1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
# Weekly BP Report -- 2026-07-04
Generated: 2026-07-06T10:30:00Z
ASNs covered: 26
Sponge sessions found: ~41,000+ (all BP ASNs)
Honeylabs events found: ~12,000+ (9 active ASNs)
Censys IPs enriched: 26 (aggregation level)
Anomalies flagged: 2 (PFCLOUD 2.6x volume increase, Proton66 RDP credential stuffing)
## Directory Structure
- `sponge/` -- Arkime/Sponge session stats per ASN (IP, port, tag distributions, timeline)
- `honeylabs/` -- Honeylabs top attackers, events per ASN
- `censys/` -- Censys aggregations per ASN (ports, software, labels, TLS issuers, OS)
- `changes/` -- Change detection vs prior week
- `iocs/` -- Structured IoC files: IPs, fingerprints, C2 paths
## Web Access
https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-04/
## Key Findings
- PFCLOUD (AS51396) event volume surged 2.6x to 11,500+ events
- All 26 monitored ASNs carry BULLETPROOF label per Censys
- Proton66 showing RDP credential stuffing pattern from Moscow
- RouterHosting demonstrating multi-vector scanning (HTTP, SMTP, SMB, SIP, Minecraft)
|
