From 89a294a0e93277e5f27fc96710f638a5ac85ab35 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 3 Aug 2026 06:52:30 -0400 Subject: chore: weekly BPH update --- kevlar/2026-08-02/OPERATIONS_LOG.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 kevlar/2026-08-02/OPERATIONS_LOG.md (limited to 'kevlar/2026-08-02/OPERATIONS_LOG.md') diff --git a/kevlar/2026-08-02/OPERATIONS_LOG.md b/kevlar/2026-08-02/OPERATIONS_LOG.md new file mode 100644 index 0000000..d1f13ee --- /dev/null +++ b/kevlar/2026-08-02/OPERATIONS_LOG.md @@ -0,0 +1,23 @@ +# Operations Log -- 2026-08-02 + +## 2026-08-02 Initialization -- Phase 0: Initialize +- ASNs loaded: 26 +- Run date: 2026-08-02 +- Prior baseline: 2026-07-27 +- Cache directories created: sponge/, honeylabs/, censys/, changes/, iocs/ +- Censys credit check: pending +## 2026-08-03 03:43:00 -- Run Complete +- ASNs queried across all sources: 26 +- Sponge queries: 78 (26 ASNs x 3 aggregations + 1 timeline) +- Honeylabs queries: 6 (IOC lookups + 1 event search + 1 top attackers) +- Censys queries: 13 (6 port + 1 software + 6 labels aggregations) +- Results cached: Y +- Blog post built: Y (astro build succeeded) +- IoC files written: Y (IPs, fingerprints, C2 paths, README) +- Errors: 0 +- Censys credits remaining: 10,000 (no per-IP enrichment attempted) + +### Key Finding +Only AS51396 (PFCLOUD) registered honeypot activity. 25 of 26 ASNs show zero +Honeylabs events despite significant Sponge session counts. All 6 Censys-profiled +ASNs are universally BULLETPROOF-labeled. -- cgit v1.2.3