From 4294adbcb3a35e85f3107922e953aa98158989d7 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 22 Jun 2026 06:54:25 -0400 Subject: add: 2026-06-20 kevlar iocs --- kevlar/2026-06-20/OPERATIONS_LOG.md | 46 +++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 kevlar/2026-06-20/OPERATIONS_LOG.md (limited to 'kevlar/2026-06-20/OPERATIONS_LOG.md') diff --git a/kevlar/2026-06-20/OPERATIONS_LOG.md b/kevlar/2026-06-20/OPERATIONS_LOG.md new file mode 100644 index 0000000..494e84a --- /dev/null +++ b/kevlar/2026-06-20/OPERATIONS_LOG.md @@ -0,0 +1,46 @@ +# Operations Log -- Weekly BP Report 2026-06-20 + +## 2026-06-22 10:35:00 -- Phase 0: Initialize +- ASNs loaded: 26 +- Run date: 2026-06-20 (week of 2026-06-14 through 2026-06-20) +- Prior run: 2026-06-15 +- Censys credits: 10,000 (sufficient for per-IP enrichment) +- Cache dirs: sponge/, honeylabs/, censys/, changes/, iocs/ + +## 2026-06-22 10:40:15 -- Phase 1: Sponge Data Gathering +- ASNs with data: 15 of 26 +- Total sessions observed: ~180,000+ across all monitored ASNs +- Top ASN: AS51396 (PFCLOUD) -- 96,045 sessions +- Second: AS138915 (KAOPU-HK) -- 78,971 sessions +- 11 ASNs with zero observed activity +- Timeline captured: hourly split across top 5 ASNs +- Data cached to sponge/ directory + +## 2026-06-22 10:42:00 -- Phase 2: Honeylabs Queries +- ASNs queried: 20 (all active) +- Active ASNs found: 11 (AS51396, AS138915, AS51852, AS14956, AS210644, AS214940, AS400992, AS198953, AS200651, AS200593, AS209847) +- Top ASN: AS51396 (PFCLOUD) -- ~14,700 events across 20+ IPs +- Fingerprints captured: JA4/JA4H from KAOPU-HK +- Data cached to honeylabs/ directory + +## 2026-06-22 10:43:00 -- Phase 3: Censys Infrastructure Profiling +- ASNs aggregated: 7 (port, software, labels) +- All active ASNs carry BULLETPROOF label +- Notable: HOSTKEY-AS (AS57043) has 99,992 hosts (new entry) +- PFCLOUD: 3,476 hosts (+1.5%), wg-easy most common software +- KAOPU-HK: 34,264 hosts (-4.6%), OpenResty+Tengine stack +- Data cached to censys/ directory + +## 2026-06-22 10:43:30 -- Phase 4: Change Detection +- Prior baseline: 2026-06-15 +- Changes: HOSTKEY-AS new entry, PROTON66 normalization (42K->112 events) +- Anomalies flagged: 2 + +## 2026-06-22 10:44:00 -- Phase 5: Blog Post +- File: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-06-20-weekly-bulletproof-report.md +- Sections: Executive Summary, By the Numbers, Top ASN Deep Dives, Infrastructure Correlation, Fleet Observations, IoCs +- Build: passed (0 errors, 0 warnings) + +## 2026-06-22 10:45:00 -- Phase 6: IoC Archival +- Files: all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md +- IPs archived: ~75 across 15 active ASNs -- cgit v1.2.3