asn,metric,prior_week,this_week,delta,notes
AS51396,honeylabs_events,~8400,11483,+37%,proxy checking continues; new 204.76.203.2xx block
AS51396,new_ips,0,5,"204.76.203.221/214/213/212/222 new this week"
AS51396,shared_hostkey,0,2,"204.76.203.221+214 share SSH key 27c4af41... (cloned infra)"
AS51396,proxy_port,8080/3128,9191,new,"HTTP proxy now on 9191 (was port-paired 8080/3128)"
AS14956,honeylabs_events,~50,206,+312%,PPTP brute-force on 1723 new this week
AS14956,new_attack,0,1,"PPTP (1723) brute from 144.172.100.63; RDP from 216.126.239.150"
AS51852,honeylabs_events,~200,143,-29%,.env/.git exfiltration now on PLI-AS (was KPRONET)
AS51852,new_pattern,0,1,".env/.git exfil from 179.43.150.26 on ports 8001/8443"
AS198953,honeylabs_events,~100,245,+145%,MSSQL-TDS brute on 17 non-standard ports
AS200651,honeylabs_events,~50,6,-88%,Tor relay 185.100.87.136 still active, reduced volume
AS214940,honeylabs_events,~200,9,-96%,.git/.env campaign largely stopped
AS138915,sponge_sessions,818K,862K,+5%,NTP/SSDP amplification continues; 38.54.2.209 dominant
AS216246,honeylabs_events,0,1,new,telnet probe from 193.233.91.113
AS210644,honeylabs_events,0,4,new,port 4028 probes from 147.45.41.132