1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
|
# Weekly BP Report -- 2026-07-20
Generated: 2026-07-20T11:15:00Z
ASNs covered: 25 (per bulletproof-asns.csv)
Query range: 2026-07-13 through 2026-07-20 (7-day window)
Sponge sessions found: ~6.9M total network traffic across 8 daily buckets
Active ASNs in Sponge: 17 (7 active+Honeylabs; 10 inactive both sources)
Honeylabs events found: ~2,600+ across 7 active ASNs
Censys IPs enriched: 14 IPs (per-host enrichment via censys_get_host)
Censys credits remaining at start: 10,000
Anomalies flagged: 11 (3 critical, 5 high, 3 medium)
## Top-Level Findings
1. **AS200651 (FlokiNET)** - Tor exit 185.100.87.136 effserved as a SPARKRAT C2 callback destination (POST /api/client/update) AND Tor exit. OpenSSH upgraded from 10.1 -> 10.2p1. CRITICAL.
2. **AS216139 (Iron Hosting Centre)** - Sequential port 6001-6050 cluster with uniform 345-348 events each in Censys -- backconnect-C2 listener pattern. CRITICAL.
3. **AS57043 (Hostkey)** - IoT MIPS downloader (aibotnet.su /bins/kla.sh) from NEW IP 132.243.194.215 (Frankfurt). CRITICAL.
4. **AS209847** - Not in Census as AS209847; actually tagged belongs to ASICs41745 FORTIS-AS Baykov Ilya Sergeevich (RU, reg 2026-06-06). 998 Sponge sessions single IP 45.144.28.70. CRITICAL.
5. **AS211720 (Datashield)** - Shifted from /ews/ Exchange recon to MSSQL TDS port 1433 brute (hostname short-tan-rat, self-signed prohaska.beatty.biz cert, TLS 1.0/1.1 still enabled).
6. **AS51396 (Pfcloud)** - NEW scanner tooling 'odin-scanner/0.4' and 'Hello World' UAs. Cluster IPs rotated to 30/.49/.81/.18 from prior 78/79/80 in 204.76.203.0/24.
7. **AS14956 (RouterHosting)** - Exposed Werkzeug/3.1.8 'fofa_monitor' Basic-auth panel on port 5000 (HIGH severity Censys misconfig).
8. **AS400992 (ZhouyiSat)** - Ceased /env scanning this week; censys profile now pure Windows admin (3389/5985/135/445). Behavioral shift.
## Headline Changes vs Prior Week
| Metric | Prior (2026-07-13) | Current (2026-07-20) | Δ | Δ% |
|---------------------------------|-------------------:|---------------------:|------:|------:|
| Active ASNs (Sponge or HL) | 15 | 17 | +2 | +13% |
| ASNs in Censys BULLETPROOF | 11 | 12 | +1 | +9% |
| Unique HASSH/JA4H signatures | 11 | ~13 | +2 | +18% |
| Top IP Honeylabs events | 1,518 (AS51852) | 968 (AS200593) | -550 | -36% |
| Critical anomalies flagged | 2 | 3 | +1 | +50% |
## Directory Structure
- `sponge/` -- Arkime session stats per ASN (33 stat files + 1 timeline)
- `honeylabs/` -- top-attackers.csv, fingerprints.csv
- `censys/` -- aggregations-summary.ndjson, fleet-correlation.csv
- `changes/` -- diff-vs-prior-week.csv, anomalies.csv
- `iocs/` -- all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md (this file)
## Web Access
https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-07-20/
## Operators Log
See ../OPERATIONS_LOG.md for the full phase-by-phase operations record.
|
