# Weekly BP Report -- 2026-07-04

Generated: 2026-07-06T10:30:00Z
ASNs covered: 26
Sponge sessions found: ~41,000+ (all BP ASNs)
Honeylabs events found: ~12,000+ (9 active ASNs)
Censys IPs enriched: 26 (aggregation level)
Anomalies flagged: 2 (PFCLOUD 2.6x volume increase, Proton66 RDP credential stuffing)

## Directory Structure

- `sponge/` -- Arkime/Sponge session stats per ASN (IP, port, tag distributions, timeline)
- `honeylabs/` -- Honeylabs top attackers, events per ASN
- `censys/` -- Censys aggregations per ASN (ports, software, labels, TLS issuers, OS)
- `changes/` -- Change detection vs prior week
- `iocs/` -- Structured IoC files: IPs, fingerprints, C2 paths

## Web Access

https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-04/

## Key Findings

- PFCLOUD (AS51396) event volume surged 2.6x to 11,500+ events
- All 26 monitored ASNs carry BULLETPROOF label per Censys
- Proton66 showing RDP credential stuffing pattern from Moscow
- RouterHosting demonstrating multi-vector scanning (HTTP, SMTP, SMB, SIP, Minecraft)