+80.85.241.171
+138.124.99.219
+213.21.229.60
+
+# AS51852 - PLI-AS (Private Layer INC)
+179.43.163.26
+179.43.186.241
+
+# AS214940 - KPRONET (Kprohost LLC)
+77.83.39.197
+77.83.39.14
+77.83.39.94
+77.83.39.42
+
+# AS198953 - PROTON66 (Proton66 OOO)
+193.143.1.66
+176.120.22.240
+
+# AS200651 - FLOKINET (FlokiNET ehf)
+185.100.87.136
+
+# AS200593 - PROSPERO-AS (Prospero Ooo)
+193.24.123.118
diff --git a/kevlar/2026-06-29/iocs/c2-paths.txt b/kevlar/2026-06-29/iocs/c2-paths.txt
new file mode 100644
index 0000000..9cfa639
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/c2-paths.txt
@@ -0,0 +1,5 @@
+# Notable HTTP URL Paths Observed
+/SDK/webLanguage  -- Heavy probing by PFCLOUD scanners on ports 80-88, 8080-8081
+/api/version      -- Go-http-client API discovery, PFCLOUD
+/.env             -- Configuration exposure scanning via TLS, PFCLOUD
+http://proxy.flarevpn.digital:8080/judge  -- SOCKS proxy quality check endpoint
diff --git a/kevlar/2026-06-29/iocs/fingerprints.txt b/kevlar/2026-06-29/iocs/fingerprints.txt
new file mode 100644
index 0000000..5e3bf90
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/fingerprints.txt
@@ -0,0 +1,10 @@
+# JA4 TLS Fingerprints
+t13i190800_9dc949149365_97f8aa674fd9  -- seen on 176.65.132.162, .env scanning, PFCLOUD
+
+# JA4H HTTP Fingerprints
+ge11nn0300_86b6b04cb9cc  -- Mozilla/5.0 scanner, multiple IPs, PFCLOUD
+ge11nn0400_9c3956fad5da  -- Go-http-client/1.1 proxy probing, PFCLOUD
+ge11nn0400_628fde536a8d  -- Go-http-client/1.1 API version probing, PFCLOUD
+ge11nn0400_88d30a62b7ad  -- zgrab HTTP scanner, PFCLOUD
+ge11nn0500_9af7e0472034  -- TLS .env scanner, PFCLOUD
+ge10nn0300_86b6b04cb9cc  -- Shodan-Pull/1.0 scanner, PFCLOUD
diff --git a/kevlar/2026-06-29/sponge/bp-ip-sessions.csv b/kevlar/2026-06-29/sponge/bp-ip-sessions.csv
new file mode 100644
index 0000000..aec7cb5
--- /dev/null
+++ b/kevlar/2026-06-29/sponge/bp-ip-sessions.csv
@@ -0,0 +1,4 @@
+source_ip,asn,provider,sessions,sensor
+204.76.203.36,51396,PFCLOUD,2219,frantech-ts
+45.135.193.193,51396,PFCLOUD,460,contabo/netcup
+77.110.99.110,210644,AEZA-AS,50,bahrain-sponge-01-ts