4 files changed, 116 insertions, 0 deletions
diff --git a/kevlar/2026-07-04/iocs/README.md b/kevlar/2026-07-04/iocs/README.md
new file mode 100644
index 0000000..fdb3979
--- /dev/null
+++ b/kevlar/2026-07-04/iocs/README.md
@@ -0,0 +1,27 @@
+# Weekly BP Report -- 2026-07-04
+
+Generated: 2026-07-06T10:30:00Z
+ASNs covered: 26
+Sponge sessions found: ~41,000+ (all BP ASNs)
+Honeylabs events found: ~12,000+ (9 active ASNs)
+Censys IPs enriched: 26 (aggregation level)
+Anomalies flagged: 2 (PFCLOUD 2.6x volume increase, Proton66 RDP credential stuffing)
+
+## Directory Structure
+
+- `sponge/` -- Arkime/Sponge session stats per ASN (IP, port, tag distributions, timeline)
+- `honeylabs/` -- Honeylabs top attackers, events per ASN
+- `censys/` -- Censys aggregations per ASN (ports, software, labels, TLS issuers, OS)
+- `changes/` -- Change detection vs prior week
+- `iocs/` -- Structured IoC files: IPs, fingerprints, C2 paths
+
+## Web Access
+
+https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-04/
+
+## Key Findings
+
+- PFCLOUD (AS51396) event volume surged 2.6x to 11,500+ events
+- All 26 monitored ASNs carry BULLETPROOF label per Censys
+- Proton66 showing RDP credential stuffing pattern from Moscow
+- RouterHosting demonstrating multi-vector scanning (HTTP, SMTP, SMB, SIP, Minecraft)
diff --git a/kevlar/2026-07-04/iocs/all-observed-ips.txt b/kevlar/2026-07-04/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..801f80a
--- /dev/null
+++ b/kevlar/2026-07-04/iocs/all-observed-ips.txt
@@ -0,0 +1,69 @@
+# Weekly BP Report -- 2026-07-04
+# All unique IPs observed across all sources, grouped by ASN
+
+# AS51396 - Pfcloud UG (NL)
+204.76.203.78
+204.76.203.80
+204.76.203.79
+204.76.203.213
+204.76.203.222
+204.76.203.221
+204.76.203.212
+204.76.203.214
+204.76.203.219
+45.135.193.193
+204.76.203.206
+45.135.194.113
+176.65.149.27
+176.65.149.30
+176.65.149.178
+176.65.149.212
+176.65.148.184
+176.65.149.31
+176.65.148.215
+204.76.203.49
+
+# AS51852 - Private Layer INC (CH)
+179.43.168.58
+81.17.28.130
+179.43.186.241
+179.43.150.26
+179.43.146.27
+179.43.134.114
+
+# AS14956 - RouterHosting LLC (US)
+144.172.96.139
+216.126.239.17
+144.172.104.239
+144.172.103.227
+216.126.239.215
+144.172.92.139
+172.86.122.53
+172.86.123.118
+167.88.165.96
+172.86.108.200
+107.189.21.110
+
+# AS214940 - Kprohost LLC (UA)
+77.83.39.197
+77.83.39.94
+77.83.39.42
+77.83.39.14
+
+# AS198953 - Proton66 OOO (RU)
+193.143.1.66
+176.120.22.240
+
+# AS200651 - FlokiNET ehf (RO)
+185.100.87.136
+185.100.84.164
+
+# AS210644 - Aeza Group LLC (AT/SE)
+45.155.71.142
+213.21.229.60
+
+# AS400992 - ZhouyiSat Communications (US)
+185.228.72.109
+
+# AS200593 - Prospero Ooo (RU)
+193.24.123.118
diff --git a/kevlar/2026-07-04/iocs/c2-paths.txt b/kevlar/2026-07-04/iocs/c2-paths.txt
new file mode 100644
index 0000000..4db9aab
--- /dev/null
+++ b/kevlar/2026-07-04/iocs/c2-paths.txt
@@ -0,0 +1,6 @@
+# Weekly BP Report -- 2026-07-04
+# Notable HTTP URL paths observed
+
+# No HTTP URL path data was collected from Honeylabs this week
+# (all traffic was non-HTTP protocol: SSH, RDP, raw TCP scanning).
+# Recommend HTTP-layer collection for future web-focused IoC gathering.
diff --git a/kevlar/2026-07-04/iocs/fingerprints.txt b/kevlar/2026-07-04/iocs/fingerprints.txt
new file mode 100644
index 0000000..2582234
--- /dev/null
+++ b/kevlar/2026-07-04/iocs/fingerprints.txt
@@ -0,0 +1,14 @@
+# Weekly BP Report -- 2026-07-04
+# Fingerprints observed per ASN
+
+# No JA4/JA3 TLS fingerprints were collected this week.
+# Honeylabs event data did not return populated TLS fingerprint fields.
+# Recommend direct JA4 collection via PCAP or Zeek for future runs.
+
+# HASSH SSH Fingerprints
+# No SSH HASSH fingerprints were collected this week.
+# Honeylabs event data for SSH connections (port 22) did not have populated HASSH fields.
+
+# NOTE: TLS/HTTP/JA4/JA4H/HASSH fingerprint data was unavailable
+# from both Honeylabs and Arkime sources this week due to
+# field-level data gaps in the respective datasets.