4 files changed, 100 insertions, 0 deletions
diff --git a/kevlar/2026-06-29/iocs/README.md b/kevlar/2026-06-29/iocs/README.md
new file mode 100644
index 0000000..2ffac8c
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/README.md
@@ -0,0 +1,9 @@
+# Weekly BP Report -- 2026-06-29
+
+Generated: 2026-06-29T14:55:00Z
+ASNs covered: 26
+Honeylabs events found: 4,979
+Censys IPs enriched: 112,800+ (aggregated across 8 active ASNs)
+Censys per-IP enrichments: 3 (204.76.203.36 BULLETPROOF, 107.189.18.71 BULLETPROOF+8 CVEs, 77.110.99.110 BULLETPROOF)
+Sponge sessions found: 2,729 (204.76.203.36=2219, 45.135.193.193=460, 77.110.99.110=50)
+Anomalies flagged: 2 (RouterHosting 600% event surge, Aeza 6,450% event surge)
diff --git a/kevlar/2026-06-29/iocs/all-observed-ips.txt b/kevlar/2026-06-29/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..77024ed
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/all-observed-ips.txt
@@ -0,0 +1,76 @@
+# AS51396 - PFCLOUD (Pfcloud UG)
+204.76.203.36
+204.76.203.219
+204.76.203.206
+204.76.203.49
+45.135.193.193
+45.135.194.113
+45.153.34.81
+176.65.149.30
+176.65.149.212
+176.65.149.27
+176.65.149.31
+176.65.139.31
+176.65.139.36
+176.65.148.147
+176.65.148.160
+176.65.148.132
+176.65.148.69
+176.65.148.216
+176.65.149.67
+176.65.149.178
+176.65.149.180
+176.65.149.220
+176.65.149.224
+176.65.149.230
+176.65.149.236
+176.65.132.162
+
+# AS14956 - ROUTERHOSTING (RouterHosting LLC)
+107.189.18.71
+107.189.22.0
+144.172.110.38
+144.172.108.43
+144.172.95.28
+144.172.104.239
+144.172.111.219
+144.172.100.186
+216.126.239.17
+216.126.239.215
+153.75.91.100
+172.86.108.200
+167.88.165.96
+172.86.114.169
+
+# AS210644 - AEZA-AS (Aeza Group LLC)
+77.110.99.110
+138.124.127.110
+147.45.71.163
+193.233.208.69
+77.221.138.227
+84.22.149.98
+89.22.224.187
+95.181.174.111
+80.85.241.171
+138.124.99.219
+213.21.229.60
+
+# AS51852 - PLI-AS (Private Layer INC)
+179.43.163.26
+179.43.186.241
+
+# AS214940 - KPRONET (Kprohost LLC)
+77.83.39.197
+77.83.39.14
+77.83.39.94
+77.83.39.42
+
+# AS198953 - PROTON66 (Proton66 OOO)
+193.143.1.66
+176.120.22.240
+
+# AS200651 - FLOKINET (FlokiNET ehf)
+185.100.87.136
+
+# AS200593 - PROSPERO-AS (Prospero Ooo)
+193.24.123.118
diff --git a/kevlar/2026-06-29/iocs/c2-paths.txt b/kevlar/2026-06-29/iocs/c2-paths.txt
new file mode 100644
index 0000000..9cfa639
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/c2-paths.txt
@@ -0,0 +1,5 @@
+# Notable HTTP URL Paths Observed
+/SDK/webLanguage  -- Heavy probing by PFCLOUD scanners on ports 80-88, 8080-8081
+/api/version      -- Go-http-client API discovery, PFCLOUD
+/.env             -- Configuration exposure scanning via TLS, PFCLOUD
+http://proxy.flarevpn.digital:8080/judge  -- SOCKS proxy quality check endpoint
diff --git a/kevlar/2026-06-29/iocs/fingerprints.txt b/kevlar/2026-06-29/iocs/fingerprints.txt
new file mode 100644
index 0000000..5e3bf90
--- /dev/null
+++ b/kevlar/2026-06-29/iocs/fingerprints.txt
@@ -0,0 +1,10 @@
+# JA4 TLS Fingerprints
+t13i190800_9dc949149365_97f8aa674fd9  -- seen on 176.65.132.162, .env scanning, PFCLOUD
+
+# JA4H HTTP Fingerprints
+ge11nn0300_86b6b04cb9cc  -- Mozilla/5.0 scanner, multiple IPs, PFCLOUD
+ge11nn0400_9c3956fad5da  -- Go-http-client/1.1 proxy probing, PFCLOUD
+ge11nn0400_628fde536a8d  -- Go-http-client/1.1 API version probing, PFCLOUD
+ge11nn0400_88d30a62b7ad  -- zgrab HTTP scanner, PFCLOUD
+ge11nn0500_9af7e0472034  -- TLS .env scanner, PFCLOUD
+ge10nn0300_86b6b04cb9cc  -- Shodan-Pull/1.0 scanner, PFCLOUD