1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
# Operations Log -- Weekly BP Report 2026-06-20
## 2026-06-22 10:35:00 -- Phase 0: Initialize
- ASNs loaded: 26
- Run date: 2026-06-20 (week of 2026-06-14 through 2026-06-20)
- Prior run: 2026-06-15
- Censys credits: 10,000 (sufficient for per-IP enrichment)
- Cache dirs: sponge/, honeylabs/, censys/, changes/, iocs/
## 2026-06-22 10:40:15 -- Phase 1: Sponge Data Gathering
- ASNs with data: 15 of 26
- Total sessions observed: ~180,000+ across all monitored ASNs
- Top ASN: AS51396 (PFCLOUD) -- 96,045 sessions
- Second: AS138915 (KAOPU-HK) -- 78,971 sessions
- 11 ASNs with zero observed activity
- Timeline captured: hourly split across top 5 ASNs
- Data cached to sponge/ directory
## 2026-06-22 10:42:00 -- Phase 2: Honeylabs Queries
- ASNs queried: 20 (all active)
- Active ASNs found: 11 (AS51396, AS138915, AS51852, AS14956, AS210644, AS214940, AS400992, AS198953, AS200651, AS200593, AS209847)
- Top ASN: AS51396 (PFCLOUD) -- ~14,700 events across 20+ IPs
- Fingerprints captured: JA4/JA4H from KAOPU-HK
- Data cached to honeylabs/ directory
## 2026-06-22 10:43:00 -- Phase 3: Censys Infrastructure Profiling
- ASNs aggregated: 7 (port, software, labels)
- All active ASNs carry BULLETPROOF label
- Notable: HOSTKEY-AS (AS57043) has 99,992 hosts (new entry)
- PFCLOUD: 3,476 hosts (+1.5%), wg-easy most common software
- KAOPU-HK: 34,264 hosts (-4.6%), OpenResty+Tengine stack
- Data cached to censys/ directory
## 2026-06-22 10:43:30 -- Phase 4: Change Detection
- Prior baseline: 2026-06-15
- Changes: HOSTKEY-AS new entry, PROTON66 normalization (42K->112 events)
- Anomalies flagged: 2
## 2026-06-22 10:44:00 -- Phase 5: Blog Post
- File: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-06-20-weekly-bulletproof-report.md
- Sections: Executive Summary, By the Numbers, Top ASN Deep Dives, Infrastructure Correlation, Fleet Observations, IoCs
- Build: passed (0 errors, 0 warnings)
## 2026-06-22 10:45:00 -- Phase 6: IoC Archival
- Files: all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md
- IPs archived: ~75 across 15 active ASNs
|
