4 files changed, 105 insertions, 0 deletions
diff --git a/kevlar/2026-06-08/iocs/README.md b/kevlar/2026-06-08/iocs/README.md
new file mode 100644
index 0000000..9f5dce8
--- /dev/null
+++ b/kevlar/2026-06-08/iocs/README.md
@@ -0,0 +1,7 @@
+# Weekly BP Report -- 2026-06-08
+
+Generated: 2026-06-08T12:00:00Z
+ASNs covered: 26
+Honeylabs events found: ~10,000+
+Censys IPs enriched: 5
+Anomalies flagged: 2 (Pfcloud riptide framework, FlokiNET SPARK C2 beacon)
diff --git a/kevlar/2026-06-08/iocs/all-observed-ips.txt b/kevlar/2026-06-08/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..b2ca14c
--- /dev/null
+++ b/kevlar/2026-06-08/iocs/all-observed-ips.txt
@@ -0,0 +1,81 @@
+# AS57043 - HOSTKEY-AS (Hostkey B.V.)
+82.21.114.69
+# AS209847 - THE (WorkTitans B.V.)
+185.231.207.151
+45.83.20.230
+89.221.225.114
+# AS210644 - AEZA-AS (Aeza International Ltd)
+213.165.33.246
+85.192.27.231
+77.221.152.105
+# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited)
+154.205.145.161
+38.60.206.69
+# AS14956 - ROUTERHOSTING (RouterHosting LLC)
+216.126.239.17
+167.88.167.247
+144.172.104.117
+45.61.129.23
+167.88.167.188
+167.88.167.134
+167.88.167.210
+167.88.167.221
+167.88.167.212
+167.88.167.159
+167.88.167.204
+167.88.167.246
+167.88.167.207
+172.86.114.63
+172.86.123.119
+172.86.126.246
+167.88.167.9
+172.86.113.252
+167.88.167.252
+167.88.167.154
+# AS51852 - PLI-AS (Private Layer INC)
+179.43.134.114
+179.43.146.227
+179.43.168.58
+179.43.150.26
+179.43.186.241
+# AS51396 - PFCLOUD (Pfcloud UG)
+204.76.203.213
+204.76.203.214
+204.76.203.212
+204.76.203.221
+204.76.203.222
+176.65.139.103
+45.135.193.193
+204.76.203.10
+176.65.149.203
+176.65.139.31
+176.65.139.151
+204.76.203.219
+176.65.139.140
+176.65.139.173
+176.65.139.188
+176.65.149.27
+176.65.149.31
+176.65.139.130
+45.135.194.113
+176.65.149.30
+# AS198953 - PROTON66 (Proton66 OOO)
+176.120.22.147
+37.77.150.67
+176.120.22.74
+176.120.22.240
+176.120.22.192
+37.77.150.72
+193.143.1.66
+176.120.22.113
+193.143.1.109
+# AS200593 - PROSPERO-AS (Prospero Ooo)
+193.24.123.55
+91.202.233.46
+# AS214940 - KPRONET (Kprohost LLC)
+77.83.39.54
+77.83.39.94
+77.83.39.197
+77.83.39.42
+# AS200651 - FLOKINET (FlokiNET ehf)
+185.100.87.136
diff --git a/kevlar/2026-06-08/iocs/c2-paths.txt b/kevlar/2026-06-08/iocs/c2-paths.txt
new file mode 100644
index 0000000..0f7b51c
--- /dev/null
+++ b/kevlar/2026-06-08/iocs/c2-paths.txt
@@ -0,0 +1,5 @@
+/login/?login_only=1  -- cPanel login probe, HOSTKEY, port 2086
+/openid_connect/cpanelid  -- cPanel OpenID probe, HOSTKEY, port 2086
+/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows  -- C2 beacon, FlokiNET, port 443
+/images/json?  -- Docker API enumeration (go-dockerclient), KAOPU-HK, ports 2375/2376/4243
+/debug/pprof  -- pprof endpoint exposed on riptide scanner, Pfcloud, port 666
diff --git a/kevlar/2026-06-08/iocs/fingerprints.txt b/kevlar/2026-06-08/iocs/fingerprints.txt
new file mode 100644
index 0000000..b8e8bdc
--- /dev/null
+++ b/kevlar/2026-06-08/iocs/fingerprints.txt
@@ -0,0 +1,12 @@
+# JA4 TLS Fingerprints
+t13i1909h2_9dc949149365_97f8aa674fd9  -- FlokiNET C2 beacon (185.100.87.136)
+# JA4H HTTP Fingerprints
+po11nn0700_fb204b7f5765  -- POST to /login/?login_only=1, Chrome 146, HOSTKEY (82.21.114.69)
+ge11nn0500_e2433fe505a0  -- GET /openid_connect/cpanelid, Chrome 146, HOSTKEY (82.21.114.69)
+ge11nn0400_9c3956fad5da  -- Firefox 140 on Linux, THE (45.83.20.230), KAOPU-HK (154.205.145.161, go-dockerclient)
+ge11nn0300_0db47b7d240d  -- Go-http-client/1.1, AEZA (77.221.152.105), Pfcloud
+po11nn0600_c9506d37ac14  -- SPARK C2 POST, FlokiNET (185.100.87.136)
+ge11nn0400_88d30a62b7ad  -- Firefox-like UA with TLS, FlokiNET (185.100.87.136)
+# HASSH SSH Fingerprints
+e54ef3ec27fe1fea7ab64d3fa05359fd  -- Go SSH client, WorkTitans THE AS209847 (185.231.207.151)
+41ff3ecd1458b0bf86e1b4891636213e  -- OpenSSH 8.9p1 server, shared across PLI-AS and Pfcloud