# Operations Log -- Weekly BP Report 2026-07-13

## 2026-07-13 -- Phase 0: Initialize
- ASNs loaded: 26 from bulletproof-asns.csv
- Gist directory: ~/Documents/gists/kevlar/2026-07-13/
- Query range: 2026-07-05 through 2026-07-11
- Censys credits: 10,000 (sufficient for per-IP enrichment)
- Prior baseline: 2026-07-04

## 2026-07-13 09:42:58 -- Phase 1: Sponge (Arkime) Data Gathering
### Sub-phase 1a: Connectivity Check
- Timeline confirmed: data flowing 2026-07-05 through 2026-07-09
- 6 daily buckets, 4320 hourly ASN-split records
### Sub-phase 1b: Per-ASN Session Stats
- ASNs queried: 26 (78 API calls)
- Active ASNs (sessions observed): AS57043(4), AS210644(7), AS138915(10000), AS14956(128), AS216139(67), AS51852(261), AS400992(200), AS33993(2), AS51396(10000), AS216246(93), AS200651(50), AS198953(547), AS200593(107), AS214940(826), AS211720(16)
- Inactive ASNs (0 sessions): AS209847, AS213702, AS30823, AS140666, AS214351, AS206728, AS216309, AS58854, AS202685, AS394711
- Top by volume: AS138915 (KAOPU-HK) 10K sessions, AS51396 (PFCLOUD) 10K sessions
- Notable ports: NTP/123 (KAOPU-HK), SSH/22 (PFCLOUD), SMTP/25 (KPRONET), port 31337 (Datashield)
### Sub-phase 1c: Multi-ASN Timeline
- Cached to sponge/timeline-all-asns.ndjson (4320 records)
- Cached all session stats to sponge/ directory (77 files)
- Errors: none

## 2026-07-13 09:47:00 -- Phase 2: Honeylabs Queries
- ASNs queried: 15 active ASNs (top attackers + event search + user agents)
- Active in Honeylabs: AS57043(1), AS210644(1), AS14956(206), AS216139(2), AS51852(1802), AS400992(2), AS51396(10000+), AS200651(20), AS198953(539+), AS200593(3890), AS214940(46), AS211720(4)
- No Honeylabs data: AS138915, AS209847, AS213702, AS30823, AS33993, AS140666, AS214351, AS216246, AS206728, AS216309, AS58854, AS202685, AS394711
- Top by volume: AS51396 (PFCLOUD) 10000+ events, AS200593 (PROSPERO) 3890 events, AS51852 (PLI) 1802 events
- Notable findings: Spring deserialization attack (AEZA), .env file scanning (ZHOUYISAT), Exchange /ews/ recon (Datashield), VNC probing (FLOKINET), UA rotation (KPRONET 20 UAs)
- Fingerprints cached: 11 unique (4 HASSH, 4 JA4, 3 JA4H)
- Results cached: Y (top-attackers.csv, fingerprints.csv)
- Errors: none

## 2026-07-13 12:00:00 -- Phase 3: Censys Aggregations and Per-IP Enrichment
- Port aggregations: 11 ASNs completed (host.services.port field)
- Labels: BULLETPROOF confirmed across all monitored ASNs
- Software aggregation: AS51396 (python/werkzeug/wg-easy/openssh/nginx)
- Per-IP enrichment: 10 IPs via censys_get_host
  - 176.65.148.25 (PFCLOUD) -- GreyNoise malicious, RDP crawler/bruteforcer
  - 91.202.233.79 (PROSPERO) -- no services, scan-only
  - 179.43.134.114 (PLI) -- OpenSSH 8.9p1, hostedby.privatelayer.com
  - 216.126.239.17 (ROUTERHOSTING) -- GreyNoise suspicious, multi-CVE scanner
  - 204.76.203.79 (PFCLOUD) -- truncated, saved to tool-output
  - 176.120.22.240 (PROTON66) -- GreyNoise malicious, multi-protocol bruteforcer
  - 185.100.87.136 (FLOKINET) -- Tor exit node, Tor 0.4.9.11
  - 77.83.39.197 (KPRONET) -- Lanedonet Datacenter, Kerkrade NL
  - 185.231.33.46 (DATASHIELD) -- hostname short-tan-rat, Seychelles
  - 185.228.72.109 (ZHOUYISAT) -- usa.unlimitedteam.space, self-signed cert
- Fleet correlation: coordinated scan cluster (204.76.203.78/79/80), UA rotation (KPRONET), Tor exit (FLOKINET)
- Cache files: aggregations-summary.ndjson, ip-enrichments.ndjson, fleet-correlation.csv
- Credits remaining: sufficient
- Errors: none

## 2026-07-13 12:05:00 -- Phase 4: Change Detection
- Prior baseline: 2026-07-04
- Active ASNs: 9 -> 15 (+67%)
- PFCLOUD: 11500 -> 10000+ (-13%, pattern shift to coordinated cluster)
- PROSPERO: 2 -> 3890 (+194400%, single-IP scan bomb)
- PROTON66: 35 -> 539 (+1440%, multi-protocol expansion)
- PLI: 822 -> 1802 (+119%)
- ROUTERHOSTING: 267 -> 206 (-23%)
- New ASNs: AS57043, AS138915, AS216139, AS33993, AS216246, AS211720
- Anomalies flagged: 11 (2 critical, 4 high, 3 medium, 2 low)
- Files: diff-vs-prior-week.csv, anomalies.csv
- Errors: none

## 2026-07-13 12:10:00 -- Phase 5: Blog Post Written
- Blog: src/data/blog/2026-07-13-weekly-bulletproof-report.md
- Build: pending

## 2026-07-13 12:10:00 -- Phase 6: IoC Archival
- all-observed-ips.txt: 27 unique IPs across 13 ASNs
- fingerprints.txt: 11 fingerprints (4 HASSH, 4 JA4/JA3, 3 JA4H) + 3 Censys SSH/Tor versions
- c2-paths.txt: 3 paths (/.env, /ews/, /transparentpix.gif)
- README.md: Run summary
- Status: COMPLETE