1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
# Weekly BP Report -- 2026-06-08
## Operations Log
### 2026-06-08 -- Phase 0: Initialize
- ASNs loaded: 26 (from bulletproof-asns.csv)
- Censys credits: 10,000
- Prior baseline: NONE (first run -- change detection skipped)
- Gists directory created: ~/Documents/gists/kevlar/2026-06-08/
### 2026-06-08 -- Phase 1: Honeylabs Queries
- ASNs with activity: 11 of 26
- Most active: AS51396 (Pfcloud, ~10K events), AS51852 (Private Layer, 3,796 events), AS198953 (Proton66, 2,189 events)
- ASNs with no activity: AS400992, AS33993, AS216139, AS213702, AS216246, AS30823, AS140666, AS214351, AS206728, AS211720, AS216309, AS58854, AS202685, AS394711
- Key findings: Pfcloud "riptide" Golang scanning framework, FlokiNET SPARK C2 beaconing
- Calls made: ~80 Honeylabs API calls
- Results cached: Y (events NDJSON per ASN, consolidated top-attackers CSV)
- Errors: None
### 2026-06-08 -- Phase 2: Censys Profiling
- Credits consumed: ~50 (within budget)
- ASN aggregations run: 11 active ASNs
- Per-IP enrichments: 5 IPs
- Key findings: All major ASNs carry BULLETPROOF label (Censys), Shared HASSH across PLI-AS/Pfcloud, riptide binary path exposed in pprof
- Results cached: Y (aggregations NDJSON, IP enrichments NDJSON)
- Errors: None
### 2026-06-08 -- Phase 3: Change Detection
- Skipped: First run, no baseline
### 2026-06-08 -- Phase 4: Blog Post
- Blog post written: src/data/blog/2026-06-08-weekly-bulletproof-report.md
- Build verification: PASSED (0 errors, 0 warnings)
- Key sections: Executive Summary, By the Numbers, Top 5 ASN Deep Dives, Infrastructure Correlation, Fleet Observations, IoCs
### 2026-06-08 -- Phase 5: IoC Archival
- Files created: all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md
- IPs archived: ~60 unique IPs across 11 ASNs
|
