# Weekly BP Report -- 2026-08-17

Generated: 2026-08-17T11:45:00Z
ASNs covered: 25
Sponge sessions found: 24,000+ (capped per query; KAOPU-HK + PFCLOUD each >10,000)
Honeylabs events found: ~13,600 across 10 ASNs
Censys IPs enriched: 6 per-IP + 11 ASN-level aggregations
Anomalies flagged: 7

## Key Findings

- PROTON66 MSSQL-TDS brute +594% (~1,700 events); 176.120.22.61 swept 289 ports, likely compromised Win 2012 R2
- FLOKINET Tor exit 185.100.87.136 beaconing SPARK C2 (POST /api/client/update, secret header, agent UUID)
- KPRONET .git/.env exfil resumed over TLS 443 (77.83.39.6/.94); Censys now attributes space to PFCLOUD
- PFCLOUD .2xx proxy block expanded; 204.76.203.224/226 share ClickHouse + proxy banner hashes (cloned)
- HASSH 41ff3ecd ties 77.83.39.6 (.env crawler) to prior PFCLOUD clone pair
- ROUTERHOSTING PPTP campaign ended; SMBv1 445 brute new
- AEZA qBittorrent peer-scanning 16663 (qB5230)
- KPRONET zero Censys-visible hosts