diff options
Diffstat (limited to 'kevlar/2026-07-13/OPERATIONS_LOG.md')
| -rw-r--r-- | kevlar/2026-07-13/OPERATIONS_LOG.md | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/kevlar/2026-07-13/OPERATIONS_LOG.md b/kevlar/2026-07-13/OPERATIONS_LOG.md new file mode 100644 index 0000000..372fb35 --- /dev/null +++ b/kevlar/2026-07-13/OPERATIONS_LOG.md @@ -0,0 +1,77 @@ +# Operations Log -- Weekly BP Report 2026-07-13 + +## 2026-07-13 -- Phase 0: Initialize +- ASNs loaded: 26 from bulletproof-asns.csv +- Gist directory: ~/Documents/gists/kevlar/2026-07-13/ +- Query range: 2026-07-05 through 2026-07-11 +- Censys credits: 10,000 (sufficient for per-IP enrichment) +- Prior baseline: 2026-07-04 + +## 2026-07-13 09:42:58 -- Phase 1: Sponge (Arkime) Data Gathering +### Sub-phase 1a: Connectivity Check +- Timeline confirmed: data flowing 2026-07-05 through 2026-07-09 +- 6 daily buckets, 4320 hourly ASN-split records +### Sub-phase 1b: Per-ASN Session Stats +- ASNs queried: 26 (78 API calls) +- Active ASNs (sessions observed): AS57043(4), AS210644(7), AS138915(10000), AS14956(128), AS216139(67), AS51852(261), AS400992(200), AS33993(2), AS51396(10000), AS216246(93), AS200651(50), AS198953(547), AS200593(107), AS214940(826), AS211720(16) +- Inactive ASNs (0 sessions): AS209847, AS213702, AS30823, AS140666, AS214351, AS206728, AS216309, AS58854, AS202685, AS394711 +- Top by volume: AS138915 (KAOPU-HK) 10K sessions, AS51396 (PFCLOUD) 10K sessions +- Notable ports: NTP/123 (KAOPU-HK), SSH/22 (PFCLOUD), SMTP/25 (KPRONET), port 31337 (Datashield) +### Sub-phase 1c: Multi-ASN Timeline +- Cached to sponge/timeline-all-asns.ndjson (4320 records) +- Cached all session stats to sponge/ directory (77 files) +- Errors: none + +## 2026-07-13 09:47:00 -- Phase 2: Honeylabs Queries +- ASNs queried: 15 active ASNs (top attackers + event search + user agents) +- Active in Honeylabs: AS57043(1), AS210644(1), AS14956(206), AS216139(2), AS51852(1802), AS400992(2), AS51396(10000+), AS200651(20), AS198953(539+), AS200593(3890), AS214940(46), AS211720(4) +- No Honeylabs data: AS138915, AS209847, AS213702, AS30823, AS33993, AS140666, AS214351, AS216246, AS206728, AS216309, AS58854, AS202685, AS394711 +- Top by volume: AS51396 (PFCLOUD) 10000+ events, AS200593 (PROSPERO) 3890 events, AS51852 (PLI) 1802 events +- Notable findings: Spring deserialization attack (AEZA), .env file scanning (ZHOUYISAT), Exchange /ews/ recon (Datashield), VNC probing (FLOKINET), UA rotation (KPRONET 20 UAs) +- Fingerprints cached: 11 unique (4 HASSH, 4 JA4, 3 JA4H) +- Results cached: Y (top-attackers.csv, fingerprints.csv) +- Errors: none + +## 2026-07-13 12:00:00 -- Phase 3: Censys Aggregations and Per-IP Enrichment +- Port aggregations: 11 ASNs completed (host.services.port field) +- Labels: BULLETPROOF confirmed across all monitored ASNs +- Software aggregation: AS51396 (python/werkzeug/wg-easy/openssh/nginx) +- Per-IP enrichment: 10 IPs via censys_get_host + - 176.65.148.25 (PFCLOUD) -- GreyNoise malicious, RDP crawler/bruteforcer + - 91.202.233.79 (PROSPERO) -- no services, scan-only + - 179.43.134.114 (PLI) -- OpenSSH 8.9p1, hostedby.privatelayer.com + - 216.126.239.17 (ROUTERHOSTING) -- GreyNoise suspicious, multi-CVE scanner + - 204.76.203.79 (PFCLOUD) -- truncated, saved to tool-output + - 176.120.22.240 (PROTON66) -- GreyNoise malicious, multi-protocol bruteforcer + - 185.100.87.136 (FLOKINET) -- Tor exit node, Tor 0.4.9.11 + - 77.83.39.197 (KPRONET) -- Lanedonet Datacenter, Kerkrade NL + - 185.231.33.46 (DATASHIELD) -- hostname short-tan-rat, Seychelles + - 185.228.72.109 (ZHOUYISAT) -- usa.unlimitedteam.space, self-signed cert +- Fleet correlation: coordinated scan cluster (204.76.203.78/79/80), UA rotation (KPRONET), Tor exit (FLOKINET) +- Cache files: aggregations-summary.ndjson, ip-enrichments.ndjson, fleet-correlation.csv +- Credits remaining: sufficient +- Errors: none + +## 2026-07-13 12:05:00 -- Phase 4: Change Detection +- Prior baseline: 2026-07-04 +- Active ASNs: 9 -> 15 (+67%) +- PFCLOUD: 11500 -> 10000+ (-13%, pattern shift to coordinated cluster) +- PROSPERO: 2 -> 3890 (+194400%, single-IP scan bomb) +- PROTON66: 35 -> 539 (+1440%, multi-protocol expansion) +- PLI: 822 -> 1802 (+119%) +- ROUTERHOSTING: 267 -> 206 (-23%) +- New ASNs: AS57043, AS138915, AS216139, AS33993, AS216246, AS211720 +- Anomalies flagged: 11 (2 critical, 4 high, 3 medium, 2 low) +- Files: diff-vs-prior-week.csv, anomalies.csv +- Errors: none + +## 2026-07-13 12:10:00 -- Phase 5: Blog Post Written +- Blog: src/data/blog/2026-07-13-weekly-bulletproof-report.md +- Build: pending + +## 2026-07-13 12:10:00 -- Phase 6: IoC Archival +- all-observed-ips.txt: 27 unique IPs across 13 ASNs +- fingerprints.txt: 11 fingerprints (4 HASSH, 4 JA4/JA3, 3 JA4H) + 3 Censys SSH/Tor versions +- c2-paths.txt: 3 paths (/.env, /ews/, /transparentpix.gif) +- README.md: Run summary +- Status: COMPLETE |