# Weekly BP Report -- 2026-08-10

Generated: 2026-08-10T11:00:00Z
ASNs covered: 26
Sponge sessions found: 10,000+ across 21 active ASNs (capped per query)
Honeylabs events found: 12,200+ across 8 ASNs (PFCLOUD, ROUTERHOSTING, PLI-AS, PROTON66, FLOKINET, KPRONET, RU-AEZA, AEZA)
Censys IPs enriched: 8 per-IP + 8 ASN-level aggregations (all BULLETPROOF-labeled)
Anomalies flagged: 5

## Key Findings

- PFCLOUD deployed new 204.76.203.2xx proxy block; 2 nodes share SSH host key (cloned infra)
- ROUTERHOSTING added PPTP brute-force on port 1723; event count +312%
- KPRONET .git/.env exfiltration stopped; pattern moved to PLI-AS
- PROTON66 MSSQL-TDS brute on 17 non-standard ports; event count +145%
- FLOKINET Tor exit relay volume dropped 88%
- KAOPU-HK continues NTP/SSDP amplification (862K sessions from single IP)