4 files changed, 133 insertions, 0 deletions
diff --git a/kevlar/2026-07-13/iocs/README.md b/kevlar/2026-07-13/iocs/README.md
new file mode 100644
index 0000000..5ad0bd3
--- /dev/null
+++ b/kevlar/2026-07-13/iocs/README.md
@@ -0,0 +1,32 @@
+# Weekly BP Report -- 2026-07-13
+
+Generated: 2026-07-13T12:00:00Z
+ASNs covered: 26
+Query range: 2026-07-05 through 2026-07-11
+Sponge sessions found: ~21,000+ (15 active ASNs)
+Honeylabs events found: ~16,000+ (12 active ASNs)
+Censys IPs enriched: 10 (per-host enrichment via censys_get_host)
+Anomalies flagged: 11 (2 critical, 4 high, 3 medium, 2 low)
+
+## Directory Structure
+
+- `sponge/` -- Arkime/Sponge session stats per ASN (77 files)
+- `honeylabs/` -- Honeylabs top attackers and fingerprints (2 files)
+- `censys/` -- Censys aggregations, IP enrichments, fleet correlation (3 files)
+- `changes/` -- Change detection vs prior week (2 files)
+- `iocs/` -- Structured IoC files: IPs, fingerprints, C2 paths
+
+## Key Findings
+
+- PFCLOUD (AS51396) remains dominant with 10K+ events and a new coordinated scan cluster (204.76.203.78/79/80)
+- Prospero Ooo (AS200593) surged from 2 to 3890 events -- single IP scan bomb
+- Proton66 (AS198953) expanded from RDP-only to multi-protocol bruteforcing (RDP+SSH+Telnet+FTP)
+- Datashield Inc. (AS211720) new entrant performing Exchange /ews/ reconnaissance
+- ZhouyiSat (AS400992) observed scanning for /.env files to steal credentials
+- FlokiNET (AS200651) Tor exit node (185.100.87.136) actively scanning HTTP/SSH
+- Active ASNs expanded from 9 to 15 (+67%) week over week
+- 11 unique fingerprints collected (4 HASSH, 4 JA4/JA3, 3 JA4H) -- major improvement over prior week
+
+## Web Access
+
+https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-13/
diff --git a/kevlar/2026-07-13/iocs/all-observed-ips.txt b/kevlar/2026-07-13/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..0d01c1b
--- /dev/null
+++ b/kevlar/2026-07-13/iocs/all-observed-ips.txt
@@ -0,0 +1,55 @@
+# Weekly BP Report -- 2026-07-13
+# All unique IPs observed across all sources, grouped by ASN
+# Query range: 2026-07-05 through 2026-07-11
+
+# AS51396 - Pfcloud UG (NL)
+176.65.148.25
+204.76.203.78
+204.76.203.79
+204.76.203.80
+45.135.193.193
+
+# AS200593 - Prospero Ooo (TM)
+91.202.233.79
+
+# AS51852 - Private Layer INC (CH)
+179.43.134.114
+179.43.168.58
+179.43.186.241
+179.43.185.147
+
+# AS14956 - RouterHosting LLC (US)
+216.126.239.17
+144.172.103.227
+216.126.225.168
+144.172.97.10
+167.88.165.96
+
+# AS198953 - Proton66 OOO (RU)
+176.120.22.240
+176.120.22.147
+37.77.150.67
+
+# AS400992 - ZhouyiSat Communications (US)
+185.228.72.109
+
+# AS200651 - FlokiNET ehf (RO)
+185.100.87.136
+185.100.84.164
+
+# AS214940 - Kprohost LLC (UA)
+77.83.39.197
+77.83.39.119
+77.83.39.94
+
+# AS211720 - Datashield Inc. (SC)
+185.231.33.46
+
+# AS57043 - Hostkey B.v. (NL)
+151.243.173.235
+
+# AS210644 - Aeza Group LLC (AT/SE)
+46.226.162.205
+
+# AS216139 - Iron Hosting Centre LTD (NL)
+178.208.88.28
diff --git a/kevlar/2026-07-13/iocs/c2-paths.txt b/kevlar/2026-07-13/iocs/c2-paths.txt
new file mode 100644
index 0000000..0970ab6
--- /dev/null
+++ b/kevlar/2026-07-13/iocs/c2-paths.txt
@@ -0,0 +1,21 @@
+# Weekly BP Report -- 2026-07-13
+# Notable HTTP URL paths observed
+# Query range: 2026-07-05 through 2026-07-11
+
+# .env file scanning (credentials exfiltration)
+/.env
+# Source: 185.228.72.109 (AS400992 ZhouyiSat) via HTTP GET
+# JA4H: ge11nn0500_2d30dc89d981
+# Intent: Retrieve environment variable files containing database credentials, API keys
+
+# Exchange /ews/ reconnaissance
+/ews/
+# Source: 185.231.33.46 (AS211720 Datashield) via HTTP HEAD
+# JA4H: he11nn0500_2d30dc89d981
+# Intent: Enumerate Exchange Web Services endpoints for vulnerability exploitation
+
+# Tor exit node transparentpix.gif probing
+/transparentpix.gif
+# Source: 185.100.87.136 (AS200651 FlokiNET) via HTTP GET on port 444
+# JA4H: ge11nn0400_88d30a62b7ad
+# Intent: Tor exit node connectivity testing or pixel tracking
diff --git a/kevlar/2026-07-13/iocs/fingerprints.txt b/kevlar/2026-07-13/iocs/fingerprints.txt
new file mode 100644
index 0000000..5b037db
--- /dev/null
+++ b/kevlar/2026-07-13/iocs/fingerprints.txt
@@ -0,0 +1,25 @@
+# Weekly BP Report -- 2026-07-13
+# Fingerprints observed per ASN
+# Query range: 2026-07-05 through 2026-07-11
+
+# HASSH SSH Fingerprints
+AS57043,151.243.173.235,hassh,f555226df1963d1d3c09daf865abdc9a,SSH-2.0-libssh_0.9.6,SSH scanning port 22
+AS200651,185.100.87.136,hassh,e54ef3ec27fe1fea7ab64d3fa05359fd,SSH-2.0-OpenSSH_10.1,SSH scanning multiple ports (Tor exit node)
+
+# JA4/JA3 TLS Fingerprints
+AS400992,185.228.72.109,ja4,t13i1711h1_ab0a1bf427ad_882d495ac381,,TLS 1.3 .env file scanning
+AS400992,185.228.72.109,ja3,fb0c9cea0478d6132076f4cdcb0d5224,,TLS 1.3 .env file scanning
+AS200651,185.100.87.136,ja4,t13i1909h2_9dc949149365_97f8aa674fd9,,TLS 1.3 transparentpix.gif probing
+AS200651,185.100.87.136,ja3,7c1e207beb00684bbbe144f1b0abe1d5,,TLS 1.3 transparentpix.gif probing
+AS211720,185.231.33.46,ja4,t13i1813h1_5103eae14fdb_97a66a8f4cb1,,TLS 1.3 Exchange /ews/ recon
+AS211720,185.231.33.46,ja3,60eb467937ec4cb8aa43b4008a510ad1,,TLS 1.3 Exchange /ews/ recon
+
+# JA4H HTTP Fingerprints
+AS400992,185.228.72.109,ja4h,ge11nn0500_2d30dc89d981,,HTTP GET /.env scanning
+AS200651,185.100.87.136,ja4h,ge11nn0400_88d30a62b7ad,,HTTP GET on port 444
+AS211720,185.231.33.46,ja4h,he11nn0500_2d30dc89d981,,HTTP HEAD /ews/ Exchange recon
+
+# Censys-enriched SSH versions
+AS51396,176.65.148.25,ssh-version,SSH-2.0-OpenSSH_9.2p1,,GreyNoise malicious RDP crawler/bruteforcer
+AS51852,179.43.134.114,ssh-version,SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10,,hostedby.privatelayer.com
+AS200651,185.100.87.136,tor-version,Tor 0.4.9.11,,Confirmed Tor exit node on port 9001