# Weekly BP Report -- 2026-08-23

Generated: 2026-08-24T03:05:00Z
ASNs covered: 25
Sponge sessions found: 132,852 (17 ASNs active, window 2026-08-17..2026-08-24)
Honeylabs events found: ~14,000 (13 ASNs with events)
Censys IPs enriched: 10
Anomalies flagged: 14 (see changes/anomalies.csv)

## Key findings

1. AUROLOGIC (AS30823): compromised Windows Server 2016 AD domain controller
   `erp01.ad.reiscrew.de` (45.11.18.33) now runs RDP sweeps (`mstshash=hello`, 455 events).
2. FLOKINET beacon host 185.100.87.136 rotated endpoint from `/api/client/update`
   (SPARK COMMIT) to `POST /api/checkin`; same TLS fingerprint both weeks.
3. PLI-AS +341%: market-maker bot discovery scanner (mmsk-scout/mm-scout), .env prober,
   DCE/RPC scanner; shared HASSH with PFCLOUD clone fleet persists (week 3).
4. PFCLOUD proxy-validation fleet confirmed: azenv.net / httpbin.org CONNECT / socks5 /
   proxy.flarevpn.digital judges; GreyNoise flags Ivanti/Pulse/F5/CrushFTP scanning.
5. KAOPU-HK 38.54.2.0/24 port-sprawl farm: ~100 HTTP listeners per host.
6. YE-series Xray panel certs span 6 monitored ASNs; AEZA carries 26k+.

## Sources and errors

- Sponge (Arkime): online, data 2026-03-12..2026-08-24. Tag aggregation returns 0 rows
  for all ASNs (known limitation); IP/port aggregations used instead.
- Honeylabs: no rate-limit errors.
- Censys: 10,000 credits at start of run; ~50 aggregate + 10 host lookups used.
- Blog post: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-08-23-weekly-bulletproof-report.md
  (build verified, 0 errors)