blob: d8e5949354dd708004bea9614d9fb86862d1badc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
# Weekly BP Report -- 2026-08-10
Generated: 2026-08-10T11:00:00Z
ASNs covered: 26
Sponge sessions found: 10,000+ across 21 active ASNs (capped per query)
Honeylabs events found: 12,200+ across 8 ASNs (PFCLOUD, ROUTERHOSTING, PLI-AS, PROTON66, FLOKINET, KPRONET, RU-AEZA, AEZA)
Censys IPs enriched: 8 per-IP + 8 ASN-level aggregations (all BULLETPROOF-labeled)
Anomalies flagged: 5
## Key Findings
- PFCLOUD deployed new 204.76.203.2xx proxy block; 2 nodes share SSH host key (cloned infra)
- ROUTERHOSTING added PPTP brute-force on port 1723; event count +312%
- KPRONET .git/.env exfiltration stopped; pattern moved to PLI-AS
- PROTON66 MSSQL-TDS brute on 17 non-standard ports; event count +145%
- FLOKINET Tor exit relay volume dropped 88%
- KAOPU-HK continues NTP/SSDP amplification (862K sessions from single IP)
|
