# Weekly BP Report -- 2026-07-20

Generated: 2026-07-20T11:15:00Z
ASNs covered: 25 (per bulletproof-asns.csv)
Query range: 2026-07-13 through 2026-07-20 (7-day window)
Sponge sessions found: ~6.9M total network traffic across 8 daily buckets
Active ASNs in Sponge: 17 (7 active+Honeylabs; 10 inactive both sources)
Honeylabs events found: ~2,600+ across 7 active ASNs
Censys IPs enriched: 14 IPs (per-host enrichment via censys_get_host)
Censys credits remaining at start: 10,000
Anomalies flagged: 11 (3 critical, 5 high, 3 medium)

## Top-Level Findings

1. **AS200651 (FlokiNET)** - Tor exit 185.100.87.136 effserved as a SPARKRAT C2 callback destination (POST /api/client/update) AND Tor exit. OpenSSH upgraded from 10.1 -> 10.2p1. CRITICAL.
2. **AS216139 (Iron Hosting Centre)** - Sequential port 6001-6050 cluster with uniform 345-348 events each in Censys -- backconnect-C2 listener pattern. CRITICAL.
3. **AS57043 (Hostkey)** - IoT MIPS downloader (aibotnet.su /bins/kla.sh) from NEW IP 132.243.194.215 (Frankfurt). CRITICAL.
4. **AS209847** - Not in Census as AS209847; actually tagged belongs to ASICs41745 FORTIS-AS Baykov Ilya Sergeevich (RU, reg 2026-06-06). 998 Sponge sessions single IP 45.144.28.70. CRITICAL.
5. **AS211720 (Datashield)** - Shifted from /ews/ Exchange recon to MSSQL TDS port 1433 brute (hostname short-tan-rat, self-signed prohaska.beatty.biz cert, TLS 1.0/1.1 still enabled).
6. **AS51396 (Pfcloud)** - NEW scanner tooling 'odin-scanner/0.4' and 'Hello World' UAs. Cluster IPs rotated to 30/.49/.81/.18 from prior 78/79/80 in 204.76.203.0/24.
7. **AS14956 (RouterHosting)** - Exposed Werkzeug/3.1.8 'fofa_monitor' Basic-auth panel on port 5000 (HIGH severity Censys misconfig).
8. **AS400992 (ZhouyiSat)** - Ceased /env scanning this week; censys profile now pure Windows admin (3389/5985/135/445). Behavioral shift.

## Headline Changes vs Prior Week

| Metric                          | Prior (2026-07-13) | Current (2026-07-20) | Δ     | Δ%    |
|---------------------------------|-------------------:|---------------------:|------:|------:|
| Active ASNs (Sponge or HL)      | 15                 | 17                    | +2    | +13%  |
| ASNs in Censys BULLETPROOF      | 11                 | 12                    | +1    | +9%   |
| Unique HASSH/JA4H signatures    | 11                 | ~13                   | +2    | +18%  |
| Top IP Honeylabs events         | 1,518 (AS51852)    | 968 (AS200593)       | -550  | -36%  |
| Critical anomalies flagged      | 2                  | 3                     | +1    | +50%  |

## Directory Structure

- `sponge/` -- Arkime session stats per ASN (33 stat files + 1 timeline)
- `honeylabs/` -- top-attackers.csv, fingerprints.csv
- `censys/` -- aggregations-summary.ndjson, fleet-correlation.csv
- `changes/` -- diff-vs-prior-week.csv, anomalies.csv
- `iocs/` -- all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md (this file)

## Web Access

https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-20/

## Operators Log

See ../OPERATIONS_LOG.md for the full phase-by-phase operations record.