4 files changed, 169 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/iocs/README.md b/kevlar/2026-08-17/iocs/README.md
new file mode 100644
index 0000000..0c5c2eb
--- /dev/null
+++ b/kevlar/2026-08-17/iocs/README.md
@@ -0,0 +1,19 @@
+# Weekly BP Report -- 2026-08-17
+
+Generated: 2026-08-17T11:45:00Z
+ASNs covered: 25
+Sponge sessions found: 24,000+ (capped per query; KAOPU-HK + PFCLOUD each >10,000)
+Honeylabs events found: ~13,600 across 10 ASNs
+Censys IPs enriched: 6 per-IP + 11 ASN-level aggregations
+Anomalies flagged: 7
+
+## Key Findings
+
+- PROTON66 MSSQL-TDS brute +594% (~1,700 events); 176.120.22.61 swept 289 ports, likely compromised Win 2012 R2
+- FLOKINET Tor exit 185.100.87.136 beaconing SPARK C2 (POST /api/client/update, secret header, agent UUID)
+- KPRONET .git/.env exfil resumed over TLS 443 (77.83.39.6/.94); Censys now attributes space to PFCLOUD
+- PFCLOUD .2xx proxy block expanded; 204.76.203.224/226 share ClickHouse + proxy banner hashes (cloned)
+- HASSH 41ff3ecd ties 77.83.39.6 (.env crawler) to prior PFCLOUD clone pair
+- ROUTERHOSTING PPTP campaign ended; SMBv1 445 brute new
+- AEZA qBittorrent peer-scanning 16663 (qB5230)
+- KPRONET zero Censys-visible hosts
diff --git a/kevlar/2026-08-17/iocs/all-observed-ips.txt b/kevlar/2026-08-17/iocs/all-observed-ips.txt
new file mode 100644
index 0000000..46f1a78
--- /dev/null
+++ b/kevlar/2026-08-17/iocs/all-observed-ips.txt
@@ -0,0 +1,120 @@
+# AS51396 - PFCLOUD (Pfcloud UG / Intelligence Hosting LLC)
+204.76.203.224
+204.76.203.226
+204.76.203.225
+204.76.203.73
+204.76.203.7
+204.76.203.49
+204.76.203.222
+204.76.203.214
+204.76.203.221
+204.76.203.212
+204.76.203.213
+204.76.203.43
+204.76.203.30
+45.135.193.193
+45.135.194.113
+176.65.149.27
+176.65.149.212
+176.65.149.31
+176.65.149.30
+176.65.149.64
+176.65.149.67
+176.65.149.55
+176.65.148.216
+77.83.39.6
+77.83.39.94
+# AS198953 - PROTON66 OOO
+176.120.22.61
+176.120.22.240
+193.143.1.66
+193.143.1.67
+176.120.22.192
+# AS51852 - PLI-AS (Private Layer INC)
+81.17.28.131
+179.43.150.26
+179.43.185.147
+179.43.146.27
+179.43.140.210
+179.43.175.56
+179.43.167.2
+179.43.139.58
+46.19.138.10
+46.19.137.194
+# AS14956 - ROUTERHOSTING (RouterHosting LLC)
+172.86.91.225
+144.172.104.239
+172.86.89.13
+216.126.224.182
+172.86.117.139
+144.172.116.49
+172.86.119.138
+172.86.114.38
+167.88.168.121
+153.75.85.203
+45.61.150.67
+216.126.239.150
+144.172.99.148
+144.172.101.79
+144.172.107.146
+216.126.236.232
+107.189.22.104
+172.86.123.118
+107.189.17.174
+153.75.94.130
+144.172.94.26
+144.172.107.98
+144.172.88.96
+107.189.17.69
+144.172.117.54
+# AS200651 - FLOKINET ehf
+185.100.87.136
+185.146.234.64
+185.100.87.136
+37.228.129.67
+185.246.188.74
+# AS138915 - KAOPU-HK (Kaopu Cloud HK Limited)
+154.93.53.239
+38.54.2.209
+38.54.2.232
+38.54.2.13
+38.54.2.152
+38.54.2.75
+154.93.119.167
+154.93.119.166
+154.93.119.165
+154.93.119.164
+154.93.119.169
+# AS214940 - KPRONET (Kprohost LLC)
+77.83.39.6
+77.83.39.64
+77.83.39.11
+77.83.39.108
+45.144.212.40
+# AS210644 - AEZA (Aeza Group LLC)
+77.110.106.52
+77.110.124.112
+147.45.41.126
+89.208.103.38
+213.21.233.236
+85.192.29.102
+# AS57043 - HOSTKEY-AS
+193.247.77.84
+212.69.84.94
+82.23.173.242
+81.29.146.37
+46.17.100.21
+# AS209847 - THE
+77.91.122.2
+# AS400992 - ZHOUYISAT-COMMUNICATIONS
+23.172.217.77
+193.46.218.239
+23.172.217.87
+# AS214940 - KPRONET
+77.83.39.6
+# AS200651 - FLOKINET
+185.100.87.136
+# AS30823 - AUROLOGIC
+172.86.94.82
+# AS200593 - PROSPERO-AS
+91.215.85.104
diff --git a/kevlar/2026-08-17/iocs/c2-paths.txt b/kevlar/2026-08-17/iocs/c2-paths.txt
new file mode 100644
index 0000000..65c2a54
--- /dev/null
+++ b/kevlar/2026-08-17/iocs/c2-paths.txt
@@ -0,0 +1,11 @@
+/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows  -- SPARK C2 beacon POST, 185.100.87.136 FLOKINET, 1 hit this week
+/eventmanager  -- SPARK C2 channel, 185.100.87.136
+/ajax  -- SPARK C2 polling, 185.100.87.136
+/api/v1/update  -- SPARK C2 update check, 185.100.87.136
+/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7  -- SPARK agent UUID path, 185.100.87.136
+/images/transparentpix.gif  -- beaconing pixel, 185.100.87.136
+/.env  -- env file exfil, 77.83.39.6 KPRONET/PFCLOUD, 25+ hits high-confidence malicious
+/.git/HEAD  -- git metadata exfil, 77.83.39.94
+/wsman  -- WinRM brute POST, 154.93.53.239 KAOPU + 179.43.185.147 PLI
+/api/trpc/setup.setup  -- tRPC setup probe, 179.43.150.26 PLI
+/version  -- Docker API probe, 179.43.175.56 PLI
diff --git a/kevlar/2026-08-17/iocs/fingerprints.txt b/kevlar/2026-08-17/iocs/fingerprints.txt
new file mode 100644
index 0000000..7bb669f
--- /dev/null
+++ b/kevlar/2026-08-17/iocs/fingerprints.txt
@@ -0,0 +1,19 @@
+# JA4 TLS Client Fingerprints
+t13i190800_9dc949149365_97f8aa674fd9  -- .env UA-rotator, 77.83.39.6, KPRONET/PFCLOUD
+t13i251000_b78ed14e2fd0_ab7e3b40a677  -- .git/HEAD probe, 77.83.39.94, KPRONET/PFCLOUD
+t13i1909h2_9dc949149365_97f8aa674fd9  -- SPARK C2 beacon, 185.100.87.136, FLOKINET
+t13i1310h1_f57a46bbacb6_e7c285222651  -- TLS web probe, 193.247.77.84 HOSTKEY; 179.43.146.27 PLI
+t13i311000_e8f1e7e78f70_d41ae481755e  -- .env/trpc probes, 179.43.150.26, PLI-AS
+# JA3 TLS Client Fingerprints
+7c1e207beb00684bbbe144f1b0abe1d5  -- SPARK C2 beacon, 185.100.87.136, FLOKINET
+19e29534fd49dd27d09234e639c4057e  -- .env UA-rotator, 77.83.39.6, KPRONET/PFCLOUD
+416eca07dcaad72dec6f76d1277b3eff  -- .git/HEAD probe, 77.83.39.94
+004556e859f3c26c5d19746b3a957c74  -- 179.43.150.26, PLI-AS
+# JA4H HTTP Client Fingerprints
+po11nn0600_c9506d37ac14  -- SPARK POST /api/client/update, 185.100.87.136
+po11nn0700_e1eadaf42879  -- WinRM /wsman, shared KAOPU 154.93.53.239 + PLI 179.43.185.147
+ge11nn0500_9af7e0472034  -- .env/.git exfil over TLS, 77.83.39.6/.94
+ge11nn0400_9c3956fad5da  -- Go-http-client/1.1 proxy checker, PFCLOUD
+# HASSH SSH Client Fingerprints
+41ff3ecd1458b0bf86e1b4891636213e  -- PFCLOUD cloned fleet + .env crawler (77.83.39.6); also 204.76.203.221/214 prior week
+e54ef3ec27fe1fea7ab64d3fa05359fd  -- SPARK C2 client, 185.100.87.136, FLOKINET