From 237f2d9330398e0a0628980056db6b09098d5f2f Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 17 Aug 2026 07:45:20 -0400 Subject: feat: update bph iocs --- kevlar/2026-08-17/OPERATIONS_LOG.md | 38 +++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 kevlar/2026-08-17/OPERATIONS_LOG.md (limited to 'kevlar/2026-08-17/OPERATIONS_LOG.md') diff --git a/kevlar/2026-08-17/OPERATIONS_LOG.md b/kevlar/2026-08-17/OPERATIONS_LOG.md new file mode 100644 index 0000000..7d9f2d1 --- /dev/null +++ b/kevlar/2026-08-17/OPERATIONS_LOG.md @@ -0,0 +1,38 @@ +# Weekly BP Report -- 2026-08-17 + +Operations log for the 2026-08-17 run. + +## 2026-08-17 -- Phase 0: Initialize +- ASNs queried: 0 +- API calls made: 0 +- Results cached: N +- Errors: none +## 2026-08-17 -- Phase 1: Sponge (Arkime) +- ASNs queried: 25 +- API calls made: 76 (73 stats + 2 timelines + 1 schema) +- Results cached: Y +- Errors: none + +## 2026-08-17 -- Phase 2: Honeylabs +- ASNs queried: 13 (events), 5 (top attackers), 7 (per-IP IOC) +- API calls made: 26 +- Results cached: Y +- Errors: ioc_lookup treats "AS*" as domain type - used asn-filtered search_events/top_attackers instead + +## 2026-08-17 -- Phase 3: Censys +- ASNs queried: 11 aggregations, 6 per-IP +- API calls made: 38 +- Results cached: Y +- Errors: aggregate endpoint transient "Query error" x6 - retry succeeded; no credit exhaustion (10,000 balance) + +## 2026-08-17 -- Phase 4: Change detection +- Baseline: 2026-08-10 +- Results cached: Y +- Anomalies: 7 + +## 2026-08-17 -- Phase 5: Blog post +- Wrote 2026-08-17-weekly-bulletproof-report.md +- Build: npm run build exit=0, 0 errors, post rendered + +## 2026-08-17 -- Phase 6: IoC archival +- Files written to iocs/: all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md -- cgit v1.2.3