1 files changed, 89 insertions, 0 deletions
diff --git a/2026/asn215540-report/honeylabs-data.md b/2026/asn215540-report/honeylabs-data.md
new file mode 100644
index 0000000..2c6f520
--- /dev/null
+++ b/2026/asn215540-report/honeylabs-data.md
@@ -0,0 +1,89 @@
+# Honeylabs Telemetry Data
+
+## ASN 215540 Enrichment (30 days: May 9 - Jun 9)
+
+- Total events: 724
+- Unique source IPs: 21
+- First seen: 2026-05-09T08:51:23
+- Last seen: 2026-06-09T10:48:20
+
+### Top Ports Targeted
+
+80, 443, 22, 2087, 2375, 2086, 5002, 2222, 2443, 18789
+
+### Source Countries
+
+FI (Finland), NL (Netherlands), NO (Norway), FR (France), US (United States)
+
+### Top Source IPs
+
+178.17.53.215 (278 events)
+89.185.81.112 (95 events)
+5.253.59.171 (48 events)
+147.45.50.147 (48 events)
+147.45.50.171 (47 events)
+147.45.50.108 (47 events) -- GreyNoise MALICIOUS admin panel
+194.87.216.198 (46 events)
+109.172.55.64 (46 events) -- Same SSH build as target IPs
+78.153.155.71 (18 events)
+178.130.47.195 (17 events)
+
+## ASN 215540 Enrichment (90 days: Mar 11 - Jun 9)
+
+- Total events: 1,973
+- Unique source IPs: 58
+- Top ports: 443, 80, 1723, 2087, 22, 2375, 2222, 2086, 8443, 25565
+- Source countries: NL, FI, US, RU, NO
+
+## IOC Lookups on Target IPs
+
+All three target IPs (92.118.112.230, 89.185.80.144, 89.185.80.183):
+
+- **Total events: 0** (not observed in honeypot data)
+- No activity in the retained window on any port/protocol monitored
+
+## Global Attack Timeline (30 days: May 9 - Jun 9)
+
+```
+Date       Events    Unique Sources
+2026-05-09  182,677   9,664
+2026-05-10  208,198   9,527
+2026-05-11  117,326   9,952
+2026-05-12  147,346  10,068
+2026-05-13  126,539   9,508
+2026-05-14  154,697   9,481
+2026-05-15  138,283   9,065
+2026-05-16  123,784   8,310
+2026-05-17   96,388   7,553
+2026-05-18  232,171   7,736
+2026-05-19  134,117   8,076
+2026-05-20  109,114   7,627
+2026-05-21  156,160   7,983
+2026-05-22   92,009   7,585
+2026-05-23   89,882   7,160
+2026-05-24  113,648   7,130
+2026-05-25  110,080   7,583
+2026-05-26  206,768   7,733
+2026-05-27   93,606   7,477
+2026-05-28  177,479   8,148
+2026-05-29  127,072   8,751
+2026-05-30  191,029   8,314
+2026-05-31  201,908   8,266
+2026-06-01  119,234   8,710
+2026-06-02  166,775   9,009
+2026-06-03  147,398   9,263
+2026-06-04  135,744   9,221
+2026-06-05  127,141   8,591
+2026-06-06  122,880   7,649
+2026-06-07  119,033   7,100
+2026-06-08  170,475   7,787
+2026-06-09  168,843   7,652
+```
+
+## Top ASNs by Event Count (90 days)
+
+1. ASN 14061 (DigitalOcean): 1,494,911 events, 13,120 unique IPs
+2. ASN 396982 (Google LLC): 1,058,293 events, 5,715 IPs
+3. ASN 135377 (UCLOUD HK): 732,199 events, 850 IPs
+4. ASN 398705 (Censys Inc): 545,368 events, 16 IPs
+5. ASN 202425 (IP Volume inc): 530,594 events, 65 IPs -- same provider type as 215540